Generated banner for Azure Architecture Autopilot
Generated logo for Azure Architecture Autopilot

Azure Architecture Autopilot

GitHubOfficialFirst committed by whoniiiiDistributed by GitHub

  • Skill
  • Workflow
  • Cloud and DevOps
  • MIT
  • Low risk
  • Has scripts

From the author

Design Azure infrastructure using natural language, or analyze existing Azure resources to auto-generate architecture diagrams, refine them through conversation, and deploy with Bicep. When to use this skill: - "Create X on Azure", "Set up a RAG architecture" (new design) - "Analyze my current Azure infrastructure", "Draw a diagram for rg-xxx" (existing analysis) - "Foundry is slow", "I want to reduce costs", "Strengthen security" (natural language modification) - Azure resource deployment, Bicep template generation, IaC code generation - Microsoft Foundry, AI Search, OpenAI, Fabric, ADLS Gen2, Databricks, and all Azure services
— the description by whoniiii

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Azure Architecture Autopilot is a multi-phase agentic workflow designed to assist users in creating or modifying Azure infrastructure. It guides users through an interactive design process, generates architecture diagrams using an embedded engine, produces Bicep templates, and manages the deployment lifecycle. The skill integrates with Azure services and utilizes official Microsoft documentation to ensure configurations align with current service specifications.

What it does

  • Designs new Azure infrastructure based on natural language requirements.
  • Analyzes existing Azure resources to generate visual architecture diagrams.
  • Refines infrastructure designs through interactive conversation.
  • Generates and reviews Bicep templates for infrastructure as code.
  • Executes deployment workflows including validation and what-if analysis.
  • Detects user language to provide localized support and documentation.

When to use it

  • When you need to design a new Azure environment or RAG architecture.
  • When you want to visualize your current Azure resource configuration.
  • When you need to generate or update Bicep templates for Azure deployments.
  • When you require guidance on modifying existing Azure infrastructure to meet new requirements.

Advantages

  • Automated diagram generation using an embedded engine with official Azure icons.
  • Structured multi-phase workflow ensuring design confirmation before deployment.
  • Integration with Microsoft documentation for dynamic service property lookups.
  • Supports natural language interaction for complex infrastructure tasks.
  • Includes built-in safety checks like what-if analysis prior to deployment.

Usage examples

“Create a RAG architecture on Azure.”
The agent will initiate the design phase, suggest a baseline architecture, generate a diagram, and guide you through the Bicep generation and deployment process.
“Analyze my current Azure infrastructure and draw a diagram.”
The agent will scan your existing resources, infer relationships, and produce an interactive HTML diagram of your current setup.
“I want to strengthen security for my existing Azure resources.”
The agent will analyze your current configuration and propose modifications to your infrastructure design to align with security patterns.

Install

Documentation by whoniiii

Azure Architecture Builder

A pipeline that designs Azure infrastructure using natural language, or analyzes existing resources to visualize architecture and proceed through modification and deployment.

The diagram engine is embedded within the skill (scripts/ folder). No pip install needed — it directly uses the bundled Python scripts to generate interactive HTML diagrams with 605+ official Azure icons. Ready to use immediately without network access or package installation.

Automatic User Language Detection

🚨 Detect the language of the user's first message and provide all subsequent responses in that language. This is the highest-priority principle.

  • If the user writes in Korean → respond in Korean

  • If the user writes in English → respond in English (ask_user, progress updates, reports, Bicep comments — all in English)

  • The instructions and examples in this document are written in English, and all user-facing output must match the user's language

⚠️ Do not copy examples from this document verbatim to the user. Use only the structure as reference, and adapt text to the user's language.

Tool Usage Guide (GHCP Environment)

FeatureTool NameNotes
Fetch URL contentweb_fetchFor MS Docs lookups, etc.
Web searchweb_searchURL discovery
Ask userask_userchoices must be a string array
Sub-agentstaskexplore/task/general-purpose
Shell command executionpowershellWindows PowerShell

All sub-agents (explore/task/general-purpose) cannot use web_fetch or web_search. Fact-checking that requires MS Docs lookups must be performed directly by the main agent.

External Tool Path Discovery

az, python, bicep, etc. are often not on PATH. Discover once before starting a Phase and cache the result. Do not re-discover every time.

⚠️ Do not use Get-Command python — risk of Windows Store alias. Direct filesystem discovery ($env:LOCALAPPDATA\Programs\Python) takes priority.

az CLI path:

$azCmd = $null
if (Get-Command az -ErrorAction SilentlyContinue) { $azCmd = 'az' }
if (-not $azCmd) {
  $azExe = Get-ChildItem -Path "$env:ProgramFiles\Microsoft SDKs\Azure\CLI2\wbin", "$env:LOCALAPPDATA\Programs\Azure CLI\wbin" -Filter "az.cmd" -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty FullName
  if ($azExe) { $azCmd = $azExe }
}

Python path + embedded diagram engine: refer to the diagram generation section in references/phase1-advisor.md.

Progress Updates Required

Use blockquote + emoji + bold format:

> **⏳ [Action]** — [Reason]
> **✅ [Complete]** — [Result]
> **⚠️ [Warning]** — [Details]
> **❌ [Failed]** — [Cause]

Parallel Preload Principle

While waiting for user input via ask_user, preload information needed for the next step in parallel.

ask_user QuestionPreload Simultaneously
Project name / scan scopeReference files, MS Docs, Python path discovery, diagram module path verification
Model/SKU selectionMS Docs for next question choices
Architecture confirmationaz account show/list, az group list
Subscription selectionaz group list

Path Branching — Automatically Determined by User Request

Path A: New Design (New Build)

Trigger: "create", "set up", "deploy", "build", etc.

Phase 1 (references/phase1-advisor.md) — Interactive architecture design + diagram
    ↓
Phase 2 (references/bicep-generator.md) — Bicep code generation
    ↓
Phase 3 (references/bicep-reviewer.md) — Code review + compilation verification
    ↓
Phase 4 (references/phase4-deployer.md) — validate → what-if → deploy
Path B: Existing Analysis + Modification (Analyze & Modify)

Trigger: "analyze", "current resources", "scan", "draw a diagram", "show my infrastructure", etc.

Phase 0 (references/phase0-scanner.md) — Existing resource scan + diagram
    ↓
Modification conversation — "What would you like to change here?" (natural language modification request → follow-up questions)
    ↓
Phase 1 (references/phase1-advisor.md) — Confirm modifications + update diagram
    ↓
Phase 2~4 — Same as above
When Path Determination Is Ambiguous

Ask the user directly:

ask_user({
  question: "What would you like to do?",
  choices: [
    "Design a new Azure architecture (Recommended)",
    "Analyze + modify existing Azure resources"
  ]
})

Phase Transition Rules

  • Each Phase reads and follows the instructions in its corresponding references/*.md file

  • When transitioning between Phases, always inform the user about the next step

  • Do not skip Phases (especially the what-if between Phase 3 → Phase 4)

  • 🚨 Required condition for Phase 1 → Phase 2 transition: 01_arch_diagram_draft.html must have been generated using the embedded diagram engine and shown to the user. Do not proceed to Bicep generation without a diagram. Completing spec collection alone does not mean Phase 1 is done — Phase 1 includes diagram generation + user confirmation.

  • Modification request after deployment → return to Phase 1, not Phase 0 (Delta Confirmation Rule)

Service Coverage & Fallback

Optimized Services

Microsoft Foundry, Azure OpenAI, AI Search, ADLS Gen2, Key Vault, Microsoft Fabric, Azure Data Factory, VNet/Private Endpoint, AML/AI Hub

Other Azure Services

All supported — MS Docs are automatically consulted to generate at the same quality standard. Do not send messages that cause user anxiety such as "out of scope" or "best-effort".

Stable vs Dynamic Information Handling
CategoryHandling MethodExamples
StableReference files firstisHnsEnabled: true, PE triple set
DynamicAlways fetch MS DocsAPI version, model availability, SKU, region

Quick Reference

FileRole
references/phase0-scanner.mdExisting resource scan + relationship inference + diagram
references/phase1-advisor.mdInteractive architecture design + fact checking
references/bicep-generator.mdBicep code generation rules
references/bicep-reviewer.mdCode review checklist
references/phase4-deployer.mdvalidate → what-if → deploy
references/service-gotchas.mdRequired properties, PE mappings
references/azure-dynamic-sources.mdMS Docs URL registry
references/azure-common-patterns.mdPE/security/naming patterns
references/ai-data.mdAI/Data service guide
assets/06-architecture-diagram.pngExample generated architecture diagram
assets/07-azure-portal-resources.pngExample Azure portal resource view
assets/08-deployment-succeeded.pngExample successful deployment result

Files

references/service-gotchas.md

Service Gotchas (Stable)

Per-service summary of non-intuitive required properties, common mistakes, and PE mappings. Only near-immutable patterns are included here. Dynamic values such as API version, SKU lists, and region are not included.


1. Required Properties (Deployment Failure or Functional Issues If Omitted)

ServiceRequired PropertyResult If OmittedNotes
ADLS Gen2isHnsEnabled: trueBecomes regular Blob Storage. Cannot be reversedkind: 'StorageV2' required
Storage AccountNo special characters/hyphens in nameDeployment failureLowercase+numbers only, 3-24 characters
Foundry (AIServices)customSubDomainName: foundryNameCannot create Project, cannot change after creation → Must delete and recreate resourceGlobally unique value
Foundry (AIServices)allowProjectManagement: trueCannot create Foundry Projectkind: 'AIServices'
Foundry (AIServices)identity: { type: 'SystemAssigned' }Project creation fails
Foundry ProjectMust be created as a set with Foundry resourceCannot use from portalaccounts/projects
Key VaultenableRbacAuthorization: trueRisk of mixed Access Policy usage
Key VaultenablePurgeProtection: trueRequired for production
Fabric Capacityadministration.members requiredDeployment failureAdmin email
PE SubnetprivateEndpointNetworkPolicies: 'Disabled'PE deployment failure
PE DNS ZoneregistrationEnabled: false (VNet Link)Possible DNS conflict
PE Configuration3-component set (PE + DNS Zone + VNet Link + Zone Group)DNS resolution fails even with PE present

2. PE groupId & DNS Zone Mapping (Key Services)

The mappings below are stable, but re-verify from the PE DNS integration document in azure-dynamic-sources.md when adding new services.

ServicegroupIdPrivate DNS Zone
Azure OpenAI / CognitiveServicesaccountprivatelink.cognitiveservices.azure.com
⚠️ (Foundry/AIServices additional)accountprivatelink.openai.azure.com ← Both zones must be included in DNS Zone Group. OpenAI API DNS resolution fails if omitted
Azure AI SearchsearchServiceprivatelink.search.windows.net
Storage (Blob/ADLS)blobprivatelink.blob.core.windows.net
Storage (DFS/ADLS Gen2)dfsprivatelink.dfs.core.windows.net
Key Vaultvaultprivatelink.vaultcore.azure.net
Azure ML / AI Hubamlworkspaceprivatelink.api.azureml.ms
Container Registryregistryprivatelink.azurecr.io
Cosmos DB (SQL)Sqlprivatelink.documents.azure.com
Azure Cache for RedisredisCacheprivatelink.redis.cache.windows.net
Data FactorydataFactoryprivatelink.datafactory.azure.net
API ManagementGatewayprivatelink.azure-api.net
Event Hubnamespaceprivatelink.servicebus.windows.net
Service Busnamespaceprivatelink.servicebus.windows.net
Monitor (AMPLS)⚠️ Complex configuration — see below⚠️ Multiple DNS Zones required — see below

ADLS Gen2 Note: When isHnsEnabled: true, both blob and dfs PEs are required.

  • With only the blob PE, Blob API works, but Data Lake operations (file system creation, directory manipulation, abfss:// protocol) will fail.

  • DFS PE: groupId dfs, DNS Zone privatelink.dfs.core.windows.net

⚠️ Azure Monitor Private Link (AMPLS) Note: Azure Monitor cannot be configured with a single PE + single DNS Zone. It connects through Azure Monitor Private Link Scope (AMPLS), and all 5 DNS Zones are required:

  • privatelink.monitor.azure.com

  • privatelink.oms.opinsights.azure.com

  • privatelink.ods.opinsights.azure.com

  • privatelink.agentsvc.azure-automation.net

  • privatelink.blob.core.windows.net (for Log Analytics data ingestion)

This mapping is complex and subject to change, so always fetch and verify MS Docs when configuring Monitor PE: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-configure


3. Common Mistakes Checklist

Item❌ Incorrect Example✅ Correct Example
ADLS Gen2 HNSisHnsEnabled omitted or falseisHnsEnabled: true
PE SubnetPolicy not setprivateEndpointNetworkPolicies: 'Disabled'
DNS Zone GroupOnly PE createdPE + DNS Zone + VNet Link + DNS Zone Group
Foundry resourcekind: 'OpenAI'kind: 'AIServices' + allowProjectManagement: true
Foundry resourcecustomSubDomainName omittedcustomSubDomainName: foundryName — Cannot change after creation
Foundry ProjectOnly Foundry exists without ProjectMust create as a set
Key Vault authAccess PolicyenableRbacAuthorization: true
Public networkNot configuredpublicNetworkAccess: 'Disabled'
Storage namest-my-storagestmystorage or st${uniqueString(...)}
API versionCopied from previous conversation/errorVerify latest stable from MS Docs
RegionHardcoded ('eastus')Pass as parameter (param location)
Sensitive valuesPlaintext in .bicepparam@secure() + Key Vault reference

4. Service Relationship Decision Rules

Described as default selection rules rather than absolute determinations.

Foundry vs Azure OpenAI vs AI Hub
Default rules:
├─ AI/RAG workloads → Use Microsoft Foundry (kind: 'AIServices')
│   ├─ Create Foundry resource + Foundry Project as a set
│   └─ Model deployment is performed at the Foundry resource level (accounts/deployments)
│
├─ ML/open-source model training needed → Consider AI Hub (MachineLearningServices)
│   └─ Only when the user explicitly requests it or features not supported in Foundry are needed
│
└─ Standalone Azure OpenAI resource →
    Consider only when the user explicitly requests it or
    official documentation requires a separate resource

These rules are a default selection guide reflecting current MS recommendations. Azure product relationships can change, so check MS Docs when uncertain.

Monitoring
Default rules:
├─ Foundry (AIServices) → Application Insights not required
└─ AI Hub (MachineLearningServices) → Application Insights + Log Analytics required

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

Security

What our scanner noticed· Low risk

  • Phrasing that asks for actions without confirmation
  • Instructions that use the network
  • Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

First committed by
GitHub avatar of whoniiiiwhoniiii
Publisher
GitHub (Official)
Distributed by
GitHub
Source
github/awesome-copilot · skills/azure-architecture-autopilot · commit 797337f
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Contributors
whoniiii, NehaGitHubAcc, Sertxito, stbenjam

AutoGineer is not affiliated with or endorsed by whoniiii or GitHub.

Get it from the source

1 of this skill’s files are not mirrored here, so there is no ZIP. Get the complete skill from its source: github/awesome-copilot