AutoGineer
Generated banner for Azure Compliance
Generated logo for Azure Compliance

Azure Compliance

MicrosoftOfficialCreated by Microsoft

  • Skill
  • Tool integration
  • Security
  • MIT
  • Low risk
Download ZIP

From the author

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The azure-compliance skill provides a structured approach to auditing Azure environments for security, reliability, and operational best practices. It leverages the azqr tool for comprehensive resource assessments and includes specific capabilities for monitoring Key Vault assets, such as secrets, keys, and certificates, for expiration. The skill guides users through selecting a scope, running scans, analyzing results, and prioritizing remediation based on severity levels.

What it does

  • Executes compliance scans using the azqr tool.
  • Monitors Azure Key Vault for expiring secrets, keys, and certificates.
  • Lists subscriptions and resource groups for targeted auditing.
  • Provides a framework for classifying findings by priority (Critical to Low).
  • Offers guidance on interpreting scan results and remediation patterns.
  • Supports programmatic access to Key Vault via various SDKs.

When to use it

  • During scheduled security and compliance audits.
  • When identifying orphaned or unused Azure resources.
  • Before performing major infrastructure changes or migrations.
  • To proactively check for expiring certificates or secrets in Key Vault.
  • When validating adherence to Azure best practices.

Advantages

  • Automates the collection of compliance and security data.
  • Standardizes the assessment process across different Azure environments.
  • Helps reduce risk by identifying expiring credentials early.
  • Provides clear prioritization logic for remediation efforts.
  • Integrates multiple assessment sources into a single workflow.

Usage examples

“Run a compliance scan on my production subscription.”
The agent will list available subscriptions, execute the azqr scan on the selected scope, and provide a summary of findings categorized by reliability, security, and cost.
“Check for any expiring secrets in my Key Vault.”
The agent will inspect the specified Key Vault, retrieve expiration dates for all secrets, and report any that are nearing their expiration date.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/microsoft/azure-compliance/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip azure-compliance.zip -d .agents/skills

Documentation by Microsoft

Azure Compliance & Security Auditing

Quick Reference

PropertyDetails
Best forCompliance scans, security audits, Key Vault expiration checks
Primary capabilitiesComprehensive Resources Assessment, Key Vault Expiration Monitoring
MCP toolsazqr, subscription and resource group listing, Key Vault item inspection

Prerequisites

  • Authentication: user is logged in to Azure via az login

  • Permissions to read resource configuration and Key Vault metadata

Assessments

AssessmentReference
Comprehensive Compliance (azqr)references/azure-quick-review.md
Key Vault Expirationreferences/azure-keyvault-expiration-audit.md
Resource Graph Queriesreferences/azure-resource-graph.md

MCP Tools

ToolPurpose
mcp_azure_mcp_extension_azqrRun azqr compliance scans
mcp_azure_mcp_subscription_listList available subscriptions
mcp_azure_mcp_group_listList resource groups
keyvault_key_listList all keys in vault
keyvault_key_getGet key details including expiration
keyvault_secret_listList all secrets in vault
keyvault_secret_getGet secret details including expiration
keyvault_certificate_listList all certificates in vault
keyvault_certificate_getGet certificate details including expiration

Assessment Workflow

  1. Select scope (subscription or resource group) for Comprehensive Resources Assessment.

  2. Run azqr and capture output artifacts.

  3. Analyze Scan Results and summarize findings and recommendations.

  4. Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.

  5. Classify issues and propose remediation or fix steps for each finding.

Priority Classification
PriorityGuidance
CriticalImmediate remediation required for high-impact exposure
HighResolve within days to reduce risk
MediumPlan a resolution in the next sprint
LowTrack and fix during regular maintenance

Error Handling

ErrorMessageRemediation
Authentication required"Please login"Run az login and retry
Access denied"Forbidden"Confirm permissions and fix role assignments
Missing resource"Not found"Verify subscription and resource group selection

Best Practices

  • Run compliance scans on a regular schedule (weekly or monthly)

  • Track findings over time and verify remediation effectiveness

  • Separate compliance reporting from remediation execution

  • Keep Key Vault expiration policies documented and enforced

SDK Quick References

For programmatic Key Vault access, see the condensed SDK guides:

Files

references/azure-quick-review.md

Azure Quick Review Compliance Assessment

This skill enables comprehensive Azure compliance assessments using Azure Quick Review (azqr), analyzing findings against Azure best practices, and providing actionable remediation guidance.

Prerequisites

  • Azure authentication - Logged in via Azure CLI (az login) or using Service Principal/Managed Identity

  • Reader permissions - Minimum Reader role on target subscription or management group

Assessment Workflow

Step 1: Determine Scan Scope

Ask the user or detect from context:

ScopeUse CaseRequired Info
SubscriptionFull subscription assessmentSubscription ID
Resource GroupTargeted assessmentSubscription ID + Resource Group name
Management GroupEnterprise-wide assessmentManagement Group ID
Specific ServiceDeep-dive on one resource typeSubscription ID + Service abbreviation
Step 2: Run Compliance Scan

Use the Azure MCP tool to run the scan:

mcp_azure_mcp_extension_azqr
  subscription: <subscription-id>
  resource-group: <optional-rg-name>
Step 3: Analyze Scan Results

The scan produces an Excel file with these sheets:

SheetContentsPriority
RecommendationsAll recommendations with impacted resource countHigh
ImpactedResourcesResources with specific issues to addressHigh
InventoryAll scanned resources with SKU, Tier, SLA detailsMedium
AdvisorAzure Advisor recommendationsMedium
DefenderRecommendationsMicrosoft Defender for Cloud findingsHigh
Azure PolicyNon-compliant resources per Azure PolicyMedium
Costs3-month cost history by subscriptionLow
DefenderDefender plan status and tiersMedium
OutOfScopeResources not scannedLow

Focus analysis on:

  1. High-severity recommendations from ImpactedResources

  2. Defender recommendations (security-critical)

  3. Advisor recommendations (reliability/performance)

  4. Policy non-compliance (governance)

Step 4: Categorize Findings

Group findings by category for prioritized remediation:

CategoryExamplesSeverity
SecurityPublic endpoints, missing encryption, no private endpointsCritical
ReliabilityNo zone redundancy, single instance, no backupHigh
PerformanceUndersized SKUs, missing caching, no CDNMedium
CostOrphaned resources, oversized SKUs, unused reservationsMedium
OperationsMissing diagnostics, no alerts, no tagsLow
Step 5: Generate Remediation Guidance

For each high-priority finding:

  1. Explain the risk in plain language

  2. Provide remediation options (Portal, CLI, Bicep)

  3. Estimate effort and impact

See azqr-remediation-patterns.md for common fix templates.

Step 6: Present Summary

Provide a structured summary:

## Compliance Assessment Summary

**Scope:** [Subscription/RG/MG name]
**Scanned:** [Date/Time]
**Resources Analyzed:** [Count]

### Key Findings

| Severity | Count | Top Issues |
|----------|-------|------------|
| Critical | X | [List top 3] |
| High | X | [List top 3] |
| Medium | X | [List top 3] |

### Recommended Actions

1. **[Issue]** - [Brief remediation]
2. **[Issue]** - [Brief remediation]
3. **[Issue]** - [Brief remediation]

### Next Steps
- [ ] Address critical security findings
- [ ] Review and remediate high-severity items
- [ ] Schedule follow-up scan to verify fixes

Supported Azure Services

azqr supports 70+ Azure resource types including:

  • Azure Kubernetes Service (AKS)

  • API Management

  • App Configuration

  • App Service

  • Container Apps

  • Cosmos DB

  • Container Registry

  • Key Vault

  • Load Balancer

  • Azure Database for MySQL

  • Azure Database for PostgreSQL

  • Azure Cache for Redis

  • Service Bus

  • Azure SQL Database

  • Storage Accounts

  • Virtual Machines

  • Virtual Networks

Tools Used

ToolPurpose
mcp_azure_mcp_extension_azqrRun azqr scans via Azure MCP
mcp_azure_mcp_subscription_listList available subscriptions
mcp_azure_mcp_group_listList resource groups in subscription

Troubleshooting

IssueSymptomSolution
Permission denied403 errors during scanVerify Reader role on scope
Not authenticatedAADSTS errorsRun az login first
Slow scanScan takes very longUse resource group scope

Example Prompts

  • "Check my Azure subscription for compliance issues"

  • "Run azqr on my production resource group"

  • "What Azure resources don't follow best practices?"

  • "Assess my storage accounts for security issues"

Reference Documentation

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

What our scanner noticed· Low risk

  • Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/skills · .github/plugins/azure-skills/skills/azure-compliance · commit 0696600
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-compliance.zip