azure-operationslisted

# Azure operations: identity-first infrastructure and the pipeline that runs it **Read [`references/AZURE-OPERATIONS.md`](references/AZURE-OPERATIONS.md) before applying any of this.** That file is the standard; everything below it is a summary to help you decide whether this skill applies and to check your work afterwards. ## What this standard covers - Provision vs deploy - Passwordless SQL end to end - The permission matrix document - CI hardening - Storage without keys - Model deployments and capacity - Container Apps manifest idioms - Container Apps jobs and escape hatches ## Failure modes | Symptom | Cause | |---|---| | Permissions fix merged, live env still 403s | Fix shipped via deploy; role assignments only apply on provision | | First blob/agent call fails right after provisioning | RBAC propagation lag; poll the data plane before first use | | App deployed, DB login fails as `<identity-name>` | Contained DB user never created — the deploymentScripts half is missing | | Two services, one DB principal | Shared managed identity; one identity per service | | `deploymentScripts` fails inside a VNet | No delegated subnet + staging storage for script execution | | Wrong-subscription deploy with no clear error | No credential preflight; assert `az account show` post-login | | Re-provision after destroy fails on name collision | Soft-deleted account not detected/restored | | Parallel model deployments conflict | One deployment operation at a time; chain `dependsOn` | |