Microsoft
Install Azure Compliance
Pick your agent. Every command is ready to paste.
npx skills add microsoft/azure-skills --skill azure-complianceThe open skills CLI detects your agents (Claude Code, Cursor, Codex and 70+ more) and installs to the right folder. Add -g to install globally.
01
Install it
Run the command above, or upload the folder in Claude.
02
Ask naturally
Describe the task. Your agent loads azure-compliance when the request matches its description.
03
Name it if needed
If it does not trigger, say “use the azure-compliance skill”. In Codex, type $azure-compliance.
Azure Compliance & Security Auditing
Quick Reference
| Property | Details |
|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
Prerequisites
- Authentication: user is logged in to Azure via
az login - Permissions to read resource configuration and Key Vault metadata
Assessments
| Assessment | Reference |
|---|---|
| Comprehensive Compliance (azqr) | references/azure-quick-review.md |
| Key Vault Expiration | references/azure-keyvault-expiration-audit.md |
| Resource Graph Queries | references/azure-resource-graph.md |
MCP Tools
| Tool | Purpose |
|---|---|
mcp_azure_mcp_extension_azqr |
Run azqr compliance scans |
mcp_azure_mcp_subscription_list |
List available subscriptions |
mcp_azure_mcp_group_list |
List resource groups |
keyvault_key_list |
List all keys in vault |
keyvault_key_get |
Get key details including expiration |
keyvault_secret_list |
List all secrets in vault |
keyvault_secret_get |
Get secret details including expiration |
keyvault_certificate_list |
List all certificates in vault |
keyvault_certificate_get |
Get certificate details including expiration |
Assessment Workflow
- Select scope (subscription or resource group) for Comprehensive Resources Assessment.
- Run azqr and capture output artifacts.
- Analyze Scan Results and summarize findings and recommendations.
- Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
- Classify issues and propose remediation or fix steps for each finding.
Priority Classification
| Priority | Guidance |
|---|---|
| Critical | Immediate remediation required for high-impact exposure |
| High | Resolve within days to reduce risk |
| Medium | Plan a resolution in the next sprint |
| Low | Track and fix during regular maintenance |
Error Handling
| Error | Message | Remediation |
|---|---|---|
| Authentication required | "Please login" | Run az login and retry |
| Access denied | "Forbidden" | Confirm permissions and fix role assignments |
| Missing resource | "Not found" | Verify subscription and resource group selection |
Best Practices
- Run compliance scans on a regular schedule (weekly or monthly)
- Track findings over time and verify remediation effectiveness
- Separate compliance reporting from remediation execution
- Keep Key Vault expiration policies documented and enforced
SDK Quick References
For programmatic Key Vault access, see the condensed SDK guides:
- Key Vault (Python): Secrets/Keys/Certs
- Secrets: TypeScript | Rust | Java
- Keys: .NET | Java | TypeScript | Rust
- Certificates: Rust
Tips for Azure Compliance
- • Start a fresh session after installing so your agent picks up the new skill.
- • It bundles reference files. The agent reads them only when needed, so they cost no context until then.
- • It is part of a pack with 30 skills. Install only the ones you need with --skill to keep triggers precise.
- • If two skills overlap, mention the one you want by name.
Questions about Azure Compliance
What does the Azure Compliance skill do?
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
How do I install Azure Compliance?
Run "npx skills add microsoft/azure-skills --skill azure-compliance" in your project. The skills CLI installs it for Claude Code, Cursor, Codex and 70+ other agents. In Claude on the web, upload the skill folder as a ZIP under Customize > Skills.
Does Azure Compliance work in Cursor and Codex?
Yes. Azure Compliance uses the open SKILL.md format, so it works in Claude Code, Claude, Cursor, OpenAI Codex, Gemini CLI, GitHub Copilot and other agents that support agent skills.
Is Azure Compliance free?
Azure Compliance is open source on GitHub under the MIT license. It is free to install; check the license before commercial use.
Who made Azure Compliance?
Azure Compliance is published by Microsoft in the microsoft/azure-skills repository, together with 29 other skills.
