1# Global Rules
2 
3These rules apply to ALL phases of the azure-upgrade skill.
4 
5## Destructive Action Policy
6 
7⛔ **NEVER** perform destructive actions without explicit user confirmation via `ask_user`:
8- Deleting apps, services, or resource groups
9- Stopping or disabling the original app/service
10- Overwriting app settings or configuration in the new app
11- Removing the original hosting plan or service tier
12- Modifying DNS or custom domain bindings
13 
14## User Confirmation Required
15 
16Always use `ask_user` before:
17- Selecting target Azure subscription
18- Selecting target Azure region/location
19- Creating new Azure resources
20- Stopping or deleting the original app/service
21- Modifying custom domains or network restrictions
22- Any irreversible configuration change
23 
24## Best Practices
25 
26- Always use `mcp_azure_mcp_get_azure_bestpractices` tool before generating upgrade commands
27- Prefer managed identity over connection strings — upgrades are a good time to improve security
28- **Always target the latest supported runtime version** — check Azure docs for the newest GA version
29- Keep the original app/service running until the upgraded one is fully validated
30- Use the same resource group for the new resource to maintain access to existing dependencies
31- Follow Azure naming conventions for all new resources
32 
33## Identity-First Authentication (Zero API Keys)
34 
35> Enterprise subscriptions commonly enforce policies that block local auth. Always design for identity-based access from the start.
36 
37- Prefer managed identity connections over connection strings/keys
38- Use `DefaultAzureCredential` in code — works locally and in Azure
39- When using User Assigned Managed Identity, always pass `managedIdentityClientId` explicitly
40- See service-specific identity configuration in the scenario reference files
41 
42## Rollback Policy
43 
44- Always document rollback steps before executing upgrade
45- Keep the original app intact and running until upgrade is validated
46- If upgrade fails, guide the user to restart the original app
47- Never delete the original app automatically — always require `ask_user`
48