azure-enterprise-infra-planner Skill for Claude: Plan Azure Infra and Generate IaC

Has Claude plan enterprise Azure infrastructure from a workload description, then generate Bicep or Terraform in seven gated phases.

Installs: 446.8K; on skills.sh
Stars: 1.6K; on GitHub
Files: 40; besides SKILL.md
Updated: Oct 2026; last repo commit

azure-enterprise-infra-planner takes a workload description and runs seven phases: extract insights, research best practices, research resources, generate a plan, verify, generate infrastructure code, and deploy. Each phase passes a gate before the next starts. The plan needs your approval before any code is made, and deploy needs a risk-acknowledged confirmation.

It writes .azure/insights.json, .azure/infrastructure-plan.json and either infra/main.bicep or infra/main.tf with modules. The generated code must pass az bicep build or terraform validate and a checkov scan with no unresolved high or critical findings. If you point it at existing resources, it references them without recreating them and deploys additively. It uses Azure MCP tools, so use the plugin from the install box.

Good for

Cloud architects planning landing zones, hub-spoke networks or multi-region setups
Platform engineers who want Bicep or Terraform that passes validation and a security scan
Teams adding a new workload next to existing Azure resources

Install azure-enterprise-infra-planner

Claude Code

Copy this prompt.

Install the azure-enterprise-infra-planner skill in Claude Code. Run this command:

/plugin install azure@claude-plugins-official

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires An Azure account, Node.js 18+, Azure CLI signed in with az login.

The README installs these skills as one plugin that also wires in the Azure MCP Server, so there is no per-skill install. Run it inside Claude Code. Install the Azure Developer CLI and sign in with azd auth login too if you plan to deploy. The planner calls Azure MCP tools such as the Bicep schema and best-practice lookups.

From the project README. Source.

What's in the skill

When it loads

Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and platform engineers planning networking, identity, security, compliance, and multi-resource topologies with WAF alignment. Generates Bicep or Terraform directly (no azd). WHEN: 'plan Azure infrastructure', 'architect Azure landing zone', 'design hub-spoke network', 'plan multi-region DR topology', 'set up VNets firewalls and private endpoints', 'subscription-scope Bicep deployment', 'Azure Backup for VM workloads'. PREFER azure-prepare FOR app-centric workflows.

Sections in SKILL.md

When to Use This Skill
Quick Reference
Workflow (Start Here)
Architecture
MCP Tools
Error Handling

Key facts

Author: Microsoft
Repository: microsoft/azure-skills, folder skills/azure-enterprise-infra-planner
Installs on skills.sh: 446,839 as of 2026-11-02
GitHub stars: 1,609 for the whole microsoft/azure-skills repo, 2026-11-02
License: MIT
Last repo commit: 2026-10-30
What is inside: 40 bundled reference pages besides SKILL.md: phase guides, resource and constraint guides, checklists; no scripts
skills.sh audits: Gen Agent Trust Hub: pass, Socket: pass, Snyk: warn

What it includes

Reads your workload description and environment
Can call the insights tool for your existing Azure setup. Saves .azure/insights.json.
Files · Phase 1: extract insights
Pulls Azure best practices and Well-Architected guidance
Uses Azure MCP tools and Microsoft Learn search.
Network · Phase 2: research best practices
Looks up the resource types and Bicep schemas
Checks pairing rules so incompatible SKUs are caught early.
Network · Phase 3: research resources
Writes .azure/infrastructure-plan.json
Status starts as draft.
Write · Phase 4: generate plan
Waits for your approval of the plan
Nothing moves on until the plan is marked approved.
Read · Phase 5: verify
Writes Bicep or Terraform and validates it
Runs az bicep build or terraform validate, plus checkov, and must show the output.
Try: “Plan a hub-spoke network with a firewall and private endpoints, then write Bicep.”
Runs code · Phase 6: generate IaC
Runs az deployment or terraform apply
Needs an explicit, risk-acknowledged confirmation. Existing resources get an incremental, additive deploy with a what-if preview.
Runs code · Phase 7: deploy

From the official docs

Permissions

High risk

Claude can write infrastructure code and deploy it into your Azure subscription, which creates billable resources. Stop after code generation and review before any deploy.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It can deploy real, billable Azure resources
Phase 7 runs az deployment or terraform apply. Stop after code generation if you only want files, and review the what-if output. github.com
Referenced resources must not be modified
For existing infrastructure, SKILL.md says to deploy additively and never modify or destroy referenced resources. Check the what-if preview to confirm. github.com
Generated code needs your review
Validation and a checkov scan catch many problems, not all. Read network, identity and access settings before you apply. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode. Stop after phase 6 to get the code without deploying anything.
Talks to	Azure Resource Manager calls made by the Azure CLI and Azure MCP tools. Your AI provider receives what Claude reads from your Azure account
Sign-in and keys	Uses your existing Azure CLI sign-in (az login). SKILL.md sets up no separate key.
Scopes	Writes plan and infrastructure files into your project (.azure/ and infra/) Runs az, terraform and checkov commands under your Azure sign-in Can deploy Azure resources after you confirm

Questions

How do I install azure-enterprise-infra-planner?

Use the install box at the top of this page. It installs the Azure plugin for Claude Code, which includes this skill and the Azure MCP tools it calls. You need an Azure account and Azure CLI signed in.

Does it deploy infrastructure on its own?

No. Phase 5 needs your plan approval, and phase 7 needs an explicit, risk-acknowledged deploy confirmation. You can stop after the code is generated and deploy yourself.

Does it support Bicep and Terraform?

Yes, both. It generates Bicep or Terraform directly and does not use azd. Bicep output must pass az bicep build, and Terraform output must pass terraform validate. Both are scanned with checkov.

Can it work with infrastructure I already have?

Yes. If you reference existing resources, SKILL.md says it inventories them and refers to them rather than recreating them, then deploys only additive, incremental changes.

Is azure-enterprise-infra-planner safe?

Use care. It can deploy real resources that cost money. Its approval gates and validation help, but read the plan and what-if output yourself.

Information

updated Nov 2, 2026

Repository: microsoft/azure-skills
Folder: skills/azure-enterprise-infra-planner

microsoft/azure-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 2

microsoft/azure-skills README · github.com
azure-enterprise-infra-planner SKILL.md · github.com