Azure Specialist

Azure Specialist

Structured investigation for Azure workloads. Five phases: gather context, diagnose, design, recommend, verify.

Arguments

• $0 — subscription context, service scope, or problem description. Required.

Phase 1: Context Gathering

1. Identify the tenant, subscription(s), resource group(s), and services in scope.
2. Glob for IaC in the working directory: **/*.bicep, **/azuredeploy.json, **/main.tf, **/*.parameters.json.
3. If Azure CLI access is available:

   az account show
   az group list --query "[].name"
   

4. Note which resource providers are registered:

   az provider list --query "[?registrationState=='Registered'].namespace" -o tsv
   

Phase 2: Diagnosis

Compute / containers:

az vm list --query "[].{name:name,rg:resourceGroup,state:powerState}" -o table
az aks list --query "[].{name:name,rg:resourceGroup,version:kubernetesVersion}" -o table
az webapp list --query "[].{name:name,rg:resourceGroup,state:state}" -o table

Identity / RBAC:

az role assignment list --assignee <principal-id> --all
az ad app list --display-name <name>
az identity list --resource-group <rg>

Networking:

az network vnet list
az network nsg rule list --nsg-name <nsg> --resource-group <rg>
az network private-endpoint list

Serverless / events:

az functionapp list
az servicebus namespace list
az eventgrid topic list

Cost / quotas:

az consumption usage list --start-date <> --end-date <>
az vm list-usage --location <region>

Phase 3: Design / Root-Cause Analysis

Map symptoms to causes:

Cite resource ID or file:line for every finding.

Phase 4: Recommendations

Output findings in priority order:

[CRITICAL] <title>
Resource: <resource ID or file:line>
Issue: <one sentence>
Evidence: <CLI output or code snippet>
Fix: <specific change, with Bicep/ARM/Terraform diff>
Trade-off: <alternative and its downside, if meaningful>

• Order: CRITICAL → WARNING → INFO.
• For IaC fixes, show the exact Bicep/ARM/Terraform diff.
• Reference relevant docs in references/ where applicable.

Phase 5: Verification

After fixes are applied:

1. Re-run the diagnostic command that surfaced the issue.
2. For RBAC/Managed Identity changes: verify with az role assignment list and a live workload token request.
3. For network changes: az network watcher test-connectivity or NSG flow-log review.
4. For Bicep/ARM deployments: run what-if before and after to confirm intended drift only.
5. Check Azure Monitor metrics and Service Health — no new alerts should be firing.

Reference Docs

Consult references/ for decision guides: