The 2026 Stack Overflow Developer Survey found that 73% of the developers who use AI coding assistants or agents use them every day, with Claude Code at 65.5% and GitHub Copilot at 58.7% among the agents they rely on most. The same survey shows that only 20% use AI for deploying, operating or troubleshooting production systems, which tells you that most of us still let the agent write the code and then take over ourselves when it's time to ship. The Azure Skills Plugin is Microsoft's attempt to close that gap, and in this post I'll explain what it installs, how to set it up in GitHub Copilot or Claude Code, how its prepare, validate and deploy workflow behaves, and which guardrails you should understand before you let an agent work on your subscription.
What the plugin installs in your agent
The plugin bundles two layers that Microsoft describes as the brain and the hands. The first layer is a set of Azure skills, which are folders with a SKILL.md file holding workflows, decision trees and rules that the agent loads when your request matches the skill's description. When I cloned the repository on October 18, 2026, it had 28 skill folders, among them azure-prepare, azure-validate, azure-deploy, azure-diagnostics, azure-compliance, azure-quotas, azure-storage, entra-app-registration and microsoft-foundry, and the list changes often because the repository syncs from Microsoft's main GitHub Copilot for Azure project.
The second layer is the Azure MCP Server, which the README describes as more than 200 structured tools across more than 40 Azure services. Those tools are what let the agent list your resource groups, check prices, query logs or run azd commands, and the Azure Skills overview sums up the split clearly by saying that the MCP server provides the individual operations while the skills provide the workflows that combine them. The README also lists Foundry MCP for model discovery, model deployment and agent workflows in Microsoft Foundry.
Microsoft introduced the plugin in March 2026 in the post Announcing the Azure Skills Plugin, and the repository is still very active, with its last sync on October 16, 2026 bringing plugin.json to version 1.2.95.
What's generally available and what isn't labeled
The page What is GitHub Copilot for Azure says that the azure-prepare, azure-validate and azure-deploy skills install automatically with that extension, and it lists general availability for Visual Studio Code, Visual Studio 2026, Claude Code and IntelliJ, while Visual Studio 2022 is still in public preview. Neither the plugin's README nor the Azure Skills pages on Microsoft Learn give the plugin a preview or GA label of its own, so I'd treat the GA status as applying to those clients and recheck the pages before you build a team process on top of it.
What you need before installing
You'll need an Azure subscription, and if you're a student, Azure for Students gives you credit without a credit card. The README asks for Node.js 18 or later on your PATH because npx starts the MCP server, the Azure CLI signed in with az login, and the Azure Developer CLI signed in with azd auth login if you plan to deploy. The skill reference page on Learn asks for Azure CLI 2.60.0 or later, and the VS Code skills extension also needs Git installed.
node --version
az --version
az login
azd auth login
Installing it in GitHub Copilot or Claude Code
In Visual Studio Code you install the Azure MCP Server extension from the Marketplace, and according to the README it also installs a companion extension that brings the skills, so the MCP server, Foundry MCP and the skills end up configured together.
In GitHub Copilot CLI you add the marketplace the first time and then install the plugin from inside the chat.
/plugin marketplace add microsoft/azure-skills
/plugin install azure@azure-skills
In Claude Code the README points to the official plugin marketplace, while the install page on Microsoft Learn uses the same two marketplace commands shown above for Copilot CLI, so either route works.
/plugin install azure@claude-plugins-official
The README also covers Cursor, Codex CLI, Gemini CLI, IntelliJ IDEA and APM, which installs the plugin across several agents from a single apm.yml. Once it's installed, the README suggests three prompts to confirm each layer is working, and the second one is the most telling because it should come back with resource groups from your own account instead of a generic answer.
What Azure services would I need to deploy this project?
List my Azure resource groups.
What AI models are available in Microsoft Foundry?
How prepare, validate and deploy work together
The three deployment skills are designed as a chain, and each one refuses to run if the previous one didn't finish. When you ask something like "Prepare this app for Azure", the azure-prepare skill instructs the agent to write a skeleton of .azure/deployment-plan.md in your workspace before doing anything else, and then to analyze whether the project is new, being modified or being modernized, gather requirements, scan the codebase, choose a recipe and map each component to an Azure service. The default recipe is the Azure Developer CLI, with Azure CLI, Bicep and Terraform as alternatives, and the skill tells the agent to present the finished plan and wait for your approval before it generates azure.yaml, the infra folder or any Dockerfile.
The skill also carries some security decisions of its own. For example, it forbids generating administratorLogin or administratorLoginPassword in SQL Server Bicep files and requires Entra-only authentication instead, which fits well with what I covered in How to authenticate Azure apps without storing credentials. When preparation ends, the agent has to change the plan's status to Ready for Validation before it can move on.
The azure-validate skill runs a workflow script that walks the agent through each check one at a time, recording its progress in .azure/validate-status.json and writing a Validation Proof section in the plan with the commands it ran and their timestamps. The rule is that every check has to pass, and if you only asked to validate, the agent stops there and reports the results instead of deploying.
The azure-deploy skill only starts when the plan says Validated and that proof section isn't empty, and the skill itself forbids the agent from setting that status by hand. From there it runs azd up, azd deploy, terraform apply or az deployment depending on the recipe, handles errors, checks that the endpoints respond, verifies the role assignments it created against your live subscription and returns the URLs with https://. If you've followed my post on the Azure Developer CLI, this is the same azd workflow, with the agent doing the planning and the checks you'd otherwise do yourself.
These are the kinds of prompts the README suggests for the workflow and for day two operations.
Prepare this app for Azure.
Validate my Azure deployment files before I run azd up.
Deploy this project to Azure Container Apps.
Troubleshoot why my container app is failing health probes.
What role should I assign to let this managed identity read blobs?
There's one inconsistency worth knowing about. The Azure Skills overview and quickstart on Microsoft Learn, last updated in April 2026, still call the plan .azure/plan.md, while the current SKILL.md and the azure-deploy reference page from July use .azure/deployment-plan.md, and the skill explicitly tells the agent not to use any other name. If you're following the quickstart and can't find the file, that's the reason.
The guardrails, and what they don't cover
Every deployment skill links to a set of global rules that require the agent to ask you before any destructive action, which the rules define as deleting, overwriting, irreversible operations, provisioning expens`ive resources and changing access policies or RBAC. The same rules say the agent must never assume your subscription or region, must not delete your project directory and may only runazd init` with a template in an empty directory.
It's important to understand that these rules are instructions written for the model and not a technical lock. The Azure MCP Server acts with your Azure CLI credentials or a managed identity, and the Azure MCP Server overview explains that access is governed by Azure RBAC, which means the agent can do whatever your account is allowed to do. Your host's approval settings matter just as much, because Microsoft's own quickstart for building with agents in VS Code describes Autopilot as running commands and editing files without asking you again. My recommendation is to try the plugin in a subscription or resource group where your account has only the permissions the project needs, and to keep tool approvals on until you've watched the workflow a few times.
The plugin also collects usage telemetry by default. In Claude Code it registers hooks on session start and after each tool call that send skill and tool usage events, and the script skips them when AZURE_MCP_COLLECT_TELEMETRY is set to false, the same variable that turns off telemetry in the Azure MCP Server.
`bash
export AZURE_MCP_COLLECT_TELEMETRY=false
`
If you want to go further with agents in your operations work, the learning path Optimize DevOps with AI agents on Azure covers GitHub Copilot plan mode for cloud operations, the Azure SRE Agent and, in its last module, how to move traditional operations tasks to agent instructions, skills and multi-agent orchestration.
When your coding agent shows you an Azure deployment plan, what's the first thing you check before you approve it?
