azure-validate
microsoft/azure-skills
Pre-deployment validation for Azure readiness with configuration, infrastructure, and RBAC checks.
What is azure-validate?
Runs deep validation checks on Azure configuration, Bicep/Terraform infrastructure, RBAC role assignments, and managed identity permissions before deployment. Use this after azure-prepare and before azure-deploy to ensure your app is deployment-ready.
- Validates azure.yaml configuration and deployment plan
- Checks Bicep and Terraform infrastructure code for correctness
- Verifies RBAC role assignments and managed identity permissions
- Runs recipe-specific validation commands (azd provision --preview, bicep build, terraform validate)
- Builds the project and identifies errors before deployment
- Records validation proof and results in deployment plan
How to install azure-validate
npx skills add https://github.com/microsoft/azure-skills --skill azure-validate- azure-prepare skill must be invoked first and completed
- `.azure/deployment-plan.md` must exist with status `Approved` or later
How to use azure-validate
- 1.Read `.azure/deployment-plan.md` to load the deployment plan and recipe
- 2.Copy validation steps from the recipe into the deployment plan
- 3.Execute recipe-specific validation commands (bicep build, terraform validate, azd provision --preview, etc.)
- 4.Build the project and fix any compilation or configuration errors
- 5.Review Bicep/Terraform code for correct RBAC role assignments
- 6.Populate Section 7 of the deployment plan with validation commands run and their results
- 7.Fix any validation failures and re-run checks if needed
- 8.Set deployment plan status to `Validated` only after all checks pass
Use cases
- Validate app readiness before deploying to Azure
- Run preflight checks on Bicep or Terraform infrastructure
- Verify RBAC roles and managed identity permissions are correctly configured
- Troubleshoot deployment errors by running validation checks
- Perform what-if analysis on Container Apps or Azure Functions deployments
- DevOps engineers managing Azure deployments
- Cloud architects validating infrastructure code
- Developers checking deployment readiness before pushing to production
- Teams using Azure Developer CLI (azd) workflows
azure-validate FAQ
Stop immediately and run azure-prepare first. The complete workflow is azure-prepare → azure-validate → azure-deploy. The deployment plan must exist with status `Approved` or later.
No. All checks must pass before deployment. Fix the failures and re-run azure-validate until all checks pass, then set status to `Validated`.
Populate Section 7 of the deployment plan with the actual commands you ran (e.g., `bicep build`, `terraform validate`, `azd provision --preview`) and their results.
No. After validation passes, invoke the azure-deploy skill to handle deployment execution. Do not run deployment commands directly.
Validation steps are recipe-specific and defined in the recipes/README.md. Load your deployment plan to see which recipe and validation steps apply to your project.
Full instructions (SKILL.md)
Source of truth, from microsoft/azure-skills.
name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment." license: MIT metadata: author: Microsoft version: "1.1.2"
Azure Validate
AUTHORITATIVE GUIDANCE — Follow these instructions exactly unless they contradict security policies given to you.
⛔ STOP — PREREQUISITE CHECK REQUIRED
Before proceeding, verify this prerequisite is met:
azure-prepare was invoked and completed →
.azure/deployment-plan.mdexists with statusApprovedor laterIf the plan is missing, STOP IMMEDIATELY and invoke azure-prepare first.
The complete workflow ensures success:
azure-prepare→azure-validate→azure-deploy
Triggers
- Check if app is ready to deploy
- Validate azure.yaml or Bicep
- Run preflight checks
- Troubleshoot deployment errors
Rules
- Run after azure-prepare, before azure-deploy
- All checks must pass—do not deploy with failures
- ⛔ Destructive actions require
ask_user— global-rules
Steps
| # | Action | Reference |
|---|---|---|
| 1 | Load Plan — Read .azure/deployment-plan.md for recipe and configuration. If missing → run azure-prepare first | .azure/deployment-plan.md |
| 2 | Add Validation Steps — Copy recipe "Validation Steps" to .azure/deployment-plan.md as children of "All validation checks pass" | recipes/README.md, .azure/deployment-plan.md |
| 3 | Run Validation — Execute recipe-specific validation commands | recipes/README.md |
| 4 | Build Verification — Build the project and fix any errors before proceeding | See recipe |
| 5 | Static Role Verification — Review Bicep/Terraform for correct RBAC role assignments in code | role-verification.md |
| 6 | Record Proof — Populate Section 7: Validation Proof with commands run and results | .azure/deployment-plan.md |
| 7 | Resolve Errors — Fix failures before proceeding | See recipe's errors.md |
| 8 | Update Status — Only after ALL checks pass, set status to Validated | .azure/deployment-plan.md |
| 9 | Deploy — Invoke azure-deploy skill | — |
⛔ VALIDATION AUTHORITY
This skill is the officially verified way to set plan status to
Validated. You MUST follow these steps to make sure every prerequisite is fulfilled before setting status toValidated:
- Run actual validation commands (azd provision --preview, bicep build, terraform validate, etc.)
- Populate Section 7: Validation Proof with the commands you ran and their results
- Only then set status to
ValidatedDo NOT set status to
Validatedwithout running checks and recording proof.
⚠️ MANDATORY NEXT STEP — DO NOT SKIP
After ALL validations pass, you MUST invoke azure-deploy to execute the deployment. Do NOT attempt to run
azd up,azd deploy, or any deployment commands directly. Let azure-deploy handle execution.If any validation failed, fix the issues and re-run azure-validate before proceeding.
Related skills
More from microsoft/azure-skills and the wider catalog.
finetuning
Fine-tune models on Azure AI Foundry with SFT, DPO, or RFT training methods.
azure-ai
Azure AI services skill for Search, Speech, OpenAI, and Document Intelligence in coding agents
azure-deploy
Execute Azure deployments for prepared applications with built-in error recovery and validation.
azure-diagnostics
Debug Azure production issues using AppLens, Azure Monitor, resource health, and systematic triage.
azure-prepare
Generate Azure deployment infrastructure (Bicep/Terraform, azure.yaml, Dockerfiles) for new or existing apps
azure-storage
Azure Storage skill: Blob, File Shares, Queue, Table, and Data Lake with access tier guidance and lifecycle management