# Azure Landing Zone Workload Integration

> Integrate a workload into an existing enterprise Azure Landing Zone (application landing zone): discover the platform contract and inherited guardrails, split workload-team vs platform-team responsibilities, resolve inherited Azure Policy blocks and platform dependencies like central networking and private DNS, and produce compliant workload actions plus precise platform requests. Not for new-app…

- **Type:** Skill
- **Install:** `agentstack add skill-danieletten-azure-landing-zone-workload-integration-azure-landing-zone-workload-integration`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [danieletten](https://agentstack.voostack.com/s/danieletten)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [danieletten](https://github.com/danieletten)
- **Source:** https://github.com/danieletten/azure-landing-zone-workload-integration/tree/main/skills/azure-landing-zone-workload-integration

## Install

```sh
agentstack add skill-danieletten-azure-landing-zone-workload-integration-azure-landing-zone-workload-integration
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Azure Landing Zone Workload Integration

Help a **workload team** integrate a workload into an **existing** enterprise
Azure Landing Zone. The platform already exists — fit the workload into it; do not
design or deploy it. Guidance is generic; defer to the user's actual platform
contract and organization standards.

## When to Use This Skill

- An Azure Landing Zone / application landing zone already exists and a workload
  must integrate with inherited policy, central networking, DNS, identity,
  monitoring, security, cost, and sovereignty controls.
- A deployment is blocked by inherited Azure Policy or a platform dependency
  (central DNS, firewall, peering, shared-service access).
- Clarifying workload-team vs platform-team responsibilities.

## When NOT to Use

| Scenario | Use Instead |
|---|---|
| Choosing Azure services from an app idea or codebase | `azure-app-onboard` |
| Designing the platform, landing zone, hub network, or governance | `azure-enterprise-infra-planner` |
| Generating IaC for a known architecture | `azure-prepare` |
| Preflight / infra validation | `azure-validate` |
| Executing a ready deployment | `azure-deploy` |

## Guardrails (non-negotiable)

Never assume subscription Owner rights or public network access. Never assume the
workload team owns management groups, central policy, hub networking, firewalls,
or private DNS zones. Never recommend a policy exemption before compliant
alternatives, duplicate central services without reason, invent organization
standards, fabricate MCP tool names or documentation links, or change live Azure
resources or deploy without explicit authorization.

## Workflow (golden path)

1. **Establish context** — capture inputs with
   [`assets/workload-integration-assessment.md`](assets/workload-integration-assessment.md).
   If the user is still selecting Azure services from an app idea, hand off to
   `azure-app-onboard`.
2. **Discover the platform contract and split responsibilities** — read the
   organization overlay `.azure-platform/platform-contract.yaml` first if present,
   following [`references/platform-contract.md`](references/platform-contract.md)
   for source precedence, provenance, and drift handling; then
   [`references/discovery-and-responsibilities.md`](references/discovery-and-responsibilities.md).
   If no contract is present, say so and operate in degraded discovery mode rather
   than inventing platform values. Use read-only Azure discovery only with explicit
   permission.
3. **Assess relevant integration domains** and **review workload IaC** — apply
   [`references/integration-decision-rules.md`](references/integration-decision-rules.md).
   Do not rewrite infrastructure unless implementation is requested.
4. **Handle policy and platform blockers** — follow
   [`references/policy-remediation-and-escalation.md`](references/policy-remediation-and-escalation.md);
   prefer compliant remediation, treat exemptions as a last resort.
5. **Produce outputs** (below), drafting requests with
   [`assets/platform-team-request.md`](assets/platform-team-request.md).

Cite only verified sources from
[`references/official-source-map.md`](references/official-source-map.md); prefer
Azure Verified Modules and Bicep in new Azure-only examples, staying usable for
Terraform.

## Output Contract

Report findings under: (1) confirmed platform context, (2) assumptions and missing
information, (3) workload-team actions, (4) platform-team requests, (5) shared
decisions, (6) architecture decisions required, (7) policy conflicts and compliant
remediation options, (8) exception candidates (if any), and (9) readiness status —
one of `Ready`, `Ready with workload actions`, `Ready after platform dependency`,
`Blocked by workload decision`, `Blocked by platform dependency`,
`Architecture decision required`.

Always distinguish confirmed facts from assumptions, and keep workload actions
separate from platform requests.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [danieletten](https://github.com/danieletten)
- **Source:** [danieletten/azure-landing-zone-workload-integration](https://github.com/danieletten/azure-landing-zone-workload-integration)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-danieletten-azure-landing-zone-workload-integration-azure-landing-zone-workload-integration
- Seller: https://agentstack.voostack.com/s/danieletten
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.