Azure Security Auditor

Azure Compliance & Security Auditing

by microsoft · MIT license · ★ 3,077 on GitHub

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks.

---
name: azure-compliance
description: "Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment."
license: MIT
metadata:
  author: Microsoft
  version: "1.2.3"
---

# Azure Compliance & Security Auditing

## Quick Reference

| Property | Details |
|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |

Overview

For programmatic Key Vault access, see the condensed SDK guides:

Manual install (npx, ZIP)

Claude Codenpx skills add microsoft/skills --skill azure-compliance -g -a claude-code

Claude Code (degit)npx degit microsoft/skills/.github/plugins/azure-skills/skills/azure-compliance#main ~/.claude/skills/azure-compliance

Claude.ai / desktopZip the folder and upload it under Settings → Capabilities → Skills.

Codex, Cursor, other agentsPoint them at SKILL.md. The other files are plain text.

Connects with Agent Alley MCP · agentalley.io/mcp

Files included

SKILL.md3.9 KB

Read SKILL.md here

microsoft/main1 file shown

SKILL.md3.9 KB

Browse every file on GitHub↗

SKILL.md

Show the full text88 lines

azure-compliance/SKILL.md88 lines · 3.9 KB

PreviewCode

Outline

RawView on GitHub

Azure Compliance & Security Auditing

Quick Reference

Property	Details
Best for	Compliance scans, security audits, Key Vault expiration checks
Primary capabilities	Comprehensive Resources Assessment, Key Vault Expiration Monitoring
MCP tools	azqr, subscription and resource group listing, Key Vault item inspection

Prerequisites

Authentication: user is logged in to Azure via az login
Permissions to read resource configuration and Key Vault metadata

Assessments

Assessment	Reference
Comprehensive Compliance (azqr)	references/azure-quick-review.md
Key Vault Expiration	references/azure-keyvault-expiration-audit.md
Resource Graph Queries	references/azure-resource-graph.md

MCP Tools

Tool	Purpose
`mcp_azure_mcp_extension_azqr`	Run azqr compliance scans
`mcp_azure_mcp_subscription_list`	List available subscriptions
`mcp_azure_mcp_group_list`	List resource groups
`keyvault_key_list`	List all keys in vault
`keyvault_key_get`	Get key details including expiration
`keyvault_secret_list`	List all secrets in vault
`keyvault_secret_get`	Get secret details including expiration
`keyvault_certificate_list`	List all certificates in vault
`keyvault_certificate_get`	Get certificate details including expiration

Assessment Workflow

Select scope (subscription or resource group) for Comprehensive Resources Assessment.
Run azqr and capture output artifacts.
Analyze Scan Results and summarize findings and recommendations.
Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
Classify issues and propose remediation or fix steps for each finding.

Priority Classification

Priority	Guidance
Critical	Immediate remediation required for high-impact exposure
High	Resolve within days to reduce risk
Medium	Plan a resolution in the next sprint
Low	Track and fix during regular maintenance

Error Handling

Error	Message	Remediation
Authentication required	"Please login"	Run `az login` and retry
Access denied	"Forbidden"	Confirm permissions and fix role assignments
Missing resource	"Not found"	Verify subscription and resource group selection

Best Practices

Run compliance scans on a regular schedule (weekly or monthly)
Track findings over time and verify remediation effectiveness
Separate compliance reporting from remediation execution
Keep Key Vault expiration policies documented and enforced

SDK Quick References

For programmatic Key Vault access, see the condensed SDK guides:

Key Vault (Python): Secrets/Keys/Certs
Secrets: TypeScript | Rust | Java
Keys: .NET | Java | TypeScript | Rust
Certificates: Rust

1	---
2	name: azure-compliance
3	description: "Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment."
4	license: MIT
5	metadata:
6	author: Microsoft
7	version: "1.2.3"
8	---
9
10	# Azure Compliance & Security Auditing
11
12	## Quick Reference
13
14	\| Property \| Details \|
15	\|---\|---\|
16	\| Best for \| Compliance scans, security audits, Key Vault expiration checks \|
17	\| Primary capabilities \| Comprehensive Resources Assessment, Key Vault Expiration Monitoring \|
18	\| MCP tools \| azqr, subscription and resource group listing, Key Vault item inspection \|
19
20	## Prerequisites
21
22	- Authentication: user is logged in to Azure via `az login`
23	- Permissions to read resource configuration and Key Vault metadata
24
25	## Assessments
26
27	\| Assessment \| Reference \|
28	\|------------\|-----------\|
29	\| Comprehensive Compliance (azqr) \| [references/azure-quick-review.md](references/azure-quick-review.md) \|
30	\| Key Vault Expiration \| [references/azure-keyvault-expiration-audit.md](references/azure-keyvault-expiration-audit.md) \|
31	\| Resource Graph Queries \| [references/azure-resource-graph.md](references/azure-resource-graph.md) \|
32
33	## MCP Tools
34
35	\| Tool \| Purpose \|
36	\|------\|---------\|
37	\| `mcp_azure_mcp_extension_azqr` \| Run azqr compliance scans \|
38	\| `mcp_azure_mcp_subscription_list` \| List available subscriptions \|
39	\| `mcp_azure_mcp_group_list` \| List resource groups \|
40	\| `keyvault_key_list` \| List all keys in vault \|
41	\| `keyvault_key_get` \| Get key details including expiration \|
42	\| `keyvault_secret_list` \| List all secrets in vault \|
43	\| `keyvault_secret_get` \| Get secret details including expiration \|
44	\| `keyvault_certificate_list` \| List all certificates in vault \|
45	\| `keyvault_certificate_get` \| Get certificate details including expiration \|
46
47	## Assessment Workflow
48
49	1. Select scope (subscription or resource group) for Comprehensive Resources Assessment.
50	2. Run azqr and capture output artifacts.
51	3. Analyze Scan Results and summarize findings and recommendations.
52	4. Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
53	5. Classify issues and propose remediation or fix steps for each finding.
54
55	### Priority Classification
56
57	\| Priority \| Guidance \|
58	\|---\|---\|
59	\| Critical \| Immediate remediation required for high-impact exposure \|
60	\| High \| Resolve within days to reduce risk \|
61	\| Medium \| Plan a resolution in the next sprint \|
62	\| Low \| Track and fix during regular maintenance \|
63
64	## Error Handling
65
66	\| Error \| Message \| Remediation \|
67	\|---\|---\|---\|
68	\| Authentication required \| "Please login" \| Run `az login` and retry \|
69	\| Access denied \| "Forbidden" \| Confirm permissions and fix role assignments \|
70	\| Missing resource \| "Not found" \| Verify subscription and resource group selection \|
71
72	## Best Practices
73
74	- Run compliance scans on a regular schedule (weekly or monthly)
75	- Track findings over time and verify remediation effectiveness
76	- Separate compliance reporting from remediation execution
77	- Keep Key Vault expiration policies documented and enforced
78
79	## SDK Quick References
80
81	For programmatic Key Vault access, see the condensed SDK guides:
82
83	- Key Vault (Python): [Secrets/Keys/Certs](references/sdk/azure-keyvault-py.md)
84	- Secrets: [TypeScript](references/sdk/azure-keyvault-secrets-ts.md) \| [Rust](references/sdk/azure-keyvault-secrets-rust.md) \| [Java](references/sdk/azure-security-keyvault-secrets-java.md)
85	- Keys: [.NET](references/sdk/azure-security-keyvault-keys-dotnet.md) \| [Java](references/sdk/azure-security-keyvault-keys-java.md) \| [TypeScript](references/sdk/azure-keyvault-keys-ts.md) \| [Rust](references/sdk/azure-keyvault-keys-rust.md)
86	- Certificates: [Rust](references/sdk/azure-keyvault-certificates-rust.md)
87
88