Hire an AI Azure deployment access reviewer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• Role recommendations
• Preflight findings
• Rollout and rollback plan

How it does the job well

• Read the existing code, its conventions and its tests before changing anything. Match the project's patterns.
• Make the smallest change that fully solves the request. Keep unrelated refactors out.
• Reproduce a bug before fixing it, and add a test that fails without the fix.
• Treat input from users, files and networks as untrusted. Validate it at the boundary.

Mistakes it avoids

• Claiming code works without running it or its tests.
• Inventing APIs, package versions or settings instead of checking the installed ones.
• Changing behaviour outside the request, such as reformatting whole files or renaming public interfaces.

What a good result looks like

An example, not your task: You are about to run a Bicep deployment in a named subscription and resource group, and want to know it will work first.

• Role recommendations. The narrowest role, why it fits, the scope, a CLI command and a Bicep snippet. You run the command.
• Preflight findings. Syntax errors, permission problems and a preview of what the deployment would change, in preflight-report.md.
• Rollout and rollback plan. Preflight checks, rollout stages, health signals and the rollback steps.
• Final summary. Unresolved findings, missing facts and one next action.

How the work is checked

• Each step passed its own checks, or the run stopped at the step that failed and says why.
• The steps ran in order, and each one used the result of the one before.
• Nothing was invented to fill a gap. Every gap is a MISSING: line.
• Nothing was deployed, assigned or paid for without a clear yes.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Azure least access role picker. Describe what an identity must do. Get the narrow Azure role that fits, with reasons. Hands the preflight step the chosen role.
• Bicep deployment preflight checker. Share your Bicep deployment. Checks its permissions against the role from step 1. Get syntax, permission and proposed-change checks before it goes live. Hands the rollout step the checks and proposed changes.
• Service rollout and rollback planner. Share a release or infrastructure change. Uses the role and the preflight results from steps 1 and 2. Get preflight checks, rollout stages, health signals and a rollback plan.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id check-azure-access-before-deploy only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/check-azure-access-before-deploy/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• What the identity must do, in plain words, and where the access applies
• Your Bicep files and parameter files, and the target subscription and resource group
• Your release window, acceptable downtime and who must approve

Tools and access

• Claude Code with the Azure MCP server: It can read Microsoft's documentation and generate commands that match your setup.
• GitHub Copilot in VS Code: This skill was written for it, and the Azure MCP tools plug in there.

Functions and deliverables

• Azure deployment access reviewer: Match Azure access to the task, check a proposed Bicep deployment and plan rollout and rollback before release.
  • Role recommendations
  • Preflight findings
  • Rollout and rollback plan
• Azure access role picker: Pick the narrowest Azure role for a person, group or app. Get the role, the scope, the CLI command and a Bicep snippet to assign it.
  • The narrowest role that fits, built in or custom
  • Why it fits and which wider roles were rejected
  • The scope to use, with a reason
  • The Azure CLI command to assign it
  • A Bicep snippet for the same assignment
  Source: GitHub Copilot community.
• Bicep deployment preflight checker: Check your Bicep files before you deploy to Azure. Get syntax checks, a preview of changes and a permission check in one report.
  • A preflight-report.md file in your project folder.
  • A list of syntax errors and warnings with line numbers.
  • A preview of what will be created, changed or deleted.
  • A note if your permissions look too low to deploy.
  • Clear next steps to fix before you deploy.
  Source: GitHub Copilot community.
• Service rollout and rollback planner: Plan a safe service rollout and rollback. Share your release or infrastructure change and get preflight checks, stages, health signals and a rollback plan.
  • A summary with the risk level and rollback time
  • Preflight checks with a go or no-go list
  • Rollout steps with commands and a check after each
  • Health signals to watch over the first 15 minutes and beyond
  • A rollback plan with clear triggers
  • A communication plan and a list of contacts
  Source: GitHub Copilot community.
• AI project context organiser: Share your project and next task. Get a short rules file, a focused file list and a clear handoff for later sessions.
  • A ready rules file for your project
  • A list of which files to load for each task
  • Rules for when to reset or trim the session
  • A checklist for spotting drifting answers
  Source: Addy Osmani.

Tasks you can use it for

• You are about to run a Bicep deployment in a named subscription and resource group, and want to know it will work first.
• A person, group or app needs access to deploy, and you want the narrowest role that does the job.
• You need a rollout and rollback plan for an infrastructure change, built on the access and the checks.

Limits to check before starting

• The access you need is an Entra ID directory role, such as managing users or groups. Those are not Azure roles, so this workflow will not fit.
• You want an Azure cost or price estimate. Use the Azure resource cost reviewer or the Azure price estimate researcher.
• Your deployment already failed and you need to know why. Use the Azure service health investigator.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Add the complete skill pack to your AI.
• Share what the identity must do and where, then your Bicep files.
• Install the Azure CLI and Bicep CLI if you want the live checks. Without them those checks are listed as not run.
• Ask it to follow the steps and mark any missing facts.
• Review the result, then run the assignment and deployment commands yourself.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/check-azure-access-before-deploy for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.