Duration: 60 minutes
Prerequisites#
Complete Challenge 4. Use your own Azure subscription and confirm your Azure prerequisites: an explicitly selected subscription and budget, Contributor on your workshop resource group, a working GitHub ↔ Azure OIDC federated credential configured for your own fork, and region capacity. No Azure account, subscription, or preconfigured identity is supplied.
Cleanup and re-provisioning below apply only to a dedicated workshop resource group you are authorized to delete. For shared groups, coordinate with the owner instead. Review the cleanup checklist and confirm the active subscription before changing resources.
Approach#
The most operationally demanding challenge. Get to a simple, working deploy early, then refine — a reachable app on basic infra beats perfect templates that never ship. Auth and quota are the top time sinks.
Suggested pacing:
Choose IaC + author templates ~20 min
Build the Actions pipeline ~20 min
Configure secure auth (OIDC/secrets) ~10 min
Deploy and verify ~10 min
Task 1: Choose IaC and author templates#
- Pick Bicep or Terraform and let Copilot scaffold the resources: compute for frontend/API, storage/database, supporting services.
- 💡 Optional starter scaffold —
infra/(Bicep) is bundled in this MicroHack folder; combined with the inactive.github/workflows/deploy.yml.exampleit sketches a Container Apps + ACR + Log Analytics + OIDC topology — two apps (apion port 3000,frontend/nginx on port 80). The design decisions (SKUs, database/storage strategy, API ingress visibility, secrets, scaling, image build/push, frontend→api discovery) are deliberately left asTODO. It's a de-risking starting point, not a required or "correct" answer — extend it, replace it, or ignore it. Finish and review it in your fork before activating it asdeploy.yml. Seeinfra/README.md.
Task 2: Build one linear pipeline#
- Author a single GitHub Actions workflow that goes build → test → provision → deploy. Keep it linear and readable.
Task 3: Configure secure auth#
- 🔑 Use OIDC federated credentials (with User-Assigned Managed Identity) for Azure auth, not long-lived secrets. The most common wall is the federated-credential subject (
repo:<owner>/<repo>:ref:refs/heads/mainor an environment subject) or a missing role. If auth fails in the pipeline, check this first and confirm the identity has Contributor on your scope. Note thatsetup-oidc.shis bundled inscripts/to help with this configuration.
Task 4: Deploy and verify#
- Get a simple deploy reachable first, then refine SKUs and structure. Load the app's Azure URL and exercise a real flow (e.g. the cart). Ask Copilot for Azure Well-Architected guidance when choosing SKUs/services.
Common blockers#
- Azure auth fails → almost always the OIDC/federated credential or a missing role.
- Quota / capacity errors → fall back to a smaller SKU or an alternate region.
- Provisioning partially fails → tear down the resource group and re-provision clean rather than patching half-built state.
- Secrets committed to source → stop and move them to GitHub secrets / OIDC.
- Pipeline green but app unreachable → check ingress/networking and that the deploy targeted the provisioned resources.
No optional stretch. Fast finishers should harden the pipeline (environments, review gates) or get a head start on Challenge 6's observability.
You successfully completed challenge 5! 🚀🚀🚀