Azure Deployment

Azure Deployment Skill

This skill guides deployment of applications to Azure using modern best practices including Azure Dev CLI (azd), Infrastructure as Code with Bicep, and automated CI/CD pipelines.

When to Use This Skill

• Deploying applications to Azure
• Creating infrastructure as code
• Setting up CI/CD pipelines
• Configuring Azure resources
• Implementing deployment automation

Prerequisites

Before deploying, read and analyze:

1. specs/prd.md - Product requirements to understand application needs
2. specs/features/*.md - Feature requirements
3. specs/adr/*.md - Architecture decisions and technology stack
4. Codebase structure (src/backend, src/frontend, etc.)

Deployment Workflow

Step 1: Pre-Deployment Analysis

Understand the application:

• Review specifications to understand requirements
• Identify required Azure services
• Analyze codebase structure
• Determine compute, storage, and networking needs

Step 2: Azure Dev CLI Setup

Initialize azd:

• Run azd init if not already initialized
• Configure azure.yaml with service definitions
• Define environments (dev, staging, prod)
• Set up environment-specific configurations

azure.yaml structure:

name: your-app-name
services:
  api:
    project: ./src/backend
    language: dotnet|python|node
    host: containerapp|appservice
  web:
    project: ./src/frontend
    language: js
    host: staticwebapp

Step 3: Infrastructure as Code (Bicep)

Bicep best practices:

• Create all infrastructure in infra/ folder
• Use Azure Verified Modules (AVM) when available
• Get Azure best practices before writing Bicep code
• Create main.bicep as orchestrator
• Follow Azure naming conventions
• Configure resource tags for cost tracking

Resource organization:

infra/
├── main.bicep              # Main orchestrator
├── main.parameters.json    # Environment parameters
├── modules/
│   ├── app-service.bicep
│   ├── sql-database.bicep
│   └── storage.bicep
└── resources.bicep         # Shared resources

Critical Bicep guidelines:

• Use parameters for environment-specific values
• Output connection strings and endpoints
• Enable diagnostic settings on all resources
• Use managed identities for authentication
• Apply least-privilege access controls

Step 4: GitHub Actions CI/CD

Create .github/workflows/deploy.yml:

• Build and test on push
• Deploy using azd commands
• Set up environment protection rules
• Configure approval gates for production
• Use GitHub secrets for sensitive values

Workflow structure:

name: Deploy to Azure
on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build application
        run: # build commands
      
  deploy:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Login to Azure
        uses: azure/login@v1
      - name: Deploy with azd
        run: azd deploy

Step 5: Security & Monitoring

Security hardening:

• ✅ Enable managed identities for all Azure resources
• ✅ Store secrets in Azure Key Vault
• ✅ Use RBAC with least-privilege access
• ✅ Enable private endpoints where applicable
• ✅ Configure network security groups
• ✅ Never commit secrets to source control

Monitoring setup:

• ✅ Configure Application Insights for observability
• ✅ Enable diagnostic logging for all resources
• ✅ Set up metric alerts for critical resources
• ✅ Configure log analytics workspace
• ✅ Create availability tests for endpoints

Step 6: Deploy & Verify

Deployment commands:

# Provision infrastructure
azd provision

# Deploy application
azd deploy

# Or do both
azd up

Verification checklist:

• ✅ Infrastructure provisioned successfully
• ✅ Application deployed without errors
• ✅ Health endpoints responding
• ✅ SSL certificates configured
• ✅ Monitoring data flowing to Application Insights
• ✅ DNS and custom domains configured (if applicable)

Step 7: Documentation

Create docs/deployment.md with:

• Prerequisites - Azure subscription, permissions needed
• Setup instructions - How to run azd commands
• Environment variables - Required configuration
• Azure resources - List of all created resources
• Monitoring - How to access logs and metrics
• Troubleshooting - Common issues and solutions
• Runbook - Common operational procedures

Tools Priority Order

1. Azure Dev CLI (azd) - Primary deployment tool
2. Bicep Experimental MCP - For Bicep best practices and Azure Verified Modules
3. Azure MCP tools - For Azure operations and best practices
4. Microsoft Docs MCP - For official Azure documentation
5. GitHub MCP - For creating workflows

Azure Best Practices

Always Do

✅ Use Azure Verified Modules when available ✅ Get Azure best practices before writing infrastructure code ✅ Use managed identities instead of connection strings ✅ Enable diagnostic logging from day one ✅ Tag all resources (environment, project, owner, cost-center) ✅ Plan for scalability even if starting small ✅ Use environment-specific parameter files ✅ Implement proper error handling and retries

Never Do

❌ Hardcode secrets or connection strings ❌ Skip resource tagging ❌ Deploy without monitoring configured ❌ Use admin credentials in connection strings ❌ Create resources without diagnostic settings ❌ Deploy to production without approval gates

Resource Naming Conventions

Follow Azure naming conventions:

• Use consistent prefixes: rg-, app-, sql-, kv-, st-
• Include environment: -dev, -staging, -prod
• Include region: -eastus, -westeu
• Example: rg-myapp-prod-eastus

Cost Management

Cost optimization strategies:

• Use appropriate SKUs for environment (dev can use lower tiers)
• Enable autoscaling for production
• Implement resource cleanup for dev/test environments
• Tag resources for cost allocation
• Set up budget alerts
• Use Azure reservations for production workloads

Common Azure Services Patterns

Web Application

• Compute: Azure App Service or Container Apps
• Database: Azure SQL Database or Cosmos DB
• Storage: Azure Storage Account (Blob, Table, Queue)
• Cache: Azure Cache for Redis
• CDN: Azure Front Door or CDN
• Auth: Azure AD B2C or App Service Authentication

API Backend

• Compute: Azure Container Apps or App Service
• API Management: Azure API Management
• Database: Azure SQL or Cosmos DB
• Message Queue: Azure Service Bus or Event Grid
• Functions: Azure Functions for event-driven tasks

Static Website + API

• Frontend: Azure Static Web Apps
• Backend: Azure Functions or Container Apps
• Database: Cosmos DB or Azure SQL
• CDN: Built-in to Static Web Apps

Troubleshooting

Common Issues

• Deployment failures: Check azd logs and Azure Portal activity log
• Resource conflicts: Ensure unique resource names
• Permission errors: Verify RBAC assignments
• Connection failures: Check network security groups and firewalls
• SSL issues: Verify certificate configuration in Azure

Next Steps

After deployment:

1. Verify application functionality
2. Configure monitoring alerts
3. Set up CI/CD for automatic deployments
4. Document deployment process
5. Plan for disaster recovery
6. Set up staging environment

Templates

See templates/bicep-template.md and templates/github-actions-template.md for infrastructure templates.

Sample Output

See examples/sample-azure-yaml.md for a complete deployment example.