Azure Compliance

MicrosoftOfficialCreated by Microsoft

Skill
Tool integration
Security
MIT
Low risk

From the author

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The azure-compliance skill provides a structured approach to auditing Azure environments for security, reliability, and operational best practices. It leverages the azqr tool for comprehensive resource assessments and includes specific capabilities for monitoring Key Vault assets, such as secrets, keys, and certificates, for expiration. The skill guides users through selecting a scope, running scans, analyzing results, and prioritizing remediation based on severity levels.

What it does

Executes compliance scans using the azqr tool.
Monitors Azure Key Vault for expiring secrets, keys, and certificates.
Lists subscriptions and resource groups for targeted auditing.
Provides a framework for classifying findings by priority (Critical to Low).
Offers guidance on interpreting scan results and remediation patterns.
Supports programmatic access to Key Vault via various SDKs.

When to use it

During scheduled security and compliance audits.
When identifying orphaned or unused Azure resources.
Before performing major infrastructure changes or migrations.
To proactively check for expiring certificates or secrets in Key Vault.
When validating adherence to Azure best practices.

Advantages

Automates the collection of compliance and security data.
Standardizes the assessment process across different Azure environments.
Helps reduce risk by identifying expiring credentials early.
Provides clear prioritization logic for remediation efforts.
Integrates multiple assessment sources into a single workflow.

Usage examples

“Run a compliance scan on my production subscription.”: The agent will list available subscriptions, execute the azqr scan on the selected scope, and provide a summary of findings categorized by reliability, security, and cost.
“Check for any expiring secrets in my Key Vault.”: The agent will inspect the specified Key Vault, retrieve expiration dates for all secrets, and report any that are nearing their expiration date.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/azure-compliance/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-compliance.zip -d .agents/skills

Documentation by Microsoft

Azure Compliance & Security Auditing

Quick Reference

Property	Details
Best for	Compliance scans, security audits, Key Vault expiration checks
Primary capabilities	Comprehensive Resources Assessment, Key Vault Expiration Monitoring
MCP tools	azqr, subscription and resource group listing, Key Vault item inspection

Prerequisites

Authentication: user is logged in to Azure via az login
Permissions to read resource configuration and Key Vault metadata

Assessments

Assessment	Reference
Comprehensive Compliance (azqr)	references/azure-quick-review.md
Key Vault Expiration	references/azure-keyvault-expiration-audit.md
Resource Graph Queries	references/azure-resource-graph.md

MCP Tools

Tool	Purpose
`mcp_azure_mcp_extension_azqr`	Run azqr compliance scans
`mcp_azure_mcp_subscription_list`	List available subscriptions
`mcp_azure_mcp_group_list`	List resource groups
`keyvault_key_list`	List all keys in vault
`keyvault_key_get`	Get key details including expiration
`keyvault_secret_list`	List all secrets in vault
`keyvault_secret_get`	Get secret details including expiration
`keyvault_certificate_list`	List all certificates in vault
`keyvault_certificate_get`	Get certificate details including expiration

Assessment Workflow

Select scope (subscription or resource group) for Comprehensive Resources Assessment.
Run azqr and capture output artifacts.
Analyze Scan Results and summarize findings and recommendations.
Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
Classify issues and propose remediation or fix steps for each finding.

Priority Classification

Priority	Guidance
Critical	Immediate remediation required for high-impact exposure
High	Resolve within days to reduce risk
Medium	Plan a resolution in the next sprint
Low	Track and fix during regular maintenance

Error Handling

Error	Message	Remediation
Authentication required	"Please login"	Run `az login` and retry
Access denied	"Forbidden"	Confirm permissions and fix role assignments
Missing resource	"Not found"	Verify subscription and resource group selection

Best Practices

Run compliance scans on a regular schedule (weekly or monthly)
Track findings over time and verify remediation effectiveness
Separate compliance reporting from remediation execution
Keep Key Vault expiration policies documented and enforced

SDK Quick References

For programmatic Key Vault access, see the condensed SDK guides:

Key Vault (Python): Secrets/Keys/Certs
Secrets: TypeScript | Rust | Java
Keys: .NET | Java | TypeScript | Rust
Certificates: Rust

Files

ATTRIBUTION.mdAdded by AutoGineer980 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.9 KiB
references/auth-best-practices.md6.1 KiB
references/azqr-recommendations.md5.7 KiB
references/azqr-remediation-patterns.md7.8 KiB
references/azure-keyvault-expiration-audit.md5.0 KiB
references/azure-quick-review.md5.0 KiB
references/azure-resource-graph.md2.6 KiB
references/sdk/azure-keyvault-certificates-rust.md1013 B
references/sdk/azure-keyvault-keys-rust.md1.3 KiB
references/sdk/azure-keyvault-keys-ts.md1019 B
references/sdk/azure-keyvault-py.md1.1 KiB
references/sdk/azure-keyvault-secrets-rust.md1.3 KiB
references/sdk/azure-keyvault-secrets-ts.md1.0 KiB
references/sdk/azure-security-keyvault-keys-dotnet.md1.1 KiB
references/sdk/azure-security-keyvault-keys-java.md1.3 KiB
references/sdk/azure-security-keyvault-secrets-java.md1.5 KiB

references/auth-best-practices.md

Azure Authentication Best Practices

Source: Microsoft — Passwordless connections for Azure services and Azure Identity client libraries.

Golden Rule

Use managed identities and Azure RBAC in production. Reserve DefaultAzureCredential for local development only.

Authentication by Environment

Environment	Recommended Credential	Why
Production (Azure-hosted)	`ManagedIdentityCredential` (system- or user-assigned)	No secrets to manage; auto-rotated by Azure
Production (on-premises)	`ClientCertificateCredential` or `WorkloadIdentityCredential`	Deterministic; no fallback chain overhead
CI/CD pipelines	`AzurePipelinesCredential` / `WorkloadIdentityCredential`	Scoped to pipeline identity
Local development	`DefaultAzureCredential`	Chains CLI, PowerShell, and VS Code credentials for convenience

Why Not `DefaultAzureCredential` in Production?

Unpredictable fallback chain — walks through multiple credential types, adding latency and making failures harder to diagnose.
Broad surface area — checks environment variables, CLI tokens, and other sources that should not exist in production.
Non-deterministic — which credential actually authenticates depends on the environment, making behavior inconsistent across deployments.
Performance — each failed credential attempt adds network round-trips before falling back to the next.

Production Patterns

.NET

using Azure.Identity;

var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"
    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials
    : new ManagedIdentityCredential();                      // production — deterministic, no fallback chain
// For user-assigned identity: new ManagedIdentityCredential("<client-id>")

TypeScript / JavaScript

import { DefaultAzureCredential, ManagedIdentityCredential } from "@azure/identity";

const credential = process.env.NODE_ENV === "development"
  ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials
  : new ManagedIdentityCredential();                      // production — deterministic, no fallback chain
// For user-assigned identity: new ManagedIdentityCredential("<client-id>")

Python

import os
from azure.identity import DefaultAzureCredential, ManagedIdentityCredential

credential = (
    DefaultAzureCredential()                              # local dev — uses CLI/VS credentials
    if os.getenv("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"
    else ManagedIdentityCredential()                      # production — deterministic, no fallback chain
)
# For user-assigned identity: ManagedIdentityCredential(client_id="<client-id>")

Java

import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.identity.ManagedIdentityCredentialBuilder;

var credential = "Development".equals(System.getenv("AZURE_FUNCTIONS_ENVIRONMENT"))
    ? new DefaultAzureCredentialBuilder().build()          // local dev — uses CLI/VS credentials
    : new ManagedIdentityCredentialBuilder().build();      // production — deterministic, no fallback chain
// For user-assigned identity: new ManagedIdentityCredentialBuilder().clientId("<client-id>").build()

Local Development Setup

DefaultAzureCredential is ideal for local dev because it automatically picks up credentials from developer tools:

Azure CLI — az login
Azure Developer CLI — azd auth login
Azure PowerShell — Connect-AzAccount
Visual Studio / VS Code — sign in via Azure extension

import { DefaultAzureCredential } from "@azure/identity";

// Local development only — uses CLI/PowerShell/VS Code credentials
const credential = new DefaultAzureCredential();

Environment-Aware Pattern

Detect the runtime environment and select the appropriate credential. The key principle: use DefaultAzureCredential only when running locally, and a specific credential in production.

Tip: Azure Functions sets AZURE_FUNCTIONS_ENVIRONMENT to "Development" when running locally. For App Service or containers, use any environment variable you control (e.g. NODE_ENV, ASPNETCORE_ENVIRONMENT).

import { DefaultAzureCredential, ManagedIdentityCredential } from "@azure/identity";

function getCredential() {
  if (process.env.NODE_ENV === "development") {
    return new DefaultAzureCredential();          // picks up az login / VS Code creds
  }
  return process.env.AZURE_CLIENT_ID
    ? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID)  // user-assigned
    : new ManagedIdentityCredential();                            // system-assigned
}

Security Checklist

[ ] Use managed identity for all Azure-hosted apps
[ ] Never hardcode credentials, connection strings, or keys
[ ] Apply least-privilege RBAC roles at the narrowest scope
[ ] Use ManagedIdentityCredential (not DefaultAzureCredential) in production
[ ] Store any required secrets in Azure Key Vault
[ ] Rotate secrets and certificates on a schedule
[ ] Enable Microsoft Defender for Cloud on production resources

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

What our scanner noticed· Low risk

Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/azure-skills/skills/azure-compliance · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

Also distributed in

microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-compliance.zip