Azure Compliance

MicrosoftOfficialCreated by Microsoft

Skill
Tool integration
Security
MIT
Low risk

From the author

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The azure-compliance skill provides a structured approach to auditing Azure environments for security, reliability, and operational best practices. It leverages the azqr tool for comprehensive resource assessments and includes specific capabilities for monitoring Key Vault assets, such as secrets, keys, and certificates, for expiration. The skill guides users through selecting a scope, running scans, analyzing results, and prioritizing remediation based on severity levels.

What it does

Executes compliance scans using the azqr tool.
Monitors Azure Key Vault for expiring secrets, keys, and certificates.
Lists subscriptions and resource groups for targeted auditing.
Provides a framework for classifying findings by priority (Critical to Low).
Offers guidance on interpreting scan results and remediation patterns.
Supports programmatic access to Key Vault via various SDKs.

When to use it

During scheduled security and compliance audits.
When identifying orphaned or unused Azure resources.
Before performing major infrastructure changes or migrations.
To proactively check for expiring certificates or secrets in Key Vault.
When validating adherence to Azure best practices.

Advantages

Automates the collection of compliance and security data.
Standardizes the assessment process across different Azure environments.
Helps reduce risk by identifying expiring credentials early.
Provides clear prioritization logic for remediation efforts.
Integrates multiple assessment sources into a single workflow.

Usage examples

“Run a compliance scan on my production subscription.”: The agent will list available subscriptions, execute the azqr scan on the selected scope, and provide a summary of findings categorized by reliability, security, and cost.
“Check for any expiring secrets in my Key Vault.”: The agent will inspect the specified Key Vault, retrieve expiration dates for all secrets, and report any that are nearing their expiration date.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/azure-compliance/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-compliance.zip -d .agents/skills

Documentation by Microsoft

Azure Compliance & Security Auditing

Quick Reference

Property	Details
Best for	Compliance scans, security audits, Key Vault expiration checks
Primary capabilities	Comprehensive Resources Assessment, Key Vault Expiration Monitoring
MCP tools	azqr, subscription and resource group listing, Key Vault item inspection

Prerequisites

Authentication: user is logged in to Azure via az login
Permissions to read resource configuration and Key Vault metadata

Assessments

Assessment	Reference
Comprehensive Compliance (azqr)	references/azure-quick-review.md
Key Vault Expiration	references/azure-keyvault-expiration-audit.md
Resource Graph Queries	references/azure-resource-graph.md

MCP Tools

Tool	Purpose
`mcp_azure_mcp_extension_azqr`	Run azqr compliance scans
`mcp_azure_mcp_subscription_list`	List available subscriptions
`mcp_azure_mcp_group_list`	List resource groups
`keyvault_key_list`	List all keys in vault
`keyvault_key_get`	Get key details including expiration
`keyvault_secret_list`	List all secrets in vault
`keyvault_secret_get`	Get secret details including expiration
`keyvault_certificate_list`	List all certificates in vault
`keyvault_certificate_get`	Get certificate details including expiration

Assessment Workflow

Select scope (subscription or resource group) for Comprehensive Resources Assessment.
Run azqr and capture output artifacts.
Analyze Scan Results and summarize findings and recommendations.
Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
Classify issues and propose remediation or fix steps for each finding.

Priority Classification

Priority	Guidance
Critical	Immediate remediation required for high-impact exposure
High	Resolve within days to reduce risk
Medium	Plan a resolution in the next sprint
Low	Track and fix during regular maintenance

Error Handling

Error	Message	Remediation
Authentication required	"Please login"	Run `az login` and retry
Access denied	"Forbidden"	Confirm permissions and fix role assignments
Missing resource	"Not found"	Verify subscription and resource group selection

Best Practices

Run compliance scans on a regular schedule (weekly or monthly)
Track findings over time and verify remediation effectiveness
Separate compliance reporting from remediation execution
Keep Key Vault expiration policies documented and enforced

SDK Quick References

For programmatic Key Vault access, see the condensed SDK guides:

Key Vault (Python): Secrets/Keys/Certs
Secrets: TypeScript | Rust | Java
Keys: .NET | Java | TypeScript | Rust
Certificates: Rust

Files

ATTRIBUTION.mdAdded by AutoGineer980 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.9 KiB
references/auth-best-practices.md6.1 KiB
references/azqr-recommendations.md5.7 KiB
references/azqr-remediation-patterns.md7.8 KiB
references/azure-keyvault-expiration-audit.md5.0 KiB
references/azure-quick-review.md5.0 KiB
references/azure-resource-graph.md2.6 KiB
references/sdk/azure-keyvault-certificates-rust.md1013 B
references/sdk/azure-keyvault-keys-rust.md1.3 KiB
references/sdk/azure-keyvault-keys-ts.md1019 B
references/sdk/azure-keyvault-py.md1.1 KiB
references/sdk/azure-keyvault-secrets-rust.md1.3 KiB
references/sdk/azure-keyvault-secrets-ts.md1.0 KiB
references/sdk/azure-security-keyvault-keys-dotnet.md1.1 KiB
references/sdk/azure-security-keyvault-keys-java.md1.3 KiB
references/sdk/azure-security-keyvault-secrets-java.md1.5 KiB

references/azqr-remediation-patterns.md

Remediation Patterns for Common azqr Findings

This document provides remediation templates for frequently identified compliance issues.

Storage Account Issues

Enable Private Endpoints

Issue: Storage account accessible via public endpoint

Azure CLI:

# Create private endpoint
az network private-endpoint create \
  --name pe-storage \
  --resource-group <rg-name> \
  --vnet-name <vnet-name> \
  --subnet <subnet-name> \
  --private-connection-resource-id $(az storage account show -n <storage-name> -g <rg-name> --query id -o tsv) \
  --group-id blob \
  --connection-name pe-storage-connection

# Disable public access
az storage account update \
  --name <storage-name> \
  --resource-group <rg-name> \
  --public-network-access Disabled

Bicep:

resource privateEndpoint 'Microsoft.Network/privateEndpoints@2023-05-01' = {
  name: 'pe-${storageAccount.name}'
  location: location
  properties: {
    subnet: {
      id: subnet.id
    }
    privateLinkServiceConnections: [
      {
        name: 'pe-${storageAccount.name}-connection'
        properties: {
          privateLinkServiceId: storageAccount.id
          groupIds: ['blob']
        }
      }
    ]
  }
}

Enable Soft Delete

Issue: No soft delete protection for blobs

Azure CLI:

az storage account blob-service-properties update \
  --account-name <storage-name> \
  --resource-group <rg-name> \
  --enable-delete-retention true \
  --delete-retention-days 7 \
  --enable-container-delete-retention true \
  --container-delete-retention-days 7

Bicep:

resource blobServices 'Microsoft.Storage/storageAccounts/blobServices@2023-01-01' = {
  parent: storageAccount
  name: 'default'
  properties: {
    deleteRetentionPolicy: {
      enabled: true
      days: 7
    }
    containerDeleteRetentionPolicy: {
      enabled: true
      days: 7
    }
  }
}

Key Vault Issues

Enable Purge Protection

Issue: Key Vault can be permanently deleted

Azure CLI:

az keyvault update \
  --name <vault-name> \
  --resource-group <rg-name> \
  --enable-purge-protection true

Bicep:

resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: keyVaultName
  location: location
  properties: {
    enableSoftDelete: true
    softDeleteRetentionInDays: 90
    enablePurgeProtection: true
    // ... other properties
  }
}

Use RBAC for Data Plane

Issue: Using access policies instead of RBAC

Azure CLI:

az keyvault update \
  --name <vault-name> \
  --resource-group <rg-name> \
  --enable-rbac-authorization true

Virtual Machine Issues

Enable Diagnostic Settings

Issue: No diagnostics configured for VM

Azure CLI:

# Create Log Analytics workspace (if needed)
az monitor log-analytics workspace create \
  --resource-group <rg-name> \
  --workspace-name <workspace-name>

# Enable diagnostics
az monitor diagnostic-settings create \
  --name diag-vm \
  --resource $(az vm show -g <rg-name> -n <vm-name> --query id -o tsv) \
  --workspace $(az monitor log-analytics workspace show -g <rg-name> -n <workspace-name> --query id -o tsv) \
  --metrics '[{"category": "AllMetrics", "enabled": true}]'

Bicep:

resource diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  name: 'diag-${vm.name}'
  scope: vm
  properties: {
    workspaceId: logAnalyticsWorkspace.id
    metrics: [
      {
        category: 'AllMetrics'
        enabled: true
      }
    ]
  }
}

Enable Azure Backup

Issue: VM not protected by Azure Backup

Azure CLI:

# Create Recovery Services vault (if needed)
az backup vault create \
  --resource-group <rg-name> \
  --name <vault-name> \
  --location <location>

# Enable backup with default policy
az backup protection enable-for-vm \
  --resource-group <rg-name> \
  --vault-name <vault-name> \
  --vm $(az vm show -g <rg-name> -n <vm-name> --query id -o tsv) \
  --policy-name DefaultPolicy

AKS Issues

Enable Defender for Containers

Issue: No security monitoring for AKS

Azure CLI:

az aks update \
  --resource-group <rg-name> \
  --name <cluster-name> \
  --enable-defender

Bicep:

resource aksCluster 'Microsoft.ContainerService/managedClusters@2024-01-01' = {
  name: clusterName
  location: location
  properties: {
    securityProfile: {
      defender: {
        securityMonitoring: {
          enabled: true
        }
        logAnalyticsWorkspaceResourceId: logAnalyticsWorkspace.id
      }
    }
    // ... other properties
  }
}

Use Managed Identity

Issue: AKS using service principal instead of managed identity

Azure CLI:

az aks update \
  --resource-group <rg-name> \
  --name <cluster-name> \
  --enable-managed-identity

SQL Database Issues

Enable Auditing

Issue: SQL Server auditing not enabled

Azure CLI:

# Enable to Log Analytics
az sql server audit-policy update \
  --resource-group <rg-name> \
  --name <server-name> \
  --state Enabled \
  --lats Enabled \
  --lawri $(az monitor log-analytics workspace show -g <rg-name> -n <workspace-name> --query id -o tsv)

Bicep:

resource sqlAudit 'Microsoft.Sql/servers/auditingSettings@2023-05-01-preview' = {
  parent: sqlServer
  name: 'default'
  properties: {
    state: 'Enabled'
    isAzureMonitorTargetEnabled: true
    retentionDays: 90
  }
}

Enable Private Endpoint

Issue: SQL Server accessible via public endpoint

Azure CLI:

# Create private endpoint
az network private-endpoint create \
  --name pe-sql \
  --resource-group <rg-name> \
  --vnet-name <vnet-name> \
  --subnet <subnet-name> \
  --private-connection-resource-id $(az sql server show -g <rg-name> -n <server-name> --query id -o tsv) \
  --group-id sqlServer \
  --connection-name pe-sql-connection

# Disable public access
az sql server update \
  --resource-group <rg-name> \
  --name <server-name> \
  --enable-public-network false

App Service Issues

Use Managed Identity

Issue: App Service not using managed identity

Azure CLI:

az webapp identity assign \
  --resource-group <rg-name> \
  --name <app-name>

Bicep:

resource webApp 'Microsoft.Web/sites@2023-01-01' = {
  name: appName
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    // ... other properties
  }
}

Enforce HTTPS Only

Issue: HTTP traffic allowed

Azure CLI:

az webapp update \
  --resource-group <rg-name> \
  --name <app-name> \
  --https-only true

Set Minimum TLS Version

Issue: TLS version below 1.2

Azure CLI:

az webapp config set \
  --resource-group <rg-name> \
  --name <app-name> \
  --min-tls-version 1.2

Bulk Remediation Script

For multiple resources of the same type, use a loop:

# Example: Enable soft delete on all storage accounts
$storageAccounts = az storage account list --query "[].{name:name, rg:resourceGroup}" -o json | ConvertFrom-Json

foreach ($sa in $storageAccounts) {
    Write-Host "Enabling soft delete on $($sa.name)..."
    az storage account blob-service-properties update `
        --account-name $sa.name `
        --resource-group $sa.rg `
        --enable-delete-retention true `
        --delete-retention-days 7
}

Remediation Validation

After applying fixes, re-run the azqr scan using the Azure MCP tool to verify the issues have been resolved:

mcp_azure_mcp_extension_azqr
  subscription: <subscription-id>

Additional Resources

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

What our scanner noticed· Low risk

Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/azure-skills/skills/azure-compliance · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

Also distributed in

microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-compliance.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Microsoft

Azure Compliance & Security Auditing

Quick Reference

Prerequisites

Assessments

MCP Tools

Assessment Workflow

Priority Classification

Error Handling

Best Practices

SDK Quick References

Files

references/azqr-remediation-patterns.md

Remediation Patterns for Common azqr Findings

Storage Account Issues

Enable Private Endpoints

Enable Soft Delete

Key Vault Issues

Enable Purge Protection

Use RBAC for Data Plane

Virtual Machine Issues

Enable Diagnostic Settings

Enable Azure Backup

AKS Issues

Enable Defender for Containers

Use Managed Identity

SQL Database Issues

Enable Auditing

Enable Private Endpoint

App Service Issues

Use Managed Identity

Enforce HTTPS Only

Set Minimum TLS Version

Bulk Remediation Script

Remediation Validation

Additional Resources

Requirements and compatibility

Security

Attribution and licence

Related skills

Security Audit

Sast Configuration

Firmware Analyst

Policy Enforcer

Backend Development Security Auditor

Memory Forensics

Download ZIP