Azure Compliance Auditing
OfficialFreeRun compliance and security audits on Azure resources.
Free · Opens the source repo
What Azure Compliance Auditing does
The Azure Compliance Auditing skill enables users to perform comprehensive compliance scans and security audits on Azure resources. It leverages the azqr tool and provides functionality for assessing resource configurations against best practices, identifying orphaned or misconfigured resources, and auditing Key Vault items for expiration. This skill is particularly useful for teams responsible for maintaining compliance and security within their Azure environments, ensuring that resources are configured correctly and that sensitive information is managed securely.
This skill supports various assessments, including the validation of Azure resource configurations and the monitoring of Key Vault keys, secrets, and certificates for expiration. Users can activate the skill when they need to check compliance, assess security posture, or review resource configurations. The integration with the azqr tool allows for a detailed analysis of Azure resources, enabling teams to identify potential risks and take corrective actions promptly.
To use this skill, users must be authenticated in Azure and possess the necessary permissions to read resource configurations and Key Vault metadata. The skill guides users through a structured assessment workflow, starting from selecting the scope of the assessment to analyzing the results and proposing remediation steps. This systematic approach helps teams to maintain a high security posture and adhere to compliance requirements effectively.
When to use it
Use this skill when conducting compliance scans, security audits, or when needing to monitor Key Vault expiration statuses.
When not to use it
This skill is not suitable for environments where Azure services are not used or for users without the necessary permissions to access Azure resources.
What you can build with it
Conducting Regular Compliance Audits
Schedule regular compliance audits using this skill to ensure Azure resources adhere to best practices.
Monitoring Key Vault Expirations
Use the skill to regularly check for expired keys, secrets, and certificates in your Azure Key Vault.
Assessing Resource Configurations
Run assessments to validate the configurations of Azure resources against established compliance standards.
How to install Azure Compliance Auditing
View source1. Install with the skills CLI
npx skills add microsoft/azure-skills/azure-compliance --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by microsoftAzure Compliance & Security Auditing
Quick Reference
| Property | Details |
|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
When to Use This Skill
- Run azqr or Azure Quick Review for compliance assessment
- Validate Azure resource configuration against best practices
- Identify orphaned or misconfigured resources
- Audit Key Vault keys, secrets, and certificates for expiration
Skill Activation Triggers
Activate this skill when user wants to:
- Check Azure compliance or best practices
- Assess Azure resources for configuration issues
- Run azqr or Azure Quick Review
- Identify orphaned or misconfigured resources
- Review Azure security posture
- "Show me expired certificates/keys/secrets in my Key Vault"
- "Check what's expiring in the next 30 days"
- "Audit my Key Vault for compliance"
- "Find secrets without expiration dates"
- "Check certificate expiration dates"
Prerequisites
- Authentication: user is logged in to Azure via
az login - Permissions to read resource configuration and Key Vault metadata
Assessments
| Assessment | Reference |
|---|---|
| Comprehensive Compliance (azqr) | references/azure-quick-review.md |
| Key Vault Expiration | references/azure-keyvault-expiration-audit.md |
| Resource Graph Queries | references/azure-resource-graph.md |
MCP Tools
| Tool | Purpose |
|---|---|
mcp_azure_mcp_extension_azqr | Run azqr compliance scans |
mcp_azure_mcp_subscription_list | List available subscriptions |
mcp_azure_mcp_group_list | List resource groups |
keyvault_key_list | List all keys in vault |
keyvault_key_get | Get key details including expiration |
keyvault_secret_list | List all secrets in vault |
keyvault_secret_get | Get secret details including expiration |
keyvault_certificate_list | List all certificates in vault |
keyvault_certificate_get | Get certificate details including expiration |
Assessment Workflow
- Select scope (subscription or resource group) for Comprehensive Resources Assessment.
- Run azqr and capture output artifacts.
- Analyze Scan Results and summarize findings and recommendations.
- Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
- Classify issues and propose remediation or fix steps for each finding.
Priority Classification
| Priority | Guidance |
|---|---|
| Critical | Immediate remediation required for high-impact exposure |
| High | Resolve within days to reduce risk |
| Medium | Plan a resolution in the next sprint |
| Low | Track and fix during regular maintenance |
Error Handling
| Error | Message | Remediation |
|---|---|---|
| Authentication required | "Please login" | Run az login and retry |
| Access denied | "Forbidden" | Confirm permissions and fix role assignments |
| Missing resource | "Not found" | Verify subscription and resource group selection |
Best Practices
- Run compliance scans on a regular schedule (weekly or monthly)
- Track findings over time and verify remediation effectiveness
- Separate compliance reporting from remediation execution
- Keep Key Vault expiration policies documented and enforced
SDK Quick References
For programmatic Key Vault access, see the condensed SDK guides:
- Key Vault (Python): Secrets/Keys/Certs
- Secrets: TypeScript | Rust | Java
- Keys: .NET | Java | TypeScript | Rust
- Certificates: Rust
Frequently asked questions about Azure Compliance Auditing
Similar skills
Data Breach Blast Radius Analyzer
Assess potential breach impacts before they occur.
Verify Agent Action
Ensure safe execution of AI agent actions with thorough reviews.
Agent Supply Chain Integrity
Ensure the integrity of AI agent plugins and tools.
Agent OWASP ASI Compliance Check
Ensure your AI agents meet OWASP ASI security standards.
Securing S3 Buckets
Enhance your S3 bucket security with AWS best practices.
AWS Account Enumeration with ScoutSuite
Assess AWS security posture with comprehensive audits.