azure-compliance
npx machina-cli add skill microsoft/GitHub-Copilot-for-Azure/azure-compliance --openclawFiles (1)
SKILL.md
4.9 KB
Azure Compliance & Security Auditing
Quick Reference
| Property | Details |
|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
When to Use This Skill
- Run azqr or Azure Quick Review for compliance assessment
- Validate Azure resource configuration against best practices
- Identify orphaned or misconfigured resources
- Audit Key Vault keys, secrets, and certificates for expiration
Skill Activation Triggers
Activate this skill when user wants to:
- Check Azure compliance or best practices
- Assess Azure resources for configuration issues
- Run azqr or Azure Quick Review
- Identify orphaned or misconfigured resources
- Review Azure security posture
- "Show me expired certificates/keys/secrets in my Key Vault"
- "Check what's expiring in the next 30 days"
- "Audit my Key Vault for compliance"
- "Find secrets without expiration dates"
- "Check certificate expiration dates"
Prerequisites
- Authentication: user is logged in to Azure via
az login - Permissions to read resource configuration and Key Vault metadata
Assessments
| Assessment | Reference |
|---|---|
| Comprehensive Compliance (azqr) | references/azure-quick-review.md |
| Key Vault Expiration | references/azure-keyvault-expiration-audit.md |
| Resource Graph Queries | references/azure-resource-graph.md |
MCP Tools
| Tool | Purpose |
|---|---|
mcp_azure_mcp_extension_azqr | Run azqr compliance scans |
mcp_azure_mcp_subscription_list | List available subscriptions |
mcp_azure_mcp_group_list | List resource groups |
keyvault_key_list | List all keys in vault |
keyvault_key_get | Get key details including expiration |
keyvault_secret_list | List all secrets in vault |
keyvault_secret_get | Get secret details including expiration |
keyvault_certificate_list | List all certificates in vault |
keyvault_certificate_get | Get certificate details including expiration |
Assessment Workflow
- Select scope (subscription or resource group) for Comprehensive Resources Assessment.
- Run azqr and capture output artifacts.
- Analyze Scan Results and summarize findings and recommendations.
- Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
- Classify issues and propose remediation or fix steps for each finding.
Priority Classification
| Priority | Guidance |
|---|---|
| Critical | Immediate remediation required for high-impact exposure |
| High | Resolve within days to reduce risk |
| Medium | Plan a resolution in the next sprint |
| Low | Track and fix during regular maintenance |
Error Handling
| Error | Message | Remediation |
|---|---|---|
| Authentication required | "Please login" | Run az login and retry |
| Access denied | "Forbidden" | Confirm permissions and fix role assignments |
| Missing resource | "Not found" | Verify subscription and resource group selection |
Best Practices
- Run compliance scans on a regular schedule (weekly or monthly)
- Track findings over time and verify remediation effectiveness
- Separate compliance reporting from remediation execution
- Keep Key Vault expiration policies documented and enforced
SDK Quick References
For programmatic Key Vault access, see the condensed SDK guides:
- Key Vault (Python): Secrets/Keys/Certs
- Secrets: TypeScript | Rust | Java
- Keys: .NET | Java | TypeScript | Rust
- Certificates: Rust
Source
git clone https://github.com/microsoft/GitHub-Copilot-for-Azure/blob/main/plugin/skills/azure-compliance/SKILL.mdView on GitHub Overview
Azure Compliance & Security Auditing helps assess resources against Azure best practices, monitor Key Vault expirations, and validate configurations for security and policy compliance. It leverages azqr, resource graph queries, and Key Vault audits to surface gaps and remediation opportunities.
How This Skill Works
The skill executes azqr-based assessments across a chosen scope (subscription or resource group), then uses Key Vault item queries to check expiration of keys, secrets, and certificates. Findings are aggregated into actionable remediation guidance and aligned with policy compliance and security posture evaluation.
When to Use It
- Run azqr or Azure Quick Review for compliance assessment
- Validate Azure resource configuration against best practices
- Identify orphaned or misconfigured resources
- Audit Key Vault keys, secrets, and certificates for expiration
- Review security posture and identify expiring items within 30 days
Quick Start
- Step 1: az login and set the target scope (subscription or resource group)
- Step 2: Run azqr-based assessment (e.g., mcp_azure_mcp_extension_azqr) and collect output artifacts
- Step 3: Review findings (config issues, expirations, policy gaps) and plan remediation
Best Practices
- Authenticate to Azure with az login and ensure read permissions before scanning
- Run comprehensive assessments at subscription or resource group scope to catch drift
- Include Key Vault expiration checks (keys, secrets, certificates) in every run
- Correlate scan results with Resource Graph queries and Azure policy references
- Prioritize remediation using the provided guidance and error handling steps
Example Use Cases
- Perform a comprehensive compliance scan across a new subscription to surface misconfigurations and policy gaps
- Audit all Key Vaults for expiring keys, secrets, and certificates and generate renewal reminders
- Identify orphaned resources after project decommissioning and propose cleanup actions
- Validate resource configurations against Azure best practices and generate remediation steps
- Evaluate security posture for regulatory compliance and track findings over time
Frequently Asked Questions
Add this skill to your agents
