---
name: azure-operations
description: >-
  Use when running .NET services on Azure beyond AI Foundry. Passwordless SQL
  end to end, provision-versus-deploy staleness, the permission matrix
  document, CI credential preflight and soft-delete recovery, storage without
  keys, model deployments and capacity, and Container Apps manifest idioms and
  job escape hatches. The unifying rule: managed identity plus RBAC
  everywhere, and a key or password anywhere in the chain is a finding.
---

# Azure operations: identity-first infrastructure and the pipeline that runs it

**Read [`references/AZURE-OPERATIONS.md`](references/AZURE-OPERATIONS.md) before applying any of this.**
That file is the standard; everything below it is a summary to help you decide
whether this skill applies and to check your work afterwards.

## What this standard covers

- Provision vs deploy
- Passwordless SQL end to end
- The permission matrix document
- CI hardening
- Storage without keys
- Model deployments and capacity
- Container Apps manifest idioms
- Container Apps jobs and escape hatches

## Failure modes

| Symptom | Cause |
|---|---|
| Permissions fix merged, live env still 403s | Fix shipped via deploy; role assignments only apply on provision |
| First blob/agent call fails right after provisioning | RBAC propagation lag; poll the data plane before first use |
| App deployed, DB login fails as `<identity-name>` | Contained DB user never created — the deploymentScripts half is missing |
| Two services, one DB principal | Shared managed identity; one identity per service |
| `deploymentScripts` fails inside a VNet | No delegated subnet + staging storage for script execution |
| Wrong-subscription deploy with no clear error | No credential preflight; assert `az account show` post-login |
| Re-provision after destroy fails on name collision | Soft-deleted account not detected/restored |
| Parallel model deployments conflict | One deployment operation at a time; chain `dependsOn` |
| Empty-secret deployment failure | Optional secret rendered as an empty block instead of conditionally omitted |
| BFF proxy 403s in one environment only | IP allowlist applied to a backend API; move it to the frontend |
| Job "updated" but behaves old | `job update` silently dropped the flags; delete + recreate |
| One-line agent change requires a full pipeline run | No targeted-re-run escape hatch with `azd env refresh` |

## Checklist

- [ ] All auth is managed identity + RBAC; no keys, no SQL passwords, `allowSharedKeyAccess: false`
- [ ] Entra-only SQL with a UAMI admin; contained users via deploymentScripts with retry; connection-string surgery centralized in the kernel
- [ ] One identity per service (database principals included)
- [ ] Permission matrix committed with the added-by-infra column; error-string decoder table alongside
- [ ] CI: credential preflight + post-login account assertion; soft-delete detect/restore; RBAC data-plane polling before first use
- [ ] Model deployments chained; capacity split planned; model tiers parameterized
- [ ] Manifests: env-conditional minReplicas, conditional secret blocks, fail-closed allowlists on frontends only, conditional domains/SNI
- [ ] Jobs recreated not updated; targeted re-run workflows exist; destroy typed-confirmed, per-env gated, purging
- [ ] Provision-vs-deploy distinction written into the deployment checklist ("why this step matters" column)

---

Generated from [`docs/guides/AZURE-OPERATIONS.md`](https://github.com/konradcinkusz/architecture-standards/blob/main/docs/guides/AZURE-OPERATIONS.md) by `scripts/build-marketplace.mjs`. Do not edit this file: change the source document, or its entry in `catalog/marketplace.catalog.json`, and re-run the generator.