# Jonathan Vella Azure Agentic Infraops Azure Defaults > Azure Defaults Skill - Skill: `tomevault-io/jonathan-vella-azure-agentic-infraops-azure-defaults` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/jonathan-vella-azure-agentic-infraops-azure-defaults` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/jonathan-vella-azure-agentic-infraops-azure-defaults/raw - Safety review: pending (external: skill-scanner PASS, skillspector CAUTION) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/jonathan-vella-azure-agentic-infraops-azure-defaults --- # Azure Defaults Skill Single source of truth for Azure infrastructure configuration. Deep-dive content lives in `references/` — load on demand. --- ## Quick Reference (Load First) ### Default Regions | Service | Default Region | Reason | | ------------------- | -------------------- | ------------------------------ | | **All resources** | `swedencentral` | EU GDPR-compliant | | **Static Web Apps** | `westeurope` | Not available in swedencentral | | **Failover** | `germanywestcentral` | EU paired alternative | ### Required Tags (Azure Policy Enforced) **These 4 tags are the MINIMUM baseline.** Always defer to `04-governance-constraints.md` for the actual required tag list. | Tag | Required | Example Values | | ------------- | -------- | ------------------------ | | `Environment` | Yes | `dev`, `staging`, `prod` | | `ManagedBy` | Yes | `Bicep` or `Terraform` | | `Project` | Yes | Project identifier | | `Owner` | Yes | Team or individual name | > **Tag Casing Rule**: Use PascalCase exactly as shown above (`Environment`, > `ManagedBy`, `Project`, `Owner`). Never emit both `owner` and `Owner` or > `environment` and `Environment` in the same template — Azure Policy treats > case-variant tag keys as ambiguous evaluation paths > (`AmbiguousPolicyEvaluationPaths` error). ### Unique Suffix Pattern Generate ONCE, pass to ALL modules: ```bicep var uniqueSuffix = uniqueString(resourceGroup().id) ``` ### Security Baseline (5-Line Summary) | Setting | Value | Applies To | | --------------------- | ---------------- | ---------------- | | HTTPS-only | `true` | Storage, all | | TLS minimum | `'TLS1_2'` | All services | | Public blob access | `false` | Storage | | Public network (prod) | `'Disabled'` | Data services | | Authentication | Managed Identity | Prefer over keys | For AVM pitfalls and deprecation patterns, read `references/security-baseline-full.md`. ### Deprecated Services (Do NOT Recommend for Greenfield) | Deprecated Service | Replacement | Since | Notes | | ---------------------- | -------------------------------- | ---------- | ----------------------------- | | Azure AD B2C | Microsoft Entra External ID | May 2025 | Not available for new tenants | | Redis Enterprise E50 | Azure Managed Redis (Enterprise) | March 2027 | Plan migration before EOL | | CDN WAF (classic) | Front Door Standard/Premium WAF | 2025 | CDN WAF creation blocked | | App Gateway v1 | App Gateway v2 | April 2026 | Classic SKU retiring | | CDN Standard Microsoft | Front Door Standard | 2027 | Migration required | **Rule**: Never recommend deprecated services for greenfield projects. Before recommending any service with a multi-year RI commitment, verify the service retirement timeline extends beyond the commitment period. Check Microsoft Learn deprecation announcements. --- ## CAF Naming Conventions | Resource | Abbr | Pattern | Max | | ---------------- | ------- | --------------------------- | --- | | Resource Group | `rg` | `rg-{project}-{env}` | 90 | | Virtual Network | `vnet` | `vnet-{project}-{env}` | 64 | | Subnet | `snet` | `snet-{purpose}-{env}` | 80 | | NSG | `nsg` | `nsg-{purpose}-{env}` | 80 | | Key Vault | `kv` | `kv-{short}-{env}-{suffix}` | 24 | | Storage Account | `st` | `st{short}{env}{suffix}` | 24 | | App Service Plan | `asp` | `asp-{project}-{env}` | 40 | | App Service | `app` | `app-{project}-{env}` | 60 | | SQL Server | `sql` | `sql-{project}-{env}` | 63 | | SQL Database | `sqldb` | `sqldb-{project}-{env}` | 128 | | Static Web App | `stapp` | `stapp-{project}-{env}` | 40 | | Log Analytics | `log` | `log-{project}-{env}` | 63 | | App Insights | `appi` | `appi-{project}-{env}` | 255 | For extended abbreviations and length-constraint examples, read `references/naming-full-examples.md`. --- ## Azure Verified Modules (AVM) 1. **ALWAYS** check AVM availability first 2. Use AVM defaults for SKUs when available 3. **NEVER** write raw Bicep/TF for a resource that has an AVM module For the full Bicep + Terraform AVM module registry, read `references/avm-modules.md`. --- ## Template-First Output Rules | Rule | Requirement | | ------------ | ---------------------------------------------- | | Exact text | Use template H2 text verbatim | | Exact order | Required H2s in template-defined order | | Anchor rule | Extra sections only AFTER last required H2 | | No omissions | All template H2s must appear in output | | Attribution | `> Generated by {agent} agent \| {YYYY-MM-DD}` | --- ## Validation Checklist - [ ] Output saved to `agent-output/{project}/` - [ ] All required H2 headings present and correctly ordered - [ ] All 4 required tags included in resource definitions - [ ] Unique suffix used for globally unique names - [ ] Security baseline settings applied - [ ] Region defaults correct --- ## Reference Index Load these on demand — do NOT read all at once: | Reference | When to Load | | ------------------------------------------- | ------------------------------------------------------- | | `references/naming-full-examples.md` | Generating names for length-constrained resources | | `references/avm-modules.md` | Looking up AVM module paths or versions | | `references/security-baseline-full.md` | Debugging AVM parameter issues or checking deprecations | | `references/pricing-guidance.md` | Running cost estimates with Azure Pricing MCP | | `references/service-matrices.md` | Mapping user requirements to Azure service tiers | | `references/waf-criteria.md` | Scoring WAF pillar assessments | | `references/governance-discovery.md` | Discovering Azure Policy constraints | | `references/policy-effect-decision-tree.md` | Translating policy effects into plan/code actions | | `references/adversarial-review-protocol.md` | Running challenger-review-subagent passes | | `references/azure-cli-auth-validation.md` | Validating Azure CLI auth before deployments | | `references/terraform-conventions.md` | Generating Terraform (HCL) code | | `references/research-workflow.md` | Following the standard 4-step research pattern | --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/jonathan-vella) — claim your Tome and manage your conversions.