Most of that plan is noise. Which part is real?
Terraform compares a Set by position, so adding one listener to an Application Gateway - or one rule to an NSG - shows every element as changed. Paste the JSON of the plan and your browser matches each element by its key (name, status code, header name, address), sets aside the ones that only moved, and numbers what really changes: replacements and what forces them, deletes, added or removed elements, other attributes. Free, before you sign in, and nothing is uploaded. Then the review rates each real change, says what to check before apply, and writes the PR comment.
The companies, addresses and IPs are invented. Each example comes with a saved model review, so you can see the whole page without signing in or spending a credit.
What this does, and what it does not
The AzureRM provider models many blocks as Sets - Application Gateway listeners, pools, rules, probes and certificates, NSG security rules, routes, subnets, firewall policy rule collections, Front Door backends. Terraform compares those by position, so one element added or removed makes every element after it look changed, and a reviewer has to find the one real line among dozens of identical ones. The skill behind this page matches elements by their key attribute instead, using a table of the AzureRM Set attributes and their keys, and reports what only moved apart from what was really added, removed or modified - nested Sets such as rewrite rules and path rules included. This page runs that analysis in your browser, adds the resource-level picture (replacements and what forces them, creates, deletes, other attributes, values known only after apply) and flags lists the table does not know whose elements are identical once sorted.
The review lane answers every real change: what it does to the running resource, its risk, and whether it matches what you said the change was for. It proposes concrete checks before and after apply, proposes table additions for the suspected reorders, and writes a pull-request comment. Its verdict follows mechanically from its risks, and the page checks the reply against its own reading.
The review is sent the page's reading only - never the plan itself, its prior state, variables or configuration - and every value Terraform marked sensitive is replaced by (sensitive) first. Text inside the plan that addresses reviewers is reported, never obeyed. Derived from the agent skill @github/terraform-azurerm-set-diff-analyzer (github/awesome-copilot, MIT: the analyzer, its output formats and exit codes, and the AzureRM Set attribute table). Sources are listed in llms.txt.