[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-azure-azure-blueprints-migration":3,"mdc-41cpuk-key":35,"related-org-azure-azure-blueprints-migration":3196,"related-repo-azure-azure-blueprints-migration":3365},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"azure-blueprints-migration","migrate Azure Blueprints to Template Specs","Use when a user needs to migrate off Azure Blueprints (definitions and\u002For assignments) to Template Specs and Deployment Stacks before the January 31, 2027 retirement. Covers inventory, export, conversion to Bicep, policy decoupling, Template Spec publishing, Deployment Stack deployment with deny-settings, validation, and cutover.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"azure","Azure (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fazure.png","Azure",[13,15,18,21],{"name":11,"slug":8,"type":14},"tag",{"name":16,"slug":17,"type":14},"Migration","migration",{"name":19,"slug":20,"type":14},"Deployment","deployment",{"name":22,"slug":23,"type":14},"Infrastructure as Code","infrastructure-as-code",260,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints","2026-07-12T08:17:49.646405",null,149,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"A library of sample Blueprints that can be easily imported via API or PowerShell","https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints\u002Ftree\u002FHEAD\u002Fskills\u002Fazure-blueprints-migration","---\nname: azure-blueprints-migration\ndescription: Use when a user needs to migrate off Azure Blueprints (definitions and\u002For assignments) to Template Specs and Deployment Stacks before the January 31, 2027 retirement. Covers inventory, export, conversion to Bicep, policy decoupling, Template Spec publishing, Deployment Stack deployment with deny-settings, validation, and cutover.\n---\n\n# Azure Blueprints → Template Specs + Deployment Stacks Migration Skill\n\n**Audience:** Any AI assistant (for example, GitHub Copilot) helping an Azure customer or partner migrate off Azure Blueprints.\n**Status:** Azure Blueprints (preview) is **retiring on January 31, 2027**, with **phased retirement beginning July 31, 2026**. Migrate blueprint definitions **and** assignments to **Deployment Stacks** (recommended) + **Template Specs** before then. Authoritative dates, phased timeline, and FAQ: \u003Chttps:\u002F\u002Faka.ms\u002FAzureBlueprintsRetirement>.\n\n---\n\n## When to use this skill\n\nInvoke this skill whenever the user:\n\n- Mentions Azure Blueprints, blueprint definitions, blueprint assignments, blueprint locks, or the Blueprints retirement.\n- Asks for a migration plan, \"what replaces Blueprints?\", or how to move governance from Blueprints to ARM\u002FBicep tooling.\n- Needs to export, convert, or re-deploy resources currently managed by Blueprints.\n- Asks about Template Specs or Deployment Stacks in the context of replacing Blueprints.\n\nIf the user is asking a general ARM\u002FBicep question with no Blueprints context, do **not** load this skill.\n\n---\n\n## Operating principles (read first)\n\n1. **Stacks over Template Specs alone.** Use Template Specs as the storage\u002Fversioning layer; deploy via Deployment Stacks to preserve assignment-like lifecycle behavior. Recommend Template Spec–only deployment only when the user explicitly has no need for resource tracking or deny-settings.\n2. **Do not auto-migrate.** Always confirm scope, parameters, and lock parity with the user before producing or running deployment commands. Migration is customer-driven.\n3. **Cutover is destructive.** Removing a Blueprint assignment can remove embedded policy assignments. Always sequence: deploy new Stack → verify → re-assign decoupled policies if needed → only then remove the Blueprint assignment.\n4. **Never invent IDs.** If the user hasn't provided a management group ID, subscription ID, blueprint name, or version, ask before generating commands.\n5. **Surface the retirement dates.** When users plan timelines, remind them Azure Blueprints (preview) **retires January 31, 2027**, with **phased retirement starting July 31, 2026** — so complete migration and export definitions before then. Link to \u003Chttps:\u002F\u002Faka.ms\u002FAzureBlueprintsRetirement> for the phased timeline.\n6. **Definitions count too, not just assignments.** The retirement recommendation flags **every** blueprint definition and published version — not only assignments. Unassigned definitions deploy nothing, but they still must be handled (convert to a Template Spec, or export-and-archive) and then **deleted** to clear the recommendation. Inventory with `Get-AzBlueprint` at **each subscription and management group**, not just `Get-AzBlueprintAssignment`.\n\n---\n\n## Inputs to gather from the user\n\nBefore producing any migration plan or commands, collect:\n\n- **Scope** — management group ID, subscription IDs, and\u002For resource group names involved.\n- **Blueprint inventory** — definition names + versions, and which subscriptions\u002FMGs they're assigned to. Offer to help inventory via `Get-AzBlueprint` \u002F `Get-AzBlueprintAssignment` if unknown.\n- **Lock mode in use** — `None` \u002F `AllResourcesReadOnly` \u002F `AllResourcesDoNotDelete`. This drives the Stack `denySettings` choice.\n- **Identity** — system-assigned vs. user-assigned managed identity used by the assignment.\n- **Policy posture** — whether policies embedded in the blueprint are app-specific (keep in template) or baseline (lift to a standalone Initiative).\n- **Target tooling** — Bicep (recommended) or ARM JSON.\n- **Production tolerance** — sandbox available? Side-by-side acceptable? Or strict adopt-in-place required?\n\nIf any of these are unknown, ask the user before proceeding.\n\n---\n\n## TL;DR — What replaces what\n\n| Blueprints concept | Recommended replacement | Why |\n|---|---|---|\n| **Blueprint Definition** (package of artifacts: ARM templates, policy assignments, RBAC, resource groups) | **Template Spec** | Stores and versions ARM\u002FBicep templates as first-class Azure resources; closest parity to a Blueprint Definition. |\n| **Blueprint Assignment** (deployment instance + lifecycle binding to a subscription\u002FMG) | **Deployment Stack** | Tracks the resources it creates, supports deny-settings (parity to Blueprint locks\u002Fdeny-assignments), and lets you update\u002Fdelete the whole set as one unit. **Preferred end-state.** |\n| **Blueprint locks \u002F deny-assignments** | **Deployment Stack `denySettings`** | `denyDelete` or `denyWriteAndDelete` modes reproduce the protective behavior with first-class tooling. |\n| **Blueprint parameters** | Template Spec \u002F Stack parameters | Direct 1:1; pass the same values through the new deployment call. |\n| **Sequenced artifact ordering** | Bicep `dependsOn` \u002F ARM `dependsOn` | Express ordering in the template rather than via Blueprint artifact sequence. |\n| **Policy assignments inside a Blueprint** | Standalone policy assignment **or** Azure Policy initiative (preferred for shared baselines) | Decouple policy from app\u002Finfra deployment so it can be managed independently. |\n\n---\n\n## Decision tree\n\n```mermaid\nflowchart TD\n  A[Have an Azure Blueprint today?] --> B{Definition or\u003Cbr\u002F>Assignment?}\n  B -->|Definition only\u003Cbr\u002F>(reusable template)| C[Migrate to\u003Cbr\u002F>Template Spec]\n  B -->|Assignment\u003Cbr\u002F>(deployed instance)| D{Need lifecycle\u003Cbr\u002F>tracking + deny-locks?}\n  D -->|Yes| E[Deploy via\u003Cbr\u002F>Deployment Stack\u003Cbr\u002F>with denySettings]\n  D -->|No, one-shot| F[Deploy from\u003Cbr\u002F>Template Spec directly]\n  C --> G[Done — versioned,\u003Cbr\u002F>shareable template]\n  E --> H[Done — tracked,\u003Cbr\u002F>protected, updatable]\n  F --> H\n\n  style E fill:#cfe8ff,stroke:#0078d4,stroke-width:2px\n  style C fill:#e6f4ea,stroke:#188038,stroke-width:2px\n```\n\n---\n\n## End-to-end migration flow\n\n```mermaid\nflowchart LR\n  subgraph Today[\"Today — Azure Blueprints\"]\n    BD[Blueprint\u003Cbr\u002F>Definition]\n    BA[Blueprint\u003Cbr\u002F>Assignment]\n    BL[Locks \u002F Deny\u003Cbr\u002F>Assignments]\n    BD --> BA\n    BA --> BL\n  end\n\n  subgraph Migration[\"Migration steps\"]\n    INV[1. Inventory\u003Cbr\u002F>blueprints]\n    EXT[2. Export\u003Cbr\u002F>definition JSON]\n    CONV[3. Convert artifacts\u003Cbr\u002F>to Bicep\u002FARM]\n    POL[4. Split policies\u003Cbr\u002F>into Policy \u002F Initiative]\n    TS[5. Publish\u003Cbr\u002F>Template Spec]\n    STK[6. Deploy via\u003Cbr\u002F>Deployment Stack]\n    VAL[7. Validate\u003Cbr\u002F>in non-prod]\n    CUT[8. Cut over\u003Cbr\u002F>+ remove BP assignment]\n  end\n\n  subgraph Future[\"Future state\"]\n    TSF[Template Spec\u003Cbr\u002F>(versioned package)]\n    STKF[Deployment Stack\u003Cbr\u002F>(tracked resources)]\n    DEN[denySettings\u003Cbr\u002F>(deny-delete)]\n    POLF[Policy Assignment\u003Cbr\u002F>\u002F Initiative]\n    TSF --> STKF\n    STKF --> DEN\n  end\n\n  BD -.->|maps to| TSF\n  BA -.->|maps to| STKF\n  BL -.->|maps to| DEN\n\n  INV --> EXT --> CONV --> POL --> TS --> STK --> VAL --> CUT\n  CUT --> STKF\n```\n\n---\n\n## How to drive a migration (step-by-step instructions for the AI)\n\nFor each step, **(a)** explain to the user what you're about to do, **(b)** ask any missing inputs, **(c)** produce the command or artifact, **(d)** wait for the user to run it and report results before moving on.\n\n### Step 1 — Inventory existing Blueprints\n\nAsk for the management group ID and subscription ID, then produce:\n\n```powershell\nGet-AzBlueprint -ManagementGroupId \"\u003Cmg-id>\" | Select-Object Name, Id, Versions\nGet-AzBlueprintAssignment -SubscriptionId \"\u003Csub-id>\"\n```\n\nFor each blueprint, capture: definition ID, latest published version, scopes assigned, assignment parameter values, lock mode, identity.\n\n### Step 2 — Export the Blueprint definition\n\n```powershell\n$bp = Get-AzBlueprint -ManagementGroupId \"\u003Cmg-id>\" -Name \"\u003Cblueprint-name>\" -LatestPublished\nExport-AzBlueprintWithArtifact -Blueprint $bp -OutputPath \".\\exports\\\u003Cblueprint-name>\"\n```\n\nOutput is `blueprint.json` plus one JSON file per artifact. Confirm the export folder structure with the user before continuing.\n\n### Step 3 — Convert artifacts to Bicep (or keep as ARM)\n\nFor each `template` artifact:\n1. Save the embedded template to a `.json` file.\n2. Decompile to Bicep (recommended): `bicep decompile .\\template.json`. Decompiled output is a starting point — review and refactor it, since it is not always idiomatic.\n3. Combine related artifacts into a single `main.bicep`, or keep modular with `module` references.\n4. Preserve the same parameters at the top level (`@description`, `@allowed`, defaults).\n\nFor RBAC artifacts: add `Microsoft.Authorization\u002FroleAssignments` resources with a deterministic `guid()` name.\nFor resource-group artifacts: model as `Microsoft.Resources\u002FresourceGroups` at subscription scope, or skip if the target RG already exists.\n\n### Step 4 — Decouple policy assignments\n\n- **Shared baseline** → publish as an Azure Policy **Initiative** at the MG and assign once. The Stack\u002Ftemplate should **not** re-assign baseline policies.\n- **App-specific policy** → keep inside the Bicep, assign at resource-group scope so it doesn't conflict with broader inheritance.\n\nWarn the user: removing the Blueprint assignment later will remove any policies embedded in it. Re-assign decoupled policies **before** removing the Blueprint assignment.\n\n### Step 5 — Publish a Template Spec\n\n```powershell\nNew-AzTemplateSpec `\n  -ResourceGroupName \"rg-templatespecs\" `\n  -Name \"landing-zone\" `\n  -Version \"1.0.0\" `\n  -Location \"eastus\" `\n  -TemplateFile \".\\main.bicep\"\n```\n\nThis is the versioned, shareable, RBAC-scoped artifact that replaces the Blueprint definition as the **package**.\n\n### Step 6 — Deploy via a Deployment Stack\n\n```powershell\n# Retrieve the Template Spec version resource ID\n$ts = Get-AzTemplateSpec -ResourceGroupName \"rg-templatespecs\" -Name \"landing-zone\" -Version \"1.0.0\"\n\nNew-AzSubscriptionDeploymentStack `\n  -Name \"landing-zone-stack\" `\n  -Location \"eastus\" `\n  -TemplateSpecId $ts.Versions[0].Id `\n  -TemplateParameterFile \".\\params.json\" `\n  -DenySettingsMode \"denyDelete\" `\n  -ActionOnUnmanage \"detachAll\"\n```\n\nDecision points to surface to the user:\n- `-DenySettingsMode` → `none` | `denyDelete` | `denyWriteAndDelete`. Map to the old lock mode (see mapping table below).\n- `-ActionOnUnmanage` → controls what happens to resources when you *delete* the stack, or when a resource drops out of the template. Use `detachAll` during pilot; switch to `deleteResources` for full-lifecycle parity with a Blueprint assignment delete.\n- For management-group scope use `New-AzManagementGroupDeploymentStack` instead.\n\n> **Note — What-If:** Deployment stacks do not yet support a native What-If preview. To preview changes, run `New-AzSubscriptionDeployment -WhatIf` (or `az deployment sub what-if`) against the underlying template before creating or updating the stack. The stack additionally applies the deny-settings, which won't appear in the template What-If.\n\n### Step 7 — Validate in non-production\n\nDeploy to a sandbox subscription first. Confirm with the user:\n- Resources created as expected.\n- Deny-settings enforced (try a manual delete — it should fail).\n- Parameter values applied correctly.\n- Diff against the original Blueprint assignment: any drift?\n\n### Step 8 — Cut over\n\nFor each existing Blueprint assignment:\n1. Deploy the matching Deployment Stack to the same scope.\n2. Choose one strategy and confirm with the user:\n   - **Side-by-side then swap** — Stack provisions new resources, redirect dependents, then remove old Blueprint-managed resources.\n   - **Adopt existing** — the stack begins managing resources whose IDs match resources declared in the template on first successful deployment (there is no separate import command). Resources at the scope that are **not** in the template are left untouched under `detachAll`.\n3. Re-assign any decoupled policies at the right scope.\n4. Remove the Blueprint assignment:\n   ```powershell\n   Remove-AzBlueprintAssignment -Name \"\u003Cassignment>\" -SubscriptionId \"\u003Csub>\"\n   ```\n5. Confirm the Stack is now the single source of truth: `Get-AzSubscriptionDeploymentStack`.\n\n> **Sequencing gotcha — embedded role\u002Fpolicy assignments.** While the Blueprint assignment still exists, it *owns* the role and policy assignments it created. If your Stack template tries to create a role assignment for the **same principal + role + scope**, Azure rejects it with `409 RoleAssignmentExists`; re-creating an embedded policy under a new name silently produces a **duplicate**. Removing the Blueprint assignment does **not** reliably delete the role assignments it created — they often **persist** and keep triggering `409`. The most reliable pattern is to **adopt** the existing assignments: query the existing name (`Get-AzRoleAssignment`, or the REST role-assignments list filtered by `principalId`) and set that exact GUID as the resource `name` so the deployment is an idempotent no-op the stack then manages.\n\n### Step 9 — Cleanup\n\nOnce **all** assignments for a Definition are migrated, delete the definition. **Note:** `Az.Blueprint` has **no `Remove-AzBlueprint` cmdlet** (only `Remove-AzBlueprintAssignment`). Delete definitions via Azure CLI or REST, deleting published versions first:\n\n```powershell\n# Azure CLI\naz blueprint delete --name \"\u003Cblueprint-name>\" --management-group \"\u003Cmg-id>\"   # or --subscription \"\u003Csub-id>\"\n\n# REST fallback (PowerShell) — published versions first, then the definition\n$path = \"\u002Fsubscriptions\u002F\u003Csub-id>\u002Fproviders\u002FMicrosoft.Blueprint\u002Fblueprints\u002F\u003Cname>\"  # or \u002Fproviders\u002FMicrosoft.Management\u002FmanagementGroups\u002F\u003Cmg-id>\u002Fproviders\u002FMicrosoft.Blueprint\u002Fblueprints\u002F\u003Cname>\n$api  = \"api-version=2018-11-01-preview\"\n(Invoke-AzRestMethod -Method GET -Path \"$path\u002Fversions?$api\").Content |\n  ConvertFrom-Json | Select-Object -Expand value |\n  Where-Object { -not [string]::IsNullOrWhiteSpace($_.name) } |   # never issue a DELETE with an empty version ID\n  ForEach-Object { Invoke-AzRestMethod -Method DELETE -Path \"$path\u002Fversions\u002F$($_.name)?$api\" }\nInvoke-AzRestMethod -Method DELETE -Path \"${path}?$api\"\n```\n\nDeleting a **management-group-scoped** definition requires Blueprint Contributor\u002FOwner **at that management group** — a subscription-level role returns `403`. Stop publishing new versions of the Blueprint Definition.\n\n---\n\n## Mapping reference\n\n| Blueprint setting | Stack equivalent |\n|---|---|\n| `properties.parameters` | `-TemplateParameterFile` \u002F `-Parameter` |\n| `properties.resourceGroups` | `Microsoft.Resources\u002FresourceGroups` in Bicep |\n| `locks.mode = AllResourcesDoNotDelete` | `DenySettingsMode = denyDelete` |\n| `locks.mode = AllResourcesReadOnly` | `DenySettingsMode = denyWriteAndDelete` |\n| `locks.excludedPrincipals` | `-DenySettingsExcludedPrincipal` (max 5) |\n| `locks.excludedActions` | `-DenySettingsExcludedAction` (max 200) |\n| Identity (`SystemAssigned` \u002F `UserAssigned`) | Stack runs with the caller's identity; deployments use the template's own identity blocks |\n| Artifact sequence | Bicep `dependsOn` |\n| Versioning (definition versions) | Template Spec `version` |\n| Assignment scope (Sub \u002F MG) | `New-AzSubscriptionDeploymentStack` \u002F `New-AzManagementGroupDeploymentStack` |\n\n---\n\n## Guardrails — things the AI must do\n\n- **Do not generate or run any `Remove-AzBlueprintAssignment` command until** the user confirms the replacement Stack is deployed and validated, and any decoupled policies are re-assigned.\n- **Do not recommend `denyWriteAndDelete`** unless the user explicitly needs write-protection — it blocks normal RBAC-allowed updates. Default to `denyDelete`.\n- **Do not recommend `-ActionOnUnmanage deleteResources` during pilot.** Use `detachAll` until the user is confident.\n- **Do not invent management group IDs, subscription IDs, blueprint names, or parameter values.** Ask.\n- **Do not claim Microsoft will auto-migrate.** It will not. This is customer-driven.\n- **Do not skip the policy-decoupling step** if the blueprint embeds policy assignments. This is the #1 source of post-migration regressions.\n\n---\n\n## Common pitfalls\n\n- **Trying to one-shot adopt existing resources.** Stacks track resources they create or that already match resources declared in the template; other pre-existing resources may need a brief side-by-side period.\n- **Forgetting to update policy ownership.** If a Blueprint assigned policy that lived inside the definition, removing the assignment also removes that policy. Re-assign at the right scope *before* removing the Blueprint assignment.\n- **Wrong deny-settings mode.** `denyWriteAndDelete` blocks normal RBAC-allowed updates — pick `denyDelete` unless you truly need write protection.\n- **`ActionOnUnmanage = deleteResources` during pilot.** Use `detachAll` until you're confident; flip later.\n- **Deny-assignment limits and gaps.** Deny-assignments don't apply at management-group scope (only when a stack deploys into a child subscription), don't cover data-plane operations, and don't protect implicitly created child resources (for example, an AKS node resource group). Add explicit `Microsoft.Authorization\u002Flocks` where those gaps matter.\n- **Blueprint-applied tags get stripped.** Blueprints stamp managed resources\u002Fresource groups with a `Blueprint` tag (and similar metadata). A migrated Stack whose template omits those tags will **remove them** on first deployment (visible as a `~ Modify` in template What-If). Carry over any tags you want to keep into the converted Bicep, or accept their removal deliberately.\n- **Role assignment `409` \u002F duplicate policy on cutover.** See the sequencing gotcha in Step 8 — defer embedded role\u002Fpolicy assignments until after the Blueprint assignment is removed, or adopt them by exact existing name.\n- **Inherited governance noise.** At resource-group scope you may see many *inherited* management-group policy assignments. Don't mistake them for the blueprint's own artifacts when validating.\n- **`Remove-AzBlueprint` doesn't exist.** `Az.Blueprint` ships `Remove-AzBlueprintAssignment` but **no** cmdlet to delete a *definition*. Use `az blueprint delete` or REST `DELETE` (see Step 9); delete published versions first. MG-scoped deletes need MG-level permissions or they return `403`.\n- **Unassigned definitions still count.** The retirement recommendation lists every definition and version, not just assignments — and the same test definitions are often replicated across every subscription and the management group. Inventory each scope and archive\u002Fconvert then delete them to reach zero.\n- **`Get-AzBlueprint -SubscriptionId` includes inherited MG definitions.** Its result mixes subscription-scoped definitions with management-group definitions inherited into that subscription's view. Distinguish by the resource `Id` (`\u002Fsubscriptions\u002F…` vs `\u002FmanagementGroups\u002F…`). Don't multiply the same MG set across every subscription when counting, and note that deleting an inherited MG definition via a *subscription* path is a no-op (idempotent `204`) — delete it once at the MG scope (with MG permissions).\n- **Never delete a version with an empty ID.** When removing a blueprint's published versions, filter out any null\u002Fblank version names *before* issuing the `DELETE` — a `DELETE …\u002Fversions\u002F` with an empty version ID can trigger a service-side error. Enumerate versions, skip empties, delete each real version, then delete the definition.\n- **Export before retirement.** Export your blueprint definitions and assignments before the **January 31, 2027** retirement (phased changes begin **July 31, 2026**). After retirement the Blueprints API stops serving requests, so `Export-AzBlueprintWithArtifact` may no longer work — capture everything you need ahead of time.\n\n---\n\n## Output artifacts the AI should produce\n\nBy the end of a migration session, the user should have:\n\n1. **Inventory list** — definitions, assignments, scopes, lock modes, parameters.\n2. **Export folder** per blueprint — `blueprint.json` + artifact JSON files.\n3. **Converted Bicep templates** — `main.bicep` per migrated definition.\n4. **Template Spec resource(s)** — published and versioned.\n5. **Deployment Stack(s)** — deployed at the correct scope with the right `denySettings`.\n6. **Decoupled policy assignments \u002F initiatives** — assigned at the appropriate MG\u002Fsub\u002FRG scope.\n7. **Cutover checklist** — one row per former Blueprint assignment, with status: deployed \u002F validated \u002F cut over \u002F Blueprint removed.\n\n---\n\n## FAQ\n\n**Q: Do I have to use Stacks? Can I just keep using Template Spec deployments?**\nA: Yes, for stateless deployments. But you lose lifecycle tracking and deny-protection. Use Stacks when you used Blueprint *assignments* for governance.\n\n**Q: What about Deployment Stacks at the management-group scope?**\nA: Supported (`New-AzManagementGroupDeploymentStack`). This is the right replacement for MG-scoped Blueprint assignments that fan out to many subs. Note that deny-assignments apply at the child-subscription scope the stack deploys into, not at the management-group scope itself.\n\n**Q: Will Microsoft auto-migrate my Blueprints?**\nA: No. Migration is customer-driven — there is no automatic conversion. Use this guide to migrate on your own timeline before retirement.\n\n**Q: What happens on the retirement dates?**\nA: Phased retirement begins **July 31, 2026**, and the service is fully **retired January 31, 2027** — after which create\u002Fupdate operations stop and definitions\u002Fassignments are no longer serviced. Export definitions and complete migration before then. See \u003Chttps:\u002F\u002Faka.ms\u002FAzureBlueprintsRetirement>.\n\n**Q: I only have unassigned blueprint *definitions* left. Do those need migrating?**\nA: Yes — the retirement recommendation counts every definition and published version. If a definition has no assignment it deploys nothing, so either convert it to a Template Spec (if you still want the template) or simply **export it for archive and delete it**. Deleting definitions (and their versions) is what clears them from the retirement recommendation.\n\n**Q: Where do I file questions or issues?**\nA: Use the public [`Azure\u002Fazure-blueprints`](https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints) GitHub repository and the official retirement notice on Microsoft Learn.\n\n---\n\n## Resources\n\n- **Azure Blueprints retirement (hub — dates, phased timeline, FAQ)** — \u003Chttps:\u002F\u002Faka.ms\u002FAzureBlueprintsRetirement>\n- **Migrate blueprints to deployment stacks (official guide)** — \u003Chttps:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fazure-resource-manager\u002Fbicep\u002Fmigrate-blueprint>\n- **Migrate blueprints to template specs** — \u003Chttps:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fgovernance\u002Fblueprints\u002Fmigrate-to-template-specs>\n- **Azure Blueprints overview** — \u003Chttps:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fgovernance\u002Fblueprints\u002Foverview>\n- **Template Specs overview** — \u003Chttps:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fazure-resource-manager\u002Ftemplates\u002Ftemplate-specs>\n- **Deployment Stacks overview** — \u003Chttps:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fazure-resource-manager\u002Fbicep\u002Fdeployment-stacks>\n- **Bicep decompile** — \u003Chttps:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fazure-resource-manager\u002Fbicep\u002Fdecompile>\n- **Deny assignments** — \u003Chttps:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Frole-based-access-control\u002Fdeny-assignments>\n- **Az.Blueprint reference (export)** — \u003Chttps:\u002F\u002Flearn.microsoft.com\u002Fpowershell\u002Fmodule\u002Faz.blueprint>\n\n---\n\n*Skill version: 2.1 · Maintained by Microsoft. Verify all commands against the latest Microsoft Learn documentation before running.*\n",{"data":36,"body":37},{"name":4,"description":6},{"type":38,"children":39},"root",[40,49,113,117,124,129,154,166,169,175,296,299,305,310,427,432,435,441,657,660,666,788,791,797,1101,1104,1110,1143,1150,1155,1180,1185,1191,1214,1227,1233,1246,1317,1346,1352,1388,1400,1406,1461,1472,1478,1563,1568,1651,1681,1687,1692,1715,1721,1726,1810,1904,1910,1960,2054,2081,2084,2090,2337,2340,2346,2441,2444,2450,2799,2802,2808,2813,2905,2908,2914,2931,2948,2958,2987,3011,3033,3036,3042,3179,3182,3190],{"type":41,"tag":42,"props":43,"children":45},"element","h1",{"id":44},"azure-blueprints-template-specs-deployment-stacks-migration-skill",[46],{"type":47,"value":48},"text","Azure Blueprints → Template Specs + Deployment Stacks Migration Skill",{"type":41,"tag":50,"props":51,"children":52},"p",{},[53,59,61,66,68,73,75,80,82,87,89,94,96,101,103,111],{"type":41,"tag":54,"props":55,"children":56},"strong",{},[57],{"type":47,"value":58},"Audience:",{"type":47,"value":60}," Any AI assistant (for example, GitHub Copilot) helping an Azure customer or partner migrate off Azure Blueprints.\n",{"type":41,"tag":54,"props":62,"children":63},{},[64],{"type":47,"value":65},"Status:",{"type":47,"value":67}," Azure Blueprints (preview) is ",{"type":41,"tag":54,"props":69,"children":70},{},[71],{"type":47,"value":72},"retiring on January 31, 2027",{"type":47,"value":74},", with ",{"type":41,"tag":54,"props":76,"children":77},{},[78],{"type":47,"value":79},"phased retirement beginning July 31, 2026",{"type":47,"value":81},". Migrate blueprint definitions ",{"type":41,"tag":54,"props":83,"children":84},{},[85],{"type":47,"value":86},"and",{"type":47,"value":88}," assignments to ",{"type":41,"tag":54,"props":90,"children":91},{},[92],{"type":47,"value":93},"Deployment Stacks",{"type":47,"value":95}," (recommended) + ",{"type":41,"tag":54,"props":97,"children":98},{},[99],{"type":47,"value":100},"Template Specs",{"type":47,"value":102}," before then. Authoritative dates, phased timeline, and FAQ: ",{"type":41,"tag":104,"props":105,"children":109},"a",{"href":106,"rel":107},"https:\u002F\u002Faka.ms\u002FAzureBlueprintsRetirement",[108],"nofollow",[110],{"type":47,"value":106},{"type":47,"value":112},".",{"type":41,"tag":114,"props":115,"children":116},"hr",{},[],{"type":41,"tag":118,"props":119,"children":121},"h2",{"id":120},"when-to-use-this-skill",[122],{"type":47,"value":123},"When to use this skill",{"type":41,"tag":50,"props":125,"children":126},{},[127],{"type":47,"value":128},"Invoke this skill whenever the user:",{"type":41,"tag":130,"props":131,"children":132},"ul",{},[133,139,144,149],{"type":41,"tag":134,"props":135,"children":136},"li",{},[137],{"type":47,"value":138},"Mentions Azure Blueprints, blueprint definitions, blueprint assignments, blueprint locks, or the Blueprints retirement.",{"type":41,"tag":134,"props":140,"children":141},{},[142],{"type":47,"value":143},"Asks for a migration plan, \"what replaces Blueprints?\", or how to move governance from Blueprints to ARM\u002FBicep tooling.",{"type":41,"tag":134,"props":145,"children":146},{},[147],{"type":47,"value":148},"Needs to export, convert, or re-deploy resources currently managed by Blueprints.",{"type":41,"tag":134,"props":150,"children":151},{},[152],{"type":47,"value":153},"Asks about Template Specs or Deployment Stacks in the context of replacing Blueprints.",{"type":41,"tag":50,"props":155,"children":156},{},[157,159,164],{"type":47,"value":158},"If the user is asking a general ARM\u002FBicep question with no Blueprints context, do ",{"type":41,"tag":54,"props":160,"children":161},{},[162],{"type":47,"value":163},"not",{"type":47,"value":165}," load this skill.",{"type":41,"tag":114,"props":167,"children":168},{},[],{"type":41,"tag":118,"props":170,"children":172},{"id":171},"operating-principles-read-first",[173],{"type":47,"value":174},"Operating principles (read first)",{"type":41,"tag":176,"props":177,"children":178},"ol",{},[179,189,199,209,219,249],{"type":41,"tag":134,"props":180,"children":181},{},[182,187],{"type":41,"tag":54,"props":183,"children":184},{},[185],{"type":47,"value":186},"Stacks over Template Specs alone.",{"type":47,"value":188}," Use Template Specs as the storage\u002Fversioning layer; deploy via Deployment Stacks to preserve assignment-like lifecycle behavior. Recommend Template Spec–only deployment only when the user explicitly has no need for resource tracking or deny-settings.",{"type":41,"tag":134,"props":190,"children":191},{},[192,197],{"type":41,"tag":54,"props":193,"children":194},{},[195],{"type":47,"value":196},"Do not auto-migrate.",{"type":47,"value":198}," Always confirm scope, parameters, and lock parity with the user before producing or running deployment commands. Migration is customer-driven.",{"type":41,"tag":134,"props":200,"children":201},{},[202,207],{"type":41,"tag":54,"props":203,"children":204},{},[205],{"type":47,"value":206},"Cutover is destructive.",{"type":47,"value":208}," Removing a Blueprint assignment can remove embedded policy assignments. Always sequence: deploy new Stack → verify → re-assign decoupled policies if needed → only then remove the Blueprint assignment.",{"type":41,"tag":134,"props":210,"children":211},{},[212,217],{"type":41,"tag":54,"props":213,"children":214},{},[215],{"type":47,"value":216},"Never invent IDs.",{"type":47,"value":218}," If the user hasn't provided a management group ID, subscription ID, blueprint name, or version, ask before generating commands.",{"type":41,"tag":134,"props":220,"children":221},{},[222,227,229,234,235,240,242,247],{"type":41,"tag":54,"props":223,"children":224},{},[225],{"type":47,"value":226},"Surface the retirement dates.",{"type":47,"value":228}," When users plan timelines, remind them Azure Blueprints (preview) ",{"type":41,"tag":54,"props":230,"children":231},{},[232],{"type":47,"value":233},"retires January 31, 2027",{"type":47,"value":74},{"type":41,"tag":54,"props":236,"children":237},{},[238],{"type":47,"value":239},"phased retirement starting July 31, 2026",{"type":47,"value":241}," — so complete migration and export definitions before then. Link to ",{"type":41,"tag":104,"props":243,"children":245},{"href":106,"rel":244},[108],[246],{"type":47,"value":106},{"type":47,"value":248}," for the phased timeline.",{"type":41,"tag":134,"props":250,"children":251},{},[252,257,259,264,266,271,273,280,282,287,289,295],{"type":41,"tag":54,"props":253,"children":254},{},[255],{"type":47,"value":256},"Definitions count too, not just assignments.",{"type":47,"value":258}," The retirement recommendation flags ",{"type":41,"tag":54,"props":260,"children":261},{},[262],{"type":47,"value":263},"every",{"type":47,"value":265}," blueprint definition and published version — not only assignments. Unassigned definitions deploy nothing, but they still must be handled (convert to a Template Spec, or export-and-archive) and then ",{"type":41,"tag":54,"props":267,"children":268},{},[269],{"type":47,"value":270},"deleted",{"type":47,"value":272}," to clear the recommendation. Inventory with ",{"type":41,"tag":274,"props":275,"children":277},"code",{"className":276},[],[278],{"type":47,"value":279},"Get-AzBlueprint",{"type":47,"value":281}," at ",{"type":41,"tag":54,"props":283,"children":284},{},[285],{"type":47,"value":286},"each subscription and management group",{"type":47,"value":288},", not just ",{"type":41,"tag":274,"props":290,"children":292},{"className":291},[],[293],{"type":47,"value":294},"Get-AzBlueprintAssignment",{"type":47,"value":112},{"type":41,"tag":114,"props":297,"children":298},{},[],{"type":41,"tag":118,"props":300,"children":302},{"id":301},"inputs-to-gather-from-the-user",[303],{"type":47,"value":304},"Inputs to gather from the user",{"type":41,"tag":50,"props":306,"children":307},{},[308],{"type":47,"value":309},"Before producing any migration plan or commands, collect:",{"type":41,"tag":130,"props":311,"children":312},{},[313,323,347,387,397,407,417],{"type":41,"tag":134,"props":314,"children":315},{},[316,321],{"type":41,"tag":54,"props":317,"children":318},{},[319],{"type":47,"value":320},"Scope",{"type":47,"value":322}," — management group ID, subscription IDs, and\u002For resource group names involved.",{"type":41,"tag":134,"props":324,"children":325},{},[326,331,333,338,340,345],{"type":41,"tag":54,"props":327,"children":328},{},[329],{"type":47,"value":330},"Blueprint inventory",{"type":47,"value":332}," — definition names + versions, and which subscriptions\u002FMGs they're assigned to. Offer to help inventory via ",{"type":41,"tag":274,"props":334,"children":336},{"className":335},[],[337],{"type":47,"value":279},{"type":47,"value":339}," \u002F ",{"type":41,"tag":274,"props":341,"children":343},{"className":342},[],[344],{"type":47,"value":294},{"type":47,"value":346}," if unknown.",{"type":41,"tag":134,"props":348,"children":349},{},[350,355,357,363,364,370,371,377,379,385],{"type":41,"tag":54,"props":351,"children":352},{},[353],{"type":47,"value":354},"Lock mode in use",{"type":47,"value":356}," — ",{"type":41,"tag":274,"props":358,"children":360},{"className":359},[],[361],{"type":47,"value":362},"None",{"type":47,"value":339},{"type":41,"tag":274,"props":365,"children":367},{"className":366},[],[368],{"type":47,"value":369},"AllResourcesReadOnly",{"type":47,"value":339},{"type":41,"tag":274,"props":372,"children":374},{"className":373},[],[375],{"type":47,"value":376},"AllResourcesDoNotDelete",{"type":47,"value":378},". This drives the Stack ",{"type":41,"tag":274,"props":380,"children":382},{"className":381},[],[383],{"type":47,"value":384},"denySettings",{"type":47,"value":386}," choice.",{"type":41,"tag":134,"props":388,"children":389},{},[390,395],{"type":41,"tag":54,"props":391,"children":392},{},[393],{"type":47,"value":394},"Identity",{"type":47,"value":396}," — system-assigned vs. user-assigned managed identity used by the assignment.",{"type":41,"tag":134,"props":398,"children":399},{},[400,405],{"type":41,"tag":54,"props":401,"children":402},{},[403],{"type":47,"value":404},"Policy posture",{"type":47,"value":406}," — whether policies embedded in the blueprint are app-specific (keep in template) or baseline (lift to a standalone Initiative).",{"type":41,"tag":134,"props":408,"children":409},{},[410,415],{"type":41,"tag":54,"props":411,"children":412},{},[413],{"type":47,"value":414},"Target tooling",{"type":47,"value":416}," — Bicep (recommended) or ARM JSON.",{"type":41,"tag":134,"props":418,"children":419},{},[420,425],{"type":41,"tag":54,"props":421,"children":422},{},[423],{"type":47,"value":424},"Production tolerance",{"type":47,"value":426}," — sandbox available? Side-by-side acceptable? Or strict adopt-in-place required?",{"type":41,"tag":50,"props":428,"children":429},{},[430],{"type":47,"value":431},"If any of these are unknown, ask the user before proceeding.",{"type":41,"tag":114,"props":433,"children":434},{},[],{"type":41,"tag":118,"props":436,"children":438},{"id":437},"tldr-what-replaces-what",[439],{"type":47,"value":440},"TL;DR — What replaces what",{"type":41,"tag":442,"props":443,"children":444},"table",{},[445,469],{"type":41,"tag":446,"props":447,"children":448},"thead",{},[449],{"type":41,"tag":450,"props":451,"children":452},"tr",{},[453,459,464],{"type":41,"tag":454,"props":455,"children":456},"th",{},[457],{"type":47,"value":458},"Blueprints concept",{"type":41,"tag":454,"props":460,"children":461},{},[462],{"type":47,"value":463},"Recommended replacement",{"type":41,"tag":454,"props":465,"children":466},{},[467],{"type":47,"value":468},"Why",{"type":41,"tag":470,"props":471,"children":472},"tbody",{},[473,500,531,574,595,629],{"type":41,"tag":450,"props":474,"children":475},{},[476,487,495],{"type":41,"tag":477,"props":478,"children":479},"td",{},[480,485],{"type":41,"tag":54,"props":481,"children":482},{},[483],{"type":47,"value":484},"Blueprint Definition",{"type":47,"value":486}," (package of artifacts: ARM templates, policy assignments, RBAC, resource groups)",{"type":41,"tag":477,"props":488,"children":489},{},[490],{"type":41,"tag":54,"props":491,"children":492},{},[493],{"type":47,"value":494},"Template Spec",{"type":41,"tag":477,"props":496,"children":497},{},[498],{"type":47,"value":499},"Stores and versions ARM\u002FBicep templates as first-class Azure resources; closest parity to a Blueprint Definition.",{"type":41,"tag":450,"props":501,"children":502},{},[503,513,521],{"type":41,"tag":477,"props":504,"children":505},{},[506,511],{"type":41,"tag":54,"props":507,"children":508},{},[509],{"type":47,"value":510},"Blueprint Assignment",{"type":47,"value":512}," (deployment instance + lifecycle binding to a subscription\u002FMG)",{"type":41,"tag":477,"props":514,"children":515},{},[516],{"type":41,"tag":54,"props":517,"children":518},{},[519],{"type":47,"value":520},"Deployment Stack",{"type":41,"tag":477,"props":522,"children":523},{},[524,526],{"type":47,"value":525},"Tracks the resources it creates, supports deny-settings (parity to Blueprint locks\u002Fdeny-assignments), and lets you update\u002Fdelete the whole set as one unit. ",{"type":41,"tag":54,"props":527,"children":528},{},[529],{"type":47,"value":530},"Preferred end-state.",{"type":41,"tag":450,"props":532,"children":533},{},[534,542,555],{"type":41,"tag":477,"props":535,"children":536},{},[537],{"type":41,"tag":54,"props":538,"children":539},{},[540],{"type":47,"value":541},"Blueprint locks \u002F deny-assignments",{"type":41,"tag":477,"props":543,"children":544},{},[545],{"type":41,"tag":54,"props":546,"children":547},{},[548,550],{"type":47,"value":549},"Deployment Stack ",{"type":41,"tag":274,"props":551,"children":553},{"className":552},[],[554],{"type":47,"value":384},{"type":41,"tag":477,"props":556,"children":557},{},[558,564,566,572],{"type":41,"tag":274,"props":559,"children":561},{"className":560},[],[562],{"type":47,"value":563},"denyDelete",{"type":47,"value":565}," or ",{"type":41,"tag":274,"props":567,"children":569},{"className":568},[],[570],{"type":47,"value":571},"denyWriteAndDelete",{"type":47,"value":573}," modes reproduce the protective behavior with first-class tooling.",{"type":41,"tag":450,"props":575,"children":576},{},[577,585,590],{"type":41,"tag":477,"props":578,"children":579},{},[580],{"type":41,"tag":54,"props":581,"children":582},{},[583],{"type":47,"value":584},"Blueprint parameters",{"type":41,"tag":477,"props":586,"children":587},{},[588],{"type":47,"value":589},"Template Spec \u002F Stack parameters",{"type":41,"tag":477,"props":591,"children":592},{},[593],{"type":47,"value":594},"Direct 1:1; pass the same values through the new deployment call.",{"type":41,"tag":450,"props":596,"children":597},{},[598,606,624],{"type":41,"tag":477,"props":599,"children":600},{},[601],{"type":41,"tag":54,"props":602,"children":603},{},[604],{"type":47,"value":605},"Sequenced artifact ordering",{"type":41,"tag":477,"props":607,"children":608},{},[609,611,617,619],{"type":47,"value":610},"Bicep ",{"type":41,"tag":274,"props":612,"children":614},{"className":613},[],[615],{"type":47,"value":616},"dependsOn",{"type":47,"value":618}," \u002F ARM ",{"type":41,"tag":274,"props":620,"children":622},{"className":621},[],[623],{"type":47,"value":616},{"type":41,"tag":477,"props":625,"children":626},{},[627],{"type":47,"value":628},"Express ordering in the template rather than via Blueprint artifact sequence.",{"type":41,"tag":450,"props":630,"children":631},{},[632,640,652],{"type":41,"tag":477,"props":633,"children":634},{},[635],{"type":41,"tag":54,"props":636,"children":637},{},[638],{"type":47,"value":639},"Policy assignments inside a Blueprint",{"type":41,"tag":477,"props":641,"children":642},{},[643,645,650],{"type":47,"value":644},"Standalone policy assignment ",{"type":41,"tag":54,"props":646,"children":647},{},[648],{"type":47,"value":649},"or",{"type":47,"value":651}," Azure Policy initiative (preferred for shared baselines)",{"type":41,"tag":477,"props":653,"children":654},{},[655],{"type":47,"value":656},"Decouple policy from app\u002Finfra deployment so it can be managed independently.",{"type":41,"tag":114,"props":658,"children":659},{},[],{"type":41,"tag":118,"props":661,"children":663},{"id":662},"decision-tree",[664],{"type":47,"value":665},"Decision tree",{"type":41,"tag":667,"props":668,"children":673},"pre",{"className":669,"code":670,"language":671,"meta":672,"style":672},"language-mermaid shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","flowchart TD\n  A[Have an Azure Blueprint today?] --> B{Definition or\u003Cbr\u002F>Assignment?}\n  B -->|Definition only\u003Cbr\u002F>(reusable template)| C[Migrate to\u003Cbr\u002F>Template Spec]\n  B -->|Assignment\u003Cbr\u002F>(deployed instance)| D{Need lifecycle\u003Cbr\u002F>tracking + deny-locks?}\n  D -->|Yes| E[Deploy via\u003Cbr\u002F>Deployment Stack\u003Cbr\u002F>with denySettings]\n  D -->|No, one-shot| F[Deploy from\u003Cbr\u002F>Template Spec directly]\n  C --> G[Done — versioned,\u003Cbr\u002F>shareable template]\n  E --> H[Done — tracked,\u003Cbr\u002F>protected, updatable]\n  F --> H\n\n  style E fill:#cfe8ff,stroke:#0078d4,stroke-width:2px\n  style C fill:#e6f4ea,stroke:#188038,stroke-width:2px\n","mermaid","",[674],{"type":41,"tag":274,"props":675,"children":676},{"__ignoreMap":672},[677,688,697,706,715,724,733,742,751,760,770,779],{"type":41,"tag":678,"props":679,"children":682},"span",{"class":680,"line":681},"line",1,[683],{"type":41,"tag":678,"props":684,"children":685},{},[686],{"type":47,"value":687},"flowchart TD\n",{"type":41,"tag":678,"props":689,"children":691},{"class":680,"line":690},2,[692],{"type":41,"tag":678,"props":693,"children":694},{},[695],{"type":47,"value":696},"  A[Have an Azure Blueprint today?] --> B{Definition or\u003Cbr\u002F>Assignment?}\n",{"type":41,"tag":678,"props":698,"children":700},{"class":680,"line":699},3,[701],{"type":41,"tag":678,"props":702,"children":703},{},[704],{"type":47,"value":705},"  B -->|Definition only\u003Cbr\u002F>(reusable template)| C[Migrate to\u003Cbr\u002F>Template Spec]\n",{"type":41,"tag":678,"props":707,"children":709},{"class":680,"line":708},4,[710],{"type":41,"tag":678,"props":711,"children":712},{},[713],{"type":47,"value":714},"  B -->|Assignment\u003Cbr\u002F>(deployed instance)| D{Need lifecycle\u003Cbr\u002F>tracking + deny-locks?}\n",{"type":41,"tag":678,"props":716,"children":718},{"class":680,"line":717},5,[719],{"type":41,"tag":678,"props":720,"children":721},{},[722],{"type":47,"value":723},"  D -->|Yes| E[Deploy via\u003Cbr\u002F>Deployment Stack\u003Cbr\u002F>with denySettings]\n",{"type":41,"tag":678,"props":725,"children":727},{"class":680,"line":726},6,[728],{"type":41,"tag":678,"props":729,"children":730},{},[731],{"type":47,"value":732},"  D -->|No, one-shot| F[Deploy from\u003Cbr\u002F>Template Spec directly]\n",{"type":41,"tag":678,"props":734,"children":736},{"class":680,"line":735},7,[737],{"type":41,"tag":678,"props":738,"children":739},{},[740],{"type":47,"value":741},"  C --> G[Done — versioned,\u003Cbr\u002F>shareable template]\n",{"type":41,"tag":678,"props":743,"children":745},{"class":680,"line":744},8,[746],{"type":41,"tag":678,"props":747,"children":748},{},[749],{"type":47,"value":750},"  E --> H[Done — tracked,\u003Cbr\u002F>protected, updatable]\n",{"type":41,"tag":678,"props":752,"children":754},{"class":680,"line":753},9,[755],{"type":41,"tag":678,"props":756,"children":757},{},[758],{"type":47,"value":759},"  F --> H\n",{"type":41,"tag":678,"props":761,"children":763},{"class":680,"line":762},10,[764],{"type":41,"tag":678,"props":765,"children":767},{"emptyLinePlaceholder":766},true,[768],{"type":47,"value":769},"\n",{"type":41,"tag":678,"props":771,"children":773},{"class":680,"line":772},11,[774],{"type":41,"tag":678,"props":775,"children":776},{},[777],{"type":47,"value":778},"  style E fill:#cfe8ff,stroke:#0078d4,stroke-width:2px\n",{"type":41,"tag":678,"props":780,"children":782},{"class":680,"line":781},12,[783],{"type":41,"tag":678,"props":784,"children":785},{},[786],{"type":47,"value":787},"  style C fill:#e6f4ea,stroke:#188038,stroke-width:2px\n",{"type":41,"tag":114,"props":789,"children":790},{},[],{"type":41,"tag":118,"props":792,"children":794},{"id":793},"end-to-end-migration-flow",[795],{"type":47,"value":796},"End-to-end migration flow",{"type":41,"tag":667,"props":798,"children":800},{"className":669,"code":799,"language":671,"meta":672,"style":672},"flowchart LR\n  subgraph Today[\"Today — Azure Blueprints\"]\n    BD[Blueprint\u003Cbr\u002F>Definition]\n    BA[Blueprint\u003Cbr\u002F>Assignment]\n    BL[Locks \u002F Deny\u003Cbr\u002F>Assignments]\n    BD --> BA\n    BA --> BL\n  end\n\n  subgraph Migration[\"Migration steps\"]\n    INV[1. Inventory\u003Cbr\u002F>blueprints]\n    EXT[2. Export\u003Cbr\u002F>definition JSON]\n    CONV[3. Convert artifacts\u003Cbr\u002F>to Bicep\u002FARM]\n    POL[4. Split policies\u003Cbr\u002F>into Policy \u002F Initiative]\n    TS[5. Publish\u003Cbr\u002F>Template Spec]\n    STK[6. Deploy via\u003Cbr\u002F>Deployment Stack]\n    VAL[7. Validate\u003Cbr\u002F>in non-prod]\n    CUT[8. Cut over\u003Cbr\u002F>+ remove BP assignment]\n  end\n\n  subgraph Future[\"Future state\"]\n    TSF[Template Spec\u003Cbr\u002F>(versioned package)]\n    STKF[Deployment Stack\u003Cbr\u002F>(tracked resources)]\n    DEN[denySettings\u003Cbr\u002F>(deny-delete)]\n    POLF[Policy Assignment\u003Cbr\u002F>\u002F Initiative]\n    TSF --> STKF\n    STKF --> DEN\n  end\n\n  BD -.->|maps to| TSF\n  BA -.->|maps to| STKF\n  BL -.->|maps to| DEN\n\n  INV --> EXT --> CONV --> POL --> TS --> STK --> VAL --> CUT\n  CUT --> STKF\n",[801],{"type":41,"tag":274,"props":802,"children":803},{"__ignoreMap":672},[804,812,820,828,836,844,852,860,868,875,883,891,899,908,917,926,935,944,953,961,969,978,987,996,1005,1014,1023,1032,1040,1048,1057,1066,1075,1083,1092],{"type":41,"tag":678,"props":805,"children":806},{"class":680,"line":681},[807],{"type":41,"tag":678,"props":808,"children":809},{},[810],{"type":47,"value":811},"flowchart LR\n",{"type":41,"tag":678,"props":813,"children":814},{"class":680,"line":690},[815],{"type":41,"tag":678,"props":816,"children":817},{},[818],{"type":47,"value":819},"  subgraph Today[\"Today — Azure Blueprints\"]\n",{"type":41,"tag":678,"props":821,"children":822},{"class":680,"line":699},[823],{"type":41,"tag":678,"props":824,"children":825},{},[826],{"type":47,"value":827},"    BD[Blueprint\u003Cbr\u002F>Definition]\n",{"type":41,"tag":678,"props":829,"children":830},{"class":680,"line":708},[831],{"type":41,"tag":678,"props":832,"children":833},{},[834],{"type":47,"value":835},"    BA[Blueprint\u003Cbr\u002F>Assignment]\n",{"type":41,"tag":678,"props":837,"children":838},{"class":680,"line":717},[839],{"type":41,"tag":678,"props":840,"children":841},{},[842],{"type":47,"value":843},"    BL[Locks \u002F Deny\u003Cbr\u002F>Assignments]\n",{"type":41,"tag":678,"props":845,"children":846},{"class":680,"line":726},[847],{"type":41,"tag":678,"props":848,"children":849},{},[850],{"type":47,"value":851},"    BD --> BA\n",{"type":41,"tag":678,"props":853,"children":854},{"class":680,"line":735},[855],{"type":41,"tag":678,"props":856,"children":857},{},[858],{"type":47,"value":859},"    BA --> BL\n",{"type":41,"tag":678,"props":861,"children":862},{"class":680,"line":744},[863],{"type":41,"tag":678,"props":864,"children":865},{},[866],{"type":47,"value":867},"  end\n",{"type":41,"tag":678,"props":869,"children":870},{"class":680,"line":753},[871],{"type":41,"tag":678,"props":872,"children":873},{"emptyLinePlaceholder":766},[874],{"type":47,"value":769},{"type":41,"tag":678,"props":876,"children":877},{"class":680,"line":762},[878],{"type":41,"tag":678,"props":879,"children":880},{},[881],{"type":47,"value":882},"  subgraph Migration[\"Migration steps\"]\n",{"type":41,"tag":678,"props":884,"children":885},{"class":680,"line":772},[886],{"type":41,"tag":678,"props":887,"children":888},{},[889],{"type":47,"value":890},"    INV[1. Inventory\u003Cbr\u002F>blueprints]\n",{"type":41,"tag":678,"props":892,"children":893},{"class":680,"line":781},[894],{"type":41,"tag":678,"props":895,"children":896},{},[897],{"type":47,"value":898},"    EXT[2. Export\u003Cbr\u002F>definition JSON]\n",{"type":41,"tag":678,"props":900,"children":902},{"class":680,"line":901},13,[903],{"type":41,"tag":678,"props":904,"children":905},{},[906],{"type":47,"value":907},"    CONV[3. Convert artifacts\u003Cbr\u002F>to Bicep\u002FARM]\n",{"type":41,"tag":678,"props":909,"children":911},{"class":680,"line":910},14,[912],{"type":41,"tag":678,"props":913,"children":914},{},[915],{"type":47,"value":916},"    POL[4. Split policies\u003Cbr\u002F>into Policy \u002F Initiative]\n",{"type":41,"tag":678,"props":918,"children":920},{"class":680,"line":919},15,[921],{"type":41,"tag":678,"props":922,"children":923},{},[924],{"type":47,"value":925},"    TS[5. Publish\u003Cbr\u002F>Template Spec]\n",{"type":41,"tag":678,"props":927,"children":929},{"class":680,"line":928},16,[930],{"type":41,"tag":678,"props":931,"children":932},{},[933],{"type":47,"value":934},"    STK[6. Deploy via\u003Cbr\u002F>Deployment Stack]\n",{"type":41,"tag":678,"props":936,"children":938},{"class":680,"line":937},17,[939],{"type":41,"tag":678,"props":940,"children":941},{},[942],{"type":47,"value":943},"    VAL[7. Validate\u003Cbr\u002F>in non-prod]\n",{"type":41,"tag":678,"props":945,"children":947},{"class":680,"line":946},18,[948],{"type":41,"tag":678,"props":949,"children":950},{},[951],{"type":47,"value":952},"    CUT[8. Cut over\u003Cbr\u002F>+ remove BP assignment]\n",{"type":41,"tag":678,"props":954,"children":956},{"class":680,"line":955},19,[957],{"type":41,"tag":678,"props":958,"children":959},{},[960],{"type":47,"value":867},{"type":41,"tag":678,"props":962,"children":964},{"class":680,"line":963},20,[965],{"type":41,"tag":678,"props":966,"children":967},{"emptyLinePlaceholder":766},[968],{"type":47,"value":769},{"type":41,"tag":678,"props":970,"children":972},{"class":680,"line":971},21,[973],{"type":41,"tag":678,"props":974,"children":975},{},[976],{"type":47,"value":977},"  subgraph Future[\"Future state\"]\n",{"type":41,"tag":678,"props":979,"children":981},{"class":680,"line":980},22,[982],{"type":41,"tag":678,"props":983,"children":984},{},[985],{"type":47,"value":986},"    TSF[Template Spec\u003Cbr\u002F>(versioned package)]\n",{"type":41,"tag":678,"props":988,"children":990},{"class":680,"line":989},23,[991],{"type":41,"tag":678,"props":992,"children":993},{},[994],{"type":47,"value":995},"    STKF[Deployment Stack\u003Cbr\u002F>(tracked resources)]\n",{"type":41,"tag":678,"props":997,"children":999},{"class":680,"line":998},24,[1000],{"type":41,"tag":678,"props":1001,"children":1002},{},[1003],{"type":47,"value":1004},"    DEN[denySettings\u003Cbr\u002F>(deny-delete)]\n",{"type":41,"tag":678,"props":1006,"children":1008},{"class":680,"line":1007},25,[1009],{"type":41,"tag":678,"props":1010,"children":1011},{},[1012],{"type":47,"value":1013},"    POLF[Policy Assignment\u003Cbr\u002F>\u002F Initiative]\n",{"type":41,"tag":678,"props":1015,"children":1017},{"class":680,"line":1016},26,[1018],{"type":41,"tag":678,"props":1019,"children":1020},{},[1021],{"type":47,"value":1022},"    TSF --> STKF\n",{"type":41,"tag":678,"props":1024,"children":1026},{"class":680,"line":1025},27,[1027],{"type":41,"tag":678,"props":1028,"children":1029},{},[1030],{"type":47,"value":1031},"    STKF --> DEN\n",{"type":41,"tag":678,"props":1033,"children":1035},{"class":680,"line":1034},28,[1036],{"type":41,"tag":678,"props":1037,"children":1038},{},[1039],{"type":47,"value":867},{"type":41,"tag":678,"props":1041,"children":1043},{"class":680,"line":1042},29,[1044],{"type":41,"tag":678,"props":1045,"children":1046},{"emptyLinePlaceholder":766},[1047],{"type":47,"value":769},{"type":41,"tag":678,"props":1049,"children":1051},{"class":680,"line":1050},30,[1052],{"type":41,"tag":678,"props":1053,"children":1054},{},[1055],{"type":47,"value":1056},"  BD -.->|maps to| TSF\n",{"type":41,"tag":678,"props":1058,"children":1060},{"class":680,"line":1059},31,[1061],{"type":41,"tag":678,"props":1062,"children":1063},{},[1064],{"type":47,"value":1065},"  BA -.->|maps to| STKF\n",{"type":41,"tag":678,"props":1067,"children":1069},{"class":680,"line":1068},32,[1070],{"type":41,"tag":678,"props":1071,"children":1072},{},[1073],{"type":47,"value":1074},"  BL -.->|maps to| DEN\n",{"type":41,"tag":678,"props":1076,"children":1078},{"class":680,"line":1077},33,[1079],{"type":41,"tag":678,"props":1080,"children":1081},{"emptyLinePlaceholder":766},[1082],{"type":47,"value":769},{"type":41,"tag":678,"props":1084,"children":1086},{"class":680,"line":1085},34,[1087],{"type":41,"tag":678,"props":1088,"children":1089},{},[1090],{"type":47,"value":1091},"  INV --> EXT --> CONV --> POL --> TS --> STK --> VAL --> CUT\n",{"type":41,"tag":678,"props":1093,"children":1095},{"class":680,"line":1094},35,[1096],{"type":41,"tag":678,"props":1097,"children":1098},{},[1099],{"type":47,"value":1100},"  CUT --> STKF\n",{"type":41,"tag":114,"props":1102,"children":1103},{},[],{"type":41,"tag":118,"props":1105,"children":1107},{"id":1106},"how-to-drive-a-migration-step-by-step-instructions-for-the-ai",[1108],{"type":47,"value":1109},"How to drive a migration (step-by-step instructions for the AI)",{"type":41,"tag":50,"props":1111,"children":1112},{},[1113,1115,1120,1122,1127,1129,1134,1136,1141],{"type":47,"value":1114},"For each step, ",{"type":41,"tag":54,"props":1116,"children":1117},{},[1118],{"type":47,"value":1119},"(a)",{"type":47,"value":1121}," explain to the user what you're about to do, ",{"type":41,"tag":54,"props":1123,"children":1124},{},[1125],{"type":47,"value":1126},"(b)",{"type":47,"value":1128}," ask any missing inputs, ",{"type":41,"tag":54,"props":1130,"children":1131},{},[1132],{"type":47,"value":1133},"(c)",{"type":47,"value":1135}," produce the command or artifact, ",{"type":41,"tag":54,"props":1137,"children":1138},{},[1139],{"type":47,"value":1140},"(d)",{"type":47,"value":1142}," wait for the user to run it and report results before moving on.",{"type":41,"tag":1144,"props":1145,"children":1147},"h3",{"id":1146},"step-1-inventory-existing-blueprints",[1148],{"type":47,"value":1149},"Step 1 — Inventory existing Blueprints",{"type":41,"tag":50,"props":1151,"children":1152},{},[1153],{"type":47,"value":1154},"Ask for the management group ID and subscription ID, then produce:",{"type":41,"tag":667,"props":1156,"children":1160},{"className":1157,"code":1158,"language":1159,"meta":672,"style":672},"language-powershell shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","Get-AzBlueprint -ManagementGroupId \"\u003Cmg-id>\" | Select-Object Name, Id, Versions\nGet-AzBlueprintAssignment -SubscriptionId \"\u003Csub-id>\"\n","powershell",[1161],{"type":41,"tag":274,"props":1162,"children":1163},{"__ignoreMap":672},[1164,1172],{"type":41,"tag":678,"props":1165,"children":1166},{"class":680,"line":681},[1167],{"type":41,"tag":678,"props":1168,"children":1169},{},[1170],{"type":47,"value":1171},"Get-AzBlueprint -ManagementGroupId \"\u003Cmg-id>\" | Select-Object Name, Id, Versions\n",{"type":41,"tag":678,"props":1173,"children":1174},{"class":680,"line":690},[1175],{"type":41,"tag":678,"props":1176,"children":1177},{},[1178],{"type":47,"value":1179},"Get-AzBlueprintAssignment -SubscriptionId \"\u003Csub-id>\"\n",{"type":41,"tag":50,"props":1181,"children":1182},{},[1183],{"type":47,"value":1184},"For each blueprint, capture: definition ID, latest published version, scopes assigned, assignment parameter values, lock mode, identity.",{"type":41,"tag":1144,"props":1186,"children":1188},{"id":1187},"step-2-export-the-blueprint-definition",[1189],{"type":47,"value":1190},"Step 2 — Export the Blueprint definition",{"type":41,"tag":667,"props":1192,"children":1194},{"className":1157,"code":1193,"language":1159,"meta":672,"style":672},"$bp = Get-AzBlueprint -ManagementGroupId \"\u003Cmg-id>\" -Name \"\u003Cblueprint-name>\" -LatestPublished\nExport-AzBlueprintWithArtifact -Blueprint $bp -OutputPath \".\\exports\\\u003Cblueprint-name>\"\n",[1195],{"type":41,"tag":274,"props":1196,"children":1197},{"__ignoreMap":672},[1198,1206],{"type":41,"tag":678,"props":1199,"children":1200},{"class":680,"line":681},[1201],{"type":41,"tag":678,"props":1202,"children":1203},{},[1204],{"type":47,"value":1205},"$bp = Get-AzBlueprint -ManagementGroupId \"\u003Cmg-id>\" -Name \"\u003Cblueprint-name>\" -LatestPublished\n",{"type":41,"tag":678,"props":1207,"children":1208},{"class":680,"line":690},[1209],{"type":41,"tag":678,"props":1210,"children":1211},{},[1212],{"type":47,"value":1213},"Export-AzBlueprintWithArtifact -Blueprint $bp -OutputPath \".\\exports\\\u003Cblueprint-name>\"\n",{"type":41,"tag":50,"props":1215,"children":1216},{},[1217,1219,1225],{"type":47,"value":1218},"Output is ",{"type":41,"tag":274,"props":1220,"children":1222},{"className":1221},[],[1223],{"type":47,"value":1224},"blueprint.json",{"type":47,"value":1226}," plus one JSON file per artifact. Confirm the export folder structure with the user before continuing.",{"type":41,"tag":1144,"props":1228,"children":1230},{"id":1229},"step-3-convert-artifacts-to-bicep-or-keep-as-arm",[1231],{"type":47,"value":1232},"Step 3 — Convert artifacts to Bicep (or keep as ARM)",{"type":41,"tag":50,"props":1234,"children":1235},{},[1236,1238,1244],{"type":47,"value":1237},"For each ",{"type":41,"tag":274,"props":1239,"children":1241},{"className":1240},[],[1242],{"type":47,"value":1243},"template",{"type":47,"value":1245}," artifact:",{"type":41,"tag":176,"props":1247,"children":1248},{},[1249,1262,1275,1296],{"type":41,"tag":134,"props":1250,"children":1251},{},[1252,1254,1260],{"type":47,"value":1253},"Save the embedded template to a ",{"type":41,"tag":274,"props":1255,"children":1257},{"className":1256},[],[1258],{"type":47,"value":1259},".json",{"type":47,"value":1261}," file.",{"type":41,"tag":134,"props":1263,"children":1264},{},[1265,1267,1273],{"type":47,"value":1266},"Decompile to Bicep (recommended): ",{"type":41,"tag":274,"props":1268,"children":1270},{"className":1269},[],[1271],{"type":47,"value":1272},"bicep decompile .\\template.json",{"type":47,"value":1274},". Decompiled output is a starting point — review and refactor it, since it is not always idiomatic.",{"type":41,"tag":134,"props":1276,"children":1277},{},[1278,1280,1286,1288,1294],{"type":47,"value":1279},"Combine related artifacts into a single ",{"type":41,"tag":274,"props":1281,"children":1283},{"className":1282},[],[1284],{"type":47,"value":1285},"main.bicep",{"type":47,"value":1287},", or keep modular with ",{"type":41,"tag":274,"props":1289,"children":1291},{"className":1290},[],[1292],{"type":47,"value":1293},"module",{"type":47,"value":1295}," references.",{"type":41,"tag":134,"props":1297,"children":1298},{},[1299,1301,1307,1309,1315],{"type":47,"value":1300},"Preserve the same parameters at the top level (",{"type":41,"tag":274,"props":1302,"children":1304},{"className":1303},[],[1305],{"type":47,"value":1306},"@description",{"type":47,"value":1308},", ",{"type":41,"tag":274,"props":1310,"children":1312},{"className":1311},[],[1313],{"type":47,"value":1314},"@allowed",{"type":47,"value":1316},", defaults).",{"type":41,"tag":50,"props":1318,"children":1319},{},[1320,1322,1328,1330,1336,1338,1344],{"type":47,"value":1321},"For RBAC artifacts: add ",{"type":41,"tag":274,"props":1323,"children":1325},{"className":1324},[],[1326],{"type":47,"value":1327},"Microsoft.Authorization\u002FroleAssignments",{"type":47,"value":1329}," resources with a deterministic ",{"type":41,"tag":274,"props":1331,"children":1333},{"className":1332},[],[1334],{"type":47,"value":1335},"guid()",{"type":47,"value":1337}," name.\nFor resource-group artifacts: model as ",{"type":41,"tag":274,"props":1339,"children":1341},{"className":1340},[],[1342],{"type":47,"value":1343},"Microsoft.Resources\u002FresourceGroups",{"type":47,"value":1345}," at subscription scope, or skip if the target RG already exists.",{"type":41,"tag":1144,"props":1347,"children":1349},{"id":1348},"step-4-decouple-policy-assignments",[1350],{"type":47,"value":1351},"Step 4 — Decouple policy assignments",{"type":41,"tag":130,"props":1353,"children":1354},{},[1355,1378],{"type":41,"tag":134,"props":1356,"children":1357},{},[1358,1363,1365,1370,1372,1376],{"type":41,"tag":54,"props":1359,"children":1360},{},[1361],{"type":47,"value":1362},"Shared baseline",{"type":47,"value":1364}," → publish as an Azure Policy ",{"type":41,"tag":54,"props":1366,"children":1367},{},[1368],{"type":47,"value":1369},"Initiative",{"type":47,"value":1371}," at the MG and assign once. The Stack\u002Ftemplate should ",{"type":41,"tag":54,"props":1373,"children":1374},{},[1375],{"type":47,"value":163},{"type":47,"value":1377}," re-assign baseline policies.",{"type":41,"tag":134,"props":1379,"children":1380},{},[1381,1386],{"type":41,"tag":54,"props":1382,"children":1383},{},[1384],{"type":47,"value":1385},"App-specific policy",{"type":47,"value":1387}," → keep inside the Bicep, assign at resource-group scope so it doesn't conflict with broader inheritance.",{"type":41,"tag":50,"props":1389,"children":1390},{},[1391,1393,1398],{"type":47,"value":1392},"Warn the user: removing the Blueprint assignment later will remove any policies embedded in it. Re-assign decoupled policies ",{"type":41,"tag":54,"props":1394,"children":1395},{},[1396],{"type":47,"value":1397},"before",{"type":47,"value":1399}," removing the Blueprint assignment.",{"type":41,"tag":1144,"props":1401,"children":1403},{"id":1402},"step-5-publish-a-template-spec",[1404],{"type":47,"value":1405},"Step 5 — Publish a Template Spec",{"type":41,"tag":667,"props":1407,"children":1409},{"className":1157,"code":1408,"language":1159,"meta":672,"style":672},"New-AzTemplateSpec `\n  -ResourceGroupName \"rg-templatespecs\" `\n  -Name \"landing-zone\" `\n  -Version \"1.0.0\" `\n  -Location \"eastus\" `\n  -TemplateFile \".\\main.bicep\"\n",[1410],{"type":41,"tag":274,"props":1411,"children":1412},{"__ignoreMap":672},[1413,1421,1429,1437,1445,1453],{"type":41,"tag":678,"props":1414,"children":1415},{"class":680,"line":681},[1416],{"type":41,"tag":678,"props":1417,"children":1418},{},[1419],{"type":47,"value":1420},"New-AzTemplateSpec `\n",{"type":41,"tag":678,"props":1422,"children":1423},{"class":680,"line":690},[1424],{"type":41,"tag":678,"props":1425,"children":1426},{},[1427],{"type":47,"value":1428},"  -ResourceGroupName \"rg-templatespecs\" `\n",{"type":41,"tag":678,"props":1430,"children":1431},{"class":680,"line":699},[1432],{"type":41,"tag":678,"props":1433,"children":1434},{},[1435],{"type":47,"value":1436},"  -Name \"landing-zone\" `\n",{"type":41,"tag":678,"props":1438,"children":1439},{"class":680,"line":708},[1440],{"type":41,"tag":678,"props":1441,"children":1442},{},[1443],{"type":47,"value":1444},"  -Version \"1.0.0\" `\n",{"type":41,"tag":678,"props":1446,"children":1447},{"class":680,"line":717},[1448],{"type":41,"tag":678,"props":1449,"children":1450},{},[1451],{"type":47,"value":1452},"  -Location \"eastus\" `\n",{"type":41,"tag":678,"props":1454,"children":1455},{"class":680,"line":726},[1456],{"type":41,"tag":678,"props":1457,"children":1458},{},[1459],{"type":47,"value":1460},"  -TemplateFile \".\\main.bicep\"\n",{"type":41,"tag":50,"props":1462,"children":1463},{},[1464,1466,1471],{"type":47,"value":1465},"This is the versioned, shareable, RBAC-scoped artifact that replaces the Blueprint definition as the ",{"type":41,"tag":54,"props":1467,"children":1468},{},[1469],{"type":47,"value":1470},"package",{"type":47,"value":112},{"type":41,"tag":1144,"props":1473,"children":1475},{"id":1474},"step-6-deploy-via-a-deployment-stack",[1476],{"type":47,"value":1477},"Step 6 — Deploy via a Deployment Stack",{"type":41,"tag":667,"props":1479,"children":1481},{"className":1157,"code":1480,"language":1159,"meta":672,"style":672},"# Retrieve the Template Spec version resource ID\n$ts = Get-AzTemplateSpec -ResourceGroupName \"rg-templatespecs\" -Name \"landing-zone\" -Version \"1.0.0\"\n\nNew-AzSubscriptionDeploymentStack `\n  -Name \"landing-zone-stack\" `\n  -Location \"eastus\" `\n  -TemplateSpecId $ts.Versions[0].Id `\n  -TemplateParameterFile \".\\params.json\" `\n  -DenySettingsMode \"denyDelete\" `\n  -ActionOnUnmanage \"detachAll\"\n",[1482],{"type":41,"tag":274,"props":1483,"children":1484},{"__ignoreMap":672},[1485,1493,1501,1508,1516,1524,1531,1539,1547,1555],{"type":41,"tag":678,"props":1486,"children":1487},{"class":680,"line":681},[1488],{"type":41,"tag":678,"props":1489,"children":1490},{},[1491],{"type":47,"value":1492},"# Retrieve the Template Spec version resource ID\n",{"type":41,"tag":678,"props":1494,"children":1495},{"class":680,"line":690},[1496],{"type":41,"tag":678,"props":1497,"children":1498},{},[1499],{"type":47,"value":1500},"$ts = Get-AzTemplateSpec -ResourceGroupName \"rg-templatespecs\" -Name \"landing-zone\" -Version \"1.0.0\"\n",{"type":41,"tag":678,"props":1502,"children":1503},{"class":680,"line":699},[1504],{"type":41,"tag":678,"props":1505,"children":1506},{"emptyLinePlaceholder":766},[1507],{"type":47,"value":769},{"type":41,"tag":678,"props":1509,"children":1510},{"class":680,"line":708},[1511],{"type":41,"tag":678,"props":1512,"children":1513},{},[1514],{"type":47,"value":1515},"New-AzSubscriptionDeploymentStack `\n",{"type":41,"tag":678,"props":1517,"children":1518},{"class":680,"line":717},[1519],{"type":41,"tag":678,"props":1520,"children":1521},{},[1522],{"type":47,"value":1523},"  -Name \"landing-zone-stack\" `\n",{"type":41,"tag":678,"props":1525,"children":1526},{"class":680,"line":726},[1527],{"type":41,"tag":678,"props":1528,"children":1529},{},[1530],{"type":47,"value":1452},{"type":41,"tag":678,"props":1532,"children":1533},{"class":680,"line":735},[1534],{"type":41,"tag":678,"props":1535,"children":1536},{},[1537],{"type":47,"value":1538},"  -TemplateSpecId $ts.Versions[0].Id `\n",{"type":41,"tag":678,"props":1540,"children":1541},{"class":680,"line":744},[1542],{"type":41,"tag":678,"props":1543,"children":1544},{},[1545],{"type":47,"value":1546},"  -TemplateParameterFile \".\\params.json\" `\n",{"type":41,"tag":678,"props":1548,"children":1549},{"class":680,"line":753},[1550],{"type":41,"tag":678,"props":1551,"children":1552},{},[1553],{"type":47,"value":1554},"  -DenySettingsMode \"denyDelete\" `\n",{"type":41,"tag":678,"props":1556,"children":1557},{"class":680,"line":762},[1558],{"type":41,"tag":678,"props":1559,"children":1560},{},[1561],{"type":47,"value":1562},"  -ActionOnUnmanage \"detachAll\"\n",{"type":41,"tag":50,"props":1564,"children":1565},{},[1566],{"type":47,"value":1567},"Decision points to surface to the user:",{"type":41,"tag":130,"props":1569,"children":1570},{},[1571,1603,1638],{"type":41,"tag":134,"props":1572,"children":1573},{},[1574,1580,1582,1588,1590,1595,1596,1601],{"type":41,"tag":274,"props":1575,"children":1577},{"className":1576},[],[1578],{"type":47,"value":1579},"-DenySettingsMode",{"type":47,"value":1581}," → ",{"type":41,"tag":274,"props":1583,"children":1585},{"className":1584},[],[1586],{"type":47,"value":1587},"none",{"type":47,"value":1589}," | ",{"type":41,"tag":274,"props":1591,"children":1593},{"className":1592},[],[1594],{"type":47,"value":563},{"type":47,"value":1589},{"type":41,"tag":274,"props":1597,"children":1599},{"className":1598},[],[1600],{"type":47,"value":571},{"type":47,"value":1602},". Map to the old lock mode (see mapping table below).",{"type":41,"tag":134,"props":1604,"children":1605},{},[1606,1612,1614,1620,1622,1628,1630,1636],{"type":41,"tag":274,"props":1607,"children":1609},{"className":1608},[],[1610],{"type":47,"value":1611},"-ActionOnUnmanage",{"type":47,"value":1613}," → controls what happens to resources when you ",{"type":41,"tag":1615,"props":1616,"children":1617},"em",{},[1618],{"type":47,"value":1619},"delete",{"type":47,"value":1621}," the stack, or when a resource drops out of the template. Use ",{"type":41,"tag":274,"props":1623,"children":1625},{"className":1624},[],[1626],{"type":47,"value":1627},"detachAll",{"type":47,"value":1629}," during pilot; switch to ",{"type":41,"tag":274,"props":1631,"children":1633},{"className":1632},[],[1634],{"type":47,"value":1635},"deleteResources",{"type":47,"value":1637}," for full-lifecycle parity with a Blueprint assignment delete.",{"type":41,"tag":134,"props":1639,"children":1640},{},[1641,1643,1649],{"type":47,"value":1642},"For management-group scope use ",{"type":41,"tag":274,"props":1644,"children":1646},{"className":1645},[],[1647],{"type":47,"value":1648},"New-AzManagementGroupDeploymentStack",{"type":47,"value":1650}," instead.",{"type":41,"tag":1652,"props":1653,"children":1654},"blockquote",{},[1655],{"type":41,"tag":50,"props":1656,"children":1657},{},[1658,1663,1665,1671,1673,1679],{"type":41,"tag":54,"props":1659,"children":1660},{},[1661],{"type":47,"value":1662},"Note — What-If:",{"type":47,"value":1664}," Deployment stacks do not yet support a native What-If preview. To preview changes, run ",{"type":41,"tag":274,"props":1666,"children":1668},{"className":1667},[],[1669],{"type":47,"value":1670},"New-AzSubscriptionDeployment -WhatIf",{"type":47,"value":1672}," (or ",{"type":41,"tag":274,"props":1674,"children":1676},{"className":1675},[],[1677],{"type":47,"value":1678},"az deployment sub what-if",{"type":47,"value":1680},") against the underlying template before creating or updating the stack. The stack additionally applies the deny-settings, which won't appear in the template What-If.",{"type":41,"tag":1144,"props":1682,"children":1684},{"id":1683},"step-7-validate-in-non-production",[1685],{"type":47,"value":1686},"Step 7 — Validate in non-production",{"type":41,"tag":50,"props":1688,"children":1689},{},[1690],{"type":47,"value":1691},"Deploy to a sandbox subscription first. Confirm with the user:",{"type":41,"tag":130,"props":1693,"children":1694},{},[1695,1700,1705,1710],{"type":41,"tag":134,"props":1696,"children":1697},{},[1698],{"type":47,"value":1699},"Resources created as expected.",{"type":41,"tag":134,"props":1701,"children":1702},{},[1703],{"type":47,"value":1704},"Deny-settings enforced (try a manual delete — it should fail).",{"type":41,"tag":134,"props":1706,"children":1707},{},[1708],{"type":47,"value":1709},"Parameter values applied correctly.",{"type":41,"tag":134,"props":1711,"children":1712},{},[1713],{"type":47,"value":1714},"Diff against the original Blueprint assignment: any drift?",{"type":41,"tag":1144,"props":1716,"children":1718},{"id":1717},"step-8-cut-over",[1719],{"type":47,"value":1720},"Step 8 — Cut over",{"type":41,"tag":50,"props":1722,"children":1723},{},[1724],{"type":47,"value":1725},"For each existing Blueprint assignment:",{"type":41,"tag":176,"props":1727,"children":1728},{},[1729,1734,1774,1779,1798],{"type":41,"tag":134,"props":1730,"children":1731},{},[1732],{"type":47,"value":1733},"Deploy the matching Deployment Stack to the same scope.",{"type":41,"tag":134,"props":1735,"children":1736},{},[1737,1739],{"type":47,"value":1738},"Choose one strategy and confirm with the user:\n",{"type":41,"tag":130,"props":1740,"children":1741},{},[1742,1752],{"type":41,"tag":134,"props":1743,"children":1744},{},[1745,1750],{"type":41,"tag":54,"props":1746,"children":1747},{},[1748],{"type":47,"value":1749},"Side-by-side then swap",{"type":47,"value":1751}," — Stack provisions new resources, redirect dependents, then remove old Blueprint-managed resources.",{"type":41,"tag":134,"props":1753,"children":1754},{},[1755,1760,1762,1766,1768,1773],{"type":41,"tag":54,"props":1756,"children":1757},{},[1758],{"type":47,"value":1759},"Adopt existing",{"type":47,"value":1761}," — the stack begins managing resources whose IDs match resources declared in the template on first successful deployment (there is no separate import command). Resources at the scope that are ",{"type":41,"tag":54,"props":1763,"children":1764},{},[1765],{"type":47,"value":163},{"type":47,"value":1767}," in the template are left untouched under ",{"type":41,"tag":274,"props":1769,"children":1771},{"className":1770},[],[1772],{"type":47,"value":1627},{"type":47,"value":112},{"type":41,"tag":134,"props":1775,"children":1776},{},[1777],{"type":47,"value":1778},"Re-assign any decoupled policies at the right scope.",{"type":41,"tag":134,"props":1780,"children":1781},{},[1782,1784],{"type":47,"value":1783},"Remove the Blueprint assignment:\n",{"type":41,"tag":667,"props":1785,"children":1787},{"className":1157,"code":1786,"language":1159,"meta":672,"style":672},"Remove-AzBlueprintAssignment -Name \"\u003Cassignment>\" -SubscriptionId \"\u003Csub>\"\n",[1788],{"type":41,"tag":274,"props":1789,"children":1790},{"__ignoreMap":672},[1791],{"type":41,"tag":678,"props":1792,"children":1793},{"class":680,"line":681},[1794],{"type":41,"tag":678,"props":1795,"children":1796},{},[1797],{"type":47,"value":1786},{"type":41,"tag":134,"props":1799,"children":1800},{},[1801,1803,1809],{"type":47,"value":1802},"Confirm the Stack is now the single source of truth: ",{"type":41,"tag":274,"props":1804,"children":1806},{"className":1805},[],[1807],{"type":47,"value":1808},"Get-AzSubscriptionDeploymentStack",{"type":47,"value":112},{"type":41,"tag":1652,"props":1811,"children":1812},{},[1813],{"type":41,"tag":50,"props":1814,"children":1815},{},[1816,1821,1823,1828,1830,1835,1837,1843,1845,1850,1852,1856,1858,1863,1865,1871,1873,1878,1880,1886,1888,1894,1896,1902],{"type":41,"tag":54,"props":1817,"children":1818},{},[1819],{"type":47,"value":1820},"Sequencing gotcha — embedded role\u002Fpolicy assignments.",{"type":47,"value":1822}," While the Blueprint assignment still exists, it ",{"type":41,"tag":1615,"props":1824,"children":1825},{},[1826],{"type":47,"value":1827},"owns",{"type":47,"value":1829}," the role and policy assignments it created. If your Stack template tries to create a role assignment for the ",{"type":41,"tag":54,"props":1831,"children":1832},{},[1833],{"type":47,"value":1834},"same principal + role + scope",{"type":47,"value":1836},", Azure rejects it with ",{"type":41,"tag":274,"props":1838,"children":1840},{"className":1839},[],[1841],{"type":47,"value":1842},"409 RoleAssignmentExists",{"type":47,"value":1844},"; re-creating an embedded policy under a new name silently produces a ",{"type":41,"tag":54,"props":1846,"children":1847},{},[1848],{"type":47,"value":1849},"duplicate",{"type":47,"value":1851},". Removing the Blueprint assignment does ",{"type":41,"tag":54,"props":1853,"children":1854},{},[1855],{"type":47,"value":163},{"type":47,"value":1857}," reliably delete the role assignments it created — they often ",{"type":41,"tag":54,"props":1859,"children":1860},{},[1861],{"type":47,"value":1862},"persist",{"type":47,"value":1864}," and keep triggering ",{"type":41,"tag":274,"props":1866,"children":1868},{"className":1867},[],[1869],{"type":47,"value":1870},"409",{"type":47,"value":1872},". The most reliable pattern is to ",{"type":41,"tag":54,"props":1874,"children":1875},{},[1876],{"type":47,"value":1877},"adopt",{"type":47,"value":1879}," the existing assignments: query the existing name (",{"type":41,"tag":274,"props":1881,"children":1883},{"className":1882},[],[1884],{"type":47,"value":1885},"Get-AzRoleAssignment",{"type":47,"value":1887},", or the REST role-assignments list filtered by ",{"type":41,"tag":274,"props":1889,"children":1891},{"className":1890},[],[1892],{"type":47,"value":1893},"principalId",{"type":47,"value":1895},") and set that exact GUID as the resource ",{"type":41,"tag":274,"props":1897,"children":1899},{"className":1898},[],[1900],{"type":47,"value":1901},"name",{"type":47,"value":1903}," so the deployment is an idempotent no-op the stack then manages.",{"type":41,"tag":1144,"props":1905,"children":1907},{"id":1906},"step-9-cleanup",[1908],{"type":47,"value":1909},"Step 9 — Cleanup",{"type":41,"tag":50,"props":1911,"children":1912},{},[1913,1915,1920,1922,1927,1929,1935,1937,1950,1952,1958],{"type":47,"value":1914},"Once ",{"type":41,"tag":54,"props":1916,"children":1917},{},[1918],{"type":47,"value":1919},"all",{"type":47,"value":1921}," assignments for a Definition are migrated, delete the definition. ",{"type":41,"tag":54,"props":1923,"children":1924},{},[1925],{"type":47,"value":1926},"Note:",{"type":47,"value":1928}," ",{"type":41,"tag":274,"props":1930,"children":1932},{"className":1931},[],[1933],{"type":47,"value":1934},"Az.Blueprint",{"type":47,"value":1936}," has ",{"type":41,"tag":54,"props":1938,"children":1939},{},[1940,1942,1948],{"type":47,"value":1941},"no ",{"type":41,"tag":274,"props":1943,"children":1945},{"className":1944},[],[1946],{"type":47,"value":1947},"Remove-AzBlueprint",{"type":47,"value":1949}," cmdlet",{"type":47,"value":1951}," (only ",{"type":41,"tag":274,"props":1953,"children":1955},{"className":1954},[],[1956],{"type":47,"value":1957},"Remove-AzBlueprintAssignment",{"type":47,"value":1959},"). Delete definitions via Azure CLI or REST, deleting published versions first:",{"type":41,"tag":667,"props":1961,"children":1963},{"className":1157,"code":1962,"language":1159,"meta":672,"style":672},"# Azure CLI\naz blueprint delete --name \"\u003Cblueprint-name>\" --management-group \"\u003Cmg-id>\"   # or --subscription \"\u003Csub-id>\"\n\n# REST fallback (PowerShell) — published versions first, then the definition\n$path = \"\u002Fsubscriptions\u002F\u003Csub-id>\u002Fproviders\u002FMicrosoft.Blueprint\u002Fblueprints\u002F\u003Cname>\"  # or \u002Fproviders\u002FMicrosoft.Management\u002FmanagementGroups\u002F\u003Cmg-id>\u002Fproviders\u002FMicrosoft.Blueprint\u002Fblueprints\u002F\u003Cname>\n$api  = \"api-version=2018-11-01-preview\"\n(Invoke-AzRestMethod -Method GET -Path \"$path\u002Fversions?$api\").Content |\n  ConvertFrom-Json | Select-Object -Expand value |\n  Where-Object { -not [string]::IsNullOrWhiteSpace($_.name) } |   # never issue a DELETE with an empty version ID\n  ForEach-Object { Invoke-AzRestMethod -Method DELETE -Path \"$path\u002Fversions\u002F$($_.name)?$api\" }\nInvoke-AzRestMethod -Method DELETE -Path \"${path}?$api\"\n",[1964],{"type":41,"tag":274,"props":1965,"children":1966},{"__ignoreMap":672},[1967,1975,1983,1990,1998,2006,2014,2022,2030,2038,2046],{"type":41,"tag":678,"props":1968,"children":1969},{"class":680,"line":681},[1970],{"type":41,"tag":678,"props":1971,"children":1972},{},[1973],{"type":47,"value":1974},"# Azure CLI\n",{"type":41,"tag":678,"props":1976,"children":1977},{"class":680,"line":690},[1978],{"type":41,"tag":678,"props":1979,"children":1980},{},[1981],{"type":47,"value":1982},"az blueprint delete --name \"\u003Cblueprint-name>\" --management-group \"\u003Cmg-id>\"   # or --subscription \"\u003Csub-id>\"\n",{"type":41,"tag":678,"props":1984,"children":1985},{"class":680,"line":699},[1986],{"type":41,"tag":678,"props":1987,"children":1988},{"emptyLinePlaceholder":766},[1989],{"type":47,"value":769},{"type":41,"tag":678,"props":1991,"children":1992},{"class":680,"line":708},[1993],{"type":41,"tag":678,"props":1994,"children":1995},{},[1996],{"type":47,"value":1997},"# REST fallback (PowerShell) — published versions first, then the definition\n",{"type":41,"tag":678,"props":1999,"children":2000},{"class":680,"line":717},[2001],{"type":41,"tag":678,"props":2002,"children":2003},{},[2004],{"type":47,"value":2005},"$path = \"\u002Fsubscriptions\u002F\u003Csub-id>\u002Fproviders\u002FMicrosoft.Blueprint\u002Fblueprints\u002F\u003Cname>\"  # or \u002Fproviders\u002FMicrosoft.Management\u002FmanagementGroups\u002F\u003Cmg-id>\u002Fproviders\u002FMicrosoft.Blueprint\u002Fblueprints\u002F\u003Cname>\n",{"type":41,"tag":678,"props":2007,"children":2008},{"class":680,"line":726},[2009],{"type":41,"tag":678,"props":2010,"children":2011},{},[2012],{"type":47,"value":2013},"$api  = \"api-version=2018-11-01-preview\"\n",{"type":41,"tag":678,"props":2015,"children":2016},{"class":680,"line":735},[2017],{"type":41,"tag":678,"props":2018,"children":2019},{},[2020],{"type":47,"value":2021},"(Invoke-AzRestMethod -Method GET -Path \"$path\u002Fversions?$api\").Content |\n",{"type":41,"tag":678,"props":2023,"children":2024},{"class":680,"line":744},[2025],{"type":41,"tag":678,"props":2026,"children":2027},{},[2028],{"type":47,"value":2029},"  ConvertFrom-Json | Select-Object -Expand value |\n",{"type":41,"tag":678,"props":2031,"children":2032},{"class":680,"line":753},[2033],{"type":41,"tag":678,"props":2034,"children":2035},{},[2036],{"type":47,"value":2037},"  Where-Object { -not [string]::IsNullOrWhiteSpace($_.name) } |   # never issue a DELETE with an empty version ID\n",{"type":41,"tag":678,"props":2039,"children":2040},{"class":680,"line":762},[2041],{"type":41,"tag":678,"props":2042,"children":2043},{},[2044],{"type":47,"value":2045},"  ForEach-Object { Invoke-AzRestMethod -Method DELETE -Path \"$path\u002Fversions\u002F$($_.name)?$api\" }\n",{"type":41,"tag":678,"props":2047,"children":2048},{"class":680,"line":772},[2049],{"type":41,"tag":678,"props":2050,"children":2051},{},[2052],{"type":47,"value":2053},"Invoke-AzRestMethod -Method DELETE -Path \"${path}?$api\"\n",{"type":41,"tag":50,"props":2055,"children":2056},{},[2057,2059,2064,2066,2071,2073,2079],{"type":47,"value":2058},"Deleting a ",{"type":41,"tag":54,"props":2060,"children":2061},{},[2062],{"type":47,"value":2063},"management-group-scoped",{"type":47,"value":2065}," definition requires Blueprint Contributor\u002FOwner ",{"type":41,"tag":54,"props":2067,"children":2068},{},[2069],{"type":47,"value":2070},"at that management group",{"type":47,"value":2072}," — a subscription-level role returns ",{"type":41,"tag":274,"props":2074,"children":2076},{"className":2075},[],[2077],{"type":47,"value":2078},"403",{"type":47,"value":2080},". Stop publishing new versions of the Blueprint Definition.",{"type":41,"tag":114,"props":2082,"children":2083},{},[],{"type":41,"tag":118,"props":2085,"children":2087},{"id":2086},"mapping-reference",[2088],{"type":47,"value":2089},"Mapping reference",{"type":41,"tag":442,"props":2091,"children":2092},{},[2093,2109],{"type":41,"tag":446,"props":2094,"children":2095},{},[2096],{"type":41,"tag":450,"props":2097,"children":2098},{},[2099,2104],{"type":41,"tag":454,"props":2100,"children":2101},{},[2102],{"type":47,"value":2103},"Blueprint setting",{"type":41,"tag":454,"props":2105,"children":2106},{},[2107],{"type":47,"value":2108},"Stack equivalent",{"type":41,"tag":470,"props":2110,"children":2111},{},[2112,2140,2162,2183,2204,2227,2250,2278,2295,2314],{"type":41,"tag":450,"props":2113,"children":2114},{},[2115,2124],{"type":41,"tag":477,"props":2116,"children":2117},{},[2118],{"type":41,"tag":274,"props":2119,"children":2121},{"className":2120},[],[2122],{"type":47,"value":2123},"properties.parameters",{"type":41,"tag":477,"props":2125,"children":2126},{},[2127,2133,2134],{"type":41,"tag":274,"props":2128,"children":2130},{"className":2129},[],[2131],{"type":47,"value":2132},"-TemplateParameterFile",{"type":47,"value":339},{"type":41,"tag":274,"props":2135,"children":2137},{"className":2136},[],[2138],{"type":47,"value":2139},"-Parameter",{"type":41,"tag":450,"props":2141,"children":2142},{},[2143,2152],{"type":41,"tag":477,"props":2144,"children":2145},{},[2146],{"type":41,"tag":274,"props":2147,"children":2149},{"className":2148},[],[2150],{"type":47,"value":2151},"properties.resourceGroups",{"type":41,"tag":477,"props":2153,"children":2154},{},[2155,2160],{"type":41,"tag":274,"props":2156,"children":2158},{"className":2157},[],[2159],{"type":47,"value":1343},{"type":47,"value":2161}," in Bicep",{"type":41,"tag":450,"props":2163,"children":2164},{},[2165,2174],{"type":41,"tag":477,"props":2166,"children":2167},{},[2168],{"type":41,"tag":274,"props":2169,"children":2171},{"className":2170},[],[2172],{"type":47,"value":2173},"locks.mode = AllResourcesDoNotDelete",{"type":41,"tag":477,"props":2175,"children":2176},{},[2177],{"type":41,"tag":274,"props":2178,"children":2180},{"className":2179},[],[2181],{"type":47,"value":2182},"DenySettingsMode = denyDelete",{"type":41,"tag":450,"props":2184,"children":2185},{},[2186,2195],{"type":41,"tag":477,"props":2187,"children":2188},{},[2189],{"type":41,"tag":274,"props":2190,"children":2192},{"className":2191},[],[2193],{"type":47,"value":2194},"locks.mode = AllResourcesReadOnly",{"type":41,"tag":477,"props":2196,"children":2197},{},[2198],{"type":41,"tag":274,"props":2199,"children":2201},{"className":2200},[],[2202],{"type":47,"value":2203},"DenySettingsMode = denyWriteAndDelete",{"type":41,"tag":450,"props":2205,"children":2206},{},[2207,2216],{"type":41,"tag":477,"props":2208,"children":2209},{},[2210],{"type":41,"tag":274,"props":2211,"children":2213},{"className":2212},[],[2214],{"type":47,"value":2215},"locks.excludedPrincipals",{"type":41,"tag":477,"props":2217,"children":2218},{},[2219,2225],{"type":41,"tag":274,"props":2220,"children":2222},{"className":2221},[],[2223],{"type":47,"value":2224},"-DenySettingsExcludedPrincipal",{"type":47,"value":2226}," (max 5)",{"type":41,"tag":450,"props":2228,"children":2229},{},[2230,2239],{"type":41,"tag":477,"props":2231,"children":2232},{},[2233],{"type":41,"tag":274,"props":2234,"children":2236},{"className":2235},[],[2237],{"type":47,"value":2238},"locks.excludedActions",{"type":41,"tag":477,"props":2240,"children":2241},{},[2242,2248],{"type":41,"tag":274,"props":2243,"children":2245},{"className":2244},[],[2246],{"type":47,"value":2247},"-DenySettingsExcludedAction",{"type":47,"value":2249}," (max 200)",{"type":41,"tag":450,"props":2251,"children":2252},{},[2253,2273],{"type":41,"tag":477,"props":2254,"children":2255},{},[2256,2258,2264,2265,2271],{"type":47,"value":2257},"Identity (",{"type":41,"tag":274,"props":2259,"children":2261},{"className":2260},[],[2262],{"type":47,"value":2263},"SystemAssigned",{"type":47,"value":339},{"type":41,"tag":274,"props":2266,"children":2268},{"className":2267},[],[2269],{"type":47,"value":2270},"UserAssigned",{"type":47,"value":2272},")",{"type":41,"tag":477,"props":2274,"children":2275},{},[2276],{"type":47,"value":2277},"Stack runs with the caller's identity; deployments use the template's own identity blocks",{"type":41,"tag":450,"props":2279,"children":2280},{},[2281,2286],{"type":41,"tag":477,"props":2282,"children":2283},{},[2284],{"type":47,"value":2285},"Artifact sequence",{"type":41,"tag":477,"props":2287,"children":2288},{},[2289,2290],{"type":47,"value":610},{"type":41,"tag":274,"props":2291,"children":2293},{"className":2292},[],[2294],{"type":47,"value":616},{"type":41,"tag":450,"props":2296,"children":2297},{},[2298,2303],{"type":41,"tag":477,"props":2299,"children":2300},{},[2301],{"type":47,"value":2302},"Versioning (definition versions)",{"type":41,"tag":477,"props":2304,"children":2305},{},[2306,2308],{"type":47,"value":2307},"Template Spec ",{"type":41,"tag":274,"props":2309,"children":2311},{"className":2310},[],[2312],{"type":47,"value":2313},"version",{"type":41,"tag":450,"props":2315,"children":2316},{},[2317,2322],{"type":41,"tag":477,"props":2318,"children":2319},{},[2320],{"type":47,"value":2321},"Assignment scope (Sub \u002F MG)",{"type":41,"tag":477,"props":2323,"children":2324},{},[2325,2331,2332],{"type":41,"tag":274,"props":2326,"children":2328},{"className":2327},[],[2329],{"type":47,"value":2330},"New-AzSubscriptionDeploymentStack",{"type":47,"value":339},{"type":41,"tag":274,"props":2333,"children":2335},{"className":2334},[],[2336],{"type":47,"value":1648},{"type":41,"tag":114,"props":2338,"children":2339},{},[],{"type":41,"tag":118,"props":2341,"children":2343},{"id":2342},"guardrails-things-the-ai-must-do",[2344],{"type":47,"value":2345},"Guardrails — things the AI must do",{"type":41,"tag":130,"props":2347,"children":2348},{},[2349,2366,2387,2411,2421,2431],{"type":41,"tag":134,"props":2350,"children":2351},{},[2352,2364],{"type":41,"tag":54,"props":2353,"children":2354},{},[2355,2357,2362],{"type":47,"value":2356},"Do not generate or run any ",{"type":41,"tag":274,"props":2358,"children":2360},{"className":2359},[],[2361],{"type":47,"value":1957},{"type":47,"value":2363}," command until",{"type":47,"value":2365}," the user confirms the replacement Stack is deployed and validated, and any decoupled policies are re-assigned.",{"type":41,"tag":134,"props":2367,"children":2368},{},[2369,2379,2381,2386],{"type":41,"tag":54,"props":2370,"children":2371},{},[2372,2374],{"type":47,"value":2373},"Do not recommend ",{"type":41,"tag":274,"props":2375,"children":2377},{"className":2376},[],[2378],{"type":47,"value":571},{"type":47,"value":2380}," unless the user explicitly needs write-protection — it blocks normal RBAC-allowed updates. Default to ",{"type":41,"tag":274,"props":2382,"children":2384},{"className":2383},[],[2385],{"type":47,"value":563},{"type":47,"value":112},{"type":41,"tag":134,"props":2388,"children":2389},{},[2390,2402,2404,2409],{"type":41,"tag":54,"props":2391,"children":2392},{},[2393,2394,2400],{"type":47,"value":2373},{"type":41,"tag":274,"props":2395,"children":2397},{"className":2396},[],[2398],{"type":47,"value":2399},"-ActionOnUnmanage deleteResources",{"type":47,"value":2401}," during pilot.",{"type":47,"value":2403}," Use ",{"type":41,"tag":274,"props":2405,"children":2407},{"className":2406},[],[2408],{"type":47,"value":1627},{"type":47,"value":2410}," until the user is confident.",{"type":41,"tag":134,"props":2412,"children":2413},{},[2414,2419],{"type":41,"tag":54,"props":2415,"children":2416},{},[2417],{"type":47,"value":2418},"Do not invent management group IDs, subscription IDs, blueprint names, or parameter values.",{"type":47,"value":2420}," Ask.",{"type":41,"tag":134,"props":2422,"children":2423},{},[2424,2429],{"type":41,"tag":54,"props":2425,"children":2426},{},[2427],{"type":47,"value":2428},"Do not claim Microsoft will auto-migrate.",{"type":47,"value":2430}," It will not. This is customer-driven.",{"type":41,"tag":134,"props":2432,"children":2433},{},[2434,2439],{"type":41,"tag":54,"props":2435,"children":2436},{},[2437],{"type":47,"value":2438},"Do not skip the policy-decoupling step",{"type":47,"value":2440}," if the blueprint embeds policy assignments. This is the #1 source of post-migration regressions.",{"type":41,"tag":114,"props":2442,"children":2443},{},[],{"type":41,"tag":118,"props":2445,"children":2447},{"id":2446},"common-pitfalls",[2448],{"type":47,"value":2449},"Common pitfalls",{"type":41,"tag":130,"props":2451,"children":2452},{},[2453,2463,2478,2501,2522,2540,2573,2590,2607,2671,2681,2736,2767],{"type":41,"tag":134,"props":2454,"children":2455},{},[2456,2461],{"type":41,"tag":54,"props":2457,"children":2458},{},[2459],{"type":47,"value":2460},"Trying to one-shot adopt existing resources.",{"type":47,"value":2462}," Stacks track resources they create or that already match resources declared in the template; other pre-existing resources may need a brief side-by-side period.",{"type":41,"tag":134,"props":2464,"children":2465},{},[2466,2471,2473,2477],{"type":41,"tag":54,"props":2467,"children":2468},{},[2469],{"type":47,"value":2470},"Forgetting to update policy ownership.",{"type":47,"value":2472}," If a Blueprint assigned policy that lived inside the definition, removing the assignment also removes that policy. Re-assign at the right scope ",{"type":41,"tag":1615,"props":2474,"children":2475},{},[2476],{"type":47,"value":1397},{"type":47,"value":1399},{"type":41,"tag":134,"props":2479,"children":2480},{},[2481,2486,2487,2492,2494,2499],{"type":41,"tag":54,"props":2482,"children":2483},{},[2484],{"type":47,"value":2485},"Wrong deny-settings mode.",{"type":47,"value":1928},{"type":41,"tag":274,"props":2488,"children":2490},{"className":2489},[],[2491],{"type":47,"value":571},{"type":47,"value":2493}," blocks normal RBAC-allowed updates — pick ",{"type":41,"tag":274,"props":2495,"children":2497},{"className":2496},[],[2498],{"type":47,"value":563},{"type":47,"value":2500}," unless you truly need write protection.",{"type":41,"tag":134,"props":2502,"children":2503},{},[2504,2514,2515,2520],{"type":41,"tag":54,"props":2505,"children":2506},{},[2507,2513],{"type":41,"tag":274,"props":2508,"children":2510},{"className":2509},[],[2511],{"type":47,"value":2512},"ActionOnUnmanage = deleteResources",{"type":47,"value":2401},{"type":47,"value":2403},{"type":41,"tag":274,"props":2516,"children":2518},{"className":2517},[],[2519],{"type":47,"value":1627},{"type":47,"value":2521}," until you're confident; flip later.",{"type":41,"tag":134,"props":2523,"children":2524},{},[2525,2530,2532,2538],{"type":41,"tag":54,"props":2526,"children":2527},{},[2528],{"type":47,"value":2529},"Deny-assignment limits and gaps.",{"type":47,"value":2531}," Deny-assignments don't apply at management-group scope (only when a stack deploys into a child subscription), don't cover data-plane operations, and don't protect implicitly created child resources (for example, an AKS node resource group). Add explicit ",{"type":41,"tag":274,"props":2533,"children":2535},{"className":2534},[],[2536],{"type":47,"value":2537},"Microsoft.Authorization\u002Flocks",{"type":47,"value":2539}," where those gaps matter.",{"type":41,"tag":134,"props":2541,"children":2542},{},[2543,2548,2550,2556,2558,2563,2565,2571],{"type":41,"tag":54,"props":2544,"children":2545},{},[2546],{"type":47,"value":2547},"Blueprint-applied tags get stripped.",{"type":47,"value":2549}," Blueprints stamp managed resources\u002Fresource groups with a ",{"type":41,"tag":274,"props":2551,"children":2553},{"className":2552},[],[2554],{"type":47,"value":2555},"Blueprint",{"type":47,"value":2557}," tag (and similar metadata). A migrated Stack whose template omits those tags will ",{"type":41,"tag":54,"props":2559,"children":2560},{},[2561],{"type":47,"value":2562},"remove them",{"type":47,"value":2564}," on first deployment (visible as a ",{"type":41,"tag":274,"props":2566,"children":2568},{"className":2567},[],[2569],{"type":47,"value":2570},"~ Modify",{"type":47,"value":2572}," in template What-If). Carry over any tags you want to keep into the converted Bicep, or accept their removal deliberately.",{"type":41,"tag":134,"props":2574,"children":2575},{},[2576,2588],{"type":41,"tag":54,"props":2577,"children":2578},{},[2579,2581,2586],{"type":47,"value":2580},"Role assignment ",{"type":41,"tag":274,"props":2582,"children":2584},{"className":2583},[],[2585],{"type":47,"value":1870},{"type":47,"value":2587}," \u002F duplicate policy on cutover.",{"type":47,"value":2589}," See the sequencing gotcha in Step 8 — defer embedded role\u002Fpolicy assignments until after the Blueprint assignment is removed, or adopt them by exact existing name.",{"type":41,"tag":134,"props":2591,"children":2592},{},[2593,2598,2600,2605],{"type":41,"tag":54,"props":2594,"children":2595},{},[2596],{"type":47,"value":2597},"Inherited governance noise.",{"type":47,"value":2599}," At resource-group scope you may see many ",{"type":41,"tag":1615,"props":2601,"children":2602},{},[2603],{"type":47,"value":2604},"inherited",{"type":47,"value":2606}," management-group policy assignments. Don't mistake them for the blueprint's own artifacts when validating.",{"type":41,"tag":134,"props":2608,"children":2609},{},[2610,2620,2621,2626,2628,2633,2635,2640,2642,2647,2649,2655,2657,2663,2665,2670],{"type":41,"tag":54,"props":2611,"children":2612},{},[2613,2618],{"type":41,"tag":274,"props":2614,"children":2616},{"className":2615},[],[2617],{"type":47,"value":1947},{"type":47,"value":2619}," doesn't exist.",{"type":47,"value":1928},{"type":41,"tag":274,"props":2622,"children":2624},{"className":2623},[],[2625],{"type":47,"value":1934},{"type":47,"value":2627}," ships ",{"type":41,"tag":274,"props":2629,"children":2631},{"className":2630},[],[2632],{"type":47,"value":1957},{"type":47,"value":2634}," but ",{"type":41,"tag":54,"props":2636,"children":2637},{},[2638],{"type":47,"value":2639},"no",{"type":47,"value":2641}," cmdlet to delete a ",{"type":41,"tag":1615,"props":2643,"children":2644},{},[2645],{"type":47,"value":2646},"definition",{"type":47,"value":2648},". Use ",{"type":41,"tag":274,"props":2650,"children":2652},{"className":2651},[],[2653],{"type":47,"value":2654},"az blueprint delete",{"type":47,"value":2656}," or REST ",{"type":41,"tag":274,"props":2658,"children":2660},{"className":2659},[],[2661],{"type":47,"value":2662},"DELETE",{"type":47,"value":2664}," (see Step 9); delete published versions first. MG-scoped deletes need MG-level permissions or they return ",{"type":41,"tag":274,"props":2666,"children":2668},{"className":2667},[],[2669],{"type":47,"value":2078},{"type":47,"value":112},{"type":41,"tag":134,"props":2672,"children":2673},{},[2674,2679],{"type":41,"tag":54,"props":2675,"children":2676},{},[2677],{"type":47,"value":2678},"Unassigned definitions still count.",{"type":47,"value":2680}," The retirement recommendation lists every definition and version, not just assignments — and the same test definitions are often replicated across every subscription and the management group. Inventory each scope and archive\u002Fconvert then delete them to reach zero.",{"type":41,"tag":134,"props":2682,"children":2683},{},[2684,2695,2697,2703,2705,2711,2713,2719,2721,2726,2728,2734],{"type":41,"tag":54,"props":2685,"children":2686},{},[2687,2693],{"type":41,"tag":274,"props":2688,"children":2690},{"className":2689},[],[2691],{"type":47,"value":2692},"Get-AzBlueprint -SubscriptionId",{"type":47,"value":2694}," includes inherited MG definitions.",{"type":47,"value":2696}," Its result mixes subscription-scoped definitions with management-group definitions inherited into that subscription's view. Distinguish by the resource ",{"type":41,"tag":274,"props":2698,"children":2700},{"className":2699},[],[2701],{"type":47,"value":2702},"Id",{"type":47,"value":2704}," (",{"type":41,"tag":274,"props":2706,"children":2708},{"className":2707},[],[2709],{"type":47,"value":2710},"\u002Fsubscriptions\u002F…",{"type":47,"value":2712}," vs ",{"type":41,"tag":274,"props":2714,"children":2716},{"className":2715},[],[2717],{"type":47,"value":2718},"\u002FmanagementGroups\u002F…",{"type":47,"value":2720},"). Don't multiply the same MG set across every subscription when counting, and note that deleting an inherited MG definition via a ",{"type":41,"tag":1615,"props":2722,"children":2723},{},[2724],{"type":47,"value":2725},"subscription",{"type":47,"value":2727}," path is a no-op (idempotent ",{"type":41,"tag":274,"props":2729,"children":2731},{"className":2730},[],[2732],{"type":47,"value":2733},"204",{"type":47,"value":2735},") — delete it once at the MG scope (with MG permissions).",{"type":41,"tag":134,"props":2737,"children":2738},{},[2739,2744,2746,2750,2752,2757,2759,2765],{"type":41,"tag":54,"props":2740,"children":2741},{},[2742],{"type":47,"value":2743},"Never delete a version with an empty ID.",{"type":47,"value":2745}," When removing a blueprint's published versions, filter out any null\u002Fblank version names ",{"type":41,"tag":1615,"props":2747,"children":2748},{},[2749],{"type":47,"value":1397},{"type":47,"value":2751}," issuing the ",{"type":41,"tag":274,"props":2753,"children":2755},{"className":2754},[],[2756],{"type":47,"value":2662},{"type":47,"value":2758}," — a ",{"type":41,"tag":274,"props":2760,"children":2762},{"className":2761},[],[2763],{"type":47,"value":2764},"DELETE …\u002Fversions\u002F",{"type":47,"value":2766}," with an empty version ID can trigger a service-side error. Enumerate versions, skip empties, delete each real version, then delete the definition.",{"type":41,"tag":134,"props":2768,"children":2769},{},[2770,2775,2777,2782,2784,2789,2791,2797],{"type":41,"tag":54,"props":2771,"children":2772},{},[2773],{"type":47,"value":2774},"Export before retirement.",{"type":47,"value":2776}," Export your blueprint definitions and assignments before the ",{"type":41,"tag":54,"props":2778,"children":2779},{},[2780],{"type":47,"value":2781},"January 31, 2027",{"type":47,"value":2783}," retirement (phased changes begin ",{"type":41,"tag":54,"props":2785,"children":2786},{},[2787],{"type":47,"value":2788},"July 31, 2026",{"type":47,"value":2790},"). After retirement the Blueprints API stops serving requests, so ",{"type":41,"tag":274,"props":2792,"children":2794},{"className":2793},[],[2795],{"type":47,"value":2796},"Export-AzBlueprintWithArtifact",{"type":47,"value":2798}," may no longer work — capture everything you need ahead of time.",{"type":41,"tag":114,"props":2800,"children":2801},{},[],{"type":41,"tag":118,"props":2803,"children":2805},{"id":2804},"output-artifacts-the-ai-should-produce",[2806],{"type":47,"value":2807},"Output artifacts the AI should produce",{"type":41,"tag":50,"props":2809,"children":2810},{},[2811],{"type":47,"value":2812},"By the end of a migration session, the user should have:",{"type":41,"tag":176,"props":2814,"children":2815},{},[2816,2826,2843,2859,2869,2885,2895],{"type":41,"tag":134,"props":2817,"children":2818},{},[2819,2824],{"type":41,"tag":54,"props":2820,"children":2821},{},[2822],{"type":47,"value":2823},"Inventory list",{"type":47,"value":2825}," — definitions, assignments, scopes, lock modes, parameters.",{"type":41,"tag":134,"props":2827,"children":2828},{},[2829,2834,2836,2841],{"type":41,"tag":54,"props":2830,"children":2831},{},[2832],{"type":47,"value":2833},"Export folder",{"type":47,"value":2835}," per blueprint — ",{"type":41,"tag":274,"props":2837,"children":2839},{"className":2838},[],[2840],{"type":47,"value":1224},{"type":47,"value":2842}," + artifact JSON files.",{"type":41,"tag":134,"props":2844,"children":2845},{},[2846,2851,2852,2857],{"type":41,"tag":54,"props":2847,"children":2848},{},[2849],{"type":47,"value":2850},"Converted Bicep templates",{"type":47,"value":356},{"type":41,"tag":274,"props":2853,"children":2855},{"className":2854},[],[2856],{"type":47,"value":1285},{"type":47,"value":2858}," per migrated definition.",{"type":41,"tag":134,"props":2860,"children":2861},{},[2862,2867],{"type":41,"tag":54,"props":2863,"children":2864},{},[2865],{"type":47,"value":2866},"Template Spec resource(s)",{"type":47,"value":2868}," — published and versioned.",{"type":41,"tag":134,"props":2870,"children":2871},{},[2872,2877,2879,2884],{"type":41,"tag":54,"props":2873,"children":2874},{},[2875],{"type":47,"value":2876},"Deployment Stack(s)",{"type":47,"value":2878}," — deployed at the correct scope with the right ",{"type":41,"tag":274,"props":2880,"children":2882},{"className":2881},[],[2883],{"type":47,"value":384},{"type":47,"value":112},{"type":41,"tag":134,"props":2886,"children":2887},{},[2888,2893],{"type":41,"tag":54,"props":2889,"children":2890},{},[2891],{"type":47,"value":2892},"Decoupled policy assignments \u002F initiatives",{"type":47,"value":2894}," — assigned at the appropriate MG\u002Fsub\u002FRG scope.",{"type":41,"tag":134,"props":2896,"children":2897},{},[2898,2903],{"type":41,"tag":54,"props":2899,"children":2900},{},[2901],{"type":47,"value":2902},"Cutover checklist",{"type":47,"value":2904}," — one row per former Blueprint assignment, with status: deployed \u002F validated \u002F cut over \u002F Blueprint removed.",{"type":41,"tag":114,"props":2906,"children":2907},{},[],{"type":41,"tag":118,"props":2909,"children":2911},{"id":2910},"faq",[2912],{"type":47,"value":2913},"FAQ",{"type":41,"tag":50,"props":2915,"children":2916},{},[2917,2922,2924,2929],{"type":41,"tag":54,"props":2918,"children":2919},{},[2920],{"type":47,"value":2921},"Q: Do I have to use Stacks? Can I just keep using Template Spec deployments?",{"type":47,"value":2923},"\nA: Yes, for stateless deployments. But you lose lifecycle tracking and deny-protection. Use Stacks when you used Blueprint ",{"type":41,"tag":1615,"props":2925,"children":2926},{},[2927],{"type":47,"value":2928},"assignments",{"type":47,"value":2930}," for governance.",{"type":41,"tag":50,"props":2932,"children":2933},{},[2934,2939,2941,2946],{"type":41,"tag":54,"props":2935,"children":2936},{},[2937],{"type":47,"value":2938},"Q: What about Deployment Stacks at the management-group scope?",{"type":47,"value":2940},"\nA: Supported (",{"type":41,"tag":274,"props":2942,"children":2944},{"className":2943},[],[2945],{"type":47,"value":1648},{"type":47,"value":2947},"). This is the right replacement for MG-scoped Blueprint assignments that fan out to many subs. Note that deny-assignments apply at the child-subscription scope the stack deploys into, not at the management-group scope itself.",{"type":41,"tag":50,"props":2949,"children":2950},{},[2951,2956],{"type":41,"tag":54,"props":2952,"children":2953},{},[2954],{"type":47,"value":2955},"Q: Will Microsoft auto-migrate my Blueprints?",{"type":47,"value":2957},"\nA: No. Migration is customer-driven — there is no automatic conversion. Use this guide to migrate on your own timeline before retirement.",{"type":41,"tag":50,"props":2959,"children":2960},{},[2961,2966,2968,2972,2974,2979,2981,2986],{"type":41,"tag":54,"props":2962,"children":2963},{},[2964],{"type":47,"value":2965},"Q: What happens on the retirement dates?",{"type":47,"value":2967},"\nA: Phased retirement begins ",{"type":41,"tag":54,"props":2969,"children":2970},{},[2971],{"type":47,"value":2788},{"type":47,"value":2973},", and the service is fully ",{"type":41,"tag":54,"props":2975,"children":2976},{},[2977],{"type":47,"value":2978},"retired January 31, 2027",{"type":47,"value":2980}," — after which create\u002Fupdate operations stop and definitions\u002Fassignments are no longer serviced. Export definitions and complete migration before then. See ",{"type":41,"tag":104,"props":2982,"children":2984},{"href":106,"rel":2983},[108],[2985],{"type":47,"value":106},{"type":47,"value":112},{"type":41,"tag":50,"props":2988,"children":2989},{},[2990,3002,3004,3009],{"type":41,"tag":54,"props":2991,"children":2992},{},[2993,2995,3000],{"type":47,"value":2994},"Q: I only have unassigned blueprint ",{"type":41,"tag":1615,"props":2996,"children":2997},{},[2998],{"type":47,"value":2999},"definitions",{"type":47,"value":3001}," left. Do those need migrating?",{"type":47,"value":3003},"\nA: Yes — the retirement recommendation counts every definition and published version. If a definition has no assignment it deploys nothing, so either convert it to a Template Spec (if you still want the template) or simply ",{"type":41,"tag":54,"props":3005,"children":3006},{},[3007],{"type":47,"value":3008},"export it for archive and delete it",{"type":47,"value":3010},". Deleting definitions (and their versions) is what clears them from the retirement recommendation.",{"type":41,"tag":50,"props":3012,"children":3013},{},[3014,3019,3021,3031],{"type":41,"tag":54,"props":3015,"children":3016},{},[3017],{"type":47,"value":3018},"Q: Where do I file questions or issues?",{"type":47,"value":3020},"\nA: Use the public ",{"type":41,"tag":104,"props":3022,"children":3024},{"href":25,"rel":3023},[108],[3025],{"type":41,"tag":274,"props":3026,"children":3028},{"className":3027},[],[3029],{"type":47,"value":3030},"Azure\u002Fazure-blueprints",{"type":47,"value":3032}," GitHub repository and the official retirement notice on Microsoft Learn.",{"type":41,"tag":114,"props":3034,"children":3035},{},[],{"type":41,"tag":118,"props":3037,"children":3039},{"id":3038},"resources",[3040],{"type":47,"value":3041},"Resources",{"type":41,"tag":130,"props":3043,"children":3044},{},[3045,3059,3074,3089,3104,3119,3134,3149,3164],{"type":41,"tag":134,"props":3046,"children":3047},{},[3048,3053,3054],{"type":41,"tag":54,"props":3049,"children":3050},{},[3051],{"type":47,"value":3052},"Azure Blueprints retirement (hub — dates, phased timeline, FAQ)",{"type":47,"value":356},{"type":41,"tag":104,"props":3055,"children":3057},{"href":106,"rel":3056},[108],[3058],{"type":47,"value":106},{"type":41,"tag":134,"props":3060,"children":3061},{},[3062,3067,3068],{"type":41,"tag":54,"props":3063,"children":3064},{},[3065],{"type":47,"value":3066},"Migrate blueprints to deployment stacks (official guide)",{"type":47,"value":356},{"type":41,"tag":104,"props":3069,"children":3072},{"href":3070,"rel":3071},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fazure-resource-manager\u002Fbicep\u002Fmigrate-blueprint",[108],[3073],{"type":47,"value":3070},{"type":41,"tag":134,"props":3075,"children":3076},{},[3077,3082,3083],{"type":41,"tag":54,"props":3078,"children":3079},{},[3080],{"type":47,"value":3081},"Migrate blueprints to template specs",{"type":47,"value":356},{"type":41,"tag":104,"props":3084,"children":3087},{"href":3085,"rel":3086},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fgovernance\u002Fblueprints\u002Fmigrate-to-template-specs",[108],[3088],{"type":47,"value":3085},{"type":41,"tag":134,"props":3090,"children":3091},{},[3092,3097,3098],{"type":41,"tag":54,"props":3093,"children":3094},{},[3095],{"type":47,"value":3096},"Azure Blueprints overview",{"type":47,"value":356},{"type":41,"tag":104,"props":3099,"children":3102},{"href":3100,"rel":3101},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fgovernance\u002Fblueprints\u002Foverview",[108],[3103],{"type":47,"value":3100},{"type":41,"tag":134,"props":3105,"children":3106},{},[3107,3112,3113],{"type":41,"tag":54,"props":3108,"children":3109},{},[3110],{"type":47,"value":3111},"Template Specs overview",{"type":47,"value":356},{"type":41,"tag":104,"props":3114,"children":3117},{"href":3115,"rel":3116},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fazure-resource-manager\u002Ftemplates\u002Ftemplate-specs",[108],[3118],{"type":47,"value":3115},{"type":41,"tag":134,"props":3120,"children":3121},{},[3122,3127,3128],{"type":41,"tag":54,"props":3123,"children":3124},{},[3125],{"type":47,"value":3126},"Deployment Stacks overview",{"type":47,"value":356},{"type":41,"tag":104,"props":3129,"children":3132},{"href":3130,"rel":3131},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fazure-resource-manager\u002Fbicep\u002Fdeployment-stacks",[108],[3133],{"type":47,"value":3130},{"type":41,"tag":134,"props":3135,"children":3136},{},[3137,3142,3143],{"type":41,"tag":54,"props":3138,"children":3139},{},[3140],{"type":47,"value":3141},"Bicep decompile",{"type":47,"value":356},{"type":41,"tag":104,"props":3144,"children":3147},{"href":3145,"rel":3146},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fazure-resource-manager\u002Fbicep\u002Fdecompile",[108],[3148],{"type":47,"value":3145},{"type":41,"tag":134,"props":3150,"children":3151},{},[3152,3157,3158],{"type":41,"tag":54,"props":3153,"children":3154},{},[3155],{"type":47,"value":3156},"Deny assignments",{"type":47,"value":356},{"type":41,"tag":104,"props":3159,"children":3162},{"href":3160,"rel":3161},"https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Frole-based-access-control\u002Fdeny-assignments",[108],[3163],{"type":47,"value":3160},{"type":41,"tag":134,"props":3165,"children":3166},{},[3167,3172,3173],{"type":41,"tag":54,"props":3168,"children":3169},{},[3170],{"type":47,"value":3171},"Az.Blueprint reference (export)",{"type":47,"value":356},{"type":41,"tag":104,"props":3174,"children":3177},{"href":3175,"rel":3176},"https:\u002F\u002Flearn.microsoft.com\u002Fpowershell\u002Fmodule\u002Faz.blueprint",[108],[3178],{"type":47,"value":3175},{"type":41,"tag":114,"props":3180,"children":3181},{},[],{"type":41,"tag":50,"props":3183,"children":3184},{},[3185],{"type":41,"tag":1615,"props":3186,"children":3187},{},[3188],{"type":47,"value":3189},"Skill version: 2.1 · Maintained by Microsoft. Verify all commands against the latest Microsoft Learn documentation before running.",{"type":41,"tag":3191,"props":3192,"children":3193},"style",{},[3194],{"type":47,"value":3195},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3197,"total":3364},[3198,3217,3224,3243,3258,3273,3286,3301,3312,3326,3339,3352],{"slug":3199,"name":3199,"fn":3200,"description":3201,"org":3202,"tags":3203,"stars":3214,"repoUrl":3215,"updatedAt":3216},"azure-arg-external-evaluation-policy-author","author and test Azure Resource Graph policies","Use when the user wants to author, design, or test an Azure Policy that queries Azure Resource Graph (ARG) at request-time — i.e. a policy whose deny\u002Faudit decision depends on data from elsewhere in the subscription (sibling\u002Fparent resource state, RG-wide invariants, multi-hop relationships, etc.). Formally called Azure Policy External Evaluation; sometimes referred to colloquially as \"Invoke\". Drives an iterative KQL co-design loop against the user's real subscription via `az graph query`, then emits a policy definition, assignment, `.http` test flow, and an `EXPLANATION.md` companion. Read-only; never provisions anything.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3204,3205,3208,3211],{"name":11,"slug":8,"type":14},{"name":3206,"slug":3207,"type":14},"Compliance","compliance",{"name":3209,"slug":3210,"type":14},"Governance","governance",{"name":3212,"slug":3213,"type":14},"Policy","policy",1686,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-policy","2026-07-12T08:17:48.378432",{"slug":4,"name":4,"fn":5,"description":6,"org":3218,"tags":3219,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3220,3221,3222,3223],{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":22,"slug":23,"type":14},{"name":16,"slug":17,"type":14},{"slug":3225,"name":3225,"fn":3226,"description":3227,"org":3228,"tags":3229,"stars":3240,"repoUrl":3241,"updatedAt":3242},"apiview-feedback-resolution","resolve APIView feedback on Azure SDKs","Analyze and resolve APIView review feedback on Azure SDK PRs. **UTILITY SKILL**. USE FOR: APIView comments, API review feedback, SDK API surface changes. DO NOT USE FOR: general code review, non-APIView feedback. INVOKES: azure-sdk-mcp:azsdk_apiview_get_comments, azure-sdk-mcp:azsdk_typespec_customized_code_update.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3230,3233,3234,3237],{"name":3231,"slug":3232,"type":14},"API Development","api-development",{"name":11,"slug":8,"type":14},{"name":3235,"slug":3236,"type":14},"Code Review","code-review",{"name":3238,"slug":3239,"type":14},"Documentation","documentation",133,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-tools","2026-07-12T08:17:43.350876",{"slug":3244,"name":3244,"fn":3245,"description":3246,"org":3247,"tags":3248,"stars":3240,"repoUrl":3241,"updatedAt":3257},"azsdk-common-live-and-recorded-tests","deploy resources and run Azure SDK tests","Deploy test resources and run Azure SDK tests in live, record, or playback mode. WHEN: \"run live tests\", \"run recorded tests\", \"deploy test resources\", \"record tests\", \"run tests in record mode\", \"clean up test resources\", \"run tests against live resources\". DO NOT USE FOR: writing new tests, authoring Bicep templates, playback-only test runs without resource deployment. INVOKES: azure-sdk-mcp:azsdk_package_run_tests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3249,3250,3251,3254],{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":3252,"slug":3253,"type":14},"SDK","sdk",{"name":3255,"slug":3256,"type":14},"Testing","testing","2026-07-12T08:17:44.718943",{"slug":3259,"name":3259,"fn":3260,"description":3261,"org":3262,"tags":3263,"stars":3240,"repoUrl":3241,"updatedAt":3272},"azsdk-common-prepare-release-plan","manage Azure SDK release plan work items","Create, get, update, abandon, and link SDK PRs to release plan work items for Azure SDK releases. **UTILITY SKILL**. USE FOR: \"create release plan\", \"get release plan\", \"update release plan\", \"update API spec in release plan\", \"update SDK details in release plan\", \"abandon release plan\", \"link SDK PR to plan\", \"namespace approval\", \"check release plan status\". DO NOT USE FOR: SDK code generation, pipeline troubleshooting, API review feedback. INVOKES: azure-sdk-mcp:azsdk_create_release_plan, azure-sdk-mcp:azsdk_get_release_plan, azure-sdk-mcp:azsdk_get_release_plan_for_spec_pr, azure-sdk-mcp:azsdk_update_release_plan, azure-sdk-mcp:azsdk_update_api_spec_pull_request_in_release_plan, azure-sdk-mcp:azsdk_update_sdk_details_in_release_plan, azure-sdk-mcp:azsdk_abandon_release_plan, azure-sdk-mcp:azsdk_link_sdk_pull_request_to_release_plan, azure-sdk-mcp:azsdk_link_namespace_approval_issue.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3264,3265,3268,3271],{"name":11,"slug":8,"type":14},{"name":3266,"slug":3267,"type":14},"GitHub","github",{"name":3269,"slug":3270,"type":14},"Project Management","project-management",{"name":3252,"slug":3253,"type":14},"2026-07-12T08:17:38.345387",{"slug":3274,"name":3274,"fn":3275,"description":3276,"org":3277,"tags":3278,"stars":3240,"repoUrl":3241,"updatedAt":3285},"azsdk-common-sdk-release","release Azure SDK packages","Check release readiness and trigger the release pipeline for Azure SDK packages. **UTILITY SKILL**. USE FOR: \"release SDK\", \"trigger release\", \"check release readiness\", \"release pipeline\", \"publish package\", \"ship SDK\". DO NOT USE FOR: SDK development, code generation, pipeline debugging, release plan creation. INVOKES: azure-sdk-mcp:azsdk_release_sdk.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3279,3280,3283,3284],{"name":11,"slug":8,"type":14},{"name":3281,"slug":3282,"type":14},"CI\u002FCD","ci-cd",{"name":19,"slug":20,"type":14},{"name":3252,"slug":3253,"type":14},"2026-07-12T08:17:34.27607",{"slug":3287,"name":3287,"fn":3288,"description":3289,"org":3290,"tags":3291,"stars":3240,"repoUrl":3241,"updatedAt":3300},"azure-typespec-author","author and modify Azure TypeSpec API specifications","Authors and modifies Azure TypeSpec (.tsp) API specifications. USE FOR: any TypeSpec\u002Ftsp change — api versions (add, bump, preview, stable, promote), resources, operations, models, properties, decorators, visibility, constraints, breaking changes, LRO, suppressions, operationId, spread model. Covers ARM resource-manager and data-plane services. DO NOT USE FOR: SDK generation, releasing SDK packages, or single MCP tool calls. INVOKES: azure-sdk-mcp:azsdk_typespec_generate_authoring_plan, azure-sdk-mcp:azsdk_run_typespec_validation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3292,3293,3294,3297],{"name":3231,"slug":3232,"type":14},{"name":11,"slug":8,"type":14},{"name":3295,"slug":3296,"type":14},"OpenAPI","openapi",{"name":3298,"slug":3299,"type":14},"Technical Writing","technical-writing","2026-07-12T08:17:39.603232",{"slug":3302,"name":3302,"fn":3303,"description":3304,"org":3305,"tags":3306,"stars":3240,"repoUrl":3241,"updatedAt":3311},"generate-sdk-locally","generate and test Azure SDKs locally","Generate, build, and test Azure SDKs locally from TypeSpec with automatic customization. WHEN: \"generate SDK locally\", \"build SDK\", \"run SDK tests\", \"run CI checks\", \"validate package\", \"run checks\", \"update changelog\", \"fix SDK build errors\", \"fix breaking changes\", \"resolve SDK generation errors\", \"customize TypeSpec\", \"rename SDK client\", \"rename SDK model\", \"hide operation from SDK\", \"fix analyzer errors\", \"resolve customization drift\", \"create subclient\", \"update metadata\", \"update version\". DO NOT USE FOR: publishing to package registries, CI pipeline configuration, API design review. INVOKES: azsdk_verify_setup, azsdk_package_generate_code, azsdk_package_build_code, azsdk_package_run_check, azsdk_package_run_tests, azsdk_customized_code_update, azsdk_package_update_changelog_content, azsdk_package_update_metadata, azsdk_package_update_version.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3307,3308,3309,3310],{"name":11,"slug":8,"type":14},{"name":3281,"slug":3282,"type":14},{"name":3252,"slug":3253,"type":14},{"name":3255,"slug":3256,"type":14},"2026-07-12T08:17:37.08523",{"slug":3313,"name":3313,"fn":3314,"description":3315,"org":3316,"tags":3317,"stars":3240,"repoUrl":3241,"updatedAt":3325},"markdown-token-optimizer","optimize markdown files for token efficiency","Analyze markdown files for token efficiency and reduce context-window bloat. **UTILITY SKILL**. DO NOT USE FOR: code optimization, general file editing, non-markdown files. TRIGGERS: optimize markdown, reduce tokens, token count, token bloat, too many tokens, make concise, shrink file, file too large, optimize for AI, token efficiency, verbose markdown, reduce file size. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3318,3321,3324],{"name":3319,"slug":3320,"type":14},"LLM","llm",{"name":3322,"slug":3323,"type":14},"Performance","performance",{"name":3298,"slug":3299,"type":14},"2026-07-12T08:17:42.080413",{"slug":3327,"name":3327,"fn":3328,"description":3329,"org":3330,"tags":3331,"stars":3240,"repoUrl":3241,"updatedAt":3338},"pipeline-troubleshooting","troubleshoot Azure SDK CI pipelines","Diagnose and resolve failures in Azure SDK CI and generation pipelines. **UTILITY SKILL**. USE FOR: \"pipeline failed\", \"build failure\", \"CI check failing\", \"SDK generation error\", \"reproduce pipeline locally\", \"debug SDK pipeline\". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing. INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_package_build_code, azure-sdk-mcp:azsdk_package_run_check.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3332,3333,3334,3337],{"name":11,"slug":8,"type":14},{"name":3281,"slug":3282,"type":14},{"name":3335,"slug":3336,"type":14},"Debugging","debugging",{"name":3252,"slug":3253,"type":14},"2026-07-12T08:17:40.821512",{"slug":3340,"name":3340,"fn":3341,"description":3342,"org":3343,"tags":3344,"stars":3240,"repoUrl":3241,"updatedAt":3351},"sensei","improve skill frontmatter compliance","**WORKFLOW SKILL** — Iteratively improve skill frontmatter compliance using the Ralph loop pattern. WHEN: \"run sensei\", \"sensei help\", \"improve skill\", \"fix frontmatter\", \"skill compliance\", \"frontmatter audit\", \"score skill\", \"check skill tokens\". INVOKES: token counting tools, test runners, git commands. FOR SINGLE OPERATIONS: use token CLI directly for counts\u002Fchecks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3345,3346,3347,3350],{"name":11,"slug":8,"type":14},{"name":3206,"slug":3207,"type":14},{"name":3348,"slug":3349,"type":14},"Process Optimization","process-optimization",{"name":3298,"slug":3299,"type":14},"2026-07-12T08:17:32.970921",{"slug":3353,"name":3353,"fn":3354,"description":3355,"org":3356,"tags":3357,"stars":3240,"repoUrl":3241,"updatedAt":3363},"skill-authoring","author agent skills for agentskills.io","Write Agent Skills that comply with the agentskills.io specification. WHEN: \"create a skill\", \"new skill\", \"write a skill\", \"skill template\", \"skill structure\", \"review skill\", \"skill PR\", \"skill compliance\", \"SKILL.md format\", \"skill frontmatter\", \"skill best practices\". DO NOT USE FOR: improving existing skills (use sensei), general documentation. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3358,3359,3362],{"name":3238,"slug":3239,"type":14},{"name":3360,"slug":3361,"type":14},"Plugin Development","plugin-development",{"name":3298,"slug":3299,"type":14},"2026-07-12T08:17:35.873862",109,{"items":3366,"total":681},[3367],{"slug":4,"name":4,"fn":5,"description":6,"org":3368,"tags":3369,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3370,3371,3372,3373],{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":22,"slug":23,"type":14},{"name":16,"slug":17,"type":14}]