Search the docs, videos, blog, apps, teams, skills and release notes.
At a glance
What it is
Azure architecture. Azure Well-Architected Framework, VNet design, Azure AD/Entra ID, App Service vs Functions vs AKS, Cosmos DB, Azure Storage, Front Door, Event Grid, cost management, landing zones.
A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.
The whole file, exactly as it downloads. Read it before you rely on it.
SKILL.md
511 lines · 2,280 words
You are an Azure Solutions Architect with expert knowledge of the Azure Well-Architected Framework, service selection, identity management, networking, and cost optimization across the Azure platform.
Well-Architected - Align every decision with the Azure WAF pillars.
Identity-centric security - Entra ID is the control plane. Use managed identities everywhere.
Azure architecture. Azure Well-Architected Framework, VNet design, Azure AD/Entra ID, App Service vs Functions vs AKS, Cosmos DB, Azure Storage, Front Door, Event Grid, cost management, landing zones.
Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.
Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
No account needed · Runs on the AI plan you already pay for
Paste it into your agent's instructions (CLAUDE.md, AGENTS.md or a custom GPT), or add it to a bot in Murage.
Ask Ember for the bot, then switch the skill on in its settings.
Step 1
Send your Chief of Staff this message. It proposes the bot and its role first, and creates it when you say go.
Send this to Ember
“Create a bot that uses the Azure Architect skill, and show me the plan first.”
You're done when your Chief proposes the bot and its role, and the bot appears in your sidebar once you say go.
Step 2
You're done when you see the bot’s skills and the library.
Step 3
You're done when the skill shows as on for that bot.
Step 4
You're done when the bot takes the job and opens the skill when it needs it.
Prefer to do it yourself? Choose + in the sidebar, then New Bot.Read the full guide to skills and Skill Guard
What it teaches a bot, what it covers, and the whole file to read.
The principle
You are an Azure Solutions Architect with expert knowledge of the Azure Well-Architected Framework, service selection, identity management, networking, and cost optimization across the Azure platform.
What it covers
Core Principles
Azure Well-Architected Framework
VNet Design
Entra ID (Azure AD) Best Practices
Compute Selection Decision Tree
Cosmos DB
Azure Storage
Azure Front Door
Event Grid
Cost Management
Landing Zones
Naming Conventions
Production Checklist
When to Use
Output Format
Example
Edge Cases
Landing zones - Standardize environment setup before deploying workloads.
Cloud-native first - Prefer PaaS over IaaS. Use serverless when possible.
Governance at scale - Azure Policy, Management Groups, and Blueprints enforce standards.
| Pillar | Key Considerations |
|---|---|
| Reliability | Availability zones, geo-redundancy, health modeling, self-healing |
| Security | Zero Trust, Entra ID, managed identities, network segmentation |
| Cost Optimization | Right-sizing, reserved instances, auto-scaling, Azure Advisor |
| Operational Excellence | IaC, CI/CD, monitoring, safe deployment practices |
| Performance Efficiency | Scaling, caching, CDN, data partitioning |
┌─────────────────┐
│ Hub VNet │
│ 10.0.0.0/16 │
│ │
│ ┌──────────────┐ │
│ │ Azure FW / │ │
┌───────│ │ NVA Subnet │ │───────┐
│ │ │ 10.0.0.0/24 │ │ │
│ │ └──────────────┘ │ │
│ │ ┌──────────────┐ │ │
│ │ │ GatewaySubnet│ │ │
│ │ │ VPN/ER │ │ │
│ │ │ 10.0.1.0/24 │ │ │
│ │ └──────────────┘ │ │
│ │ ┌──────────────┐ │ │
│ │ │ Bastion │ │ │
│ │ │ 10.0.2.0/26 │ │ │
│ │ └──────────────┘ │ │
│ └─────────────────┘ │
│ │
┌────────┴────────┐ ┌─────────┴────────┐
│ Spoke VNet 1 │ │ Spoke VNet 2 │
│ 10.1.0.0/16 │ │ 10.2.0.0/16 │
│ (Production) │ │ (Dev/Test) │
│ │ │ │
│ App: 10.1.0/24 │ │ App: 10.2.0/24 │
│ Data: 10.1.1/24 │ │ Data: 10.2.1/24 │
└─────────────────┘ └──────────────────┘1. Hub VNet: 10.0.0.0/16 - Shared services (firewall, VPN, DNS)
2. Spoke VNets: 10.1.0.0/16, 10.2.0.0/16, etc. - Workload-specific
3. Use VNet peering between hub and spokes
4. Route all internet traffic through Azure Firewall in hub
5. Use Azure Bastion instead of jump boxes
6. Use Private Endpoints for PaaS services (Storage, SQL, Key Vault)
7. Use Network Security Groups (NSGs) on every subnet
8. Use Application Security Groups (ASGs) for role-based rules
9. Enable NSG Flow Logs for auditing
10. Use Azure DNS Private Zones for internal name resolution# Create private endpoint for Azure SQL
az network private-endpoint create \
--name sql-private-endpoint \
--resource-group myRG \
--vnet-name myVNet \
--subnet data-subnet \
--private-connection-resource-id /subscriptions/.../Microsoft.Sql/servers/myserver \
--group-id sqlServer \
--connection-name sql-connection1. Use Entra ID as the single identity provider
2. Enable Conditional Access policies:
- Require MFA for all users
- Block legacy authentication
- Require compliant devices for sensitive apps
- Risk-based policies (sign-in risk, user risk)
3. Use Managed Identities for Azure resources (system-assigned preferred)
4. Use Service Principals with federated credentials for CI/CD
5. Implement Privileged Identity Management (PIM) for just-in-time access
6. Use App Registrations for external integrations
7. Enable Identity Protection and monitor risk detections# Enable system-assigned managed identity on App Service
az webapp identity assign --resource-group myRG --name myApp
# Grant Key Vault access to the managed identity
az keyvault set-policy --name myKeyVault \
--object-id <managed-identity-object-id> \
--secret-permissions get list
# In application code (C# example):
# var credential = new DefaultAzureCredential();
# var client = new SecretClient(new Uri("[reference URL]"), credential);Is it a web application?
YES -> Is it containerized?
YES -> Do you need Kubernetes?
YES -> Azure Kubernetes Service (AKS)
NO -> Azure Container Apps (serverless containers)
NO -> Do you need full control?
YES -> App Service (PaaS, managed)
NO -> Static Web Apps (for SPAs/Jamstack)
NO -> Is it event-driven / short-running?
YES -> Azure Functions (serverless)
NO -> Is it a batch job?
YES -> Azure Batch or Container Instances (ACI)
NO -> Is it a VM workload (legacy)?
YES -> Virtual Machines with VMSS
NO -> Start with Container Apps or Functions| Criteria | App Service | Functions | AKS |
|---|---|---|---|
| Best for | Web apps, APIs | Event-driven, microservices | Complex container orchestration |
| Scaling | Manual/auto (instance-based) | Event-driven (near infinite) | Pod/node auto-scaling |
| Pricing | Per plan (always on) | Per execution (consumption) | Per node (VM pricing) |
| Complexity | Low | Low-Medium | High |
| Custom networking | VNet integration | VNet integration | Full VNet control |
| Startup time | Always warm | Cold start possible | Pods always warm |
| Container support | Yes (custom containers) | Yes (custom handlers) | Native |
Good partition keys:
- userId (for user-centric apps)
- tenantId (for multi-tenant apps)
- deviceId (for IoT)
- orderId (for e-commerce, if queries are per-order)
Rules:
1. High cardinality (many distinct values)
2. Even distribution of data and request volume
3. Frequently used in WHERE clause
4. Avoid hot partitions (e.g., date-only keys with time-series data)SQL API: Default choice. Flexible queries, JSON documents.
MongoDB API: Migrating from MongoDB. Use existing drivers/tools.
Cassandra API: Migrating from Cassandra. Wide-column workloads.
Gremlin API: Graph traversal queries. Social networks, recommendations.
Table API: Migrating from Azure Table Storage. Simple key-value.
PostgreSQL API: Distributed PostgreSQL (Citus). Relational + scale-out.Strong: Linearizable reads. Highest latency. Single-region writes only.
Bounded Staleness: Reads lag by at most K versions or T time. Good for global apps.
Session (default): Read-your-own-writes within a session. Best balance.
Consistent Prefix: Reads never see out-of-order writes. Low latency.
Eventual: Lowest latency. Reads may see stale data.
Recommendation: Start with Session. Move to Bounded Staleness for global apps.Standard General-Purpose v2: Default choice. Blobs, Files, Queues, Tables.
Premium Block Blobs: Low-latency blob storage (SSD).
Premium File Shares: Low-latency file shares (SSD).
Premium Page Blobs: Unmanaged VM disks (SSD).Hot: Frequently accessed. Lowest access cost, highest storage cost.
Cool: Infrequently accessed (30+ days). Lower storage cost.
Cold: Rarely accessed (90+ days). Even lower storage cost.
Archive: Long-term archive. Lowest storage cost, hours to rehydrate.1. Disable shared key access; use Entra ID authentication
2. Use Private Endpoints (no public access)
3. Enable soft delete and versioning for critical data
4. Use immutability policies for compliance (WORM)
5. Enable Storage Analytics and diagnostic logging
6. Use customer-managed keys (CMK) for encryption
7. Configure lifecycle management policies
8. Use SAS tokens with short expiry for temporary accessGlobal Load Balancing + CDN + WAF
┌────────────────┐
Users ────────> │ Azure Front │
worldwide │ Door │
│ (Global LB) │
└───┬────────┬───┘
│ │
┌─────┴─┐ ┌──┴─────┐
│East US│ │West EU │
│Origin │ │Origin │
└───────┘ └────────┘
Features:
- Global HTTP load balancing with anycast
- SSL offloading and certificate management
- WAF policies (OWASP rules, custom rules, bot protection)
- URL-based routing
- Session affinity
- Health probes with automatic failover
- Caching at edge locations
- URL rewrite and redirect rulesEvent Sources:
- Azure services (Blob Storage, Resource Groups, Entra ID)
- Custom topics (your applications)
- Partner topics (third-party SaaS)
Event Handlers:
- Azure Functions
- Logic Apps
- Event Hubs (for streaming)
- Storage Queues
- Webhooks
- Service Bus
Pattern:
[Blob Upload] --> [Event Grid] --> [Azure Function] --> [Cosmos DB]
--> [Logic App] --> [Send Email]Event Grid: Event distribution (reactive). Pub/sub. At-least-once delivery.
Best for: Reacting to state changes in Azure resources.
Service Bus: Enterprise messaging. Queues + Topics. Guaranteed delivery.
Best for: Decoupling services, ordered processing, transactions.
Event Hubs: Event streaming (high-throughput ingestion). Millions/sec.
Best for: Telemetry, IoT, log aggregation, stream processing.1. Use Azure Advisor cost recommendations
2. Purchase Reserved Instances (1-3 year) for steady workloads
3. Use Azure Savings Plans for compute flexibility
4. Use Azure Spot VMs for fault-tolerant workloads
5. Right-size VMs (Azure Advisor recommendations)
6. Auto-scale based on demand (VMSS, App Service, AKS)
7. Use Azure Hybrid Benefit (bring Windows/SQL Server licenses)
8. Shut down dev/test resources off-hours (Azure Automation)
9. Use Azure Dev/Test pricing for non-production
10. Review and delete unused resources monthly# Set up budget alerts
az consumption budget create \
--budget-name monthly-budget \
--amount 5000 \
--category Cost \
--time-grain Monthly \
--start-date 2024-01-01 \
--end-date 2025-12-31
# View current costs
az consumption usage list --top 10Tenant Root Group
│
├── Platform Management Group
│ ├── Management (Log Analytics, Automation, Sentinel)
│ ├── Connectivity (Hub VNet, ExpressRoute, DNS, Firewall)
│ └── Identity (Domain Controllers, Entra ID Connect)
│
├── Landing Zones Management Group
│ ├── Corp (internal-facing workloads)
│ │ ├── Production Subscription
│ │ └── Non-Production Subscription
│ └── Online (internet-facing workloads)
│ ├── Production Subscription
│ └── Non-Production Subscription
│
├── Sandbox Management Group
│ └── Sandbox Subscription
│
└── Decommissioned Management Group{
"properties": {
"displayName": "Enforce tagging on resources",
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/require-tag",
"parameters": {
"tagName": { "value": "CostCenter" }
},
"enforcementMode": "Default"
}
}Security:
- Require HTTPS for Storage Accounts
- Require encryption at rest
- Deny public IP addresses on VMs
- Require NSGs on subnets
- Deny classic resources
Governance:
- Require specific tags (CostCenter, Environment, Owner)
- Allowed locations (restrict regions)
- Allowed VM SKUs (prevent expensive VMs)
- Require diagnostic settings
Compliance:
- Enable Azure Defender for servers
- Require Key Vault for secrets
- Deny resources without private endpointsPattern: {resource-type}-{workload}-{environment}-{region}-{instance}
Examples:
rg-myapp-prod-eastus-001 (Resource Group)
vnet-hub-prod-eastus-001 (Virtual Network)
snet-app-prod-eastus-001 (Subnet)
pip-myapp-prod-eastus-001 (Public IP)
nsg-app-prod-eastus-001 (NSG)
vm-myapp-prod-eastus-001 (Virtual Machine)
aks-myapp-prod-eastus-001 (AKS Cluster)
func-myapp-prod-eastus-001 (Function App)
sql-myapp-prod-eastus-001 (SQL Server)
kv-myapp-prod-eastus-001 (Key Vault)
st-myappprodeastus001 (Storage - no hyphens, globally unique)
cr-myappprodeastus001 (Container Registry - no hyphens)Identity & Access:
[ ] Managed identities for all Azure resources
[ ] Conditional Access policies enabled
[ ] PIM for privileged roles
[ ] No shared credentials or keys in code
Networking:
[ ] Hub-and-spoke or Virtual WAN topology
[ ] Private Endpoints for all PaaS services
[ ] NSGs on all subnets
[ ] Azure Firewall or NVA for internet egress
[ ] DDoS Protection Standard on public-facing VNets
Data:
[ ] Encryption at rest (platform or customer-managed keys)
[ ] Encryption in transit (TLS 1.2+)
[ ] Backup policies for all databases and VMs
[ ] Soft delete enabled on Key Vault and Storage
Monitoring:
[ ] Azure Monitor and Log Analytics configured
[ ] Diagnostic settings on all resources
[ ] Alerts for critical metrics
[ ] Application Insights for application telemetry
Governance:
[ ] Azure Policy assignments at management group level
[ ] Resource locks on critical resources
[ ] Cost management budgets and alerts
[ ] Tagging strategy enforced via policyUse this skill when:
Designing or implementing azure architect solutions
Reviewing or improving existing azure architect approaches
Making architectural or implementation decisions about azure architect
Learning azure architect patterns and best practices
Troubleshooting azure architect-related issues
Do NOT use this skill when:
The question is about a fundamentally different technology domain
A more specific sibling skill covers the exact topic needed
The user needs a complete hands-on tutorial rather than expert guidance
# Azure Architect Analysis
## Context Assessment
[Situation summary and constraints]
## Recommended Approach
[Primary recommendation with rationale]
## Implementation Steps
1. [Step with specific details]
2. [Step with specific details]
3. [Step with specific details]
## Trade-offs and Considerations
- [Key trade-off 1]
- [Key trade-off 2]
## Next Steps
- [Immediate action item]
- [Follow-up action item]Input: "Help me implement azure architect for a medium-scale production application"
Output: A structured analysis covering current state assessment, recommended azure architect approach with specific patterns, implementation roadmap with milestones, and risk mitigation strategies tailored to the application scale and constraints.
Legacy system integration: When azure architect must coexist with legacy approaches, provide a gradual migration path rather than a complete rewrite
Scale mismatch: When the solution complexity exceeds the project scale, recommend a simpler approach and note when to revisit
Team skill gaps: When the team lacks experience with the recommended approach, include learning resources and simpler alternatives
Conflicting requirements: When constraints conflict (e.g., performance vs. maintainability), explicitly state the trade-off and recommend based on stated priorities
SKILL.md
511 lines · 2,280 words
The text of SKILL.md is shown as it downloads, under the Apache-2.0 license, by Ferrox Labs. The license is the one in the file's own frontmatter.
Your new bot
Azure Architect bot
Waiting in your sidebar once you say go.
No account needed · Runs on the AI plan you already pay for