azure-admin

What this skill does

# Azure Administration Skill

## Overview

This skill provides comprehensive Azure administration capabilities, covering identity management, resource orchestration, CLI tooling, and DevOps automation. It integrates Microsoft's Azure ecosystem including Azure CLI (az), Azure Developer CLI (azd), Entra ID (formerly Azure AD), and Azure MCP (Model Context Protocol) for AI-powered workflows.

**Core Capabilities:**

- **Identity & Access Management**: User provisioning, RBAC, service principals, managed identities
- **Resource Management**: Subscriptions, resource groups, ARM templates, Bicep deployments
- **CLI & Tooling**: az CLI patterns, azd workflows, PowerShell integration
- **MCP Integration**: Azure MCP server for AI-driven Azure operations
- **DevOps Automation**: CI/CD pipelines, infrastructure as code, deployment strategies
- **Cost & Governance**: Budget management, policy enforcement, compliance

**Target Audience:**

- Cloud administrators managing Azure environments
- DevOps engineers automating Azure deployments
- Security teams implementing RBAC and compliance
- Developers using Azure services and MCP integration

**Philosophy Alignment:**
This skill follows amplihack principles: ruthless simplicity, working code only, clear module boundaries, and systematic workflows.

## Quick Reference Matrix

### Common Task Mapping

| Task                     | Primary Tool   | Secondary Tools     | Skill Doc Reference                         |
| ------------------------ | -------------- | ------------------- | ------------------------------------------- |
| Create user account      | az cli         | Entra ID Portal     | @docs/user-management.md                    |
| Assign RBAC role         | az cli         | Azure Portal        | @docs/role-assignments.md                   |
| Deploy resource group    | az cli, Bicep  | ARM templates       | @docs/resource-management.md                |
| Setup service principal  | az cli         | Portal              | @docs/user-management.md#service-principals |
| Enable managed identity  | az cli         | Portal              | @docs/user-management.md#managed-identities |
| Create resource          | az cli, azd    | Portal, Terraform   | @docs/resource-management.md                |
| Query resources          | az cli --query | JMESPath            | @docs/cli-patterns.md#querying              |
| Bulk user operations     | az cli + bash  | PowerShell          | @examples/bulk-user-onboarding.md           |
| Environment provisioning | azd            | az cli, Bicep       | @examples/environment-setup.md              |
| Audit role assignments   | az cli         | Azure Policy        | @examples/role-audit.md                     |
| Cost analysis            | az cli, Portal | Cost Management API | @docs/cost-optimization.md                  |
| MCP integration          | Azure MCP      | az cli              | @docs/mcp-integration.md                    |
| CI/CD pipeline           | Azure DevOps   | GitHub Actions      | @docs/devops-automation.md                  |

### Command Pattern Reference

```bash
# Identity operations
az ad user create --display-name "Jane Doe" --user-principal-name [email protected]
az ad sp create-for-rbac --name myServicePrincipal --role Contributor

# Resource operations
az group create --name myResourceGroup --location eastus
az deployment group create --resource-group myRG --template-file main.bicep

# RBAC operations
az role assignment create --assignee [email protected] --role Reader --scope /subscriptions/xxx
az role assignment list --assignee [email protected] --all

# Query patterns
az vm list --query "[?powerState=='VM running'].{Name:name, RG:resourceGroup}"
az resource list --resource-type "Microsoft.Compute/virtualMachines" --query "[].{name:name, location:location}"

# Cost management
az consumption usage list --start-date 2025-01-01 --end-date 2025-01-31
az costmanagement query --type ActualCost --dataset-aggregation name=Cost,function=Sum

# Azure Developer CLI (azd)
azd init --template todo-nodejs-mongo
azd up  # provision + deploy
azd env list
azd down
```

## Topic 1: Identity & Access Management

Manage Azure identities through Entra ID: users, groups, service principals, managed identities, and RBAC.

**Common operations:** User creation, group management, role assignment, service principal setup, managed identity configuration, RBAC auditing

**See:** @docs/user-management.md and @docs/role-assignments.md for complete guides

**Quick example:**

```bash
# Create user
az ad user create --display-name "Jane Doe" --user-principal-name [email protected] --password "SecureP@ssw0rd!"

# Create group and add member
az ad group create --display-name "Engineering Team" --mail-nickname "engineering"
az ad group member add --group "Engineering Team" --member-id $(az ad user show --id [email protected] --query id -o tsv)

# Create service principal
az ad sp create-for-rbac --name "myAppSP" --role Contributor --scopes /subscriptions/{sub-id}

# Enable managed identity
az vm identity assign --name myVM --resource-group myRG

# Assign RBAC role
az role assignment create --assignee [email protected] --role Reader --scope /subscriptions/{sub-id}
```

**Key concepts:**

- **Users & Groups**: Entra ID accounts, group-based permissions
- **Service Principals**: App authentication, certificate-based auth preferred
- **Managed Identities**: Azure-managed credentials, no secret rotation needed
- **RBAC**: Owner, Contributor, Reader, custom roles at multiple scopes
- **Security**: MFA enforcement, least privilege, regular access reviews

**Best practices:**

- Use groups for role assignments (not individual users)
- Prefer managed identities over service principals
- Rotate service principal credentials every 90 days
- Store credentials in Azure Key Vault
- Enable MFA for all administrative accounts

## Topic 2: Resource Management

Organize and deploy Azure resources through subscriptions, resource groups, and infrastructure as code.

**Common operations:** Resource group creation, tagging strategy, ARM/Bicep deployment, resource locks, multi-region management

**See:** @docs/resource-management.md for advanced patterns

**Quick example:**

```bash
# Create resource group with tags
az group create --name myResourceGroup --location eastus
az group update --name myResourceGroup --tags Environment=Production CostCenter=IT

# Deploy Bicep template with validation
az deployment group validate --resource-group myRG --template-file main.bicep
az deployment group create --resource-group myRG --template-file main.bicep --parameters vmName=myVM

# Lock resource group to prevent deletion
az lock create --name DontDelete --resource-group myResourceGroup --lock-type CanNotDelete

# Query resources by tag
az resource list --tag Environment=Production --query "[].{Name:name, Type:type}"
```

**Resource hierarchy:**

```
Management Groups (optional)
└── Subscriptions (billing boundary)
    └── Resource Groups (logical container)
        └── Resources (VMs, databases, storage, etc.)
```

**Bicep basics:** Declarative IaC with cleaner syntax than ARM templates, transpiles to ARM JSON, modular and reusable.

**Tagging strategy:** Environment, CostCenter, Owner, Application, Criticality, BackupPolicy

## Topic 3: CLI & Tooling

Master Azure CLI (az), Azure Developer CLI (azd), and query patterns for automation.

**Common operations:** Authentication, JMESPath queries, batch operations, azd workflows, PowerShell integration

**See:** @docs/cli-patterns.md for advanced scripting

**Quick example:**

```bash
# Azure CLI authentication
az login
az account set --subscription "My Subscription Name"
az account show

# JMESPath query patterns
az vm list --query "[?powerState=='VM running'].{Name:name, RG:resourceGroup}"
az resource list --query "[?contains(name, 'prod')]"
az vm list --query "sort_by([],&name)[0:5]"  # Top 5 by name

# Azure Developer CLI (azd)
azd init --template todo-nodejs-mongo
azd up  # prov