Performs comprehensive preflight validation of Bicep deployments to Azure, including template syntax validation, what-if analysis, and permission checks. Use this skill before any deployment to Azure to preview changes, identify potential issues, and ensure the deployment will succeed. Activate when users mention deploying to Azure, validating Bicep files, checking deployment permissions, previewing infrastructure changes, running what-if, or preparing for azd provision.
This skill validates Bicep deployments before execution, supporting both Azure CLI (az) and Azure Developer CLI (azd) workflows.
azd up, azd provision, or az deployment commandsFollow these steps in order. Continue to the next step even if a previous step fails—capture all issues in the final report.
Determine the deployment workflow by checking for project indicators:
Check for azd project: Look for azure.yaml in the project root
Locate Bicep files: Find all .bicep files to validate
infra/ directory first, then project rootinfra/, deploy/, project root)Auto-detect parameter files: For each Bicep file, look for matching parameter files:
<filename>.bicepparam (Bicep parameters - preferred)<filename>.parameters.json (JSON parameters)parameters.json or parameters/<env>.json in same directoryRun Bicep CLI to check template syntax before attempting deployment validation:
bicep build <bicep-file> --stdout
What to capture:
If Bicep CLI is not installed:
Choose the appropriate validation based on project type detected in Step 1.
Use azd provision --preview to validate the deployment:
azd provision --preview
If an environment is specified or multiple environments exist:
azd provision --preview --environment <env-name>
Determine the deployment scope from the Bicep file's targetScope declaration:
| Target Scope | Command |
|---|---|
resourceGroup (default) | az deployment group what-if |
subscription | az deployment sub what-if |
managementGroup | az deployment mg what-if |
tenant | az deployment tenant what-if |
Run with Provider validation level first:
# Resource Group scope (most common)
az deployment group what-if \
--resource-group <rg-name> \
--template-file <bicep-file> \
--parameters <param-file> \
--validation-level Provider
# Subscription scope
az deployment sub what-if \
--location <location> \
--template-file <bicep-file> \
--parameters <param-file> \
--validation-level Provider
# Management Group scope
az deployment mg what-if \
--location <location> \
--management-group-id <mg-id> \
--template-file <bicep-file> \
--parameters <param-file> \
--validation-level Provider
# Tenant scope
az deployment tenant what-if \
--location <location> \
--template-file <bicep-file> \
--parameters <param-file> \
--validation-level Provider
Fallback Strategy:
If --validation-level Provider fails with permission errors (RBAC), retry with ProviderNoRbac:
az deployment group what-if \
--resource-group <rg-name> \
--template-file <bicep-file> \
--validation-level ProviderNoRbac
Note the fallback in the report—the user may lack full deployment permissions.
Parse the what-if output to categorize resource changes:
| Change Type | Symbol | Meaning |
|---|---|---|
| Create | + | New resource will be created |
| Delete | - | Resource will be deleted |
| Modify | ~ | Resource properties will change |
| NoChange | = | Resource unchanged |
| Ignore | * | Resource not analyzed (limits reached) |
| Deploy | ! | Resource will be deployed (changes unknown) |
For modified resources, capture the specific property changes.
Create a Markdown report file in the project root named:
preflight-report.mdUse the template structure from references/REPORT-TEMPLATE.md.
Report sections:
Before running validation, gather:
| Information | Required For | How to Obtain |
|---|---|---|
| Resource Group | az deployment group | Ask user or check existing .azure/ config |
| Subscription | All deployments | az account show or ask user |
| Location | Sub/MG/Tenant scope | Ask user or use default from config |
| Environment | azd projects | azd env list or ask user |
If required information is missing, prompt the user before proceeding.
See references/ERROR-HANDLING.md for detailed error handling guidance.
Key principle: Continue validation even when errors occur. Capture all issues in the final report.
| Error Type | Action |
|---|---|
| Not logged in | Note in report, suggest az login or azd auth login |
| Permission denied | Fall back to ProviderNoRbac, note in report |
| Bicep syntax error | Include all errors, continue to other files |
| Tool not installed | Note in report, skip that validation step |
| Resource group not found | Note in report, suggest creating it |
This skill uses the following tools:
az) - Version 2.76.0+ recommended for --validation-levelazd) - For projects with azure.yamlbicep) - For syntax validationCheck tool availability before starting:
az --version
azd version
bicep --version
azure.yaml → azd projectinfra/main.bicep and infra/main.bicepparambicep build infra/main.bicep --stdoutazd provision --previewpreflight-report.md in project root