Add Azure Local skills

plugin/README.md

@@ -65,7 +65,7 @@ The Azure MCP Server provides tools for 40+ Azure services:
 - Azure AI Services Speech (speech-to-text, text-to-speech)
 
 ### Compute & Containers
-- Azure App Service, Container Apps, Azure Kubernetes Service (AKS)
+- Azure App Service, Container Apps, Azure Kubernetes Service (AKS), Azure Local
 - Azure Functions, Virtual Desktop
 
 ### Storage & Databases

plugin/skills/azure-local/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: azure-local
+description: "WHEN: Azure Local, Stack HCI, resource"
+license: MIT
+metadata:
+  author: Microsoft
+  version: "0.0.0-placeholder"
+---
+
+# Azure Local
+
+## Quick Reference
+
+Azure Local planning, deployment, operations, workloads, networking, updates, troubleshooting. References: [MCP/CLI](references/mcp-and-cli-tools.md), [docs-map](references/docs-map.md), [resource-types](references/resource-types.md), [safety-rules](references/safety-rules.md).
+
+## When to Use This Skill
+
+Use for Azure Local, Azure Stack HCI, Azure Local VMs, AKS on Azure Local, AKS hybrid, SDN, lifecycle updates, disconnected sites. Do not use for cloud VM or public AKS guidance.
+
+## MCP Tools
+
+Use `mcp_azure_mcp_extension_cli_generate`, `mcp_azure_mcp_monitor`, `mcp_azure_mcp_resourcehealth`, and `mcp_azure_mcp_documentation`; verify scope with [MCP/CLI](references/mcp-and-cli-tools.md).
+
+## Workflow
+
+1. Deploy: [Plan](workflows/plan-and-deploy/plan-and-deploy.md)
+2. Operate/update: [Operate](workflows/operate-and-update/operate-and-update.md)
+3. VMs, AKS, SQL, images, disks, networks: [Workloads](workflows/workload-management/workload-management.md)
+4. SDN, NSG, gateway, security: [Network](workflows/networking-and-security/networking-and-security.md)
+5. Failures: [Troubleshoot](workflows/troubleshooting/troubleshooting.md)
+
+Read the matched workflow first. Start read-only. Ask before updates, deletes, reimages, network changes, VM power/delete operations, or Arc bridge/custom location changes.
+
+## Error Handling
+
+| Scenario | Remediation |
+| --- | --- |
+| Version unknown | Ask or fetch latest docs. |
+| Risky change | Stop; follow [safety-rules](references/safety-rules.md). |
+| No local access | Use Azure control-plane only. |

plugin/skills/azure-local/references/docs-map.md

@@ -0,0 +1,86 @@
+# Azure Local Documentation Map
+
+Use Microsoft Learn as the authoritative source for Azure Local procedures. Use latest-version URLs by default; add a version-aware view parameter only when the user asks about a specific Azure Local release, and fetch current docs before giving detailed commands.
+
+## Core entry points
+
+| Area | Microsoft Learn path |
+| --- | --- |
+| Azure Local landing page | `https://learn.microsoft.com/azure/azure-local/` |
+| What is Azure Local | `https://learn.microsoft.com/azure/azure-local/overview` |
+| Scalability and deployments | `https://learn.microsoft.com/azure/azure-local/scalability-deployments` |
+| Release information | `https://learn.microsoft.com/azure/azure-local/release-information-23h2` |
+| Known issues | `https://learn.microsoft.com/azure/azure-local/known-issues` |
+
+## Planning and deployment
+
+| Need | Microsoft Learn path |
+| --- | --- |
+| System requirements | `https://learn.microsoft.com/azure/azure-local/concepts/system-requirements-23h2` |
+| Physical network requirements | `https://learn.microsoft.com/azure/azure-local/concepts/physical-network-requirements` |
+| Host network requirements | `https://learn.microsoft.com/azure/azure-local/concepts/host-network-requirements` |
+| Firewall requirements | `https://learn.microsoft.com/azure/azure-local/concepts/firewall-requirements` |
+| Network reference patterns | `https://learn.microsoft.com/azure/azure-local/plan/network-patterns-overview` |
+| Choose network pattern | `https://learn.microsoft.com/azure/azure-local/plan/choose-network-pattern` |
+| Deployment introduction | `https://learn.microsoft.com/azure/azure-local/deploy/deployment-introduction` |
+| Deployment prerequisites | `https://learn.microsoft.com/azure/azure-local/deploy/deployment-prerequisites` |
+| Prepare Active Directory | `https://learn.microsoft.com/azure/azure-local/deploy/deployment-prep-active-directory` |
+| Install OS | `https://learn.microsoft.com/azure/azure-local/deploy/deployment-install-os` |
+| Simplified machine provisioning | `https://learn.microsoft.com/azure/azure-local/deploy/simplified-machine-provisioning` |
+| Subscription permissions | `https://learn.microsoft.com/azure/azure-local/deploy/deployment-arc-register-server-permissions` |
+| Register without Arc gateway | `https://learn.microsoft.com/azure/azure-local/deploy/deployment-without-azure-arc-gateway` |
+| Register with Arc gateway | `https://learn.microsoft.com/azure/azure-local/deploy/deployment-with-azure-arc-gateway` |
+| Deploy via portal | `https://learn.microsoft.com/azure/azure-local/deploy/deploy-via-portal` |
+| Deploy via ARM template | `https://learn.microsoft.com/azure/azure-local/deploy/deployment-azure-resource-manager-template` |
+
+## Operations, updates, and upgrades
+
+| Need | Microsoft Learn path |
+| --- | --- |
+| About updates | `https://learn.microsoft.com/azure/azure-local/update/about-updates-23h2` |
+| Update phases | `https://learn.microsoft.com/azure/azure-local/update/update-phases-23h2` |
+| Update via PowerShell | `https://learn.microsoft.com/azure/azure-local/update/update-via-powershell-23h2` |
+| Limited connectivity updates | `https://learn.microsoft.com/azure/azure-local/update/import-discover-updates-offline-23h2` |
+| Update via Azure portal | `https://learn.microsoft.com/azure/azure-local/update/azure-update-manager-23h2` |
+| Update best practices | `https://learn.microsoft.com/azure/azure-local/update/update-best-practices` |
+| Troubleshoot updates | `https://learn.microsoft.com/azure/azure-local/update/update-troubleshooting-23h2` |
+| About upgrades | `https://learn.microsoft.com/azure/azure-local/upgrade/about-upgrades-23h2` |
+| Upgrade troubleshooting | `https://learn.microsoft.com/azure/azure-local/upgrade/troubleshoot-upgrade-to-23h2` |
+
+## Workloads
+
+| Need | Microsoft Learn path |
+| --- | --- |
+| Azure Local VM management overview | `https://learn.microsoft.com/azure/azure-local/manage/azure-arc-vm-management-overview` |
+| VM management prerequisites | `https://learn.microsoft.com/azure/azure-local/manage/azure-arc-vm-management-prerequisites` |
+| Assign VM RBAC roles | `https://learn.microsoft.com/azure/azure-local/manage/assign-vm-rbac-roles` |
+| Create storage path | `https://learn.microsoft.com/azure/azure-local/manage/create-storage-path` |
+| Create logical networks | `https://learn.microsoft.com/azure/azure-local/manage/create-logical-networks` |
+| Create network interfaces | `https://learn.microsoft.com/azure/azure-local/manage/create-network-interfaces` |
+| Create Arc VMs | `https://learn.microsoft.com/azure/azure-local/manage/create-arc-virtual-machines` |
+| Manage Arc VMs | `https://learn.microsoft.com/azure/azure-local/manage/manage-arc-virtual-machines` |
+| Troubleshoot Arc VMs | `https://learn.microsoft.com/azure/azure-local/manage/troubleshoot-arc-enabled-vms` |
+| AKS on Azure Local | `https://learn.microsoft.com/azure/aks/hybrid/aks-create-clusters-portal?toc=/azure/azure-local/toc.json&bc=/azure/azure-local/breadcrumb/toc.json` |
+| SQL Server on Azure Local | `https://learn.microsoft.com/azure/azure-local/deploy/sql-server-23h2` |
+| Disaster recovery overview | `https://learn.microsoft.com/azure/azure-local/manage/disaster-recovery-overview` |
+
+## Networking and security
+
+| Need | Microsoft Learn path |
+| --- | --- |
+| Security features | `https://learn.microsoft.com/azure/azure-local/concepts/security-features` |
+| Security book | `https://learn.microsoft.com/azure/azure-local/security-book/overview` |
+| Private endpoints | `https://learn.microsoft.com/azure/azure-local/deploy/about-private-endpoints` |
+| SDN overview | `https://learn.microsoft.com/azure/azure-local/concepts/sdn-overview` |
+| Enable SDN integration | `https://learn.microsoft.com/azure/azure-local/deploy/enable-sdn-integration` |
+| Network security groups | `https://learn.microsoft.com/azure/azure-local/manage/create-network-security-groups` |
+| Manage NSGs | `https://learn.microsoft.com/azure/azure-local/manage/manage-network-security-groups` |
+| SDN troubleshooting | `https://learn.microsoft.com/azure/azure-local/manage/sdn-troubleshooting` |
+| External storage | `https://learn.microsoft.com/azure/azure-local/deploy/enable-external-storage` |
+
+## Documentation usage rules
+
+1. Fetch current docs for detailed procedures, command syntax, or supported topology decisions.
+2. If a URL redirects or 404s, search Microsoft Learn for the article title and keep the user's requested Azure Local version in the query.
+3. Do not copy long procedural content into responses; summarize the decision and link or cite the authoritative doc.
+4. When documentation differs by version, ask for the Azure Local version or use the version provided by the user.

plugin/skills/azure-local/references/mcp-and-cli-tools.md

@@ -0,0 +1,60 @@
+# MCP and CLI Tools for Azure Local
+
+Prefer Azure MCP tools for Azure control-plane discovery where they support the Azure Local resource type, then use generated Azure CLI/PowerShell commands when a documented operation requires command execution. Azure MCP does not currently expose a dedicated Azure Local tool namespace; treat support as partial through generic Azure, Azure Resource Graph, documentation, monitor/resource health, and Bicep schema surfaces.
+
+## MCP tools
+
+| Tool | Use |
+| --- | --- |
+| `mcp_azure_mcp_subscription_list` | Discover subscription scope. |
+| `mcp_azure_mcp_group_list` | Discover resource groups. |
+| `mcp_azure_mcp_extension_cli_generate` | Generate Azure CLI or Azure Resource Graph commands for Azure Local/Arc inventory and operations. |
+| `mcp_azure_mcp_monitor` | Query logs/metrics when Azure Monitor or Log Analytics is configured. |
+| `mcp_azure_mcp_resourcehealth` | Check resource health where supported. |
+| `mcp_azure_mcp_documentation` | Retrieve current Microsoft Learn content. |
+| `mcp_azure_mcp_bicepschema` | Inspect ARM/Bicep schemas for Azure Local resource types such as `Microsoft.AzureStackHCI/clusters` when authoring templates. |
+
+Do not assume public Azure service-specific MCP tools are interchangeable with Azure Local. For example, public Azure VM and AKS tools may not cover Arc VMs or AKS on Azure Local; confirm the resource provider/type and use ARG, generated CLI, or documented PowerShell when the dedicated MCP tool does not match.
+
+## Azure CLI patterns
+
+Use Azure CLI for Azure control-plane operations:
+
+```bash
+az account show
+az group list -o table
+az graph query -q "Resources | where type =~ 'microsoft.azurestackhci/clusters' | project name, resourceGroup, location" -o table
+az resource show --ids <resource-id>
+az monitor activity-log list --resource-id <resource-id> --max-events 20
+```
+
+For Azure Local VM operations, use the Azure Local VM management docs to determine the required extension/CLI commands and parameters. Do not assume public Azure VM commands have identical behavior for Azure Local VMs enabled by Azure Arc.
+
+## PowerShell patterns
+
+Use PowerShell when Microsoft Learn specifies Azure Local lifecycle, update, or local cluster commands. Confirm the command is supported for the user's Azure Local version before execution.
+
+Common categories:
+
+- Azure Local update assessment, import, scheduling, and installation.
+- Local evidence collection from an Azure Local machine.
+- SDN management/troubleshooting when docs require local or administrative PowerShell modules.
+- Upgrade readiness and post-upgrade validation.
+
+## When local machine access is required
+
+Ask the user to confirm direct administrative access to an Azure Local machine before local commands. Local access may be required for:
+
+- OS installation or simplified machine provisioning.
+- Local logs or evidence collection.
+- Update/upgrade commands that must run on a system node.
+- SDN certificate or infrastructure troubleshooting.
+- Arc resource bridge local VM state checks.
+
+## Command safety
+
+- Generate commands with read-only flags first.
+- Scope all commands to the subscription/resource group/resource ID.
+- Use `--first`, `--query`, or projection for large Azure Resource Graph queries.
+- Ask before update installation, resource deletion, VM power operations, network changes, or decommissioning.
+- Never embed secrets in commands. Use Key Vault, environment variables, or interactive authentication where documented.

plugin/skills/azure-local/references/resource-types.md

@@ -0,0 +1,63 @@
+# Azure Local Resource Types and ARG Patterns
+
+Use Azure Resource Graph for cross-resource inventory. Resource providers and API coverage can evolve; verify against live resources and current Microsoft Learn docs.
+
+## Common resource types
+
+| Area | Resource type pattern |
+| --- | --- |
+| Azure Local instance / cluster | `microsoft.azurestackhci/clusters` |
+| Arc machines | `microsoft.hybridcompute/machines` |
+| Arc resource bridge | `microsoft.resourceconnector/appliances` |
+| Custom locations | `microsoft.extendedlocation/customlocations` |
+| Kubernetes/Arc extensions | `microsoft.kubernetesconfiguration/extensions` |
+| AKS Arc / connected Kubernetes | `microsoft.kubernetes/connectedclusters` |
+| Azure Local Arc VMs | `microsoft.azurestackhci/virtualmachineinstances`, `microsoft.hybridcompute/machines` |
+| Azure Local logical networks | `microsoft.azurestackhci/logicalnetworks` |
+| Azure Local network interfaces | `microsoft.azurestackhci/networkinterfaces` |
+| Azure Local virtual hard disks | `microsoft.azurestackhci/virtualharddisks` |
+| Azure Local gallery/images | `microsoft.azurestackhci/galleryimages`, `microsoft.azurestackhci/marketplacegalleryimages` |
+| Azure Local storage paths | `microsoft.azurestackhci/storagecontainers` |
+| Network security groups | `microsoft.azurestackhci/networksecuritygroups`, `microsoft.network/networksecuritygroups` |
+
+## Inventory queries
+
+List Azure Local instances:
+
+```kql
+Resources
+| where type =~ 'microsoft.azurestackhci/clusters'
+| project name, resourceGroup, location, id, properties
+```
+
+List Arc resource bridges and custom locations:
+
+```kql
+Resources
+| where type in~ ('microsoft.resourceconnector/appliances', 'microsoft.extendedlocation/customlocations')
+| project name, type, resourceGroup, location, id, properties
+```
+
+List Azure Local workload resources:
+
+```kql
+Resources
+| where type startswith 'microsoft.azurestackhci/'
+| project name, type, resourceGroup, location, id, properties
+```
+
+Find Arc machines associated with Azure Local:
+
+```kql
+Resources
+| where type =~ 'microsoft.hybridcompute/machines'
+| project name, resourceGroup, location, id, properties
+```
+
+## Query rules
+
+- Use `=~`, `in~`, or lower-case type comparisons because resource types are case-insensitive but commonly stored lower-case.
+- Project only needed fields for large tenants.
+- Use `--subscriptions` or resource group filters when possible.
+- Do not mutate through ARG; it is read-only.
+- Validate resource-type names against live inventory because Azure Local resource providers evolve.

plugin/skills/azure-local/references/safety-rules.md

@@ -0,0 +1,45 @@
+# Azure Local Safety Rules
+
+Azure Local changes can affect physical hosts, storage networks, Azure Arc connectivity, and local workloads. Default to assessment and reversible actions.
+
+## Always ask before
+
+- Installing, scheduling, importing, or retrying updates that can reboot hosts or affect workloads.
+- Upgrading Azure Local or changing feature releases.
+- Deleting, recreating, or repairing Azure Arc resource bridge.
+- Deleting custom locations.
+- Decommissioning, reimaging, or unregistering Azure Local machines.
+- Changing physical network settings, VLANs, IP pools, DNS, gateways, proxy, Arc gateway, private endpoints, SDN infrastructure, NSGs, load balancers, gateways, or firewall policy.
+- Creating, deleting, resizing, stopping, restarting, or migrating Azure Local VMs.
+- Deleting disks, NICs, VM images, logical networks, storage paths, AKS clusters, SQL deployments, or backup/disaster-recovery resources.
+- Disabling security baseline controls, Defender, Policy, monitoring, or auditing.
+
+## Critical components
+
+| Component | Rule |
+| --- | --- |
+| Azure Arc resource bridge | Do not delete unless following confirmed reimage/decommission guidance after dependent workload resources are removed. |
+| Custom location | Do not delete until dependent workloads are removed and resource bridge decommission guidance allows it. |
+| Infrastructure logical network | Treat as required infrastructure for Azure Local VM management. |
+| VM management extension | Check health before VM remediation; do not remove as a generic fix. |
+| SDN infrastructure | Treat certificate, controller, load balancer, and gateway changes as high risk. |
+
+## Safe default sequence
+
+1. Read-only inventory.
+2. Health and activity log review.
+3. Documentation lookup for the user's version.
+4. Impact analysis and rollback plan.
+5. User confirmation.
+6. Scoped change.
+7. Post-change validation.
+
+## Response requirements
+
+When recommending a risky change, include:
+
+- The specific resource(s) affected.
+- Why the change is needed.
+- Expected workload/control-plane impact.
+- Validation steps.
+- Rollback or recovery notes when available.

plugin/skills/azure-local/version.json

@@ -0,0 +1,6 @@
+{
+  "version": "1.0",
+  "pathFilters": [
+    "."
+  ]
+}