Azure Enterprise Infrastructure Planner
Turn enterprise workload descriptions into deployable Azure infrastructure plans.
The evidence requires plan approval before IaC generation or deployment and recommends managed identities, RBAC, private endpoints, and secure parameters; it also discloses MCP, CLI, and deployment effects. However, it lacks an explicit least-privilege matrix, sensitive-data flow, rollback/recovery procedure, detailed confirmation rules for external writes, and source citation requirements, so points are deducted.
The evidence provides a seven-phase workflow entry point, handling guidance for unavailable MCP tools and validation failures, and extensive resource-pairing constraints. However, the referenced workflow is not supplied, tool and schema dependencies cannot be reproduced statically, abnormal-input handling is thin, and no skill-specific tests are shown; the static ceiling and uncertainty therefore reduce the score.
The evidence clearly targets cloud architects and platform engineers, covering landing zones, networking, identity, compliance, disaster recovery, and Bicep/Terraform, with trigger phrases and a stated preference boundary for azure-prepare. Non-fit cases, required inputs, output contracts, and semantic anti-trigger conditions remain incomplete, and Chinese-language or mainland-China network fit is not addressed, so points are deducted.
The evidence includes a stable name and description, MIT license, version, quick reference, linked reference structure, and parameter-file examples. However, referenced files such as schema.md and workflow.md are not fully supplied, FAQs and known limitations are limited, and changelog, maintenance ownership, and update path are unclear; the repository is also marked as work in progress.
The evidence establishes a clear core task: derive infrastructure plans and Bicep/Terraform from workload descriptions with schema checks, approval gates, and pre-deployment validation. But no representative output, end-to-end result, or comparative benefit evidence is provided, and generated IaC still requires human review; the static cap therefore limits this score.
The evidence includes versioned documentation, constraint tables, repository CI workflows, and general harness tests. However, the supplied tests do not cover this skill's key paths, and no dedicated IaC-generation, deployment, constraint-correctness, or third-party execution evidence is shown, so verifiability remains limited.
- This skill targets real Azure infrastructure; an approval gate exists, but fine-grained permissions, rollback, and recovery procedures are not defined, so generated IaC should not be treated as execution-ready without review.
- Key references such as workflow.md and schema.md, along with some referenced constraint content, are not supplied; MCP, CLI, API-version, and constraint accuracy cannot be confirmed from this static review.
- No Chinese-output convention or mainland-China reachability guidance is provided; availability of Azure/Microsoft documentation and MCP dependencies should be verified separately.
What does this skill do, and when should you use it?
Azure Enterprise Infrastructure Planner is a skill in Microsoft’s azure-skills plugin for cloud architects and platform engineers. It plans Azure networking, identity, RBAC, security, compliance, multi-resource-group, and multi-region topologies from workload or architecture descriptions. It can generate Bicep or Terraform directly and is explicitly not an azd workflow. It is designed for enterprise infrastructure planning rather than application-centric development.
Reads a workload or architecture description; optionally uses Azure MCP tools to retrieve environment insights, Azure best practices, Well-Architected service guidance, Microsoft Learn content, and Bicep resource schemas; plans VNets, subnets, firewalls, private endpoints, VPN gateways, identity and RBAC, backup, disaster recovery, failover, and cross-region high-availability topologies; produces an infrastructure plan and generates Bicep or Terraform; and references az deployment group create, az bicep build, az resource list, terraform init, terraform plan, terraform validate, and terraform apply.
- A cloud architect designing an Azure landing zone or hub-spoke network from an enterprise workload description.
- A platform engineer planning VNets, subnets, firewalls, private endpoints, and VPN gateways.
- An infrastructure team designing cross-region disaster recovery, failover, or high-availability topology.
- A security or platform team planning identity, RBAC, and compliance-driven infrastructure.
- An engineering team needing subscription-scope or multi-resource-group Bicep or Terraform generation.
What are this skill's strengths and limitations?
- Covers enterprise networking, identity, security, compliance, multi-region, and disaster-recovery planning.
- Generates Bicep or Terraform directly and identifies validation and deployment commands.
- Provides Azure MCP, Microsoft Learn, best-practice, and Bicep-schema reference points.
- The skill identifies Microsoft as its author, uses version 1.2.3, and is MIT-licensed.
- A complete workflow requires Azure MCP tools and environments capable of running Azure CLI or Terraform commands.
- The supplied source does not include the contents of schema.md, workflow.md, or the other referenced files, so the seven-phase workflow cannot be independently assessed here.
- The source does not specify supported Azure SKUs, regions, or organizational policies.
- It is focused on enterprise infrastructure rather than application-centric workflows; its description recommends azure-prepare for those scenarios.
How do you install this skill?
Run npx skills add microsoft/skills and select azure-enterprise-infra-planner in the installation wizard. The README does not document a command-line-only selection flow or a standalone installation command for this skill.
How do you use this skill?
After installation, submit a natural-language request such as “plan Azure infrastructure,” “architect Azure landing zone,” “design hub-spoke network,” or “plan multi-region DR topology.” Planning must be completed and approved before infrastructure-as-code generation or deployment; the skill says to stop when meta.status is not approved.