1---
2name: azure-compliance
3description: "Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment."
4license: MIT
5metadata:
6  author: Microsoft
7  version: "1.1.1"
8---
9 
10# Azure Compliance & Security Auditing
11 
12## Quick Reference
13 
14| Property | Details |
15|---|---|
16| Best for | Compliance scans, security audits, Key Vault expiration checks |
17| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
18| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
19 
20## When to Use This Skill
21 
22- Run azqr or Azure Quick Review for compliance assessment
23- Validate Azure resource configuration against best practices
24- Identify orphaned or misconfigured resources
25- Audit Key Vault keys, secrets, and certificates for expiration
26 
27## Skill Activation Triggers
28 
29Activate this skill when user wants to:
30- Check Azure compliance or best practices
31- Assess Azure resources for configuration issues
32- Run azqr or Azure Quick Review
33- Identify orphaned or misconfigured resources
34- Review Azure security posture
35- "Show me expired certificates/keys/secrets in my Key Vault"
36- "Check what's expiring in the next 30 days"
37- "Audit my Key Vault for compliance"
38- "Find secrets without expiration dates"
39- "Check certificate expiration dates"
40 
41## Prerequisites
42 
43- Authentication: user is logged in to Azure via `az login`
44- Permissions to read resource configuration and Key Vault metadata
45 
46## Assessments
47 
48| Assessment | Reference |
49|------------|-----------|
50| Comprehensive Compliance (azqr) | [references/azure-quick-review.md](references/azure-quick-review.md) |
51| Key Vault Expiration | [references/azure-keyvault-expiration-audit.md](references/azure-keyvault-expiration-audit.md) |
52| Resource Graph Queries | [references/azure-resource-graph.md](references/azure-resource-graph.md) |
53 
54## MCP Tools
55 
56| Tool | Purpose |
57|------|---------|
58| `mcp_azure_mcp_extension_azqr` | Run azqr compliance scans |
59| `mcp_azure_mcp_subscription_list` | List available subscriptions |
60| `mcp_azure_mcp_group_list` | List resource groups |
61| `keyvault_key_list` | List all keys in vault |
62| `keyvault_key_get` | Get key details including expiration |
63| `keyvault_secret_list` | List all secrets in vault |
64| `keyvault_secret_get` | Get secret details including expiration |
65| `keyvault_certificate_list` | List all certificates in vault |
66| `keyvault_certificate_get` | Get certificate details including expiration |
67 
68## Assessment Workflow
69 
701. Select scope (subscription or resource group) for Comprehensive Resources Assessment.
712. Run azqr and capture output artifacts.
723. Analyze Scan Results and summarize findings and recommendations.
734. Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
745. Classify issues and propose remediation or fix steps for each finding.
75 
76### Priority Classification
77 
78| Priority | Guidance |
79|---|---|
80| Critical | Immediate remediation required for high-impact exposure |
81| High | Resolve within days to reduce risk |
82| Medium | Plan a resolution in the next sprint |
83| Low | Track and fix during regular maintenance |
84 
85## Error Handling
86 
87| Error | Message | Remediation |
88|---|---|---|
89| Authentication required | "Please login" | Run `az login` and retry |
90| Access denied | "Forbidden" | Confirm permissions and fix role assignments |
91| Missing resource | "Not found" | Verify subscription and resource group selection |
92 
93## Best Practices
94 
95- Run compliance scans on a regular schedule (weekly or monthly)
96- Track findings over time and verify remediation effectiveness
97- Separate compliance reporting from remediation execution
98- Keep Key Vault expiration policies documented and enforced
99 
100## SDK Quick References
101 
102For programmatic Key Vault access, see the condensed SDK guides:
103 
104- **Key Vault (Python)**: [Secrets/Keys/Certs](references/sdk/azure-keyvault-py.md)
105- **Secrets**: [TypeScript](references/sdk/azure-keyvault-secrets-ts.md) | [Rust](references/sdk/azure-keyvault-secrets-rust.md) | [Java](references/sdk/azure-security-keyvault-secrets-java.md)
106- **Keys**: [.NET](references/sdk/azure-security-keyvault-keys-dotnet.md) | [Java](references/sdk/azure-security-keyvault-keys-java.md) | [TypeScript](references/sdk/azure-keyvault-keys-ts.md) | [Rust](references/sdk/azure-keyvault-keys-rust.md)
107- **Certificates**: [Rust](references/sdk/azure-keyvault-certificates-rust.md)
108 
109