Azure App Onboard
MicrosoftOfficialCreated by Microsoft
- Skill
- Workflow
- Cloud and DevOps
- MIT
- Low risk
- Has scripts
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
Azure App Onboard is a comprehensive workflow agent designed to take a business idea or an existing codebase and transition it to a running Azure deployment. It automates the entire lifecycle from initial discovery and architecture planning to infrastructure scaffolding and final deployment. The skill is built to be intelligent and tailored, analyzing the specific requirements of your application rather than relying on generic templates. It includes built-in approval gates for both the architecture plan and the final deployment, ensuring you maintain control over costs and resource configuration throughout the process.
What it does
- Analyzes your application code or business idea to determine the optimal Azure service stack.
- Generates custom infrastructure-as-code (IaC) files tailored to your specific application needs.
- Provides detailed cost estimates for the proposed Azure infrastructure before deployment.
- Executes the deployment of resources directly to your Azure subscription.
- Handles the migration of existing applications to Azure with minimal code changes.
- Provides a structured, step-by-step onboarding experience for developers of all experience levels.
When to use it
- When you have an application and want to deploy it to Azure but are unsure which services to use.
- When you need to migrate an existing application to the cloud without a complete rewrite.
- When you require a cost estimate for your infrastructure before committing to a deployment.
- When you need guided, end-to-end assistance for setting up a new Azure project.
- When you want to verify if your current codebase is ready for a cloud deployment.
Advantages
- Eliminates guesswork by auto-detecting the right Azure services for your specific stack.
- Reduces manual effort by automating the scaffolding of infrastructure-as-code.
- Ensures transparency with mandatory approval gates for architecture and deployment.
- Provides cost visibility early in the planning phase.
- Supports a wide range of scenarios from greenfield projects to existing app migrations.
Usage examples
- “I have a Python web app and want to deploy it to Azure. Can you help me get started?”
- The agent will initiate the discovery phase, scan your codebase, propose an architecture, and guide you through the deployment process.
- “I need to move my existing application to Azure, but I'm not sure what services I need. Can you plan this for me?”
- The agent will analyze your app's requirements, suggest the appropriate Azure services, and provide a cost estimate for your approval.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/azure-app-onboard/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip azure-app-onboard.zip -d .agents/skills
Documentation by Microsoft
Azure App Onboard
⛔ Every repo goes through the full pipeline (Steps 1–10). No exceptions. Do not skip steps, refuse, or short-circuit based on what you recognize. Follow the Workflow table below sequentially — read each step's references before acting.
Quick Reference
| Property | Value |
|---|---|
| Best for | Developers who know what to build but not which Azure services to use |
| Inputs | Business idea or existing codebase, budget/scale preferences (optional) |
| Outputs | Architecture plan, cost estimate, IaC files, deployed Azure resources |
| Phases | Discover → Architect → Scaffold → Deploy (self-contained, no external skill calls) |
When to Use This Skill
Deploy existing code without knowing which Azure services to use
Check if your existing code is ready to deploy to Azure
Move an existing app to Azure without rewriting or with minimal changes
Get cost estimates before committing to infrastructure
Understand architecture decisions and rejected alternatives
Get answers to Azure architecture or service selection questions (e.g., "What database should I use?")
Get guided Azure onboarding without prior experience
When NOT to Use
| Scenario | Use Instead |
|---|---|
Run azd up or execute an existing deployment | azure-deploy |
| Optimize existing Azure spend | cost-optimization from the optional azure-cost plugin |
| Generate Bicep/Terraform for a known architecture | azure-prepare |
| Validate infrastructure or run preflight checks | azure-validate |
| Troubleshoot a running Azure deployment | azure-diagnostics |
| Deploy to or manage AKS/Kubernetes directly | azure-kubernetes |
| Look up or list existing Azure resources | azure-resource-lookup |
If cost-optimization is unavailable, explain that it is provided by the
optional azure-cost plugin and direct the user to their client's supported
plugin installation flow; do not imply the handoff completed.
Pipeline Rules
⛔ You MUST read
references/pipeline-rules.mdat the start of every AppOnboard session. It contains approval gates, phase lifecycle, session artifacts, deploy-as-is, and security baseline rules.
Workflow
⛔ Deploy recovery: After deploy gate approval OR before any
az deployment/az webapp deploy/az acr build— if you haven't readdeploy/PHASE.md, read.copilot-azure/sessions/{id}/deploy-checklist.mdfirst, thendeploy/PHASE.md. ⛔ NEVER invoke{"skill": "azure-deploy"}— that is a DIFFERENT skill for a DIFFERENT workflow.
⛔ Post-scaffold transition (MANDATORY): Immediately after
scaffold-manifest.jsonis written, YOUR NEXT ACTION MUST be Step 8 (Deploy Approval Gate) — NOT a summary report, NOT a "here are the generated files" message, NOT a completion signal. Confirmcontext.jsonhascompletedPhases: [...,"scaffold"]+currentPhase: "deploy"(update it yourself if the scaffold subagent didn't). Re-read approval-gates.md § Deploy Gate if evicted from context (scaffold reference loading is heavy), then present the exact prompt: "🚀 Ready to deploy? (Yes / Run manually / Edit plan / Cancel)". This gate is the LAST content in your response — wait for the user's reply.
| # | Step | Action | Reference |
|---|---|---|---|
| 1 | Session check + Azure login | Create/resume session, verify Azure CLI auth, resolve subscription + user identity | ⛔ You MUST read session-protocol.md |
| 2 | Scope triage | Check azd markers, triage question. Empty workspace or code-only (no infra) → Step 3 directly. | ⛔ Read intent-gathering.md § Scope Triage |
| 3 | Prereq scan | ⛔ Skip if completedPhases includes "prereq". Otherwise: invoke {"skill": "azure-app-onboard-prereq"}. Write prereq-output.json, update context.json. Halt if: overallHealth: "blocked" OR routeToSkill set. | |
| 4 | Gather intent | Present prereq results, confirm stack + Azure services, ask remaining questions. | ⛔ Read intent-gathering.md § After Prereq Returns |
| 5 | Plan architecture | Write prepare-plan.json. | ⛔ You MUST read prepare/PHASE.md |
| 6 | Scaffold approval gate | Display plan for user approval BEFORE generating any files. | ⛔ Read approval-gates.md § Scaffold Gate |
| 7 | Scaffold | Generate IaC, self-review. Write scaffold-manifest.json. Update context.json. | ⛔ You MUST read scaffold/PHASE.md |
| 8 | Deploy approval gate | Display validation summary. ⛔ After approval: FIRST read deploy-checklist.md → deploy/PHASE.md. NEVER {"skill": "azure-deploy"}. | ⛔ Read approval-gates.md § Deploy Gate |
| 9 | Deploy | Execute IaC, health-check. Write deploy-result.json. | ⛔ You MUST read deploy/PHASE.md |
| 10 | Handoff | Surface deployment identity, cleanup commands, next steps. | ⛔ You MUST read handoff-protocol.md |
Error Handling
| Error | Remediation |
|---|---|
| Phase fails | Halt, report phase + error. User decides: retry, skip, abort. |
| MCP server unavailable | Skip affected checks, add disclaimer to costEstimate.assumptions[] and every approval gate. |
| Missing RBAC | Report required role + az role assignment command. |
Shared references: MCP tools (cross-phase tool parameters) | IaC resources (Azure resource docs for troubleshooting)
Files
- ATTRIBUTION.mdAdded by AutoGineer983 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SKILL.md6.6 KiB
- deploy/PHASE.md7.5 KiB
- deploy/references/approval-gate-template.md2.9 KiB
- deploy/references/blocked-patterns.md5.7 KiB
- deploy/references/code-deployment-appservice.md4.6 KiB
- deploy/references/code-deployment-container-apps.md8.4 KiB
- deploy/references/code-deployment-swa.md5.7 KiB
- deploy/references/database-post-deploy.md4.5 KiB
- deploy/references/deploy-checklist-template.md10.1 KiB
- deploy/references/deploy-safety.md4.5 KiB
- deploy/references/deploy-schemas.tsScript3.5 KiB
- deploy/references/error-classification.md3.6 KiB
- deploy/references/health-check-patterns.md5.5 KiB
- deploy/references/mcp-tools.md5.5 KiB
- deploy/references/portal-links.md3.1 KiB
- deploy/references/preflight-checks.md4.4 KiB
- deploy/references/subagent-preflight.md5.1 KiB
- prepare/PHASE.md6.4 KiB
- prepare/references/deploy-strategy.md6.8 KiB
- prepare/references/mcp-tools.md5.6 KiB
- prepare/references/naming-patterns.md4.6 KiB
- prepare/references/prepare-schemas.tsScript7.0 KiB
- prepare/references/pricing-guide-services.md8.4 KiB
- prepare/references/pricing-guide.md4.0 KiB
- prepare/references/service-mapping.md8.5 KiB
- prepare/references/sku-matrix.md3.2 KiB
- prepare/references/sku-quota-validation.md9.0 KiB
- prepare/references/subagent-pricing.md2.5 KiB
- prepare/references/subagent-quota.md3.5 KiB
- prepare/references/validation-rubric.md2.3 KiB
- references/approval-gates.md8.4 KiB
- references/azd-template-routing.md4.7 KiB
- references/handoff-protocol.md7.8 KiB
- references/iac-resources.md2.6 KiB
- references/intent-gathering.md2.2 KiB
- references/mcp-tool-reference.md3.7 KiB
- references/pipeline-rules-runtime.md3.5 KiB
- references/pipeline-rules.md6.3 KiB
- references/session-protocol.md8.0 KiB
- references/session-schemas.tsScript5.2 KiB
- references/subscription-resolution.md2.1 KiB
- scaffold/PHASE.md14.2 KiB
- scaffold/references/bicep-app-service.md5.4 KiB
- scaffold/references/bicep-container-apps.md9.3 KiB
- scaffold/references/bicep-patterns-data.md4.0 KiB
- scaffold/references/bicep-patterns-security.md7.8 KiB
- scaffold/references/bicep-patterns.md6.8 KiB
- scaffold/references/bicep-swa.md757 B
- scaffold/references/cicd-pipelines.md325 B
- scaffold/references/dockerfile-generation.md4.1 KiB
- scaffold/references/env-var-secrets.md4.1 KiB
- scaffold/references/error-handling.md1.5 KiB
- scaffold/references/iac-generation-rules.md6.6 KiB
- scaffold/references/mcp-tools.md7.0 KiB
- scaffold/references/rbac-roles.md3.8 KiB
- scaffold/references/scaffold-healing-rules.md3.3 KiB
- scaffold/references/scaffold-schemas.tsScript3.5 KiB
- scaffold/references/self-healing.md2.3 KiB
- scaffold/references/self-review-checklist.md9.0 KiB
- scaffold/references/self-review-procedure.md2.3 KiB
- scaffold/references/subagent-iac-gen.md9.5 KiB
- scaffold/references/subagent-review.md3.5 KiB
- scaffold/references/subagent-validate.md7.2 KiB
- scaffold/references/terraform-patterns.md6.9 KiB
- scaffold/references/validation-and-manifest.md5.1 KiB
- scaffold/references/waf-checklist.md2.3 KiB
- scaffold/scripts/scaffold-conformance.ps1Script12.8 KiB
- scaffold/scripts/scaffold-conformance.shScript13.8 KiB
deploy/references/code-deployment-swa.md
Code Deployment — Static Web Apps
Static Web Apps — Content Deployment (Step 6c)
Deploy content using the SWA CLI with deployment token.
Pre-check: Verify swa CLI is installed: npx --yes @azure/[email protected] --version. If not available, install: npm install -g @azure/[email protected].
⛔ Pre-deploy: Build the frontend if SPA source (not pre-built HTML). Check if the SWA component directory has a
package.json(or equivalent manifest) with abuildscript. If yes, detect the package manager from the lockfile (package-lock.json→ npm,yarn.lock→ yarn,pnpm-lock.yaml→ pnpm,bun.lock/bun.lockb→ bun; default to npm if no lockfile) and run:cd {component-path} # e.g., web/ {pm} install # npm install, yarn install, pnpm install, etc. {pm} run build # npm run build, yarn build, pnpm build, etc.The deploy path should point to the build output directory — read the framework config to determine the output dir (
vite.config.*→build.outDir,next.config.*→.next/orout/, CRA →build/; default todist/). If nopackage.jsonexists (plain HTML/CSS/JS), deploy the source directory directly — no build needed.⛔ This is NOT optional for SPA frameworks. Raw JSX/TSX/Vue/Svelte source files cannot be served by SWA — the app must be compiled to static HTML/JS/CSS first. Skipping the build produces a broken deployment.
⛔ Pre-deploy: Update frontend config with deployed backend URLs. If
prereq-output.json.cloudSdkSwaps[]mapped cloud SDK endpoints (AWS API Gateway, GCP Cloud Functions) to Azure equivalents, the frontend config file (config.ts,.env,environment.ts) still references the original cloud URLs. After IaC deploy (Step 6), readdeploy-result.json.endpoints[]to get the deployed Azure backend URLs. Update the frontend config with these URLs before runningswa deploy. This is a string replacement in the config file — NOT a code rewrite. Do NOT defer as a post-deploy step — the SWA will show a broken page if the frontend calls non-existent AWS/GCP endpoints.
| Step | Command | Notes |
|---|---|---|
| 1. Get token | $token = az staticwebapp secrets list --name {swa} -g {rg} --query "properties.apiKey" -o tsv 2>$null | Store in variable first — do NOT pass inline. ⛔ On Windows, use 2>$null (not 2>&1) — Azure CLI Python warnings corrupt -o tsv output |
| 2. Set env var | $env:SWA_CLI_DEPLOYMENT_TOKEN = $token | ⛔ Use env var ONLY — do NOT pass --deployment-token $token as CLI arg (leaks token in process args / transcript) |
| 3. Copy to temp | $tempDir = "C:\temp\swa-deploy"; Remove-Item -Recurse -Force $tempDir -ErrorAction SilentlyContinue; New-Item -ItemType Directory -Path $tempDir -Force | Out-Null; Copy-Item -Path .\* -Destination $tempDir -Recurse -Exclude @('.git','.copilot-azure','node_modules','.azure','infra') | ⛔ MANDATORY on Windows — $env:TEMP often contains spaces (e.g., C:\Users\Jane Doe\AppData\Local\Temp). Always use a short, space-free path on the FIRST attempt — do NOT use $env:TEMP and retry. On macOS/Linux, use /tmp/swa-deploy instead. If a build step ran: copy the build output directory (e.g., {component}/dist/) instead of the entire workspace — Copy-Item -Path {component}\dist\* -Destination $tempDir -Recurse. |
| 4. Deploy | swa deploy $tempDir --app-name {swaName} --env production | ⛔ --app-name is MANDATORY — without it, the SWA CLI launches an interactive "create new project?" prompt that fails in automation. {swaName} = the SWA resource name from prepare-plan.json.naming.resources[]. SWA CLI reads SWA_CLI_DEPLOYMENT_TOKEN from env var automatically — do NOT pass --deployment-token flag (leaks token in command args) |
| 5. Clean up | Remove-Item -Recurse -Force $tempDir | Clean temp dir after successful deploy |
⛔ az staticwebapp deploy does NOT exist — the correct CLI is swa deploy (from @azure/static-web-apps-cli).
Fallback: Direct StaticSitesClient Upload
If swa deploy fails (binary crash, path errors on Windows), use the underlying StaticSitesClient.exe directly:
# Find the binary bundled with @azure/static-web-apps-cli
$swaCliPath = (Get-Command swa).Source | Split-Path -Parent
$client = Get-ChildItem -Path $swaCliPath -Recurse -Filter "StaticSitesClient*" | Select-Object -First 1
# Upload from PARENT directory with relative paths (avoids "identical to artifact folder" error)
Push-Location (Split-Path $tempDir -Parent)
& $client.FullName upload --app (Split-Path $tempDir -Leaf) --apiToken $token --skipAppBuild true
Pop-Location⛔ Run from a PARENT directory with a relative
--apppath. Running from inside the app directory causesStaticSitesClientto error with "Current directory cannot be identical to or contained within artifact folders."
Finalize deploy-result.json (after swa deploy succeeds)
⛔ swa deploy succeeding is NOT the end of the deploy phase. SWA finalizes through the generic Step 8 (see deploy-checklist-template.md §"Before handoff (Step 8)") — overwrite the deploy-result.json skeleton IN PLACE with the full DeployResult contract, not a status+subscriptionId stub. Only the values Step 8 can't derive on the SWA path are below:
Hostname —
swa deployproduces no ARM endpoint output, so fetch it:$swaHost = az staticwebapp show -n {swa} -g {rg} --query defaultHostname -o tsvendpoints[]—[{ name, url: "https://$swaHost", healthStatus: "healthy" }](HTTP GEThttps://$swaHost/→ 2xx confirms healthy)resourceIds[]— include theMicrosoft.Web/staticSitesresource id
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an MCP server, Needs Node.js
Security
What our scanner noticed· Low risk
- Instructions that use the network
- Scripts that your agent may run
This skill includes scripts that your agent may run. Read them before you use it.
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/skills · .github/plugins/azure-skills/skills/azure-app-onboard · commit 0696600
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Also distributed in
- microsoft/azure-skills
AutoGineer is not affiliated with or endorsed by Microsoft.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-app-onboard.zip