Azure Compliance
- 481k installs
- 1.3k repo stars
- Updated July 26, 2026
- microsoft/azure-skills
azure-compliance is an agent skill that runs Azure compliance scans with azqr and audits Key Vault secrets, keys and certificates for expiration before deploying.
About
azure-compliance runs Azure compliance and security audits using the azqr CLI and checks Key Vault keys, secrets and certificates for expiration. A developer invokes it to validate resource configuration against best practices, find orphaned or misconfigured resources, and see what is expiring in the next 30 days before a deployment. It classifies each finding by priority and proposes remediation while keeping reporting separate from fixes. It requires an authenticated Azure session via az login and read permissions on resource and Key Vault metadata.
- Runs azqr (Azure Quick Review) compliance scans across a subscription or resource group
- Audits Key Vault keys, secrets and certificates for expiration
- Classifies findings by priority (Critical/High/Medium/Low) and proposes remediation
- Separates compliance reporting from remediation execution
Azure Compliance by the numbers
- 480,913 all-time installs (skills.sh)
- Security screen: LOW risk (skills.sh audit)
- Data as of Jul 28, 2026 (Skillselion catalog sync)
azure-compliance capabilities & compatibility
Free skill; requires an authenticated Azure session (az login) and read permissions.
- Capabilities
- compliance scan · security audit · key vault expiration audit · resource assessment · orphaned resource discovery
- Works with
- azure
- Use cases
- security audit
- Pricing
- Free
What azure-compliance says it does
Run Azure compliance and security audits with azqr plus Key Vault expiration checks.
Audit Key Vault keys, secrets, and certificates for expiration
Separate compliance reporting from remediation execution
npx skills add https://github.com/microsoft/azure-skills --skill azure-complianceAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 481k |
|---|---|
| repo stars | ★ 1.3k |
| Security audit | 3 / 3 scanners passed |
| Last updated | July 26, 2026 |
| Repository | microsoft/azure-skills ↗ |
Which Azure resources violate best practices, and what certificates or secrets are about to expire before I deploy?
security-audit
Who is it for?
Developers who need a compliance scan or security posture check on an Azure subscription and Key Vault before shipping.
Skip if: Application-specific deploy-readiness checks or executing remediation; the skill separates reporting from fixes.
When should I use this skill?
The user asks to check Azure compliance or best practices, run azqr, review security posture, or audit Key Vault for expired or expiring certificates, keys and secrets.
What you get
A prioritized list of compliance findings and Key Vault expiration issues with proposed remediation steps.
- Prioritized compliance findings report
- Key Vault expiration audit
- Proposed remediation steps
By the numbers
- 4-priority classification (Critical/High/Medium/Low)
- 5-step assessment workflow
Files
Azure Compliance & Security Auditing
Quick Reference
| Property | Details |
|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
When to Use This Skill
- Run azqr or Azure Quick Review for compliance assessment
- Validate Azure resource configuration against best practices
- Identify orphaned or misconfigured resources
- Audit Key Vault keys, secrets, and certificates for expiration
Skill Activation Triggers
Activate this skill when user wants to:
- Check Azure compliance or best practices
- Assess Azure resources for configuration issues
- Run azqr or Azure Quick Review
- Identify orphaned or misconfigured resources
- Review Azure security posture
- "Show me expired certificates/keys/secrets in my Key Vault"
- "Check what's expiring in the next 30 days"
- "Audit my Key Vault for compliance"
- "Find secrets without expiration dates"
- "Check certificate expiration dates"
Prerequisites
- Authentication: user is logged in to Azure via
az login - Permissions to read resource configuration and Key Vault metadata
Assessments
| Assessment | Reference |
|---|---|
| Comprehensive Compliance (azqr) | references/azure-quick-review.md |
| Key Vault Expiration | references/azure-keyvault-expiration-audit.md |
| Resource Graph Queries | references/azure-resource-graph.md |
MCP Tools
| Tool | Purpose |
|---|---|
mcp_azure_mcp_extension_azqr | Run azqr compliance scans |
mcp_azure_mcp_subscription_list | List available subscriptions |
mcp_azure_mcp_group_list | List resource groups |
keyvault_key_list | List all keys in vault |
keyvault_key_get | Get key details including expiration |
keyvault_secret_list | List all secrets in vault |
keyvault_secret_get | Get secret details including expiration |
keyvault_certificate_list | List all certificates in vault |
keyvault_certificate_get | Get certificate details including expiration |
Assessment Workflow
1. Select scope (subscription or resource group) for Comprehensive Resources Assessment. 2. Run azqr and capture output artifacts. 3. Analyze Scan Results and summarize findings and recommendations. 4. Review Key Vault Expiration Monitoring output for keys, secrets, and certificates. 5. Classify issues and propose remediation or fix steps for each finding.
Priority Classification
| Priority | Guidance |
|---|---|
| Critical | Immediate remediation required for high-impact exposure |
| High | Resolve within days to reduce risk |
| Medium | Plan a resolution in the next sprint |
| Low | Track and fix during regular maintenance |
Error Handling
| Error | Message | Remediation |
|---|---|---|
| Authentication required | "Please login" | Run az login and retry |
| Access denied | "Forbidden" | Confirm permissions and fix role assignments |
| Missing resource | "Not found" | Verify subscription and resource group selection |
Best Practices
- Run compliance scans on a regular schedule (weekly or monthly)
- Track findings over time and verify remediation effectiveness
- Separate compliance reporting from remediation execution
- Keep Key Vault e
Guides
- Azure Skills for Claude Code: The Complete Guide to microsoft/azure-skills
microsoft/azure-skills is Microsoft's official repo of 27 Azure skills for Claude Code, covering deploy, AKS, diagnostics, compliance, cost, and Azure AI Foundry. Combined they have 9,775,059 installs, with microsoft-foundry alone at 446,557 installs (skills.sh registry, July 2026). This guide maps every skill to the Azure job it does.
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets478k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.79.5k204
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.78.9k389
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.2k85
Prisma Driver Adapter ImplementationWhen they need the authoritative reference to correctly implement or modify a Prisma v7 database driver adapter.50.9k47How it compares
Use azure-compliance for subscription-wide security audits; use azure-validate for application-specific deploy readiness checks.
FAQ
What compliance tool does azure-compliance run?
It runs azqr (Azure Quick Review) for a comprehensive resources assessment against Azure best practices, then summarizes and classifies the findings.
Does it check Key Vault expiration?
Yes. It lists and inspects keys, secrets and certificates in Key Vault to find expired items, items expiring soon, and secrets without expiration dates.
Does azure-compliance fix the issues it finds?
No. It separates compliance reporting from remediation execution and proposes fix steps for each finding rather than applying them.
Is Azure Compliance safe to install?
skills.sh reports 3 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.