AI
Azure Copilot for Terraform: What Changed in the Past Year
Microsoft made four changes to the Azure Terraform Copilot handler over the past year. The model moved from an earlier GPT variant to GPT-4o Mini, which produces fewer hallucinated resource properties. The handler now supports the EasyAPI provider alongside AzureRM, so users get responses for either by including “api” in the prompt. A full-screen editor opened from the Azure portal replaced the cramped sidebar view. A Terraform validation logic loop was also added: if the LLM generates invalid HCL, the loop catches the error and asks the model to correct it before surfacing the result.
Full Deployment From Portal to Cloud Without Leaving the Browser
The Copilot-to-VS Code web deployment demo (04:56) traces the full greenfield path. Jingwei prompted the Azure portal Copilot to create a container app and container registry using the AzureRM provider. The generated HCL opened in VS Code web, which pre-installed the HashiCorp MCP server and preserved the Azure login session. She pushed the code to a private GitHub repo, then used Copilot chat to inject the HCP workspace block into main.tf. Terraform plan showed five resources to add, zero to change. Apply confirmed all five created and visible in both HCP and the Azure portal.
Exporting Existing Infrastructure and Catching Policy Failures Before Apply
Copilot generates new infrastructure, but the VS Code extension handles day-two work. The VS Code export and pre-flight demo (17:36) shows both capabilities. Export runs from the command palette: pick a subscription, select a resource group (in the demo, “cascade-cloud”), and the extension produces a complete Terraform file with all configurable properties exposed and commented import blocks at the top. Pre-flight runs before any apply: it executes terraform plan and checks Azure Policy compliance. A storage account named “storage account” triggered a failure immediately.
“don’t want it to fail on 48.” — Steven Ma
MS Graph Terraform Provider: Day-Zero Coverage for Entra and M365
The MS Graph provider gives Terraform day-zero coverage for every CRUD-capable Microsoft Graph API: Entra ID, M365, SharePoint, and Outlook. The Azure AD provider stays; MS Graph sits alongside it the same way EasyAPI sits alongside AzureRM. When you need a feature that Azure AD does not yet support, such as flexible federated identity credentials, you reach for MS Graph. The demo used the msgraph_update_resource to patch an existing application’s federated identity credential, a property the Azure AD provider cannot modify today.
“day zero support for all graph APIs.” — Steven Ma
JIT and MFA are next on the roadmap. The provider is in public preview ahead of GA.
Notable Quotes
don’t want it to fail on 48. Steven Ma · ▶ 19:37
Storage account name is already taken. Steven Ma · ▶ 19:43
day zero support for all graph APIs. Steven Ma · ▶ 20:11
Key Takeaways
- Azure Copilot switched to GPT-4o Mini and added a Terraform validation loop to cut hallucination errors.
- A new VS Code extension exports live Azure resource groups as Terraform code and runs pre-flight policy checks before apply.
- The MS Graph Terraform provider covers all CRUD-capable Microsoft Graph APIs on day zero, including Entra and M365.