AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The azure-compliance skill provides a structured approach to auditing Azure environments for security, reliability, and operational best practices. It leverages the azqr tool for comprehensive resource assessments and includes specific capabilities for monitoring Key Vault assets, such as secrets, keys, and certificates, for expiration. The skill guides users through selecting a scope, running scans, analyzing results, and prioritizing remediation based on severity levels.
What it does
- Executes compliance scans using the azqr tool.
- Monitors Azure Key Vault for expiring secrets, keys, and certificates.
- Lists subscriptions and resource groups for targeted auditing.
- Provides a framework for classifying findings by priority (Critical to Low).
- Offers guidance on interpreting scan results and remediation patterns.
- Supports programmatic access to Key Vault via various SDKs.
When to use it
- During scheduled security and compliance audits.
- When identifying orphaned or unused Azure resources.
- Before performing major infrastructure changes or migrations.
- To proactively check for expiring certificates or secrets in Key Vault.
- When validating adherence to Azure best practices.
Advantages
- Automates the collection of compliance and security data.
- Standardizes the assessment process across different Azure environments.
- Helps reduce risk by identifying expiring credentials early.
- Provides clear prioritization logic for remediation efforts.
- Integrates multiple assessment sources into a single workflow.
Usage examples
- “Run a compliance scan on my production subscription.”
- The agent will list available subscriptions, execute the azqr scan on the selected scope, and provide a summary of findings categorized by reliability, security, and cost.
- “Check for any expiring secrets in my Key Vault.”
- The agent will inspect the specified Key Vault, retrieve expiration dates for all secrets, and report any that are nearing their expiration date.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/azure-compliance/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip azure-compliance.zip -d .agents/skills
Documentation by Microsoft
Azure Compliance & Security Auditing
Quick Reference
| Property | Details |
|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
Prerequisites
Authentication: user is logged in to Azure via
az loginPermissions to read resource configuration and Key Vault metadata
Assessments
| Assessment | Reference |
|---|---|
| Comprehensive Compliance (azqr) | references/azure-quick-review.md |
| Key Vault Expiration | references/azure-keyvault-expiration-audit.md |
| Resource Graph Queries | references/azure-resource-graph.md |
MCP Tools
| Tool | Purpose |
|---|---|
mcp_azure_mcp_extension_azqr | Run azqr compliance scans |
mcp_azure_mcp_subscription_list | List available subscriptions |
mcp_azure_mcp_group_list | List resource groups |
keyvault_key_list | List all keys in vault |
keyvault_key_get | Get key details including expiration |
keyvault_secret_list | List all secrets in vault |
keyvault_secret_get | Get secret details including expiration |
keyvault_certificate_list | List all certificates in vault |
keyvault_certificate_get | Get certificate details including expiration |
Assessment Workflow
Select scope (subscription or resource group) for Comprehensive Resources Assessment.
Run azqr and capture output artifacts.
Analyze Scan Results and summarize findings and recommendations.
Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
Classify issues and propose remediation or fix steps for each finding.
Priority Classification
| Priority | Guidance |
|---|---|
| Critical | Immediate remediation required for high-impact exposure |
| High | Resolve within days to reduce risk |
| Medium | Plan a resolution in the next sprint |
| Low | Track and fix during regular maintenance |
Error Handling
| Error | Message | Remediation |
|---|---|---|
| Authentication required | "Please login" | Run az login and retry |
| Access denied | "Forbidden" | Confirm permissions and fix role assignments |
| Missing resource | "Not found" | Verify subscription and resource group selection |
Best Practices
Run compliance scans on a regular schedule (weekly or monthly)
Track findings over time and verify remediation effectiveness
Separate compliance reporting from remediation execution
Keep Key Vault expiration policies documented and enforced
SDK Quick References
For programmatic Key Vault access, see the condensed SDK guides:
Key Vault (Python): Secrets/Keys/Certs
Secrets: TypeScript | Rust | Java
Keys: .NET | Java | TypeScript | Rust
Certificates: Rust
Files
- ATTRIBUTION.mdAdded by AutoGineer980 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SKILL.md3.9 KiB
- references/auth-best-practices.md6.1 KiB
- references/azqr-recommendations.md5.7 KiB
- references/azqr-remediation-patterns.md7.8 KiB
- references/azure-keyvault-expiration-audit.md5.0 KiB
- references/azure-quick-review.md5.0 KiB
- references/azure-resource-graph.md2.6 KiB
- references/sdk/azure-keyvault-certificates-rust.md1013 B
- references/sdk/azure-keyvault-keys-rust.md1.3 KiB
- references/sdk/azure-keyvault-keys-ts.md1019 B
- references/sdk/azure-keyvault-py.md1.1 KiB
- references/sdk/azure-keyvault-secrets-rust.md1.3 KiB
- references/sdk/azure-keyvault-secrets-ts.md1.0 KiB
- references/sdk/azure-security-keyvault-keys-dotnet.md1.1 KiB
- references/sdk/azure-security-keyvault-keys-java.md1.3 KiB
- references/sdk/azure-security-keyvault-secrets-java.md1.5 KiB
references/azqr-recommendations.md
azqr Recommendation Categories
This document describes how to interpret azqr recommendations and prioritize remediation.
Recommendation Sources
azqr aggregates recommendations from multiple sources:
| Source | Description | Priority |
|---|---|---|
| APRL | Azure Proactive Resiliency Library - reliability-focused best practices | High |
| Orphaned Resources | Resources that are unused or disconnected | Medium |
| Azure Advisor | Microsoft's built-in recommendation engine | Medium |
| Defender for Cloud | Security-focused recommendations | Critical |
| Azure Policy | Governance compliance status | Varies |
Impact Categories
Reliability
Recommendations that affect service availability and resiliency:
| Issue | Risk | Example Resources |
|---|---|---|
| No zone redundancy | Single zone failure causes outage | VMs, Storage, SQL, AKS |
| Single instance | No failover capability | App Service, Redis, VMs |
| No backup configured | Data loss risk | VMs, SQL, Cosmos DB |
| No disaster recovery | Regional failure exposure | Storage, SQL, Key Vault |
Security
Recommendations that affect security posture:
| Issue | Risk | Example Resources |
|---|---|---|
| Public endpoint exposed | Attack surface exposure | Storage, SQL, Key Vault |
| Missing encryption | Data exposure risk | Storage, Disks, SQL |
| No private endpoint | Traffic on public internet | PaaS services |
| Weak TLS version | Protocol vulnerabilities | App Service, API Management |
| No managed identity | Credential management risk | App Service, Functions, AKS |
Operational Excellence
Recommendations for better operations:
| Issue | Risk | Example Resources |
|---|---|---|
| No diagnostic settings | Blind to failures | All resources |
| Missing alerts | Delayed incident response | All resources |
| No tags | Governance/cost tracking gaps | All resources |
| Outdated SKU/version | Missing features/security fixes | All resources |
Cost Optimization
Recommendations to reduce spending:
| Issue | Risk | Example Resources |
|---|---|---|
| Orphaned disk | Paying for unused storage | Managed Disks |
| Orphaned public IP | Paying for unused IP | Public IP |
| Oversized SKU | Excess capacity cost | VMs, SQL, App Service |
| No reserved capacity | Missing discounts | VMs, SQL, Cosmos DB |
Severity Levels
Prioritize remediation using this severity matrix:
| Severity | Criteria | Response Time |
|---|---|---|
| Critical | Security vulnerability with active exploit risk | Immediate |
| High | Reliability risk affecting availability | Within 1 week |
| Medium | Best practice violation with moderate risk | Within 1 month |
| Low | Optimization opportunity | As capacity allows |
Excel Report Columns
Recommendations Sheet
| Column | Description |
|---|---|
| Recommendation ID | Unique identifier for the recommendation |
| Category | Reliability, Security, Cost, etc. |
| Recommendation | Description of the issue |
| Learn More | Link to documentation |
| Impacted Resources | Count of affected resources |
ImpactedResources Sheet
| Column | Description |
|---|---|
| Subscription | Subscription ID (may be masked) |
| Resource Group | Resource group name |
| Type | Azure resource type |
| Name | Resource name |
| Recommendation ID | Links to Recommendations sheet |
| Recommendation | Issue description |
| Learn More | Documentation link |
| Param1-5 | Additional context (varies by recommendation) |
Inventory Sheet
| Column | Description |
|---|---|
| Subscription | Subscription ID |
| Resource Group | Resource group name |
| Location | Azure region |
| Type | Resource type |
| Name | Resource name |
| SKU | SKU tier/name |
| SLA | Calculated SLA percentage |
| Availability Zones | Zone configuration |
| Private Endpoint | Private endpoint status |
| Diagnostic Settings | Diagnostic configuration status |
Common Recommendation IDs
High-impact recommendations to prioritize:
Storage Accounts
| ID | Issue |
|---|---|
st-001 | Enable soft delete for blobs |
st-002 | Enable soft delete for containers |
st-003 | Enable versioning |
st-004 | Use private endpoints |
st-005 | Disable public blob access |
Virtual Machines
| ID | Issue |
|---|---|
vm-001 | Enable Azure Backup |
vm-002 | Use managed disks |
vm-003 | Deploy in availability zones |
vm-004 | Enable boot diagnostics |
vm-005 | Use managed identity |
Azure Kubernetes Service
| ID | Issue |
|---|---|
aks-001 | Enable Azure Policy |
aks-002 | Use managed identity |
aks-003 | Enable Defender for Containers |
aks-004 | Use availability zones |
aks-005 | Enable cluster autoscaler |
Key Vault
| ID | Issue |
|---|---|
kv-001 | Enable soft delete |
kv-002 | Enable purge protection |
kv-003 | Use private endpoints |
kv-004 | Enable diagnostic logging |
kv-005 | Use RBAC for data plane |
SQL Database
| ID | Issue |
|---|---|
sql-001 | Enable Transparent Data Encryption |
sql-002 | Enable auditing |
sql-003 | Use private endpoints |
sql-004 | Enable zone redundancy |
sql-005 | Enable Advanced Threat Protection |
Additional Resources
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Security
What our scanner noticed· Low risk
- Instructions that use the network
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/skills · .github/plugins/azure-skills/skills/azure-compliance · commit 0696600
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Also distributed in
- microsoft/azure-skills
AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.
Related skills
Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude CodeMITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-compliance.zip