Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/alexpizarro/azure-lean-stack-skillsnpx agentmods add skills/alexpizarro/azure-lean-stack-skills/securing-azure-sql-and-storage-with-managed-identityWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alexpizarro/azure-lean-stack-skills/securing-azure-sql-and-storage-with-managed-identity)<a href="https://agentmods.dev/skills/alexpizarro/azure-lean-stack-skills/securing-azure-sql-and-storage-with-managed-identity"><img src="https://agentmods.dev/badge/skills/alexpizarro/azure-lean-stack-skills/securing-azure-sql-and-storage-with-managed-identity/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alexpizarro/azure-lean-stack-skills/securing-azure-sql-and-storage-with-managed-identity"><img src="https://agentmods.dev/badge/skills/alexpizarro/azure-lean-stack-skills/securing-azure-sql-and-storage-with-managed-identity.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00172 | $0.04666 |
| Opus 5.5 | $0.00069 | $0.01866 |
| Sonnet 5.5 | $0.00034 | $0.00933 |
| Haiku 4.5 | $0.00017 | $0.00467 |
Grade A, and why
securing-azure-sql-and-storage-with-managed-identity scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
MYIP=$(curl -s https://api.ipify.org) Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
const token = JSON.parse(execSync( How it starts
The opening of the file, as written. The whole thing — 262 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Securing Azure SQL and Storage with Managed Identity
Kill the stored SQL password and the storage account key from the runtime auth path. Use the compute's system-assigned managed identity (MI) instead: Entra token auth for Azure SQL, user-delegation SAS for Blob Storage. Managed identity is free. Keep the connection string and account key present as instant rollback only — never the primary auth.
This is the DEFAULT for new deployments. Username/password + account key is legacy / rollback.
Scope note. This is about the app's data-plane auth to SQL and to user blobs. It is separate from FC1's host storage MI (
AzureWebJobsStorage__accountName, the deployment + host lease), which deploying-fc1-flex-consumption-functions already covers. Both use the same system-assigned identity; they authorise different things.Applies to FC1 / Container Apps / App Service — not SWA managed functions. SWA managed functions have no managed identity and no Key Vault references; if the API lives there, move it to FC1 first (the code is the same CommonJS shape).
Proven end-to-end on Azure Functions (Flex Consumption) + Azure SQL + Blob Storage, 2026-07-17.
Workflow checklist
Copy this checklist and tick items off. SQL and storage are independent — do SQL fully first.
Managed-identity data-plane auth:
- [ ] Step 1: Add @azure/identity to the api package; ship the flag-gated code (both flags default OFF)
- [ ] Step 2: SQL server Entra admin set (additive — sqladmin still works)
- [ ] Step 3: MI DB user created FROM EXTERNAL PROVIDER + db_datareader/db_datawriter (connected AS the Entra admin; db_ddladmin only if the app runs DDL)
- [ ] Step 4: Storage RBAC — MI granted Storage Blob Data Contributor at ACCOUNT scope (add Storage Blob Delegator only if the data role is scoped narrower)
- [ ] Step 5: preInvocation user-delegation-key warm-up deployed (needed before any storage cutover)
- [ ] Step 6: Add SQL_AUTH_MODE + STORAGE_AUTH_MODE to the deploy's configure-function-app --settings list
- [ ] Step 7: Cut SQL over — SQL_AUTH_MODE=msi, restart, validate a SQL-backed read
- [ ] Step 8: Cut storage over — STORAGE_AUTH_MODE=msi, restart, validate a SAS BYTE fetch (200 + bytes)
- [ ] Step 9: Rollback rehearsed — unset a flag → back to password/key (both still present)
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +2 lines b9d3703764f9
- 1mo ago First seen · 260 lines · 172 tokens per session scan A b648be5fe983
securing-azure-sql-and-storage-with-managed-identity is a skill published in the GitHub repository alexpizarro/azure-lean-stack-skills (1 stars, last pushed 1mo ago), licensed MIT. It adds 172 tokens to every session and 4,666 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.
Other skills, from other repositories
azure-expert
Expert-level Microsoft Azure cloud platform, services, and architecture. Use when the user mentions cloud, Microsoft platforms, Azure Functions, or Cosmos DB.
cloud-native-azure-functions
Use this skill when the user says 'azure functions', 'durable functions', 'orchestrator function', 'activity function', 'durable entities', 'event grid trigger', 'flex consumption', 'azure functions hosting plan', 'fan-out fan-in azure'. Designs Azure Functions apps and Durable Functions workflows with correct…
azure-mgmt-applicationinsights-dotnet
Azure Application Insights SDK for .NET. Application performance monitoring and observability resource management. Use for creating Application Insights components, web tests, workbooks, analytics items, and API keys. Triggers: "Application Insights", "ApplicationInsights", "App Insights", "APM", "application…
azure-resource-manager-mysql-dotnet
Azure MySQL Flexible Server SDK for .NET. Database management for MySQL Flexible Server deployments. Use for creating servers, databases, firewall rules, configurations, backups, and high availability. Triggers: "MySQL", "MySqlFlexibleServer", "MySQL Flexible Server", "Azure Database for MySQL", "MySQL database…
azure-eventhub-dotnet
Azure Event Hubs SDK for .NET. Use for high-throughput event streaming: sending events (EventHubProducerClient, EventHubBufferedProducerClient), receiving events (EventProcessorClient with checkpointing), partition management, and real-time data ingestion. Triggers: "Event Hubs", "event streaming"…
azure-mgmt-botservice-dotnet
Azure Resource Manager SDK for Bot Service in .NET. Management plane operations for creating and managing Azure Bot resources, channels (Teams, DirectLine, Slack), and connection settings. Triggers: "Bot Service", "BotResource", "Azure Bot", "DirectLine channel", "Teams channel", "bot management .NET", "create bot".