Mcsb — Agent Skill by Microsoft

From the author

Microsoft Cloud Security Benchmark (MCSB v2) control-domain taxonomy and NIST 800-53 / CIS Controls crosswalk for planning and reviewing Azure cloud resources.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The mcsb skill provides a durable reference for the Microsoft Cloud Security Benchmark (MCSB) v2. It organizes security controls into twelve distinct domains, such as Network Security, Identity Management, and Artificial Intelligence Security. By mapping these domains to NIST SP 800-53 Rev. 5 and CIS Controls v8.1, the skill enables security planners and reviewers to assess Azure resources against a consistent, industry-aligned vocabulary. The skill is designed to hold the stable taxonomy of the benchmark while delegating volatile, service-specific control identifiers to a runtime lookup process.

What it does

Provides a structured taxonomy of twelve security control domains for Azure.
Maps MCSB v2 domains to NIST 800-53 Rev. 5 and CIS Controls v8.1.
Includes assessment checklists for evaluating Azure resource security.
Identifies common anti-patterns and insecure configurations.
Offers guidance on defensive measures and mitigation strategies.
Delegates volatile, per-service control lookups to a dedicated playbook.

When to use it

When planning the security architecture for new Azure deployments.
During security audits or reviews of existing Azure cloud resources.
When aligning internal security policies with the Microsoft Cloud Security Benchmark.
When identifying gaps in network, identity, or data protection configurations.

Advantages

Provides a consistent, standardized vocabulary for Azure security assessments.
Facilitates compliance mapping to widely recognized frameworks like NIST and CIS.
Separates stable domain definitions from volatile service-specific data.
Includes actionable checklists to identify common security misconfigurations.

Usage examples

“What are the key assessment criteria for the Network Security domain in MCSB v2?”: The agent returns the Network Security (NS) checklist, including requirements for private endpoints, NSG restrictions, WAF deployment, and the avoidance of public management port exposure.
“How does MCSB v2 map to NIST 800-53 for data protection?”: The agent provides the crosswalk information for the Data Protection (DP) domain, linking it to the relevant NIST 800-53 Rev. 5 control families.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/mcsb/download
Unzip it into the cross-client skills folder of your project:
```
mkdir -p .agents/skills && unzip mcsb.zip -d .agents/skills
```

Documentation by Microsoft

Microsoft Cloud Security Benchmark — Skill Entry

This SKILL.md is the entrypoint for the Microsoft Cloud Security Benchmark (MCSB) skill.

The skill encodes the durable, structurally stable layer of MCSB — the control-domain taxonomy and a domain-grain crosswalk to NIST SP 800-53 and CIS Controls — so the Security Planner and Security Reviewer can map and assess Azure cloud resources against a consistent control vocabulary.

The skill deliberately does not embed the volatile layer of MCSB (per-Azure-service security baselines, per-service control IDs, Azure Policy mappings, and Defender for Cloud assessment specifics). That content changes on Microsoft's release cadence and is retrieved at runtime through the Researcher Subagent per references/lookup-playbook.md.

Version and stability

This skill targets MCSB v2, which Microsoft marks as preview and which supersedes MCSB v1. Content is version-pinned and retrieval-dated (2026-07-21). MCSB v2 replaces v1's Governance and Strategy (GS) domain with an Artificial Intelligence Security (AI) domain, and maps to NIST SP 800-53 Rev. 5 and CIS Controls v8.1 (v1 mapped to Rev. 4 and CIS v8). Re-verify the taxonomy and mappings against the official source before relying on them for a compliance decision.

Normative references

00 Control Index
01 Network Security
02 Identity Management
03 Privileged Access
04 Data Protection
05 Asset Management
06 Logging and Threat Detection
07 Incident Response
08 Posture and Vulnerability Management
09 Endpoint Security
10 Backup and Recovery
11 DevOps Security
12 Artificial Intelligence Security
Lookup Playbook — delegation guardrail for volatile per-service lookups.

Skill layout

SKILL.md — this file (skill entrypoint).
references/ — the MCSB durable reference documents.
- 00-control-index.md — control-domain catalog, consolidated crosswalk, and attribution.
- 01 through 12 — one document per MCSB v2 control domain with assessment checklists.
- lookup-playbook.md — delegation guardrail for volatile per-service content.

Attribution

Reference content in this skill is original prose that paraphrases publicly documented MCSB structure. The MCSB v2 (preview) documentation this skill cites is published on Microsoft Learn from a non-public source repository and is governed by the Microsoft Learn Terms of Use, not a public Creative Commons license. The separate, older MicrosoftDocs/SecurityBenchmarks repository is CC BY 4.0, but its benchmark spreadsheets stop at Azure Security Benchmark v3 (the pre-rename lineage) and Microsoft Cloud Security Benchmark v1; it does not contain the MCSB v2 (preview) content this skill cites. Because this skill paraphrases rather than reproduces upstream text, no verbatim-reproduction license grant applies; it cites the canonical source in each reference file. See references/00-control-index.md for the consolidated attribution.

Files

ATTRIBUTION.mdAdded by AutoGineer813 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md3.9 KiB
references/00-control-index.md6.3 KiB
references/01-network-security.md2.2 KiB
references/02-identity-management.md2.1 KiB
references/03-privileged-access.md2.0 KiB
references/04-data-protection.md1.9 KiB
references/05-asset-management.md1.9 KiB
references/06-logging-threat-detection.md2.0 KiB
references/07-incident-response.md1.8 KiB
references/08-posture-vulnerability-management.md1.9 KiB
references/09-endpoint-security.md1.8 KiB
references/10-backup-recovery.md1.8 KiB
references/11-devops-security.md2.0 KiB
references/12-ai-security.md2.3 KiB
references/lookup-playbook.md2.4 KiB

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude Code
MITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k