Azure App Onboard
MicrosoftOfficialCreated by Microsoft
- Skill
- Workflow
- Cloud and DevOps
- MIT
- Low risk
- Has scripts
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
Azure App Onboard is a comprehensive workflow agent designed to take a business idea or an existing codebase and transition it to a running Azure deployment. It automates the entire lifecycle from initial discovery and architecture planning to infrastructure scaffolding and final deployment. The skill is built to be intelligent and tailored, analyzing the specific requirements of your application rather than relying on generic templates. It includes built-in approval gates for both the architecture plan and the final deployment, ensuring you maintain control over costs and resource configuration throughout the process.
What it does
- Analyzes your application code or business idea to determine the optimal Azure service stack.
- Generates custom infrastructure-as-code (IaC) files tailored to your specific application needs.
- Provides detailed cost estimates for the proposed Azure infrastructure before deployment.
- Executes the deployment of resources directly to your Azure subscription.
- Handles the migration of existing applications to Azure with minimal code changes.
- Provides a structured, step-by-step onboarding experience for developers of all experience levels.
When to use it
- When you have an application and want to deploy it to Azure but are unsure which services to use.
- When you need to migrate an existing application to the cloud without a complete rewrite.
- When you require a cost estimate for your infrastructure before committing to a deployment.
- When you need guided, end-to-end assistance for setting up a new Azure project.
- When you want to verify if your current codebase is ready for a cloud deployment.
Advantages
- Eliminates guesswork by auto-detecting the right Azure services for your specific stack.
- Reduces manual effort by automating the scaffolding of infrastructure-as-code.
- Ensures transparency with mandatory approval gates for architecture and deployment.
- Provides cost visibility early in the planning phase.
- Supports a wide range of scenarios from greenfield projects to existing app migrations.
Usage examples
- “I have a Python web app and want to deploy it to Azure. Can you help me get started?”
- The agent will initiate the discovery phase, scan your codebase, propose an architecture, and guide you through the deployment process.
- “I need to move my existing application to Azure, but I'm not sure what services I need. Can you plan this for me?”
- The agent will analyze your app's requirements, suggest the appropriate Azure services, and provide a cost estimate for your approval.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/azure-app-onboard/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip azure-app-onboard.zip -d .agents/skills
Documentation by Microsoft
Azure App Onboard
⛔ Every repo goes through the full pipeline (Steps 1–10). No exceptions. Do not skip steps, refuse, or short-circuit based on what you recognize. Follow the Workflow table below sequentially — read each step's references before acting.
Quick Reference
| Property | Value |
|---|---|
| Best for | Developers who know what to build but not which Azure services to use |
| Inputs | Business idea or existing codebase, budget/scale preferences (optional) |
| Outputs | Architecture plan, cost estimate, IaC files, deployed Azure resources |
| Phases | Discover → Architect → Scaffold → Deploy (self-contained, no external skill calls) |
When to Use This Skill
Deploy existing code without knowing which Azure services to use
Check if your existing code is ready to deploy to Azure
Move an existing app to Azure without rewriting or with minimal changes
Get cost estimates before committing to infrastructure
Understand architecture decisions and rejected alternatives
Get answers to Azure architecture or service selection questions (e.g., "What database should I use?")
Get guided Azure onboarding without prior experience
When NOT to Use
| Scenario | Use Instead |
|---|---|
Run azd up or execute an existing deployment | azure-deploy |
| Optimize existing Azure spend | cost-optimization from the optional azure-cost plugin |
| Generate Bicep/Terraform for a known architecture | azure-prepare |
| Validate infrastructure or run preflight checks | azure-validate |
| Troubleshoot a running Azure deployment | azure-diagnostics |
| Deploy to or manage AKS/Kubernetes directly | azure-kubernetes |
| Look up or list existing Azure resources | azure-resource-lookup |
If cost-optimization is unavailable, explain that it is provided by the
optional azure-cost plugin and direct the user to their client's supported
plugin installation flow; do not imply the handoff completed.
Pipeline Rules
⛔ You MUST read
references/pipeline-rules.mdat the start of every AppOnboard session. It contains approval gates, phase lifecycle, session artifacts, deploy-as-is, and security baseline rules.
Workflow
⛔ Deploy recovery: After deploy gate approval OR before any
az deployment/az webapp deploy/az acr build— if you haven't readdeploy/PHASE.md, read.copilot-azure/sessions/{id}/deploy-checklist.mdfirst, thendeploy/PHASE.md. ⛔ NEVER invoke{"skill": "azure-deploy"}— that is a DIFFERENT skill for a DIFFERENT workflow.
⛔ Post-scaffold transition (MANDATORY): Immediately after
scaffold-manifest.jsonis written, YOUR NEXT ACTION MUST be Step 8 (Deploy Approval Gate) — NOT a summary report, NOT a "here are the generated files" message, NOT a completion signal. Confirmcontext.jsonhascompletedPhases: [...,"scaffold"]+currentPhase: "deploy"(update it yourself if the scaffold subagent didn't). Re-read approval-gates.md § Deploy Gate if evicted from context (scaffold reference loading is heavy), then present the exact prompt: "🚀 Ready to deploy? (Yes / Run manually / Edit plan / Cancel)". This gate is the LAST content in your response — wait for the user's reply.
| # | Step | Action | Reference |
|---|---|---|---|
| 1 | Session check + Azure login | Create/resume session, verify Azure CLI auth, resolve subscription + user identity | ⛔ You MUST read session-protocol.md |
| 2 | Scope triage | Check azd markers, triage question. Empty workspace or code-only (no infra) → Step 3 directly. | ⛔ Read intent-gathering.md § Scope Triage |
| 3 | Prereq scan | ⛔ Skip if completedPhases includes "prereq". Otherwise: invoke {"skill": "azure-app-onboard-prereq"}. Write prereq-output.json, update context.json. Halt if: overallHealth: "blocked" OR routeToSkill set. | |
| 4 | Gather intent | Present prereq results, confirm stack + Azure services, ask remaining questions. | ⛔ Read intent-gathering.md § After Prereq Returns |
| 5 | Plan architecture | Write prepare-plan.json. | ⛔ You MUST read prepare/PHASE.md |
| 6 | Scaffold approval gate | Display plan for user approval BEFORE generating any files. | ⛔ Read approval-gates.md § Scaffold Gate |
| 7 | Scaffold | Generate IaC, self-review. Write scaffold-manifest.json. Update context.json. | ⛔ You MUST read scaffold/PHASE.md |
| 8 | Deploy approval gate | Display validation summary. ⛔ After approval: FIRST read deploy-checklist.md → deploy/PHASE.md. NEVER {"skill": "azure-deploy"}. | ⛔ Read approval-gates.md § Deploy Gate |
| 9 | Deploy | Execute IaC, health-check. Write deploy-result.json. | ⛔ You MUST read deploy/PHASE.md |
| 10 | Handoff | Surface deployment identity, cleanup commands, next steps. | ⛔ You MUST read handoff-protocol.md |
Error Handling
| Error | Remediation |
|---|---|
| Phase fails | Halt, report phase + error. User decides: retry, skip, abort. |
| MCP server unavailable | Skip affected checks, add disclaimer to costEstimate.assumptions[] and every approval gate. |
| Missing RBAC | Report required role + az role assignment command. |
Shared references: MCP tools (cross-phase tool parameters) | IaC resources (Azure resource docs for troubleshooting)
Files
- ATTRIBUTION.mdAdded by AutoGineer983 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SKILL.md6.6 KiB
- deploy/PHASE.md7.5 KiB
- deploy/references/approval-gate-template.md2.9 KiB
- deploy/references/blocked-patterns.md5.7 KiB
- deploy/references/code-deployment-appservice.md4.6 KiB
- deploy/references/code-deployment-container-apps.md8.4 KiB
- deploy/references/code-deployment-swa.md5.7 KiB
- deploy/references/database-post-deploy.md4.5 KiB
- deploy/references/deploy-checklist-template.md10.1 KiB
- deploy/references/deploy-safety.md4.5 KiB
- deploy/references/deploy-schemas.tsScript3.5 KiB
- deploy/references/error-classification.md3.6 KiB
- deploy/references/health-check-patterns.md5.5 KiB
- deploy/references/mcp-tools.md5.5 KiB
- deploy/references/portal-links.md3.1 KiB
- deploy/references/preflight-checks.md4.4 KiB
- deploy/references/subagent-preflight.md5.1 KiB
- prepare/PHASE.md6.4 KiB
- prepare/references/deploy-strategy.md6.8 KiB
- prepare/references/mcp-tools.md5.6 KiB
- prepare/references/naming-patterns.md4.6 KiB
- prepare/references/prepare-schemas.tsScript7.0 KiB
- prepare/references/pricing-guide-services.md8.4 KiB
- prepare/references/pricing-guide.md4.0 KiB
- prepare/references/service-mapping.md8.5 KiB
- prepare/references/sku-matrix.md3.2 KiB
- prepare/references/sku-quota-validation.md9.0 KiB
- prepare/references/subagent-pricing.md2.5 KiB
- prepare/references/subagent-quota.md3.5 KiB
- prepare/references/validation-rubric.md2.3 KiB
- references/approval-gates.md8.4 KiB
- references/azd-template-routing.md4.7 KiB
- references/handoff-protocol.md7.8 KiB
- references/iac-resources.md2.6 KiB
- references/intent-gathering.md2.2 KiB
- references/mcp-tool-reference.md3.7 KiB
- references/pipeline-rules-runtime.md3.5 KiB
- references/pipeline-rules.md6.3 KiB
- references/session-protocol.md8.0 KiB
- references/session-schemas.tsScript5.2 KiB
- references/subscription-resolution.md2.1 KiB
- scaffold/PHASE.md14.2 KiB
- scaffold/references/bicep-app-service.md5.4 KiB
- scaffold/references/bicep-container-apps.md9.3 KiB
- scaffold/references/bicep-patterns-data.md4.0 KiB
- scaffold/references/bicep-patterns-security.md7.8 KiB
- scaffold/references/bicep-patterns.md6.8 KiB
- scaffold/references/bicep-swa.md757 B
- scaffold/references/cicd-pipelines.md325 B
- scaffold/references/dockerfile-generation.md4.1 KiB
- scaffold/references/env-var-secrets.md4.1 KiB
- scaffold/references/error-handling.md1.5 KiB
- scaffold/references/iac-generation-rules.md6.6 KiB
- scaffold/references/mcp-tools.md7.0 KiB
- scaffold/references/rbac-roles.md3.8 KiB
- scaffold/references/scaffold-healing-rules.md3.3 KiB
- scaffold/references/scaffold-schemas.tsScript3.5 KiB
- scaffold/references/self-healing.md2.3 KiB
- scaffold/references/self-review-checklist.md9.0 KiB
- scaffold/references/self-review-procedure.md2.3 KiB
- scaffold/references/subagent-iac-gen.md9.5 KiB
- scaffold/references/subagent-review.md3.5 KiB
- scaffold/references/subagent-validate.md7.2 KiB
- scaffold/references/terraform-patterns.md6.9 KiB
- scaffold/references/validation-and-manifest.md5.1 KiB
- scaffold/references/waf-checklist.md2.3 KiB
- scaffold/scripts/scaffold-conformance.ps1Script12.8 KiB
- scaffold/scripts/scaffold-conformance.shScript13.8 KiB
references/azd-template-routing.md
azd Template Routing
When prereq detects an existing azd template, AppOnboard routes to azure-prepare instead of continuing the greenfield pipeline. AppOnboard is a greenfield deployment skill — repos with existing Azure IaC belong to the prepare → validate → deploy pipeline.
Detection
Before the scope triage question (Step 2), do a quick file-system check (workspace root + infra/ only — never scan .copilot-azure/). Route if ALL of these are true:
| Condition | Where to check |
|---|---|
azure.yaml exists in workspace root | File system scan |
*.bicep or *.tf files exist in infra/ | File system scan |
azure.yaml has services: with at least 1 entry | Read azure.yaml in workspace root |
If only azure.yaml is present without IaC files (partial azd setup), continue AppOnboard pipeline — the repo needs IaC generated.
Gate — presented as the scope triage question
When an azd template is detected, the scope triage question is replaced with an azd-aware version (see intent-gathering.md § Scope triage). Present:
📦 **Existing Azure deployment setup detected**
Your repo already has:
- `azure.yaml` — Azure Developer CLI configuration
- `infra/` — {Bicep|Terraform} infrastructure templates
{list any other detected infra: Dockerfiles, CI/CD workflows}
This is a complete azd template — it already defines how to build and deploy your app.
**How would you like to proceed?**
1. **Deploy with existing setup** — I'll hand off to `azure-prepare`, which works with azd templates natively. It will analyze your IaC, plan the deployment, and walk you through `azd up`.
2. **Start fresh** — Ignore the existing IaC and build new infrastructure from scratch using AppOnboard's greenfield pipeline. Your existing files won't be modified.
3. **Just scan for readiness** — Keep the prereq results (your app is {ready|needs fixes}) and stop here.Routing protocol
Option 1 — Deploy with existing setup:
Write routing state to
context.json:{ "routeToSkill": "azure-prepare", "routeReason": "existing-azd-template", "completedPhases": [], "currentPhase": null, "statusSummary": "Routed to azure-prepare — existing azd template detected, prereq scan skipped (not needed for existing IaC)" }Tell the user:
✅ Your app is healthy — prereq scan found no blockers. Since your repo has a complete azd setup, I'm handing off to **azure-prepare** — it's purpose-built for repos with existing IaC and works natively with `azd up`.Invoke azure-prepare directly: Call
{"skill": "azure-prepare"}to load the skill, then follow its workflow using the user's original prompt fromcontext.json.intent.userPrompt. This is the same pattern as prereq invocation in Step 3 — AppOnboard loads the skill and the agent follows its instructions. Do NOT ask the user to type a command.STOP the AppOnboard pipeline. Do NOT continue to Step 5 (plan architecture). Do NOT generate IaC. Do NOT run
azd upyourself. azure-prepare owns the rest of the conversation.
Option 2 — Start fresh:
Write override to
context.json.overrides[]:{ "key": "ignoreExistingInfra", "value": "true", "reason": "User chose greenfield over existing azd template" }If
infra/directory exists, rename it toinfra.bak/(single folder rename). This preserves the user's existing IaC as a backup before scaffold writes new files.Continue AppOnboard pipeline from Step 5 (plan architecture).
Scaffold Step 3 is skipped (override exists) — the backup was already done here.
Option 3 — Just scan:
Update
context.json.statusSummaryto reflect the scan-only outcome.Present prereq results summary. STOP.
Edge cases
| Scenario | Handling |
|---|---|
azure.yaml exists but infra/ is empty | NOT an azd template — continue AppOnboard (repo needs IaC) |
azure.yaml exists with infra.provider: terraform | Route same as Bicep — azure-prepare handles both |
| User chose "Start fresh" then hits scaffold guard | Scaffold guard bypassed via ignoreExistingInfra override |
| Prereq found blockers AND repo has azure.yaml | Present blockers first (prereq triage), then present azd gate. Blockers take priority. |
azure.yaml/infra/ looks like it might be an AppOnboard leftover | It's ours only if any .copilot-azure/sessions/*/scaffold-manifest.json files[] lists it (checking every session, not just the active one, catches leftovers from a prior abandoned run); otherwise treat as the user's → route → STOP. ⛔ Never decide by git commit status; never delete/overwrite — move to .copilot-azure/sessions/<id>/replaced-files/ (mirror path). |
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an MCP server, Needs Node.js
Security
What our scanner noticed· Low risk
- Instructions that use the network
- Scripts that your agent may run
This skill includes scripts that your agent may run. Read them before you use it.
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/skills · .github/plugins/azure-skills/skills/azure-app-onboard · commit 0696600
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Also distributed in
- microsoft/azure-skills
AutoGineer is not affiliated with or endorsed by Microsoft.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-app-onboard.zip