azure-enclave

Name: azure-enclave
Author: MicrosoftDocs/Agent-Skills

$npx mdskill add MicrosoftDocs/Agent-Skills/azure-enclave

This skill provides expert guidance for Azure Enclave. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

SKILL.md

.github/skills/azure-enclaveView on GitHub ↗

---
name: azure-enclave
description: Expert knowledge for Azure Enclave development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, and deployment. Use when configuring enclave apps with AVD/AKS, RBAC/MI/CMK, Bicep/ARM deploys, ExpressRoute/VPN, or DR/migration, and other Azure Enclave related development tasks. Not for Azure Confidential Computing (use azure-confidential-computing), Azure Attestation (use azure-attestation), Azure Dedicated HSM (use azure-dedicated-hsm), Azure Cloud Hsm (use azure-cloud-hsm).
compatibility: Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.
metadata:
  generated_at: "2026-09-27"
  generator: "docs2skills/1.0.0"
---
# Azure Enclave Skill

This skill provides expert guidance for Azure Enclave. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

## How to Use This Skill

> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file

> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)

This skill requires **network access** to fetch documentation content:
- **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.
- **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.

## Category Index

| Category | Lines | Description |
|----------|-------|-------------|
| Troubleshooting | L36-L41 | Diagnosing and fixing common Azure Enclave issues, including setup/attestation failures, runtime errors, connectivity problems, and frequently asked troubleshooting questions. |
| Best Practices | L42-L47 | Design, security, and operational best practices for Azure Enclave, including secure architecture patterns and how to harden and manage admin VMs safely. |
| Decision Making | L48-L53 | Planning disaster recovery and business continuity for Azure Enclave, and strategies, steps, and considerations for migrating existing Azure workloads into an Enclave environment. |
| Architecture & Design Patterns | L54-L60 | Architectural patterns for Azure Enclave apps: DMZ-based public access, integrating with AVD/AKS, and secure data ingress design for enclave environments. |
| Limits & Quotas | L61-L66 | Naming rules for Azure Enclave resources plus service limits, quotas, and regional availability to plan compliant deployments and capacity. |
| Security | L67-L91 | Configuring Azure Enclave security: RBAC, managed identities, CMK encryption, policy/guardrails for AKS, App Service, SQL, Storage, ACR, Cosmos DB, Key Vault, and governance/JIT access. |
| Configuration | L92-L106 | Configuring enclaves, governance, approvals, DNS/AVD setup, observability, policy exemptions, and using service catalog templates for Azure Enclave workloads. |
| Deployment | L107-L115 | Guides for deploying Enclave workloads: app installation on RemoteApp VMs, using Bicep/ARM/CLI templates, and setting up ExpressRoute/VPN connectivity and shared dependencies. |

### Troubleshooting
| Topic | URL |
|-------|-----|
| Resolve common questions and issues in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/azure-enclave-faq |
| Troubleshoot common Azure Enclave errors and issues | https://learn.microsoft.com/en-us/azure/enclave/troubleshoot |

### Best Practices
| Topic | URL |
|-------|-----|
| Apply design and security best practices for Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/best-practices |
| Operate admin VMs securely in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/understand-admin-vm |

### Decision Making
| Topic | URL |
|-------|-----|
| Design disaster recovery strategy for Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/disaster-recovery-planning |
| Migrate existing Azure resources into Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/migrate-azure-resources-azure-enclave |

### Architecture & Design Patterns
| Topic | URL |
|-------|-----|
| Design DMZ-based public access for Azure Enclave apps | https://learn.microsoft.com/en-us/azure/enclave/1-7-host-publicly-accessible-application-azure-enclave |
| Plan Azure Enclave architecture for AVD and AKS | https://learn.microsoft.com/en-us/azure/enclave/2-1-plan-architecture-workloads |
| Plan secure data transfer into Azure Enclave environments | https://learn.microsoft.com/en-us/azure/enclave/move-data-inside-enclave |

### Limits & Quotas
| Topic | URL |
|-------|-----|
| Apply naming rules and restrictions for Azure Enclave resources | https://learn.microsoft.com/en-us/azure/enclave/name-rules-restrictions-azure-enclave-resources |
| Review Azure Enclave quotas and regional availability | https://learn.microsoft.com/en-us/azure/enclave/quotas-region-availability |

### Security
| Topic | URL |
|-------|-----|
| Configure Azure Enclave RBAC and deny assignments | https://learn.microsoft.com/en-us/azure/enclave/access-controls-enclaves |
| Apply AKS security policy guardrails in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/aks-initiative |
| Apply App Service security policy guardrails in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/app-service-initiative |
| Use built-in RBAC roles for Azure Enclave access | https://learn.microsoft.com/en-us/azure/enclave/built-in-rbac-roles |
| Configure CMK encryption for Azure Enclave resources | https://learn.microsoft.com/en-us/azure/enclave/configure-customer-managed-key-encryption-within-enclave |
| Apply secure policy guardrails to Azure Container Registry | https://learn.microsoft.com/en-us/azure/enclave/container-registry-initiative |
| Enforce secure deployment policies for Azure Cosmos DB | https://learn.microsoft.com/en-us/azure/enclave/cosmosdb-initiative |
| Create user-assigned managed identities in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/create-user-managed-identity |
| Implement defense-in-depth protections in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/defense-in-depth |
| Set up JIT access with PIM for Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/just-in-time-access |
| Secure Azure Key Vault with Enclave policy guardrails | https://learn.microsoft.com/en-us/azure/enclave/key-vault-initiative |
| Use Azure Enclave maintenance mode for protected resources | https://learn.microsoft.com/en-us/azure/enclave/maintenance-mode |
| Configure secure monitoring policies in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/monitor-initiative |
| Configure permissions and onboarding for Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/onboard |
| Enforce secure deployment guardrails for Azure PostgreSQL | https://learn.microsoft.com/en-us/azure/enclave/postgresql-initiative |
| Use Azure Enclave built-in RBAC roles | https://learn.microsoft.com/en-us/azure/enclave/role-based-access-controls |
| Secure Azure Service Bus with Enclave policy guardrails | https://learn.microsoft.com/en-us/azure/enclave/service-bus-initiative |
| Understand Azure Enclave shared security responsibilities | https://learn.microsoft.com/en-us/azure/enclave/shared-responsibility-model |
| Apply Azure Enclave security policies to Azure SQL | https://learn.microsoft.com/en-us/azure/enclave/sql-initiative |
| Apply secure policy guardrails to Azure Storage accounts | https://learn.microsoft.com/en-us/azure/enclave/storage-initiative |
| Configure approval-based governance in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/what-approvals |

### Configuration
| Topic | URL |
|-------|-----|
| Configure enclave and community endpoint resources in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/1-5-create-enclave-endpoint-connections |
| Configure approvals workflow in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/configure-approvals |
| Configure community-level governance in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/configure-community-governance |
| Understand creation and deletion rules for Azure Enclave resources | https://learn.microsoft.com/en-us/azure/enclave/create-and-delete-logic |
| Configure Azure Virtual Desktop workloads within an enclave | https://learn.microsoft.com/en-us/azure/enclave/create-azure-virtual-desktop-workloads |
| Set up a DNS forwarder VM in an Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/create-domain-name-service-forwarder |
| Use Azure Enclave service catalog templates for workloads | https://learn.microsoft.com/en-us/azure/enclave/list-service-catalog-templates |
| Manage and process Azure Enclave approval requests | https://learn.microsoft.com/en-us/azure/enclave/manage-approvals |
| Configure observability destinations for Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/observability |
| Configure policy exemptions for Azure Enclave workloads | https://learn.microsoft.com/en-us/azure/enclave/policy-compliance-exemptions |
| Understand and use approvals for Azure Enclave changes | https://learn.microsoft.com/en-us/azure/enclave/understand-approvals |

### Deployment
| Topic | URL |
|-------|-----|
| Install applications on RemoteApp VMs in Azure Enclave | https://learn.microsoft.com/en-us/azure/enclave/application-deployment-using-remote-app-vm |
| Use Azure Enclave Bicep and ARM deployment templates | https://learn.microsoft.com/en-us/azure/enclave/azure-enclave-templates |
| Deploy common dependency templates to Enclave workloads | https://learn.microsoft.com/en-us/azure/enclave/deploy-common-dependencies-service-catalog |
| Deploy ExpressRoute connections in Azure Enclave workloads | https://learn.microsoft.com/en-us/azure/enclave/deploy-express-route-connection-service-catalog |
| Deploy Azure Enclave templates using Azure CLI | https://learn.microsoft.com/en-us/azure/enclave/deploy-template-service-catalog-azure-cli |
| Deploy VPN connections for Azure Enclave transit hubs | https://learn.microsoft.com/en-us/azure/enclave/deploy-vpn-connection-service-catalog |

More from MicrosoftDocs/Agent-Skills

Skill	Description
azure-active-directory-b2c	Expert knowledge for Azure Active Directory B2C development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when building B2C user flows/custom policies, configuring IdPs/MFA, securing APIs, automating CI/CD, or monitoring with Sentinel, and other Azure Active Directory B2C related development tasks. Not for Azure Role-based access control (use azure-rbac), Azure Information Protection (use azure-information-protection), Azure Security (use azure-security), Azure Sentinel (use azure-sentinel).
azure-advisor	Expert knowledge for Azure Advisor development including best practices, decision making, limits & quotas, security, configuration, and integrations & coding patterns. Use when configuring Advisor alerts/digests, managing recommendation states, using workbooks, Resource Graph, or RBAC, and other Azure Advisor related development tasks. Not for Cost Management (use azure-cost-management), Azure Monitor (use azure-monitor), Azure Policy (use azure-policy), Azure Security (use azure-security).
azure-ai-vision	Expert knowledge for Azure AI Vision development including decision making, limits & quotas, configuration, integrations & coding patterns, and deployment. Use when using Image Analysis, Read OCR containers, smart-crop thumbnails, background removal, or video frame analysis, and other Azure AI Vision related development tasks. Not for Azure AI Custom Vision (use azure-custom-vision), Azure AI Video Indexer (use azure-video-indexer), Azure AI Document Intelligence (use azure-document-intelligence), Azure AI Immersive Reader (use azure-immersive-reader).
azure-aks-edge-essentials	Expert knowledge for Azure Kubernetes Service Edge Essentials development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when deploying AKS Edge/Arc on Azure Local or bare metal, with MetalLB/BGP, GitOps, IoT/OPC, or Key Vault secrets, and other Azure Kubernetes Service Edge Essentials related development tasks. Not for Azure Kubernetes Service (AKS) (use azure-kubernetes-service), Azure IoT Edge (use azure-iot-edge), Azure Stack Edge (use azure-stack-edge), Azure Container Apps (use azure-container-apps).
azure-analysis-services	Expert knowledge for Azure Analysis Services development including troubleshooting. Use when resolving server connectivity, firewall/VNet, DNS, client connection, or network error issues, and other Azure Analysis Services related development tasks. Not for Azure Synapse Analytics (use azure-synapse-analytics), Azure SQL Database (use azure-sql-database), Azure SQL Managed Instance (use azure-sql-managed-instance), SQL Server on Azure Virtual Machines (use azure-sql-virtual-machines).
azure-anomaly-detector	Expert knowledge for Azure AI Anomaly Detector development including troubleshooting, best practices, limits & quotas, configuration, and deployment. Use when tuning Docker-based Anomaly Detector, ACI or IoT Edge deployments, univariate/multivariate APIs, or service limits, and other Azure AI Anomaly Detector related development tasks. Not for Azure AI Metrics Advisor (use azure-metrics-advisor), Azure Monitor (use azure-monitor), Azure Machine Learning (use azure-machine-learning).
azure-anyscale-on-azure	Expert knowledge for Azure Anyscale On Azure development including limits & quotas, security, configuration, and deployment. Use when authoring ARM templates, hardening images, configuring Private Link, securing egress, or checking regional support, and other Azure Anyscale On Azure related development tasks. Not for Azure Databricks (use azure-databricks), Azure Kubernetes Service (AKS) (use azure-kubernetes-service), Azure Machine Learning (use azure-machine-learning), Azure Virtual Machines (use azure-virtual-machines).
azure-api-center	Expert knowledge for Azure Api Center development including best practices, security, configuration, integrations & coding patterns, and deployment. Use when setting API auth, provisioning API Center, automating linting/registration, self-hosting the portal, or syncing with API gateways, and other Azure Api Center related development tasks. Not for Azure API Management (use azure-api-management), Azure Resource Manager (use azure-resource-manager), Azure Portal (use azure-portal).
azure-api-management	Expert knowledge for Azure API Management development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when integrating APIM with AI backends, configuring VNets/domains, securing with Entra/OAuth/JWT, setting quotas, or deploying self-hosted gateways, and other Azure API Management related development tasks. Not for Azure App Service (use azure-app-service), Azure Functions (use azure-functions), Azure Logic Apps (use azure-logic-apps).
azure-app-configuration	Expert knowledge for Azure App Configuration development including troubleshooting, best practices, decision making, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when using feature flags, dynamic config refresh, snapshots, Key Vault integration, or CI/CD config sync, and other Azure App Configuration related development tasks. Not for Azure App Service (use azure-app-service), Azure Key Vault (use azure-key-vault), Azure Functions (use azure-functions).