azure-reliability

Name: azure-reliability
Author: microsoft

bymicrosoft· 555 skills

Installs

167k

Stars

1.3k

Forks

219

How to install azure-reliability?

microsoft/azure-skills/azure-reliability

$npx -y skills add microsoft/azure-skills --skill azure-reliability

Installs into the current project.

›Prefer a prompt? Paste this to your agent

Use this skill

Run `npx skills use "https://github.com/microsoft/azure-skills" --skill "microsoft/azure-skills/azure-reliability"` and follow the generated skill instructions now. Read its complete output, redirecting it to a temporary file first if necessary. Resolve relative paths from the supporting-files directory it provides.

Use the whole pack

Use the skills in "https://github.com/microsoft/azure-skills" that are relevant to the current task. Run `npx skills add "https://github.com/microsoft/azure-skills"` and select the relevant skills, then follow their instructions.

Files · 1

View on GitHub

SKILL.md

1	# Azure Reliability Assessment & Configuration
2
3	## Quick Reference
4
5	\| Property \| Details \|
6	\|---\|---\|
7	\| Best for \| Reliability posture assessment, zone redundancy enablement, multi-region failover setup \|
8	\| Primary capabilities \| Reliability assessment table, Zone Redundancy Configuration, Multi-Region IaC Generation \|
9	\| Supported services \| Azure Functions, App Service (Container Apps planned for a future version) \|
10	\| MCP tools \| Azure Resource Graph queries, Azure CLI commands \|
11
12	## When to Use This Skill
13
14	Activate this skill when user wants to:
15	- "Assess my Function app's reliability"
16	- "Assess my Web app's reliability"
17	- "Check the reliability of my resource group" (App Service and Functions resources only)
18	- "Is my app zone redundant?" (App Service and Functions resources only)
19	- "Is my app service plan zone redundant?"
20	- "Make my app zone redundant" (App Service and Functions resources only)
21	- "Make my app service plan zone redundant"
22	- "Set up multi-region failover for my app" (App Service and Functions resources only)
23	- "Check my reliability posture"
24	- "Find single points of failure" (App Service and Functions resources only)
25	- "Enable high availability for my app" (App Service and Functions resources only)
26	- "Check disaster recovery readiness"
27	- "Improve my app's resilience" (App Service and Functions resources only)
28
29	> Scope note: This skill currently covers Azure Functions and Azure App Service only. If the user asks about Azure Container Apps reliability, acknowledge that support is planned but not yet available, and only proceed with the parts that apply to App Service and Functions resources in scope.
30
31	## Prerequisites
32
33	- Authentication: user is logged in to Azure via `az login`
34	- Permissions: Reader access on target subscription/resource group (for assessment)
35	- Permissions: Contributor access (for configuration changes)
36	- Azure Resource Graph extension: `az extension add --name resource-graph`
37
38	## MCP Tools
39
40	\| Tool \| Purpose \|
41	\|------\|---------\|
42	\| `mcp_azure_mcp_extension_cli_generate` \| Generate `az` CLI commands for resource queries and configuration \|
43	\| `mcp_azure_mcp_subscription_list` \| List available subscriptions \|
44	\| `mcp_azure_mcp_group_list` \| List resource groups \|
45
46	Primary query method: Azure Resource Graph via `az graph query` (requires `az extension add --name resource-graph`).
47
48	## Assessment Workflow
49
50	### Phase 1: Discover Resources
51
52	1. Identify scope — Ask user for resource group, subscription, or app name
53	2. Query Azure Resource Graph to discover all resources in scope
54	3. Classify resources by service type (Functions, Storage, etc.). If non-Functions compute (App Service sites that aren't Function Apps, Container Apps) is found, note it but do not deep-dive — those services are planned for a future version of this skill.
55
56	Important: Always scope queries to the user's specified resource group or subscription. Add these filters to every Resource Graph query:
57	- Resource group: `\| where resourceGroup =~ '<rg-name>'`
58	- Subscription: Use `--subscriptions <sub-id>` flag on `az graph query`
59	- App name: `\| where name =~ '<app-name>'`
60
61	### Phase 2: Assess Reliability
62
63	Two-step assessment: platform-level discovery first, then per-service deep dive.
64
65	Step 1 — Platform discovery (find what's there). Use these to enumerate resources in scope and detect cross-cutting reliability gaps:
66
67	\| Platform check \| Reference \|
68	\|---\|---\|
69	\| Zone redundancy — discovery \| [references/zone-redundancy-checks.md](references/zone-redundancy-checks.md) \|
70	\| Storage redundancy (cross-service) \| [references/storage-redundancy-checks.md](references/storage-redundancy-checks.md) \|
71	\| Multi-region & global load balancers \| [references/multi-region-checks.md](references/multi-region-checks.md) \|
72	\| Front Door / Traffic Manager / App Insights probes \| [references/health-probe-checks.md](references/health-probe-checks.md) \|
73
74	Step 2 — Per-service deep dive. For each compute resource discovered in Step 1, load the matching service reference. The service reference is the single source of truth for that service's plan/SKU rules, assessment queries, CLI commands, IaC patches (Bicep + Terraform + AVM), and reporting hints.
75
76	This skill version ships only the Azure Functions and App Service per-service references. Other compute services are listed below explicitly so the dispatch logic is unambiguous: if a resource matches an unsupported row, do not attempt to load a reference, fabricate CLI commands, or generate IaC patches for it.
77
78	\| Service detected \| Reference \|
79	\|---\|---\|
80	\| Azure Functions (`microsoft.web/serverfarms` with `kind contains 'functionapp'`) \| [references/services/functions/reliability.md](references/services/functions/reliability.md) \|
81	\| Azure App Service (non-Functions sites: `microsoft.web/sites` without `kind contains 'functionapp'`, `microsoft.web/serverfarms` without `kind contains 'functionapp'`) \| [references/services/app-service/reliability.md](references/services/app-service/reliability.md) \|
82	\| Azure Container Apps (`microsoft.app/containerapps`, `microsoft.app/managedenvironments`) \| ⚪ Not yet shipped — planned for a future version \|
83
84	> Handling unsupported services: If a resource matches an unsupported row above, surface it in the discovery summary, mark it as `⚪ not assessed (planned)` in the Phase 3 table, and skip the per-service remediation steps for it. Do not attempt to fabricate CLI commands or IaC patches for those services.
85
86	### Phase 3: Generate Reliability Checklist
87
88	Present findings as a feature-pivoted table: one row per reliability feature (Zone redundancy on compute, Zone-redundant storage, Health probes, Multi-region failover), with a single status indicator and the specific resources that are relevant to that feature. This avoids the noise of one-row-per-resource with mostly `n/a` cells. Do not assign numeric scores or grades.
89
90	```
91	🔍 Reliability Assessment — {scope}
92	─────────────────────────────────────────────────────────────────────────────────────────────
93	Reliability Feature Status Resources
94	─────────────────────────────────────────────────────────────────────────────────────────────
95	Zone redundancy — compute 🔴 OFF • plan-web-ii5trxva2ark4 (P1v3)
96	• plan-ii5trxva2ark4 (FC1)
97
98	Zone-redundant storage 🔴 GRS • stii5trxva2ark4 (defaulted; no SKU set in IaC)
99
100	Health probes 🔴 OFF • func-api-ii5trxva2ark4 — needs code change (FC1)
101	• app-web-ii5trxva2ark4 — no health check path
102
103	Multi-region failover 🔴 OFF • Single region (eastus) only — Front Door not configured
104	─────────────────────────────────────────────────────────────────────────────────────────────
105
106	Want me to fix the 🔴 items? I'll do the quick wins first (App
107	plan zone redundancy + health checks on supported plans), then ask before
108	storage migration and multi-region setup. (yes/no)
109	```
110
111	Rules for the table:
112
113	- Four feature rows, in this order: Zone redundancy — compute · Zone-redundant storage · Health probes · Multi-region failover. Omit a row entirely only if no resource in scope could ever apply to it.
114	- Status column is one symbol + one short word, no other characters:
115	- `🟢 ON` — feature is fully enabled across all relevant resources in scope
116	- `🟡 PARTIAL` — some resources have it, some don't (or partial config like liveness-only)
117	- `🔴 OFF` — feature is missing on all relevant resources
118	- For storage, replace `OFF` with the current SKU when relevant (`🔴 LRS`, `🔴 GRS`, `🟢 ZRS`, `🟢 GZRS`). When no SKU is set in IaC, label as `🔴 GRS` (ARM/AVM default) and note that in the resource line.
119	- Resources column lists only what's relevant to that feature, one bullet per resource:
120	- For "needs fixing" resources, include a short inline reason (`(FC1)`, `(defaulted; no SKU set)`, `liveness only`, `needs code change (FC1)`).
121	- For resources that are already ON for that feature, mention them on the same row with `— already ON` so the user sees credit for what's right.
122	- Do not include `n/a`, `—`, or empty cells. If a feature doesn't apply to any resource in scope, drop the row.
123	- Do not include numeric scores, grades, or point totals.
124	- End the assessment with a single yes/no question that kicks off the staged remediation flow. Do not enumerate the per-resource fix list here — the user will see it after they say yes (Configuration Workflow Step 1).
125
126	> UX Note: If the assessment finds the app already has all core reliability features (zone redundancy, ZRS/GZRS storage, health probes), skip the fix-it question and jump straight to Configuration Workflow [Step 3](#step-3-both-paths-multi-region-followup--ask-and-wait) (Multi-region follow-up). Do NOT start any multi-region work without explicit consent.
127
128	## Configuration Workflow
129
130	When user wants to fix findings from the assessment:
131
132	> ⛔ ALWAYS confirm with user before executing changes. Show what will change, any cost implications, and any destructive actions (e.g., environment recreation).
133
134	### Step 1: Present Fix Plan + Choose Path
135
136	After assessment, if user says "fix it" / "improve my reliability" / "enable zone redundancy":
137
138	1. List each fixable finding with the specific action
139	2. Flag any cost implications or breaking changes
140	3. Ask user which path they want:
141
142	```
143	I'll start with the quick wins (no downtime, fast):
144
145	1. ✏️ Enable zone redundancy on plan-ii5trxva2ark4 (Flex Consumption — no cost change)
146	2. ✏️ Set health check path to /api/health on func-api-ii5trxva2ark4
147
148	Then, separately, I'll ask if you want to upgrade storage:
149
150	3. 🕒 Upgrade stii5trxva2ark4 from LRS → ZRS (small cost increase, migration takes hours)
151	— Required for full zone redundancy, but I'll confirm with you before starting.
152
153	How would you like to apply these changes?
154
155	A) Fix now — Run az CLI commands against your live resources (immediate, one-time)
156	B) Patch my IaC — Update your Bicep/Terraform files so changes persist across deploys
157
158	(If you use azd or Terraform, option B is recommended so `azd up` won't overwrite changes.)
159	```
160
161	### Path A: Fix Now (CLI)
162
163	Run fixes against live resources using `az` CLI commands. Quick wins first, then ask before the slow storage migration.
164
165	The exact CLI commands per service live in the per-service references — pick the one(s) matching the resources discovered in Phase 2:
166
167	\| Fix \| Reference \|
168	\|---\|---\|
169	\| Enable zone redundancy / configure health probes (Functions) \| [references/services/functions/reliability.md](references/services/functions/reliability.md) \|
170	\| Enable zone redundancy / configure health probes (App Service) \| [references/services/app-service/reliability.md](references/services/app-service/reliability.md) \|
171	\| Upgrade storage replication (cross-service) \| [references/configure-storage.md](references/configure-storage.md) \|
172	\| Set up multi-region (cross-service) \| [references/configure-multi-region.md](references/configure-multi-region.md) \|
173	\| Platform overview / verification \| [references/configure-zone-redundancy.md](references/configure-zone-redundancy.md), [references/configure-health-probes.md](references/configure-health-probes.md) \|
174
175	Execution order — always quick wins first:
176
177	1. Zone redundancy on compute (fast, in-place property update on the App's plan).
178	2. Health probes (Premium / Dedicated only — in-place; for FC1 / Consumption, follow the consent gate in [configure-health-probes.md](references/configure-health-probes.md)).
179	3. Verify the compute changes succeeded before doing anything else.
180	4. ⛔ STOP — Ask about storage upgrade. Compute is now zone-redundant, but storage may still be LRS or GRS. Ask the user explicitly:
181
182	```
183	✅ Compute is now zone-redundant.
184
185	To be fully zone-redundant, your storage account also needs to be upgraded:
186	• stii5trxva2ark4: currently `Standard_LRS` → needs `Standard_ZRS`
187
188	⚠️ This is a live storage redundancy conversion:
189	• Takes hours to days depending on data volume
190	• Small ongoing cost increase (~$0.01/GB/month more)
191	• Only supported for Standard general-purpose v2 accounts
192
193	Do you want me to start the storage migration now? (yes / no / later)
194	```
195
196	- yes → run `az storage account update --sku Standard_ZRS` (or `migration start` if needed); poll `az storage account show --query sku.name` until it reports `Standard_ZRS`.
197	- no / later → leave storage as-is; note in the re-assessment that ZR storage remains a gap.
198
199	5. Multi-region — do NOT auto-run. Handled in Step 3 below as an explicit follow-up after re-assessment.
200
201	> ⚠️ Warning: If the user uses `azd up` or `terraform apply` later, CLI-only changes may be overwritten by the IaC definitions. Recommend also patching IaC after CLI fixes.
202
203	### Path B: Patch IaC
204
205	Update the user's Bicep or Terraform files so reliability settings are persistent.
206
207	Step 1: Detect IaC type
208	1. Look for `infra/` folder in project root
209	2. If not found, check project root for `.bicep` or `.tf` files
210	3. If still not found, ask user: "Where are your IaC files located?"
211	4. Check for `*.bicep` files → use Bicep patching
212	5. Check for `*.tf` files → use Terraform patching
213	6. If both exist, ask user which to patch
214	7. If no IaC exists, fall back to Path A (CLI) and inform user
215
216	Step 2: Classify each fix by risk level
217
218	\| Fix \| Risk Level \| What Happens \|
219	\|-----\|-----------\|--------------\|
220	\| Zone redundancy (App plan) \| 🟢 Safe patch \| In-place property update on next deploy \|
221	\| Storage LRS → ZRS \| 🟡 Pre-migration required \| Live storage migration must complete before the IaC SKU change can deploy. Never bundle with safe patches — use the two-deploy flow in Steps 3–5. \|
222	\| Health check path (Basic/Standard/Premium / Dedicated) \| 🟢 Safe patch \| In-place update, but causes app restart \|
223	\| Health check path (FC1 / Consumption) \| ⚪ Code-only — ask first \| `healthCheckPath` is unsupported. Adding a health endpoint requires adding an HTTP-triggered `/api/health` function to app code. Always ask the user for explicit consent before touching source code. Do not patch IaC. \|
224
225	Step 3: Apply patches in two deploys (quick wins first)
226
227	The IaC patching framework (detection, AVM-module guidance, deploy-order rule, storage SKU patch) lives in:
228
229	\| IaC Type \| Framework reference \|
230	\|---\|---\|
231	\| Bicep \| [references/iac-patching-bicep.md](references/iac-patching-bicep.md) \|
232	\| Terraform \| [references/iac-patching-terraform.md](references/iac-patching-terraform.md) \|
233
234	The actual per-service compute patches (Function App plan ZR, App Service Plan ZR, etc.) live in the per-service references — load the matching service file from Phase 2 for the exact Bicep / Terraform / AVM snippets. Only Azure Functions and App Service have per-service references in this skill version; Container Apps is out of scope.
235
236	Deploy 1 — Quick wins only. Patch the 🟢 Safe items (zone redundancy on the App Service/Function App plan, health probes on Basic/Standard/Premium / Dedicated). Do NOT include the storage SKU patch in this deploy.
237
238	After patching, the skill runs the deploy itself (do not stop and tell the user to run it). Detect the deployment tool and confirm once before executing:
239
240	```
241	📦 Patches applied to your IaC. Ready to deploy:
242	Tool detected: azd (found azure.yaml)
243	Command: azd up
244
245	Proceed with deployment? (yes / no)
246	```
247
248	On yes, run the appropriate command, stream output back to the user, and continue to the next step on success:
249	- AZD project (has `azure.yaml`): `azd up`
250	- Bicep-only: `az deployment group create --resource-group <rg> --template-file infra/main.bicep --parameters @infra/main.parameters.json`
251	- Terraform: `terraform plan -out tfplan` → (show plan summary) → `terraform apply tfplan`
252
253	On no, stop and report the patched files; do not proceed to Step 4 / Re-Assess.
254
255	If deployment fails, surface the error and stop — do not continue to the storage step.
256
257	⛔ STOP — Ask about storage upgrade before Deploy 2. After Deploy 1 succeeds, ask the user explicitly:
258
259	```
260	✅ Quick-win patches deployed. Compute is now zone-redundant.
261
262	To be fully zone-redundant, your storage account also needs to be upgraded:
263	• stii5trxva2ark4: currently `Standard_LRS` → needs `Standard_ZRS`
264
265	⚠️ This is a two-part change:
266	1. Live storage migration (`az storage account migration start`) — takes hours to days
267	2. A second deploy to update your IaC's storage SKU to match
268
269	Do you want me to start the storage migration now? (yes / no / later)
270	```
271
272	- yes → the skill runs the migration command itself, polls until complete, then patches the storage SKU in IaC and runs Deploy 2 (now a no-op confirmation). The user does not need to run anything manually.
273	- no / later → leave the storage SKU patch unapplied. Note in the re-assessment that ZR storage remains a gap; suggest revisiting later.
274
275	Step 4: Storage migration (only if user said yes in Step 3)
276
277	The skill runs these commands itself — do not ask the user to run them. Show progress as you go:
278
279	```
280	🔄 Starting storage migration (this can take up to 72 hours)...
281
282	az storage account migration start --name stii5trxva2ark4 \
283	--resource-group rg-example --sku Standard_ZRS --no-wait
284
285	Polling: az storage account show --name stii5trxva2ark4 --query sku.name
286	...
287	✅ Migration complete: sku.name = Standard_ZRS
288	```
289
290	For very long migrations, you may surface a checkpoint to the user ("this is still running, check back later") rather than blocking the entire conversation.
291
292	Step 5: Deploy 2 — storage SKU patch
293
294	After the migration completes, the skill patches the storage SKU in IaC and runs the same deploy command as Step 3 (e.g. `azd up`). This deploy is a no-op confirmation that the IaC matches the live state. Confirm once with the user before executing, then run it directly.
295
296	### Step 2 (both paths): Re-Assess
297
298	After changes are applied (CLI) or deployed (IaC), automatically re-run the assessment and show the same feature-pivoted table as Phase 3, with each feature row's status updated to reflect the new state. Briefly call out what changed since the previous run.
299
300	```
301	🔄 Reliability Re-Assessment — rg-eventhubs-python-jan13 (eastus)
302	───────────────────────────────────────────────────────────────────────────────────────
303	Reliability Feature Status Resources
304	───────────────────────────────────────────────────────────────────────────────────────
305	Zone redundancy — compute 🟢 ON • plan-ii5trxva2ark4 (FC1) — now ON
306	• plan-web-ii5trxva2ark4 (P1v3) — now ON
307
308	Zone-redundant storage 🟢 ZRS • stii5trxva2ark4 — GRS → ZRS
309
310	Health probes 🟡 PARTIAL • func-api-ii5trxva2ark4 — still off (FC1, code change declined)
311	• app-web-ii5trxva2ark4 — now ON
312
313	Multi-region failover 🔴 OFF • Single region (eastus) only
314	───────────────────────────────────────────────────────────────────────────────────────
315
316	What changed: Function App and App Service plan

6 picks

Type

Run `npx skills use "https://github.com/microsoft/azure-skills" --skill "microsoft/azure-skills/azure-reliability"` and follow the generated skill instructions now. Read its complete output, redirecting it to a temporary file first if necessary. Resolve relative paths from the supporting-files directory it provides.

Use the skills in "https://github.com/microsoft/azure-skills" that are relevant to the current task. Run `npx skills add "https://github.com/microsoft/azure-skills"` and select the relevant skills, then follow their instructions.

azure-reliability

How to install azure-reliability?

Related

azure-reliability

How to install azure-reliability?

Related