azure-validate Skill for Claude: Check Your Azure Deployment Before You Ship

Makes Claude run preflight checks on your Azure app, Bicep or Terraform, and role assignments before you deploy.

Installs: 574.2K; on skills.sh
Stars: 1.6K; on GitHub
Files: 26; besides SKILL.md
Updated: Oct 2026; last repo commit

azure-validate makes Claude check that an Azure deployment is ready before anything goes live. It looks at your config, your Bicep or Terraform, role assignments and managed identity permissions. Every check must pass before the plan is marked Validated.

It is the middle step of a three-skill flow: azure-prepare, azure-validate, then azure-deploy. It stops if .azure/deployment-plan.md does not exist yet. It runs a workflow script that ships with the skill, bash on macOS and Linux or PowerShell on Windows, and it only hands off to azure-deploy if you asked to deploy.

Good for

Developers about to deploy to Azure with azd, Bicep or Terraform
Teams that want a pass/fail gate before every deploy
Azure Functions and Container Apps users who want role and identity problems caught early

Install azure-validate

Claude Code

Copy this prompt.

Install the azure-validate skill in Claude Code. Run this command:

/plugin install azure@claude-plugins-official

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Azure CLI signed in.

Pick one route, not both. The plugin installs all the Azure skills and wires in the Azure and Foundry tool servers they call. The skills CLI route installs only the skills named in the command, and does not wire in the Azure or Foundry tool servers, so enable the Azure MCP server separately if you want the tools the skills call. Sign in with az login first. azure-validate needs azure-prepare and azure-deploy from the same repo, so the CLI command names them all.

From the project README. Source.

What's in the skill

When it loads

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.

Sections in SKILL.md

Triggers
Rules
Steps

Key facts

Author: Microsoft
License: MIT (stated in SKILL.md)
GitHub stars: 1,609 for the whole microsoft/azure-skills repo (Nov 2, 2026)
Last commit: Oct 30, 2026
What installs: SKILL.md plus 26 files, 10 of them shell or PowerShell scripts
Needs: azure-prepare (creates the plan file) and azure-deploy from the same repo; bash or PowerShell; Azure CLI signed in, per the plugin README
Part of: The azure plugin in microsoft/azure-skills
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk pass
Works in: GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, OpenCode (plugin README)

What it includes

Stops unless an approved azure-prepare plan exists
Claude looks for .azure/deployment-plan.md with status Approved or later. If it is missing, it runs azure-prepare first.
Files · Prerequisite check
Walks Claude through each validation step and records progress
Claude runs the script, does what it prints, then runs it again with the completed step. Progress is saved in .azure/validate-status.json.
Runs code · scripts/workflow.sh and workflow.ps1
Per-tool checks, with validate-deployment and validate-terraform scripts
Claude reads the recipe that matches your project. The recipes include shell and PowerShell scripts for deployment and Terraform validation.
Runs code · Recipes: azcli, azd, Bicep, Terraform
Reviews RBAC role assignments, managed identity access and policy
Covers role verification, region availability and policy validation, each in its own reference file.
Read · Role and policy checks
Scans Aspire and Functions projects for secrets in config
A bundled scan-aspire-functions-secrets script, run from the workflow.
Runs code · Aspire and Functions secrets scan
Deploys only if you explicitly asked for a deploy
If you only asked to validate, it stops after recording the result and does not deploy.
Runs code · Handoff to azure-deploy

From the official docs

Permissions

Medium risk

Claude runs shell scripts on your machine as it walks the checks, and a validated plan can lead to a real deploy. Read each command before you approve it, and say "validate only" if you do not want to deploy.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It runs bundled shell scripts on your machine
The workflow and validation scripts run through bash or PowerShell. Read the command Claude proposes before you approve it.
Validation can lead straight to a deploy
If you ask to deploy, it hands off to azure-deploy. Say "validate only" if you do not want that.
Destructive actions ask first
The SKILL.md rules require Claude to ask you before any destructive action.

Technical details

Scopes	Runs bundled bash or PowerShell scripts on your machine Writes .azure/validate-status.json and updates the plan status Uses your signed-in Azure CLI session

Questions

What does azure-validate do?

It runs preflight checks on an Azure deployment before you ship. It covers config, Bicep or Terraform, role assignments and managed identity permissions, and records the result in .azure/validate-status.json.

How do I install it?

Use the install box at the top of this page. In Claude Code the plugin command installs the Azure skills together with the Azure tools they call, so pick it unless you want this one skill only. Run az login before you start.

Does it work without azure-prepare and azure-deploy?

No. It stops if there is no approved plan from azure-prepare, and it hands deployment to azure-deploy. Install all three, which the install box does.

Does it need an API key?

The SKILL.md names no API key. It needs the Azure CLI signed in with az login, and the Azure Developer CLI signed in with azd auth login for deployment workflows, per the plugin README.

Is it safe?

It can run bundled shell scripts and write status files in your project, so approve commands as Claude proposes them. It asks before destructive actions, per its rules. skills.sh lists Gen Agent Trust Hub, Socket and Snyk as pass.

azure-validate vs azure-deploy?

azure-validate checks that a deploy will work and never deploys on its own. azure-deploy runs the deployment. The flow is prepare, validate, deploy.

Does it work in the Claude app, Codex or Cursor?

The Azure README lists GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI and OpenCode as hosts for the plugin. It does not list the Claude desktop or web app.

Information

updated Nov 2, 2026

Repository: microsoft/azure-skills
Folder: skills/azure-validate

microsoft/azure-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 3

microsoft/azure-skills README · github.com
azure-validate SKILL.md · github.com
azure-validate on skills.sh · skills.sh