---

name: azure description: | Azure cloud services SDK integration. Azure Functions, Cosmos DB, Blob Storage, Service Bus, Azure AD (Entra ID), and Key Vault. Node.js and .NET SDKs.

USE WHEN: user mentions "Azure", "Azure Functions", "Cosmos DB", "Blob Storage", "Service Bus", "Azure AD", "Entra ID", "Key Vault", "Azure SDK"

DO NOT USE FOR: AWS services - use aws; GCP services - use gcp; Terraform for Azure - use terraform allowed-tools: Read, Grep, Glob, Write, Edit

Azure SDK Integration

Azure Functions

import { app, HttpRequest, HttpResponseInit, InvocationContext } from '@azure/functions';

app.http('getProduct', {
  methods: ['GET'],
  authLevel: 'anonymous',
  route: 'products/{id}',
  handler: async (req: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
    const id = req.params.id;
    const product = await getProduct(id);
    return { status: 200, jsonBody: product };
  },
});

// Queue trigger
app.serviceBusQueue('processOrder', {
  connection: 'ServiceBusConnection',
  queueName: 'orders',
  handler: async (message: unknown, context: InvocationContext) => {
    const order = message as Order;
    await processOrder(order);
  },
});

// Timer trigger (cron)
app.timer('dailyCleanup', {
  schedule: '0 0 2 * * *',
  handler: async (timer, context) => {
    await cleanupExpiredSessions();
  },
});

Cosmos DB

import { CosmosClient } from '@azure/cosmos';

const client = new CosmosClient(process.env.COSMOS_CONNECTION_STRING!);
const container = client.database('mydb').container('products');

// Create
await container.items.create({ id: '123', name: 'Widget', price: 19.99, category: 'tools' });

// Read
const { resource } = await container.item('123', 'tools').read();

// Query
const { resources } = await container.items
  .query({
    query: 'SELECT * FROM c WHERE c.category = @cat AND c.price < @maxPrice',
    parameters: [
      { name: '@cat', value: 'tools' },
      { name: '@maxPrice', value: 50 },
    ],
  })
  .fetchAll();

Blob Storage

import { BlobServiceClient } from '@azure/storage-blob';

const blobService = BlobServiceClient.fromConnectionString(process.env.AZURE_STORAGE_CONNECTION!);
const container = blobService.getContainerClient('uploads');

// Upload
const blockBlob = container.getBlockBlobClient(`files/${filename}`);
await blockBlob.uploadData(buffer, {
  blobHTTPHeaders: { blobContentType: contentType },
});

// Download
const downloadResponse = await blockBlob.download(0);
const content = await streamToBuffer(downloadResponse.readableStreamBody!);

// Generate SAS URL
import { generateBlobSASQueryParameters, BlobSASPermissions } from '@azure/storage-blob';
const sasUrl = blockBlob.generateSasUrl({
  permissions: BlobSASPermissions.parse('r'),
  expiresOn: new Date(Date.now() + 3600 * 1000),
});

Service Bus

import { ServiceBusClient } from '@azure/service-bus';

const sbClient = new ServiceBusClient(process.env.SERVICE_BUS_CONNECTION!);

// Send
const sender = sbClient.createSender('orders');
await sender.sendMessages({ body: { orderId: '123', status: 'created' } });

// Receive
const receiver = sbClient.createReceiver('orders');
const messages = await receiver.receiveMessages(10, { maxWaitTimeInMs: 5000 });
for (const msg of messages) {
  await processOrder(msg.body);
  await receiver.completeMessage(msg);
}

Authentication (DefaultAzureCredential)

import { DefaultAzureCredential } from '@azure/identity';

// Works in all environments: local dev, Azure VMs, App Service, AKS
const credential = new DefaultAzureCredential();

// Use with any Azure SDK client
const blobService = new BlobServiceClient(
  `https://${accountName}.blob.core.windows.net`,
  credential,
);

Anti-Patterns

Anti-Pattern	Fix
Connection strings in code	Use DefaultAzureCredential + managed identity
Not using partition keys (Cosmos DB)	Design partition key for query patterns
Polling Service Bus	Use event-driven triggers or receiveMessages
No retry configuration	Azure SDKs retry automatically — configure retryOptions
Hardcoded resource names	Use environment variables or App Configuration

Production Checklist

• Managed identity for authentication (no secrets in config)
• DefaultAzureCredential for local + cloud parity
• Key Vault for secrets management
• Application Insights for monitoring
• Resource tagging for cost management
• Network security (VNet integration, private endpoints)