Azure Compliance Auditor
Audit Azure resources with azqr and detect expiration risks across Key Vault keys, secrets, and certificates.
The documentation requires existing Azure authentication and read permissions, and promotes managed identities, RBAC, and avoiding hardcoded credentials, providing partial least-privilege and sensitive-data guidance. Points are deducted because execution confirmation, data-flow disclosure, output redaction, and rollback are not specified; secret_get may expose secret values, and remediation commands modify resources.
The main workflow, tool inventory, and authentication/permission error guidance are broadly consistent and provide actionable failure feedback. Points are deducted because no key-path reproduction is included, MCP availability is unverified, some scope and tool behavior depend on external conditions, and abnormal-input and report-failure handling are limited.
Activation triggers and the Azure compliance and Key Vault expiration scenarios are clear, with subscription, resource-group, and multi-vault scopes described. Points are deducted for weak non-fit boundaries and input constraints, no explicit Chinese-language support, and no evidence regarding reachability from mainland-China networks.
The skill is readable and layered, with prerequisites, workflow, error handling, priorities, references, MIT licensing, and a version number. Points are deducted for lacking a changelog, explicit maintenance owner, or update path; several referenced SDK files are absent from the supplied material, and the example report is Markdown rather than a strictly machine-readable format.
The documentation covers azqr scans, Key Vault expiration analysis, result classification, and multiple CLI/Bicep remediation templates, so the core audit value is plausible. Points are deducted because this is a static review with no execution evidence; tool results, Excel parsing, and report completeness are unverified, and remediation examples require human review and environment-specific adaptation.
The materials include linked source references for Azure authentication, azqr, Resource Graph, and CLI usage, and the repository shows general CI/test materials. Points are deducted because there are no skill-specific tests, pinned input/output fixtures, or third-party execution results, so key paths cannot be independently reproduced from the supplied evidence.
- Confirm each target subscription, resource, and change impact before running remediation commands, and establish a recoverable backup or rollback plan.
- Avoid Key Vault operations that return secret values; redact audit reports and restrict their access.
- Verify MCP tool names, parameters, azqr output format, and CLI/Bicep examples against the current Azure environment.
- The supplied materials do not establish Chinese-language support or mainland-China network reachability.
What does this skill do, and when should you use it?
azure-compliance is Microsoft’s Agent Skill for Azure compliance and security auditing. It runs Azure Quick Review (azqr), reviews resource configuration and security posture, and checks expiration metadata for Key Vault items. It is suited to teams that need recurring compliance reviews, configuration checks, or expiration monitoring. Azure CLI authentication and read access to resource configuration and Key Vault metadata are required.
Selects a subscription or resource group as the audit scope; runs azqr and captures its output artifacts; lists subscriptions and resource groups; lists Key Vault keys, secrets, and certificates; retrieves item details and expiration dates; identifies expired, soon-to-expire, or undated items; summarizes findings, assigns Critical-to-Low priorities, and proposes remediation steps.
- An Azure administrator wants a best-practice review before deploying or changing a resource group.
- A security team runs recurring scans to identify orphaned or misconfigured Azure resources.
- A Key Vault owner needs to find expired items or items expiring within the next 30 days.
- A platform team wants to review Azure security posture and track remediation over time.
- A compliance team needs audit findings grouped by Critical, High, Medium, and Low priority.
What are this skill's strengths and limitations?
- Combines Azure resource compliance assessment with Key Vault expiration monitoring.
- Defines a concrete workflow around azqr, subscription, resource-group, and Key Vault MCP tools.
- Includes priority classification, error handling, and recurring-scan guidance.
- Provides condensed Key Vault SDK references for Python, TypeScript, Rust, Java, and .NET.
- Requires Azure authentication, read permissions, azqr, and Azure MCP tools.
- The source does not specify the azqr version, output format, or standalone test coverage for this skill.
- It describes assessment and recommendations, not automatic remediation.
- The documented Key Vault scope is metadata and expiration inspection; secret-value retrieval is not described.
How do you install this skill?
Use the repository’s documented installation flow: run npx skills add microsoft/skills and select the required skill in the wizard. The repository also documents Copilot CLI plugin installation with /plugin marketplace add microsoft/skills, followed by /plugin install azure-skills@skills. The source does not document a standalone azure-compliance installation command.
How do you use this skill?
Run az login first and confirm that the identity can read Azure resource configuration and Key Vault metadata. Then use a focused request such as Run an Azure compliance scan for this resource group, Show me expired certificates, keys, and secrets in my Key Vault, or Check what's expiring in the next 30 days. The skill selects the scope, runs azqr, and performs Key Vault checks when requested.