azure-compliance
π―SkillThis skill checks your Azure setup for security problems and settings that do not follow best practices. It also finds keys, secrets and certificates that have expired or expire soon, and suggests fixes in order of urgency.
Installation
npx skills add microsoft/azure-skills --skill azure-complianceRun it in a terminal; it asks which AI coding tools to install it for (Claude Code, Codex, Cursor and more).
Uses skills.sh Β· Node.js 22.20+
After installing
Ask for related work and the agent uses it on its own, or call it yourself.
/azure-complianceInstall by hand
Copy the whole skill folder from GitHub to the place below. Copying only SKILL.md can leave out files the skill uses.
Open the skill folder β- This project
.claude/skills/azure-compliance/ - All projects
~/.claude/skills/azure-compliance/
These paths are for Claude Code. For other tools, the command above puts it in the right place.
What this skill does
Overview
This skill checks your Azure resources with azqr, a command-line tool that compares them with best practices. It also checks expiration dates in Key Vault, Azure's safe storage for keys, secrets and certificates. You sign in with az login, then choose a subscription (your Azure account area) or a resource group (a set of related resources) to check.
Key Features
- Scan one subscription or resource group with azqr and get a summary of findings and recommendations.
- Check the expiration dates of keys, secrets and certificates in Key Vault.
- Sort each problem as Critical, High, Medium or Low, and get steps to fix it.
- Get next steps for common errors, such as running
az loginwhen you are not signed in. - Use short guides to work with Key Vault from your own code in Python, TypeScript, .NET, Java and Rust.
Who is this for?
Use it when you run regular security or compliance checks on Azure, for example every week or month. It also helps when you want to find expired or expiring certificates and secrets in Key Vault.
Summarized by AI from this skill's SKILL.md. Suggest a better one
SKILL.md
View on GitHub βRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
Azure Compliance & Security Auditing
Quick Reference
| Property | Details |
|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
Prerequisites
- Authentication: user is logged in to Azure via
az login - Permissions to read resource configuration and Key Vault metadata
Assessments
| Assessment | Reference |
|---|---|
| Comprehensive Compliance (azqr) | references/azure-quick-review.md |
| Key Vault Expiration | references/azure-keyvault-expiration-audit.md |
| Resource Graph Queries | references/azure-resource-graph.md |
MCP Tools
| Tool | Purpose |
|---|---|
mcp_azure_mcp_extension_azqr | Run azqr compliance scans |
mcp_azure_mcp_subscription_list | List available subscriptions |
mcp_azure_mcp_group_list | List resource groups |
keyvault_key_list | List all keys in vault |
keyvault_key_get | Get key details including expiration |
keyvault_secret_list | List all secrets in vault |
keyvault_secret_get | Get secret details including expiration |
keyvault_certificate_list | List all certificates in vault |
keyvault_certificate_get | Get certificate details including expiration |
Assessment Workflow
- Select scope (subscription or resource group) for Comprehensive Resources Assessment.
- Run azqr and capture output artifacts.
- Analyze Scan Results and summarize findings and recommendations.
- Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
- Classify issues and propose remediation or fix steps for each finding.
Priority Classification
| Priority | Guidance |
|---|---|
| Critical | Immediate remediation required for high-impact exposure |
| High | Resolve within days to reduce risk |
| Medium | Plan a resolution in the next sprint |
| Low | Track and fix during regular maintenance |
Error Handling
| Error | Message | Remediation |
|---|---|---|
| Authentication required | "Please login" | Run az login and retry |
| Access denied | "Forbidden" | Confirm permissions and fix role assignments |
| Missing resource | "Not found" | Verify subscription and resource group selection |
Best Practices
- Run compliance scans on a regular schedule (weekly or monthly)
- Track findings over time and verify remediation effectiveness
- Separate compliance reporting from remediation execution
- Keep Key Vault expiration policies documented and enforced
SDK Quick References
For programmatic Key Vault access, see the condensed SDK guides:
- Key Vault (Python): Secrets/Keys/Certs
- Secrets: TypeScript | Rust | Java
- Keys: .NET | Java | TypeScript | Rust
- Certificates: Rust
More from this repository10
Helps you build, deploy, test, and manage AI agents and models on Microsoft Foundry, Microsoft's Azure service for AI. It guides the AI through each task with fixed steps.
Helps you find and fix problems in apps running on Azure, such as crashes, slow responses, or connection failures. It checks things in a set order and can work only from logs you provide.
azure-prepare gets a new or existing app ready to deploy to Azure with azd, Microsoft's command-line tool for Azure. It first writes a plan for your approval, then creates the setup files.
azure-deploy puts your app on Azure after the azure-prepare and azure-validate skills have prepared and checked it. It runs the deployment, recovers from errors, and gives you the live web addresses.
azure-validate checks your Azure app before you deploy it, so you can catch setup and permission problems early. It runs after azure-prepare and before azure-deploy.
azure-resource-lookup finds and lists your Azure resources, such as web apps, virtual machines, and storage accounts, across your subscriptions. It only reads data and never changes anything.
azure-resource-visualizer draws a diagram of an Azure resource group that shows how each resource connects to the others. It saves the diagram and notes in a markdown file.
Lets Claude search and summarize large amounts of logs and app data stored in Azure Data Explorer. You ask what you want to know, and it writes and runs the queries for you.
Helps you send all requests to your AI models and tools through Azure API Management, so you can control cost, block harmful content and limit traffic. It includes Azure command-line steps for setup and testing.
Helps you find and fix errors in apps that send and receive messages through Azure Event Hubs or Service Bus. It checks service health and Microsoft docs to suggest a fix.