[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69BG5FWSASJKDQ4232N0HNF":3,"skill-same:01M69BG5FWSASJKDQ4232N0HNF":70},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":47,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M69BG5FWSASJKDQ4232N0HNF","teardown-agent-aca-dev",null,"AI-led teardown of the local-LLM (Ollama) sample agent deployment on Azure Container Apps created by deploy-agent-aca-dev. Use when the user wants to delete the dev sample ACA deployment, clean up the resource group, or optionally delete the Blueprint \u002F Agent Identity \u002F Client SPA. Defaults to DRY-RUN and keeps Entra objects unless the user explicitly opts in. NOT for local docker-compose (use `docker compose down -v`) and NOT for the AWS Bedrock variant (use teardown-agent-aca-aws).","microsoft\u002Fentra-agentid-samples","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M69BFR215QBKQVG4EP8577MV",15,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fentra-agentid-samples\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fteardown-agent-aca-dev\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35],"teardown agent aca dev","docker","identity","deploy","azure","docker compose","deployment","delete","run","2026-11-10 10:12:30",false,"---\nname: teardown-agent-aca-dev\ndescription: 'AI-led teardown of the local-LLM (Ollama) sample agent deployment on Azure Container Apps created by deploy-agent-aca-dev. Use when the user wants to delete the dev sample ACA deployment, clean up the resource group, or optionally delete the Blueprint \u002F Agent Identity \u002F Client SPA. Defaults to DRY-RUN and keeps Entra objects unless the user explicitly opts in. NOT for local docker-compose (use `docker compose down -v`) and NOT for the AWS Bedrock variant (use teardown-agent-aca-aws).'\n---\n\n# Teardown — Dev (Ollama) Agent on Azure Container Apps (AI-Led)\n\nReverses the `deploy-agent-aca-dev` skill. Deletes the Azure resource group and (opt-in) the Entra objects.\n\n**Paired with:** [deploy-agent-aca-dev](..\u002Fdeploy-agent-aca-dev\u002FSKILL.md). Uses the same `\u002Ftmp\u002Fdeploy-vars.sh`.\n\n## When to Use\n\n- User says: \"tear down the dev ACA deployment\", \"delete the Ollama agent on Azure\", \"clean up the demo RG\"\n- User wants to re-run the deploy skill from a clean state\n- User is ending a demo and needs to remove billable resources (ACA, ACR with Ollama images, Log Analytics)\n\n## Do NOT Use When\n\n- **Local docker-compose** — `cd sidecar\u002Fdev && docker compose down -v` is enough\n- **AWS variant** — use [teardown-agent-aca-aws](..\u002Fteardown-agent-aca-aws\u002FSKILL.md) (handles IAM role, OIDC provider, intermediary app)\n- **Shared \u002F long-lived tenants** — confirm the Blueprint and Client SPA are not shared with other agents first\n\n## Safety posture\n\n1. **Dry-run by default** (`DRY_RUN=1`). User must set `DRY_RUN=0` to actually delete.\n2. **Entra objects are opt-in** (`DELETE_ENTRA=1`). Default keeps them.\n3. **Confirm tenant + subscription + RG** with the user first — the user has multiple Azure accounts.\n4. **Re-confirm before deleting the Blueprint.** Blueprints are often shared.\n\n## Prerequisites\n\n- `\u002Ftmp\u002Fdeploy-vars.sh` from the original deployment (at minimum `SUBSCRIPTION_ID`, `RG`).\n- `az` logged in to the correct tenant + subscription.\n- Graph role sufficient to delete Entra apps (only if `DELETE_ENTRA=1`): `Application Administrator` or higher.\n\n## Procedure\n\n### Step 0 — Confirm scope\n\n```\nTeardown plan (dev \u002F Ollama):\n  Subscription:  $SUBSCRIPTION_ID\n  Resource group: $RG            (WILL be deleted)\n  Delete Entra objects: $DELETE_ENTRA\n  Dry run:              $DRY_RUN\nProceed? [y\u002FN]\n```\n\n### Step 1 — Revoke OAuth consent grants on the Agent SP\n\nIf keeping the Agent Identity, revoke existing consent so a redeploy starts clean:\n\n```bash\nAGENT_SP_OID=$(az ad sp show --id \"$AGENT_CLIENT_ID\" --query id -o tsv 2>\u002Fdev\u002Fnull)\nif [[ -n \"$AGENT_SP_OID\" ]]; then\n  az rest --method GET \\\n    --uri \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Foauth2PermissionGrants?\\$filter=clientId eq '$AGENT_SP_OID'\" \\\n    --query 'value[].id' -o tsv | while read -r g; do\n      az rest --method DELETE --uri \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Foauth2PermissionGrants\u002F$g\"\n  done\nfi\n```\n\n### Step 2 — Delete the resource group\n\n```bash\naz group delete --name \"$RG\" --yes --no-wait\n```\n\nThis removes the Container App, ACA environment, ACR (with the ~1–4 GB baked Ollama image), Log Analytics workspace, and user-assigned managed identity in one shot.\n\n### Step 3 — Delete Entra objects (opt-in: `DELETE_ENTRA=1`)\n\nAsk per object. Order:\n\n1. **Client SPA** (`CLIENT_SPA_APP_ID`) — safe if no other agent reuses it.\n2. **Agent Identity** — delete via Agent ID portal or Graph (`DELETE \u002FagentIdentities\u002F{id}`).\n3. **Blueprint** (`BLUEPRINT_APP_ID`) — **ASK AGAIN**. Blueprints are often shared.\n\n```bash\naz ad app delete --id \"$CLIENT_SPA_APP_ID\" 2>\u002Fdev\u002Fnull || true\n# Agent + Blueprint: prompt explicitly, then call Graph\n```\n\n### Step 4 — Verify\n\n```bash\naz group exists --name \"$RG\"                          # expect: false\naz ad app show --id \"$CLIENT_SPA_APP_ID\" 2>&1 | head -1   # expect: not found (if DELETE_ENTRA=1)\n```\n\n## Orchestrator\n\nSingle-entry-point script: [`scripts\u002Fteardown-aca-dev.sh`](.\u002Fscripts\u002Fteardown-aca-dev.sh).\n\n```bash\n# Dry run (default)\nbash .claude\u002Fskills\u002Fteardown-agent-aca-dev\u002Fscripts\u002Fteardown-aca-dev.sh\n\n# Real teardown, Azure only\nDRY_RUN=0 bash .claude\u002Fskills\u002Fteardown-agent-aca-dev\u002Fscripts\u002Fteardown-aca-dev.sh\n\n# Full teardown (incl. Entra apps)\nDRY_RUN=0 DELETE_ENTRA=1 \\\n  bash .claude\u002Fskills\u002Fteardown-agent-aca-dev\u002Fscripts\u002Fteardown-aca-dev.sh\n```\n\n## Common failure modes\n\n| Symptom | Cause | Fix |\n|---|---|---|\n| `az group delete` hangs | ACR still has replications or a KV with purge protection is in the RG | Check RG contents with `az resource list -g \"$RG\"`; delete the stuck resource manually |\n| `Authorization_RequestDenied` on `az ad app delete` | Signing-in user lacks `Application Administrator` on the app | Elevate via PIM or have the app owner run it |\n| FIC cleanup leaves orphaned entries on Blueprint | MI deleted by `az group delete` | Inert; clean with `az ad app federated-credential list\u002Fdelete` if cosmetic |\n| Baked Ollama image still billing after `az group delete` completes | ACR has a soft-delete retention window | Check: `az acr list --query \"[].{n:name,p:properties.policies.softDeletePolicy.status}\"`; purge if present |\n\n## References\n\n- [Azure — delete resource group](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fazure-resource-manager\u002Fmanagement\u002Fdelete-resource-group)\n- [Microsoft Graph — oauth2PermissionGrants](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fgraph\u002Fapi\u002Foauth2permissiongrant-delete)\n","# Teardown — Dev (Ollama) Agent on Azure Container Apps (AI-Led)\n\nReverses the `deploy-agent-aca-dev` skill. Deletes the Azure resource group and (opt-in) the Entra objects.\n\n**Paired with:** [deploy-agent-aca-dev](..\u002Fdeploy-agent-aca-dev\u002FSKILL.md). Uses the same `\u002Ftmp\u002Fdeploy-vars.sh`.\n\n## When to Use\n\n- User says: \"tear down the dev ACA deployment\", \"delete the Ollama agent on Azure\", \"clean up the demo RG\"\n- User wants to re-run the deploy skill from a clean state\n- User is ending a demo and needs to remove billable resources (ACA, ACR with Ollama images, Log Analytics)\n\n## Do NOT Use When\n\n- **Local docker-compose** — `cd sidecar\u002Fdev && docker compose down -v` is enough\n- **AWS variant** — use [teardown-agent-aca-aws](..\u002Fteardown-agent-aca-aws\u002FSKILL.md) (handles IAM role, OIDC provider, intermediary app)\n- **Shared \u002F long-lived tenants** — confirm the Blueprint and Client SPA are not shared with other agents first\n\n## Safety posture\n\n1. **Dry-run by default** (`DRY_RUN=1`). User must set `DRY_RUN=0` to actually delete.\n2. **Entra objects are opt-in** (`DELETE_ENTRA=1`). Default keeps them.\n3. **Confirm tenant + subscription + RG** with the user first — the user has multiple Azure accounts.\n4. **Re-confirm before deleting the Blueprint.** Blueprints are often shared.\n\n## Prerequisites\n\n- `\u002Ftmp\u002Fdeploy-vars.sh` from the original deployment (at minimum `SUBSCRIPTION_ID`, `RG`).\n- `az` logged in to the correct tenant + subscription.\n- Graph role sufficient to delete Entra apps (only if `DELETE_ENTRA=1`): `Application Administrator` or higher.\n\n## Procedure\n\n### Step 0 — Confirm scope\n\n```\nTeardown plan (dev \u002F Ollama):\n  Subscription:  $SUBSCRIPTION_ID\n  Resource group: $RG            (WILL be deleted)\n  Delete Entra objects: $DELETE_ENTRA\n  Dry run:              $DRY_RUN\nProceed? [y\u002FN]\n```\n\n### Step 1 — Revoke OAuth consent grants on the Agent SP\n\nIf keeping the Agent Identity, revoke existing consent so a redeploy starts clean:\n\n```bash\nAGENT_SP_OID=$(az ad sp show --id \"$AGENT_CLIENT_ID\" --query id -o tsv 2>\u002Fdev\u002Fnull)\nif [[ -n \"$AGENT_SP_OID\" ]]; then\n  az rest --method GET \\\n    --uri \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Foauth2PermissionGrants?\\$filter=clientId eq '$AGENT_SP_OID'\" \\\n    --query 'value[].id' -o tsv | while read -r g; do\n      az rest --method DELETE --uri \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Foauth2PermissionGrants\u002F$g\"\n  done\nfi\n```\n\n### Step 2 — Delete the resource group\n\n```bash\naz group delete --name \"$RG\" --yes --no-wait\n```\n\nThis removes the Container App, ACA environment, ACR (with the ~1–4 GB baked Ollama image), Log Analytics workspace, and user-assigned managed identity in one shot.\n\n### Step 3 — Delete Entra objects (opt-in: `DELETE_ENTRA=1`)\n\nAsk per object. Order:\n\n1. **Client SPA** (`CLIENT_SPA_APP_ID`) — safe if no other agent reuses it.\n2. **Agent Identity** — delete via Agent ID portal or Graph (`DELETE \u002FagentIdentities\u002F{id}`).\n3. **Blueprint** (`BLUEPRINT_APP_ID`) — **ASK AGAIN**. Blueprints are often shared.\n\n```bash\naz ad app delete --id \"$CLIENT_SPA_APP_ID\" 2>\u002Fdev\u002Fnull || true\n# Agent + Blueprint: prompt explicitly, then call Graph\n```\n\n### Step 4 — Verify\n\n```bash\naz group exists --name \"$RG\"                          # expect: false\naz ad app show --id \"$CLIENT_SPA_APP_ID\" 2>&1 | head -1   # expect: not found (if DELETE_ENTRA=1)\n```\n\n## Orchestrator\n\nSingle-entry-point script: [`scripts\u002Fteardown-aca-dev.sh`](.\u002Fscripts\u002Fteardown-aca-dev.sh).\n\n```bash\n# Dry run (default)\nbash .claude\u002Fskills\u002Fteardown-agent-aca-dev\u002Fscripts\u002Fteardown-aca-dev.sh\n\n# Real teardown, Azure only\nDRY_RUN=0 bash .claude\u002Fskills\u002Fteardown-agent-aca-dev\u002Fscripts\u002Fteardown-aca-dev.sh\n\n# Full teardown (incl. Entra apps)\nDRY_RUN=0 DELETE_ENTRA=1 \\\n  bash .claude\u002Fskills\u002Fteardown-agent-aca-dev\u002Fscripts\u002Fteardown-aca-dev.sh\n```\n\n## Common failure modes\n\n| Symptom | Cause | Fix |\n|---|---|---|\n| `az group delete` hangs | ACR still has replications or a KV with purge protection is in the RG | Check RG contents with `az resource list -g \"$RG\"`; delete the stuck resource manually |\n| `Authorization_RequestDenied` on `az ad app delete` | Signing-in user lacks `Application Administrator` on the app | Elevate via PIM or have the app owner run it |\n| FIC cleanup leaves orphaned entries on Blueprint | MI deleted by `az group delete` | Inert; clean with `az ad app federated-credential list\u002Fdelete` if cosmetic |\n| Baked Ollama image still billing after `az group delete` completes | ACR has a soft-delete retention window | Check: `az acr list --query \"[].{n:name,p:properties.policies.softDeletePolicy.status}\"`; purge if present |\n\n## References\n\n- [Azure — delete resource group](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fazure-resource-manager\u002Fmanagement\u002Fdelete-resource-group)\n- [Microsoft Graph — oauth2PermissionGrants](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fgraph\u002Fapi\u002Foauth2permissiongrant-delete)\n",{"name":5,"description":7},"main","ce211acbb1781de04882eda398e7d5187f6832d1",".claude\u002Fskills\u002Fteardown-agent-aca-dev",8,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fentra-agentid-samples","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-08-06 00:26:28",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add microsoft\u002Fentra-agentid-samples --skill teardown-agent-aca-dev",{"tool":56,"command":57},"bunx","bunx skills add microsoft\u002Fentra-agentid-samples --skill teardown-agent-aca-dev",{"tool":59,"command":60},"pnpm","pnpm dlx skills add microsoft\u002Fentra-agentid-samples --skill teardown-agent-aca-dev","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fentra-agentid-samples\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fteardown-agent-aca-dev\u002FSKILL.md",true,[64],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"scripts\u002Fteardown-aca-dev.sh","SCRIPT","脚本",4172,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fentra-agentid-samples\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fteardown-agent-aca-dev\u002Fscripts\u002Fteardown-aca-dev.sh",[71,81,93,104],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":79,"publishedAt":36},"01M69BG3F1RT6STV6GERQ8AK7Q","teardown-agent-aca-aws","AI-led teardown of the AWS Bedrock sample agent deployment on Azure Container Apps created by deploy-agent-aca-aws. Use when the user wants to delete the AWS sample ACA deployment, clean up the resource group, remove the AWS IAM role + OIDC provider, delete the intermediary Entra app, or optionally delete the Blueprint \u002F Agent Identity \u002F Client SPA. Defaults to DRY-RUN and keeps Entra\u002FAWS objects unless the user explicitly opts in. NOT for local docker-compose (no cloud resources to delete) and NOT for GCP (pending).","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fentra-agentid-samples\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fteardown-agent-aca-aws\u002FSKILL.md",[77,78],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[80,30,29,28,31,33,34,35],"teardown agent aca aws",{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":88,"publishedAt":36},"01M69BG0YJ1YKC9FYRNNXMY4ZF","entra-agent-id-setup","AI-guided setup for Microsoft Entra Agent ID. Use when the user wants to provision an Agent Identity Blueprint, Agent Identity, and OBO client app in an Entra tenant; when configuring the dev\u002FAWS\u002FGCP sidecar stack; when debugging 403 Authorization_RequestDenied on blueprint creation; when checking which Entra role is required (Global Admin \u002F Agent ID Administrator \u002F Agent ID Developer); when running Start-EntraAgentIDWorkflow \u002F setup-obo-client-app \u002F setup-obo-blueprint.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fentra-agentid-samples\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fentra-agent-id-setup\u002FSKILL.md",[87],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[89,90,91,92,29,9],"entra agent id","setup","entra agent id setup","debugging",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":101,"publishedAt":36},"01M69BFXMDA70Q4P5KZDKY97YF","deploy-agent-aca-dev","AI-led deployment of the local-LLM sample agent (Ollama + Microsoft Entra Agent ID sidecar) to Azure Container Apps. Use when the user wants to deploy sidecar\u002Fdev to ACA, run the agent on Azure without AWS\u002FGCP, host Ollama on Container Apps, promote the docker-compose local-dev stack from ClientSecret to SignedAssertionFromManagedIdentity (secretless), or debug AADSTS65001\u002FAADSTS50011\u002FImagePullBackOff\u002FOllama OOM errors in this specific deployment. NOT for AWS Bedrock (use deploy-agent-aca-aws) and NOT for local docker-compose on a laptop (use sidecar\u002Fdev directly). Chains to entra-agent-id-setup for the Blueprint + Agent Identity + Client SPA objects.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fentra-agentid-samples\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdeploy-agent-aca-dev\u002FSKILL.md",[99,100],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[102,30,103,35,33,31,28,9,29,89,90],"deploy agent aca dev","debug",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":112,"publishedAt":36},"01M69BFT5RJ78RV71NSH1K0JC2","deploy-agent-aca-aws","AI-led deployment of the AWS Bedrock sample agent with the Microsoft Entra Agent ID sidecar to Azure Container Apps. Use when the user wants to deploy the AWS sample to ACA, provision the AWS-federation intermediary Entra app, wire the token refresher, create the AWS OIDC provider and IAM role for Bedrock, build and push the four container images to ACR, or debug InvalidIdentityToken \u002F AADSTS65001 \u002F Directory.AccessAsUser.All \u002F AcrPull errors in this specific deployment. NOT for local docker-compose (use sidecar\u002Fdev) and NOT for GCP (deploy-agent-aca-gcp, pending). Chains to entra-agent-id-setup for the Blueprint + Agent Identity + Client SPA objects.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fentra-agentid-samples\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdeploy-agent-aca-aws\u002FSKILL.md",[110,111],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[113,30,114,28,9,29,89,90,103,31,33,115,116],"deploy agent aca aws","container images","create","directory"]