Azure Compliance — Agent Skill by Microsoft

From the author

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The azure-compliance skill provides a structured approach to auditing Azure environments for security, reliability, and operational best practices. It leverages the azqr tool for comprehensive resource assessments and includes specific capabilities for monitoring Key Vault assets, such as secrets, keys, and certificates, for expiration. The skill guides users through selecting a scope, running scans, analyzing results, and prioritizing remediation based on severity levels.

What it does

Executes compliance scans using the azqr tool.
Monitors Azure Key Vault for expiring secrets, keys, and certificates.
Lists subscriptions and resource groups for targeted auditing.
Provides a framework for classifying findings by priority (Critical to Low).
Offers guidance on interpreting scan results and remediation patterns.
Supports programmatic access to Key Vault via various SDKs.

When to use it

During scheduled security and compliance audits.
When identifying orphaned or unused Azure resources.
Before performing major infrastructure changes or migrations.
To proactively check for expiring certificates or secrets in Key Vault.
When validating adherence to Azure best practices.

Advantages

Automates the collection of compliance and security data.
Standardizes the assessment process across different Azure environments.
Helps reduce risk by identifying expiring credentials early.
Provides clear prioritization logic for remediation efforts.
Integrates multiple assessment sources into a single workflow.

Usage examples

“Run a compliance scan on my production subscription.”: The agent will list available subscriptions, execute the azqr scan on the selected scope, and provide a summary of findings categorized by reliability, security, and cost.
“Check for any expiring secrets in my Key Vault.”: The agent will inspect the specified Key Vault, retrieve expiration dates for all secrets, and report any that are nearing their expiration date.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/azure-compliance/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-compliance.zip -d .agents/skills

Documentation by Microsoft

Azure Compliance & Security Auditing

Quick Reference

Property	Details
Best for	Compliance scans, security audits, Key Vault expiration checks
Primary capabilities	Comprehensive Resources Assessment, Key Vault Expiration Monitoring
MCP tools	azqr, subscription and resource group listing, Key Vault item inspection

Prerequisites

Authentication: user is logged in to Azure via az login
Permissions to read resource configuration and Key Vault metadata

Assessments

Assessment	Reference
Comprehensive Compliance (azqr)	references/azure-quick-review.md
Key Vault Expiration	references/azure-keyvault-expiration-audit.md
Resource Graph Queries	references/azure-resource-graph.md

MCP Tools

Tool	Purpose
`mcp_azure_mcp_extension_azqr`	Run azqr compliance scans
`mcp_azure_mcp_subscription_list`	List available subscriptions
`mcp_azure_mcp_group_list`	List resource groups
`keyvault_key_list`	List all keys in vault
`keyvault_key_get`	Get key details including expiration
`keyvault_secret_list`	List all secrets in vault
`keyvault_secret_get`	Get secret details including expiration
`keyvault_certificate_list`	List all certificates in vault
`keyvault_certificate_get`	Get certificate details including expiration

Assessment Workflow

Select scope (subscription or resource group) for Comprehensive Resources Assessment.
Run azqr and capture output artifacts.
Analyze Scan Results and summarize findings and recommendations.
Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
Classify issues and propose remediation or fix steps for each finding.

Priority Classification

Priority	Guidance
Critical	Immediate remediation required for high-impact exposure
High	Resolve within days to reduce risk
Medium	Plan a resolution in the next sprint
Low	Track and fix during regular maintenance

Error Handling

Error	Message	Remediation
Authentication required	"Please login"	Run `az login` and retry
Access denied	"Forbidden"	Confirm permissions and fix role assignments
Missing resource	"Not found"	Verify subscription and resource group selection

Best Practices

Run compliance scans on a regular schedule (weekly or monthly)
Track findings over time and verify remediation effectiveness
Separate compliance reporting from remediation execution
Keep Key Vault expiration policies documented and enforced

SDK Quick References

For programmatic Key Vault access, see the condensed SDK guides:

Key Vault (Python): Secrets/Keys/Certs
Secrets: TypeScript | Rust | Java
Keys: .NET | Java | TypeScript | Rust
Certificates: Rust

Files

ATTRIBUTION.mdAdded by AutoGineer980 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.9 KiB
references/auth-best-practices.md6.1 KiB
references/azqr-recommendations.md5.7 KiB
references/azqr-remediation-patterns.md7.8 KiB
references/azure-keyvault-expiration-audit.md5.0 KiB
references/azure-quick-review.md5.0 KiB
references/azure-resource-graph.md2.6 KiB
references/sdk/azure-keyvault-certificates-rust.md1013 B
references/sdk/azure-keyvault-keys-rust.md1.3 KiB
references/sdk/azure-keyvault-keys-ts.md1019 B
references/sdk/azure-keyvault-py.md1.1 KiB
references/sdk/azure-keyvault-secrets-rust.md1.3 KiB
references/sdk/azure-keyvault-secrets-ts.md1.0 KiB
references/sdk/azure-security-keyvault-keys-dotnet.md1.1 KiB
references/sdk/azure-security-keyvault-keys-java.md1.3 KiB
references/sdk/azure-security-keyvault-secrets-java.md1.5 KiB

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

What our scanner noticed· Low risk

Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude Code
MITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-compliance.zip