agentsclimarketplace

Azure expert

Skill jpantsjoha/ai-native-developer-experience/.agents/skills/azure-expert

Team-wide AI harness adoption plugin, \w operating model, onboarding and delivery standards coherent human-agent outcomes from day one.

Install
npx -y skills add jpantsjoha/ai-native-developer-experience --skill azure-expert

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 10 stars10 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Azure expert guardrails — Entra ID least-privilege, policy-first governance, data boundaries, cost, residency, and official-source validation. Trigger when designing or reviewing any Azure workload, especially agents, LLMs (Foundry/OpenAI), or landing-zone systems.

SKILL.md

4.4 KB, as published. Nobody here has run it

Azure Expert

Azure is policy-first: Entra ID and Azure Policy are the guardrails; the Foundry is the agent surface. If it is not enforced by policy, it is a wish.

This skill enforces the discipline that makes Azure workloads production-safe: identity, policy, data boundaries, cost controls, and residency. It is not an Azure feature tour — it is a checklist of the things that cause incidents and compliance failures when skipped.

When to use

  • Designing any Azure infrastructure (new or modified)
  • Before deploying agents or LLM workloads to Azure (AI Foundry, Azure OpenAI, Azure AI Agent Service)
  • When reviewing a Bicep/Terraform plan or a landing-zone design
  • When a system spans subscriptions, touches regulated data, or crosses geographies

Procedure

  1. Identity and access — verify least-privilege for every identity:

    • Managed identities over service principals with secrets; no client secrets in code or config.
    • Entra ID RBAC scoped to the specific function; PIM for standing privileged access.
    • Conditional Access policies for human principals on production subscriptions.

  2. Policy and landing zones — confirm governance is mechanical:

    • Azure Policy assignments enforce allowed locations, required encryption, and denied public endpoints.
    • Workload sits inside a Cloud Adoption Framework landing zone (or an explicit, owned deviation).

  3. Data boundaries — for every data store:

    • Classification recorded (Purview where in scope); CMK where required.
    • Private Endpoints on PaaS data services; public network access disabled by default.
    • Cross-tenant or cross-subscription sharing explicit and documented.

  4. Data residency — for each resource:

    • Allowed-locations policy constrains deployment geography (e.g. EU Data Boundary where required).
    • For Azure OpenAI / Foundry calls: regional deployments, not global, where residency matters.

  5. Cost controls — for every LLM, compute, or storage resource:

    • Cost Management budgets with alerts at 50%, 75%, 90%, 100%.
    • Foundry model quotas and rate limits set; autoscale maximums bounded.

  6. Network and egress — confirm:

    • Private Link over public endpoints; NSGs default-deny.
    • Egress costed for cross-region and internet-bound traffic.

  7. Observability — confirm:

    • Azure Monitor / Log Analytics dashboards and alerts on error rate, latency, and cost.
    • Activity logs routed centrally for retention and audit — evidence before go-live.

  8. Run the Adversarial Gate — common Azure failure modes: service principals with secrets, public PaaS endpoints, missing allowed-locations policy, uncapped Foundry spend, standing owner access without PIM.

Official sources — validate before you assert

  • Documentation: learn.microsoft.com/azure · Well-Architected: learn.microsoft.com/azure/well-architected
  • Live docs via MCP (verify currency before pinning): the official Azure MCP Server (github.com/microsoft/azure-mcp) and the Microsoft Learn docs MCP endpoint — fetch current docs instead of relying on memory.
  • GitHub, foundations: github.com/Azure/Enterprise-Scale (CAF landing zones) · github.com/Azure/bicep · github.com/Azure-Samples
  • GitHub, agent examples: Azure AI Agent Service samples under github.com/Azure-Samples · AutoGen (github.com/microsoft/autogen) · Semantic Kernel (github.com/microsoft/semantic-kernel)
  • Rule: every service/API claim cites an official doc. Quotas, prices, and model names are dated facts — stale until re-verified against the source.

Outputs

  • Azure guardrail checklist (pass/fail per item)
  • Identity matrix: principal | role | scope | justification
  • Data classification and boundary map
  • Budget alert confirmation
  • Open findings for human review

Guardrails

  • No client secrets in code or config. Managed identity or nothing.
  • Policy, not promises. If a guardrail is not an Azure Policy assignment, it does not exist.
  • Residency is a constraint, not a preference. Enforce with allowed-locations policy.
  • Budget alerts are not optional. An unmonitored LLM workload will produce a surprise invoice.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.