Azure Enterprise Infra Planner

MicrosoftOfficialCreated by Microsoft

Skill
Workflow
Cloud and DevOps
MIT
No issues found

From the author

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment', 'Azure Backup for VM workloads'. PREFER azure-prepare FOR app-centric workflows.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill guides users through a 7-phase pipeline to design and deploy Azure infrastructure. It processes workload descriptions to generate Bicep or Terraform code, supporting both greenfield deployments and additive updates to existing environments. The process includes research, planning, user approval, and automated validation using security and syntax checks before deployment.

What it does

Extracts insights from workload descriptions to inform infrastructure planning.
Researches Azure best practices and service-specific documentation.
Generates infrastructure plans and corresponding Bicep or Terraform code.
Validates generated IaC using syntax checks and security scanning tools.
Supports additive deployments for existing environments without modifying referenced resources.
Manages multi-resource topologies including networking, identity, and compliance configurations.

When to use it

When planning Azure infrastructure from a workload or architecture description.
When designing hub-spoke networks, landing zones, or multi-region topologies.
When setting up networking components like VNets, firewalls, and private endpoints.
When generating subscription-scope or multi-resource-group infrastructure code.

Advantages

Follows a structured, gated pipeline to ensure plan approval and code validation.
Integrates security scanning and syntax validation into the generation workflow.
Provides support for referencing existing resources to avoid accidental recreation.
Utilizes specific Azure schema data to ensure accurate resource definitions.

Usage examples

“Plan Azure infrastructure for a hub-spoke network with firewalls.”: The agent initiates the 7-phase pipeline, researching networking best practices and generating the corresponding IaC for the requested topology.
“Architect an Azure landing zone.”: The agent guides the user through requirements extraction and resource planning, resulting in a structured infrastructure plan and Bicep or Terraform files.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/azure-enterprise-infra-planner/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-enterprise-infra-planner.zip -d .agents/skills

Documentation by Microsoft

Azure Enterprise Infra Planner

When to Use This Skill

Activate this skill when user wants to:

Plan enterprise Azure infrastructure from a workload or architecture description
Architect a landing zone, hub-spoke network, or multi-region topology
Design networking infrastructure: VNets, subnets, firewalls, private endpoints, VPN gateways
Plan identity, RBAC, and compliance-driven infrastructure
Generate Bicep or Terraform for subscription-scope or multi-resource-group deployments
Plan disaster recovery, failover, or cross-region high-availability topologies

Quick Reference

Property	Details
MCP tools	`insights_get`, `get_azure_bestpractices_get`, `wellarchitectedframework_serviceguide_get`, `microsoft_docs_fetch`, `microsoft_docs_search`, `bicepschema_get`
CLI commands	`az deployment group create`, `az bicep build`, `az resource list`, `terraform init`, `terraform plan`, `terraform validate`, `terraform apply`, `checkov`
Output schema	schema.md
Key references	workflow.md, waf-checklist.md, resources/, constraints/

Workflow (Start Here)

Follow the step-by-step instructions in workflow.md to execute the 7 phases of infrastructure planning and provisioning.

Architecture

The skill runs a 7-phase, gated pipeline. Input is triaged into one of two flows:

Greenfield — only new requirements; run the phases straight through.
Referenced (brownfield) — the user supplies something that already exists (a live resource / resource group / subscription, IaC or an infra plan, or a requirements doc). The same phases run, plus referenced-workload.md: existing resources are inventoried and referenced (never recreated), the new workload is wired into them, and Phase 7 deploys additively (incremental only — never modifying or destroying the referenced resources).

Every phase advances only after its gate passes. Phase 5 requires explicit user approval; Phase 6 is a hardened, self-verifying gate — the generated IaC must be secure-by-default, pass local validation (az bicep build / terraform validate) with zero errors, pass a checkov security scan with no unresolved high/critical findings, and the skill must show the command output and emit a completion self-check before advancing; Phase 7 requires an explicit, risk-acknowledged deploy confirmation.

flowchart TD
    IN([Input]) --> TRIAGE{Existing infra<br/>referenced?}
    TRIAGE -- "No (greenfield)" --> P1
    TRIAGE -- "Yes (referenced)" --> RW[/referenced-workload.md:<br/>inventory + assign roles<br/>reference, never recreate/]
    RW --> P1

    subgraph PIPE [7-phase gated pipeline]
        direction TB
        P1[Phase 1 · Extract insights] --> P2[Phase 2 · Research best practices]
        P2 --> P3[Phase 3 · Research resources]
        P3 --> P4[Phase 4 · Generate plan]
        P4 --> P5{Phase 5 · Verify<br/>user approves?}
        P5 -- "no" --> P4
        P5 -- "approved" --> P6[Phase 6 · Generate IaC]
        P6 --> VAL{Validate<br/>az bicep build /<br/>terraform validate}
        VAL -- "errors" --> P6
        VAL -- "clean" --> P7{Phase 7 · Deploy<br/>risk-ack confirm?}
    end

    P7 -- "greenfield" --> DEP[az deployment / terraform apply]
    P7 -- "referenced" --> DEPADD[Additive deploy · incremental only<br/>what-if preview · no destroy of<br/>referenced resources]
    DEP --> OUT([Deployed])
    DEPADD --> OUT

    classDef gate fill:#fff3cd,stroke:#d39e00,color:#000;
    classDef ref fill:#e2f0d9,stroke:#548235,color:#000;
    class P5,VAL,P7,TRIAGE gate;
    class RW,DEPADD ref;

Artifacts (written under <project-root>/): .azure/insights.json (Phase 1), .azure/infrastructure-plan.json (Phase 4, status draft→approved→deployed), and infra/main.bicep + infra/modules/* or infra/main.tf + infra/modules/** (Phase 6).

MCP Tools

Tool	Purpose
`insights_get`	Retrieve insights about the user's existing Azure environment to guide planning decisions
`get_azure_bestpractices_get`	Azure best practices for code generation, operations, and deployment
`wellarchitectedframework_serviceguide_get`	WAF service guide for a specific Azure service
`microsoft_docs_search`	Search Microsoft Learn for relevant documentation chunks
`microsoft_docs_fetch`	Fetch full content of a Microsoft Learn page by URL
`bicepschema_get`	Bicep schema definition for any Azure resource type (latest API version)

Error Handling

Error	Cause	Fix
MCP tool error or not available	Tool call timeout, connection error, or tool doesn't exist	Retry once; fall back to reference files and notify user if unresolved
Plan approval missing	`meta.status` is not `approved`	Stop and prompt user for approval before IaC generation or deployment
IaC validation failure	`az bicep build` or `terraform validate` returns errors	Fix the generated code and re-validate; notify user if unresolved
Pairing constraint violation	Incompatible SKU or resource combination	Fix in plan before proceeding to IaC generation
Infra plan or IaC files not found	Files written to wrong location or not created	Verify files exist at `<project-root>/.azure/` and `<project-root>/infra/`; if missing, re-create the files by following workflow.md exactly

Files

ATTRIBUTION.mdAdded by AutoGineer1022 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md6.2 KiB
references/bicep-generation.md5.1 KiB
references/constraints/README.md1.2 KiB
references/constraints/ai-ml.md3.2 KiB
references/constraints/compute-apps.md7.8 KiB
references/constraints/compute-infra.md4.5 KiB
references/constraints/data-analytics.md6.3 KiB
references/constraints/data-relational.md4.9 KiB
references/constraints/messaging.md2.5 KiB
references/constraints/monitoring.md1.7 KiB
references/constraints/networking-connectivity.md6.1 KiB
references/constraints/networking-core.md7.0 KiB
references/constraints/networking-traffic.md4.6 KiB
references/constraints/security.md2.4 KiB
references/deployment.md3.7 KiB
references/pairing-checks.md3.7 KiB
references/phases/1-extract-insights.md2.6 KiB
references/phases/2-research-best-practices.md2.8 KiB
references/phases/3-research-resources.md3.3 KiB
references/phases/4-generate-plan.md792 B
references/phases/5-verify.md814 B
references/phases/6-generate-iac.md2.5 KiB
references/phases/7-deploy.md1.3 KiB
references/referenced-workload.md7.3 KiB
references/resources/README.md1.6 KiB
references/resources/ai-ml.md2.1 KiB
references/resources/compute-apps.md4.0 KiB
references/resources/compute-infra.md2.8 KiB
references/resources/data-analytics.md3.0 KiB
references/resources/data-relational.md2.6 KiB
references/resources/messaging.md2.0 KiB
references/resources/monitoring.md1.5 KiB
references/resources/networking-connectivity.md3.6 KiB
references/resources/networking-core.md4.3 KiB
references/resources/networking-traffic.md2.6 KiB
references/resources/security.md1.5 KiB
references/schema.md3.8 KiB
references/terraform-generation.md4.4 KiB
references/verification.md2.6 KiB
references/waf-checklist.md1.9 KiB
references/workflow.md4.9 KiB

references/workflow.md

Workflow

Mandatory Rules

You must execute the seven phases in sequential order. Follow the instructions precisely as defined. Do not continue to the next phase until the current phase is complete.
You must stop on all "gate" conditions and only continue when the conditions have been met.
Destructive actions require explicit user confirmation.
Confirmation gate vs. answer-first. Always present a plain-language summary of your understanding plus an explicit "confirm before I proceed" checkpoint before deploying (Phase 7). In referenced mode you still generate the plan and IaC in the same turn (answer-first) — the gate governs deployment, not whether you produce the artifacts. Never end a turn with only a question, and never deploy without an explicit, risk-acknowledged go-ahead.
Never claim a gate passed without proof. When a phase gate depends on a command (validation, security scan), run it and show its actual output/exit status; do not assert success from memory.
You must read each phase's reference file in full before executing it.
Never assume knowledge and cut corners or skip research steps.

Overview

Starting from Phase 1, execute all phases in sequential order. Do not advance to the next phase until the current phase is complete and all of its gate conditions have been met.

Phase 6 — hardened generation gate (apply inline)

The detailed generation reference files may not be loaded in every environment, so the Phase 6 gate is restated here and is mandatory. After generating the IaC, and before offering it or advancing to deploy:

Secure-by-default. Every resource: private endpoints + public network access disabled on data/PaaS services; managed identity + RBAC (never keys/connection strings); no secrets in code; storage shared-key access disabled; Key Vault soft-delete + purge protection; AKS managed identity with local accounts disabled; TLS 1.2 minimum.
Validate + security-scan, fix until clean. Bicep: az bicep build --file infra/main.bicep. Terraform: terraform init -backend=false then terraform validate. Then checkov -d infra/. Fix in-place and re-run until every command passes. Paste the actual command output / exit status into your response — never claim the gate passed without showing it. If a tool is genuinely unavailable, say so and self-review against the secure-by-default list.
Completion self-check. End Phase 6 with a checklist, each line marked pass/fail: validation clean (output shown); checkov no unresolved high/critical; secure-by-default applied; referenced resources wired and none recreated (referenced mode); files under infra/ with original sources untouched.

Referenced workload? If the user supplies something existing to reference or integrate with — a live Azure resource/resource group/subscription, a Bicep/Terraform/ARM file or infra plan, or a general doc of requirements/context — also read referenced-workload.md and apply it alongside these phases. If not, run greenfield exactly as below.

Phase	Action	Reference	Key Gate
1	Extract insights	1-extract-insights.md	Insights written to `<project-root>/.azure/insights.json`
2	Research best practices	2-research-best-practices.md	All MCP tool calls complete and WAF guides summarized
3	Research resources	3-research-resources.md	All resources have ARM type, naming rules, and pairing constraints; user approves resource list
4	Generate plan	4-generate-plan.md	Plan JSON written to disk
5	Verify plan	5-verify.md	All checks pass, user approves
6	Generate IaC	6-generate-iac.md	All IaC files generated and saved to disk
7	Deploy to Azure	7-deploy.md	User confirms destructive actions

Plan Status Lifecycle

draft → approved → deployed

draft — set by Phase 4 when the plan is written.
approved — set by Phase 5 only after the user explicitly approves. Required before Phase 6 and Phase 7.
deployed — set by Phase 7 after a successful az deployment ... create or terraform apply.

Outputs

Artifact	Location
Insights	`<project-root>/.azure/insights.json`
Infrastructure Plan	`<project-root>/.azure/infrastructure-plan.json`
Bicep files	`<project-root>/infra/main.bicep`, `<project-root>/infra/modules/*.bicep`
Terraform files	`<project-root>/infra/main.tf`, `<project-root>/infra/modules/*/.tf`

Before writing any .bicep or .tf files in Phase 6:

Create the infra/ directory at <project-root>/infra/.
Create infra/modules/ for child modules.
Write main.bicep (or main.tf) inside infra/, not in the project root or .azure/.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/azure-skills/skills/azure-enterprise-infra-planner · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

Also distributed in

microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-enterprise-infra-planner.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Microsoft

Azure Enterprise Infra Planner

When to Use This Skill

Quick Reference

Workflow (Start Here)

Architecture

MCP Tools

Error Handling

Files

references/workflow.md

Workflow

Mandatory Rules

Overview

Phase 6 — hardened generation gate (apply inline)

Plan Status Lifecycle

Outputs

Requirements and compatibility

Security

Attribution and licence

Related skills

Deployment Strategies Terraform Specialist

Terraform Module Library

Cloud Infrastructure Terraform Specialist

Cicd Automation Terraform Specialist

Terraform Azure Planning

Terratest Module Testing

Download ZIP