Skill

Official

Pass

Audit score 90

azure-compliance

microsoft/azure-skills

Run Azure compliance and security audits with azqr plus Key Vault expiration checks

What is azure-compliance?

azure-compliance is a SKILL.md package that enables coding agents to perform Azure compliance and security audits. It orchestrates azqr (Azure Quick Review) scans across subscriptions and resource groups, then audits Key Vault keys, secrets, and certificates for expiration or missing expiration policies. Findings are classified by priority (Critical/High/Medium/Low) with remediation guidance.

Runs azqr compliance scans against Azure subscriptions or resource groups
Lists and inspects Key Vault keys, secrets, and certificates for expiration dates
Identifies orphaned or misconfigured Azure resources
Classifies findings by priority (Critical, High, Medium, Low)
Proposes remediation steps for each compliance finding
Summarizes security posture and best-practice gaps

How to install azure-compliance

npx skills add https://github.com/microsoft/azure-skills --skill azure-compliance

Prerequisites

Azure CLI installed and authenticated via `az login`
Permissions to read resource configuration across target subscriptions
Read access to Key Vault metadata (keys, secrets, certificates)
MCP extension for Azure (provides azqr and Key Vault tools) must be available to the agent

Claude Code

Cursor

Windsurf

Cline

How to use azure-compliance

1.Install the skill: `npx skills add https://github.com/microsoft/azure-skills --skill azure-compliance`
2.Ask the agent to run a compliance scan, e.g. 'Run an azqr compliance scan on my subscription'
3.Select the scope: subscription or resource group when prompted
4.Review the azqr output artifacts and the agent's summary of findings
5.Ask the agent to audit Key Vault expiration, e.g. 'Check what certificates are expiring in the next 30 days'
6.Review the prioritized findings (Critical/High/Medium/Low) returned by the agent
7.Request remediation steps for specific findings
8.Re-run scans after remediation to verify fixes

Use cases

Good for

Auditing an Azure environment against Microsoft best practices before a security review
Finding expired or soon-to-expire certificates and secrets in Key Vault
Identifying orphaned resources that increase cost or attack surface
Validating Azure resource configuration as part of a sprint or release gate
Scheduling regular compliance scans and tracking remediation over time

Who it's for

Cloud security engineers responsible for Azure compliance posture
DevOps or platform engineers managing Azure infrastructure
Developers who need to audit Key Vault secrets and certificates
Compliance teams validating Azure environments against policy
Anyone running azqr (Azure Quick Review) as part of their workflow

azure-compliance FAQ

What is azqr and does it need to be installed separately?

azqr (Azure Quick Review) is a compliance CLI tool. The skill uses the `mcp_azure_mcp_extension_azqr` MCP tool to invoke it, so the Azure MCP extension must be available to your agent environment.

Which Key Vault item types are checked for expiration?

The skill checks keys, secrets, and certificates stored in Azure Key Vault, including items that are already expired and those missing expiration dates entirely.

What scope can compliance scans cover?

Scans can target an individual subscription or a specific resource group. The agent lists available subscriptions and resource groups to help you select the right scope.

Does this skill remediate issues automatically?

No. The skill identifies and classifies findings and proposes remediation steps, but does not apply fixes automatically. Remediation execution is kept separate from reporting.

How often should I run compliance scans?

The skill's best practices recommend running scans on a weekly or monthly schedule and tracking findings over time to verify remediation effectiveness.

Full instructions (SKILL.md)

Source of truth, from microsoft/azure-skills.

name: azure-compliance description: "Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment." license: MIT metadata: author: Microsoft version: "1.1.1"

Azure Compliance & Security Auditing

Quick Reference

Property	Details
Best for	Compliance scans, security audits, Key Vault expiration checks
Primary capabilities	Comprehensive Resources Assessment, Key Vault Expiration Monitoring
MCP tools	azqr, subscription and resource group listing, Key Vault item inspection

When to Use This Skill

Run azqr or Azure Quick Review for compliance assessment
Validate Azure resource configuration against best practices
Identify orphaned or misconfigured resources
Audit Key Vault keys, secrets, and certificates for expiration

Skill Activation Triggers

Activate this skill when user wants to:

Check Azure compliance or best practices
Assess Azure resources for configuration issues
Run azqr or Azure Quick Review
Identify orphaned or misconfigured resources
Review Azure security posture
"Show me expired certificates/keys/secrets in my Key Vault"
"Check what's expiring in the next 30 days"
"Audit my Key Vault for compliance"
"Find secrets without expiration dates"
"Check certificate expiration dates"

Prerequisites

Authentication: user is logged in to Azure via az login
Permissions to read resource configuration and Key Vault metadata

Assessments

Assessment	Reference
Comprehensive Compliance (azqr)	references/azure-quick-review.md
Key Vault Expiration	references/azure-keyvault-expiration-audit.md
Resource Graph Queries	references/azure-resource-graph.md

MCP Tools

Tool	Purpose
`mcp_azure_mcp_extension_azqr`	Run azqr compliance scans
`mcp_azure_mcp_subscription_list`	List available subscriptions
`mcp_azure_mcp_group_list`	List resource groups
`keyvault_key_list`	List all keys in vault
`keyvault_key_get`	Get key details including expiration
`keyvault_secret_list`	List all secrets in vault
`keyvault_secret_get`	Get secret details including expiration
`keyvault_certificate_list`	List all certificates in vault
`keyvault_certificate_get`	Get certificate details including expiration

Assessment Workflow

Select scope (subscription or resource group) for Comprehensive Resources Assessment.
Run azqr and capture output artifacts.
Analyze Scan Results and summarize findings and recommendations.
Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
Classify issues and propose remediation or fix steps for each finding.

Priority Classification

Priority	Guidance
Critical	Immediate remediation required for high-impact exposure
High	Resolve within days to reduce risk
Medium	Plan a resolution in the next sprint
Low	Track and fix during regular maintenance

Error Handling

Error	Message	Remediation
Authentication required	"Please login"	Run `az login` and retry
Access denied	"Forbidden"	Confirm permissions and fix role assignments
Missing resource	"Not found"	Verify subscription and resource group selection

Best Practices

Run compliance scans on a regular schedule (weekly or monthly)
Track findings over time and verify remediation effectiveness
Separate compliance reporting from remediation execution
Keep Key Vault expiration policies documented and enforced

SDK Quick References

For programmatic Key Vault access, see the condensed SDK guides:

Key Vault (Python): Secrets/Keys/Certs
Secrets: TypeScript | Rust | Java
Keys: .NET | Java | TypeScript | Rust
Certificates: Rust

Azure Storage skill: Blob, File Shares, Queue, Table, and Data Lake with access tier guidance and lifecycle management

420k installsAudited