What it does
Copilot in Azure turns natural-language prompts into real work across your estate: it authors scripts and config, queries Azure Resource Graph, analyses cost, and helps diagnose broken resources. It works across the portal, mobile app and CLI, and only ever acts within your permissions.
Key facts
- Authors deployment artefacts: Azure CLI, Terraform configuration and API Management policies you can review and run.
- Writes Azure Resource Graph queries from plain English, and uses Graph itself to find and list resources faster than clicking blades (filter by type, tag, resource group or subscription).
- Cost skill uses Cost Management APIs to analyse spend, estimate costs and flag waste, orphaned resources, oversized VMs, wrong storage tiers, idle dev environments, with rough savings per item.
- Troubleshoots specific resources, e.g. AKS clusters and Arc server extensions, and can offer to reinstall a broken extension.
- Complies with Azure RBAC, PIM, Azure Policy and resource locks; only sees resources the user can see.
- Requires explicit confirmation before making any change; nothing is applied silently.
- Grounds answers in Microsoft Learn and your resource metadata rather than open-web guessing.
When to use / skip
Reach for it to draft a Graph query you can't remember the syntax for, to get a first-pass CLI or Terraform block, or to get a fast read on where cost is leaking. It's strong at the boring lookup and scaffolding work. Don't lean on it for production-grade IaC without review, or treat its cost savings figures as billing-accurate, they're directional. And it won't design your architecture, it fills in the parts once you know what you want.
Configuration decisions
- Decide which surface your team standardises on, portal for exploration, CLI for repeatable work.
- Treat generated CLI, Terraform and APIM policy as drafts that go through your normal review and pipeline, not straight to apply.
- Keep RBAC tight; the cost and troubleshooting skills are only as scoped as the user's access.
- Where you want proposed actions executed, use the confirm-before-apply flow deliberately rather than rubber-stamping.
Gotchas
- Generated Terraform and CLI can reference stale API versions or defaults, read before running.
- Cost numbers come from Cost Management data and estimates, so they lag and round, don't quote them to finance verbatim.
- Troubleshooting coverage is per resource type; plenty of services aren't wired up yet.
- Confirmation gating means it won't fix things end-to-end, expect it to propose and hand back.
- Answers vary by the asker's permissions, so two engineers may see different resource lists.
Consultant notes
- Best demo is a Resource Graph query from plain English, it lands instantly with ops teams.
- Use the cost skill for a quick waste sweep before a proper FinOps engagement, not instead of one.
- Remind clients it proposes and asks before acting, that reassures security reviewers fast.
- The generated-IaC angle is handy for onboarding juniors, as long as review discipline holds.
Re-run a couple of the generated scripts before you claim it "authors deployable Terraform", drift happens.