Repository Creation Process

1. Add yourself to the Module Owners Team and Open Source orgs

If you have already completed these steps, skip to step 2.

1. Open the Open Source Portal and ensure your GitHub account is linked to your Microsoft account.
2. Open the Open Source Portal and ensure you are a member of the Azure and Microsoft organizations.
3. Request access via the Azure Verified Modules (AVM) Module Contributors access package. Approval adds you to the azure-verified-modules-module-contributors Entra group.

2. Gather repository information

Gather the following approved values from the module request issue. Repository creation uses them to initialize the root metadata.json.

Record every approved owner. An empty owner array is valid for an unowned module, subject to the proposal and ownership processes. Metadata does not grant access. Later ownership changes use the metadata review process.

3. Create the repository

Prerequisites:

• PowerShell 7.4 or later
• Git
• GitHub CLI
• AVM core team approval and permission to create the repository, push its contents, and edit its custom properties.
• A configured Git commit identity.

Clone and prepare

Use a trusted checkout of the repository creation tooling. Its README covers operator prerequisites, additional options, and recovery.

Set-Location $HOME
git clone "https://github.com/Azure/azure-verified-modules-tools"
Set-Location .\azure-verified-modules-tools\repository-management\repository-creation

Authenticate

gh auth login -h "github.com" -w -p "https"

Run the creation script

Supply the approved canonicalType below. For a resource module, you can instead replace that entry with both resourceProviderNamespace and resourceType; pattern and utility modules require an explicit canonicalType. Supply the assigned telemetry prefix if the proposal has one; otherwise omit telemetryIdPrefix and let creation mint it for resource and pattern modules. Utility modules do not use telemetry. Do not derive telemetry identifiers from repository names or replace existing identifiers.

if (!(Test-Path -Path ".\scripts\New-Repository.ps1")) {
    Write-Error "This script must be run from the repository-creation directory."
    exit 1
}

$parameters = @{
    moduleName = "<approved module name>"
    moduleDisplayName = "<approved display name>"
    moduleDescription = "<approved description>"
    canonicalType = "<approved ARM resource type or taxonomy>"
    ownerGitHubHandles = @("<approved individual handle>")
}

.\scripts\New-Repository.ps1 @parameters -planOnly

Add optional entries from the table when needed, including telemetryIdPrefix when the proposal already assigns one. Keep ownerGitHubHandles as an array, such as @("first-owner", "@Azure/approved-team"), and moduleAlternativeNames as a comma-separated string.

-planOnly and -WhatIf validate the inputs and show the plan without making GitHub or filesystem changes. Review the plan, including any minted telemetry identifier, and obtain the required approval before running the same command without either switch.

Creation publishes validated root metadata in the first commit to main. If creation fails, stop and follow the recovery guidance in the tooling README before retrying.

Complete Open Source Portal Setup

The script will pause and prompt you to configure the Open Source Portal. Follow the link in the script output.

Return to the terminal and type yes to complete repository configuration.

The script creates the Azure Verified Modules GitHub App installation request.

4. Upgrade just-in-time access to JITv2

New repositories default to JIT v1. AVM repositories must be upgraded to JIT v2 and tied to the shared service-AVM-azure-verified-modules-module-owners rule, so that just-in-time elevation is governed centrally by the AVM team rather than by a repository-specific rule.

This is a one-off manual action in the Open Source Portal. You need Direct Owner access to the repository (configured in the previous step) to complete it.

Migrate the repository to JIT v2

1. Open the repository overview on the Open Source Portal: https://repos.opensource.microsoft.com/orgs/Azure/repos/<module name>.
2. In the right-hand sidebar, find the Improved Just-in-time (New) panel and click Next.
3. Review the concepts (Rule Version, Rule, Tie) and click Next.
4. Leave Require approval for elevation selected and click Upgrade <module name> now.

This migrates the repository to JIT v2 and creates a temporary repository-scoped starter rule. Reload the page and confirm the Just-in-time elevation section now shows JIT version: JIT v2.

Tie the repository to the shared AVM rule

1. On the repository overview, click Advanced JIT options, then select Propose a new tie.
2. Under Propose tying a new rule to this repository, enter the Rule ID service-AVM-azure-verified-modules-module-owners and click Review.
3. Confirm the details and click Create tie.

The tie is created in a pending approval state, so the temporary repository-scoped rule stays active until the tie is approved.

Remove yourself as a Direct Owner

You were added as a Direct Owner so you could perform the JIT configuration above. Once you have finished both the JIT v2 upgrade and the shared-rule tie, remove your own account so that only jaredholgate and jatracey remain as Direct Owners.

1. On the Open Source Portal, open the repository’s Compliance tab.
2. Under Direct owners, remove your own account, leaving only jaredholgate and jatracey.

5. Wait for the GitHub App and repository sync

After the app is installed, repository sync applies the shared repository configuration and managed files to complete the setup.

Sync reads the root metadata.json from the module repository’s default branch for the display name and full owner list.