56 results available
Sign in
Skills directory

preset

microsoft

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 27 targeted changes and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 0. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 10. Review findings remaining: 2.


Open before hardening

2

Low
Open after hardening

2

Low

Expand
File
Group
Subtype
Severity
Status
references/preset-workflow.md

Malicious Code & Command Execution

Command injection

Low
Open
references/workflow.md

Malicious Code & Command Execution

Command injection

Low
Open

2 findings


SKILL.md

Deploy Model to Optimal Region

Automates intelligent Azure OpenAI model deployment by checking capacity across regions and deploying to the best available option.

What This Skill Does

  1. Verifies Azure authentication and project scope
  2. Checks capacity in current project's region
  3. If no capacity: analyzes all regions and shows available alternatives
  4. Filters projects by selected region
  5. Supports creating new projects if needed
  6. Deploys model with GlobalStandard SKU
  7. Monitors deployment progress

Prerequisites

  • Azure CLI installed and configured
  • Active Azure subscription with Cognitive Services read/create permissions
  • Microsoft Foundry project resource ID (PROJECT_RESOURCE_ID env var or provided interactively)
    • Format: /subscriptions/{sub-id}/resourceGroups/{rg}/providers/Microsoft.CognitiveServices/accounts/{account}/projects/{project}
    • Found in: Microsoft Foundry portal → Project → Overview → Resource ID
  • The resource ID must match the format above exactly. Show the parsed subscription, resource group, account and project to the user and get confirmation before continuing. Stop if any part is empty or contains spaces, quotes or shell characters.

Minimal Permissions

This skill needs only three things. It reads the bundled reference files. It runs the az commands shown in the workflow. It runs the bundled deployment name script after reading it. It keeps capacity data in memory, leaves skill and user files as they are, and runs no other shell commands or web requests.

Quick Workflow

Fast Path (Current Region Has Capacity)

1. Check authentication → 2. Get project → 3. Check current region capacity
→ 4. Show the deployment plan, get user approval, then deploy

Alternative Region Path (No Capacity)

1. Check authentication → 2. Get project → 3. Check current region (no capacity)
→ 4. Query all regions → 5. Show alternatives → 6. Select region + project
→ 7. Deploy

Deployment Phases

Approval gate: Before any account create or deployment create, show the user the subscription, resource group, region, model, version, SKU and capacity. Note that these resources are billable. Proceed only after the user explicitly approves. Cost can be checked with the separate cost estimation skill.

Input checks: Take model name, version and region only from values returned by the list-models and capacity queries. Accept only letters, digits, hyphens and periods in model name, version, region and deployment name. Keep every value double-quoted in commands, and stop if a value contains anything else.

Capacity: Show the computed capacity and its effect on remaining quota, and let the user adjust it before deploying.

Bundled scripts: Before running any bundled script, read it and confirm that it only lists deployments or builds a portal link. If it does anything else, or is missing, stop and choose the deployment name by hand using the numeric suffix rule.

PhaseActionKey Commands

1. Verify Auth

Check Azure CLI login and subscription

az account show, az login

2. Get Project

Parse PROJECT_RESOURCE_ID ARM ID, verify exists

az cognitiveservices account show

3. Get Model

List available models, user selects model + version

az cognitiveservices account list-models

4. Check Current Region

Query capacity using GlobalStandard SKU

az rest --method GET .../modelCapacities

5. Multi-Region Query

If no local capacity, query all regions

Same capacity API without location filter

6. Select Region + Project

User picks region; find or create project

az cognitiveservices account list, az cognitiveservices account create

7. Deploy

Generate unique name, calculate capacity (50% available, min 50 TPM), create deployment

az cognitiveservices account deployment create

For detailed step-by-step instructions, see workflow reference.


Error Handling

ErrorSymptomResolution

Auth failure

az account show returns error

Ask the user to run az login then az account set --subscription <id> themselves; confirm the tenant and subscription with the user before any write

No quota

All regions show 0 capacity

Defer to the quota skill for increase requests and troubleshooting; check existing deployments; try alternative models

Model not found

Empty capacity list

Verify model name with az cognitiveservices account list-models; check case sensitivity

Name conflict

"deployment already exists"

Append suffix to deployment name (handled automatically by generate_deployment_name script)

Region unavailable

Region doesn't support model

Select a different region from the available list

Permission denied

"Forbidden" or "Unauthorized"

Verify Cognitive Services Contributor role: az role assignment list --assignee <user>; check only whether that role is held on the target account and report only the relevant role names


Advanced Usage

# Custom capacity (must not exceed the available capacity reported by the query; confirm with the user first)
az cognitiveservices account deployment create ... --sku-capacity <value>

# Check deployment status
az cognitiveservices account deployment show --name <acct> --resource-group <rg> --deployment-name <name> --query "{Status:properties.provisioningState}"

Notes

  • SKU: GlobalStandard only — API Version: 2024-10-01 (GA stable)
  • Data residency: GlobalStandard and alternate regions may process data outside the geography of the project. Ask the user about residency constraints before showing alternatives, offer only regions the user approves, and use customize when data residency matters.

  • microsoft-foundry - Parent skill for Microsoft Foundry operations
  • quota — For quota viewing, increase requests, and troubleshooting quota errors, defer to this skill
  • azure-quick-review - Review Azure resources for compliance
  • cost-estimation - Estimate costs through the separately installed azure-cost plugin
  • azure-validate - Validate Azure infrastructure before deployment

Install

Install with chainctl
chainctl skill install public/microsoft/preset:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/microsoft/azure-skills
Upstream commit9184881885141eccbf8f6477db9689f861608a68
OCI reference

skills.cgr.dev/public/github.com/microsoft/skills/microsoft-foundry/models/deploy-model/preset:latest

License

MIT

Files

EXAMPLES.md

HARDENING.md

LICENSE

SKILL.md

references/preset-workflow.md

references/workflow.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.