# Azure Compliance

> Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

Source: https://skillsagentes.com/skills/microsoft/azure-skills/azure-compliance
Repository: https://github.com/microsoft/azure-skills
Author: microsoft
License: MIT
Updated: hace 17 días
Context cost: 102 tok installed, 1.2k tok once triggered, 12.1k tok with every bundled file
Bundle: 16 files, 47 KB
Permissions requested: none declared

## Install

```bash
npx -y skills add microsoft/azure-skills --skill azure-compliance --agent claude-code
```

## What it does

- Ejecuta auditorías de cumplimiento y seguridad en Azure con azqr (Azure Quick Review) más comprobaciones de caducidad en Key Vault.
- Cubre evaluación contra buenas prácticas, revisión de recursos, validación de políticas y postura de seguridad.
- Audita claves, secretos y certificados de Key Vault buscando lo caducado, lo que caduca pronto y lo que no tiene fecha de caducidad.
- Identifica recursos huérfanos o mal configurados.

## Use it when

- Se quiere un escaneo de cumplimiento o una auditoría de seguridad.
- Antes de ejecutar azqr.
- Se quiere revisar caducidades de Key Vault o encontrar recursos huérfanos.

## What triggers it

- "haz una auditoría de seguridad"
- "¿qué certificados caducan este mes?"
- "corre azqr en mi suscripción"
- "busca recursos huérfanos"

## Before you install

- Requiere estar autenticado con `az login` y permisos de lectura sobre la configuración de recursos y los metadatos de Key Vault.

## Files

- SKILL.md — 5 KB
- references/auth-best-practices.md — 6 KB
- references/azqr-recommendations.md — 6 KB
- references/azqr-remediation-patterns.md — 8 KB
- references/azure-keyvault-expiration-audit.md — 5 KB
- references/azure-quick-review.md — 5 KB
- references/azure-resource-graph.md — 3 KB
- references/sdk/azure-keyvault-certificates-rust.md — 1013 B
- references/sdk/azure-keyvault-keys-rust.md — 1 KB
- references/sdk/azure-keyvault-keys-ts.md — 1019 B
- references/sdk/azure-keyvault-py.md — 1 KB
- references/sdk/azure-keyvault-secrets-rust.md — 1 KB
- references/sdk/azure-keyvault-secrets-ts.md — 1 KB
- references/sdk/azure-security-keyvault-keys-dotnet.md — 1 KB
- references/sdk/azure-security-keyvault-keys-java.md — 1 KB
- references/sdk/azure-security-keyvault-secrets-java.md — 1 KB

## SKILL.md

Reproduced verbatim from microsoft/azure-skills under MIT. This section is the upstream document and is in English.

# Azure Compliance & Security Auditing

## Quick Reference

| Property | Details |
|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |

## When to Use This Skill

- Run azqr or Azure Quick Review for compliance assessment
- Validate Azure resource configuration against best practices
- Identify orphaned or misconfigured resources
- Audit Key Vault keys, secrets, and certificates for expiration

## Skill Activation Triggers

Activate this skill when user wants to:
- Check Azure compliance or best practices
- Assess Azure resources for configuration issues
- Run azqr or Azure Quick Review
- Identify orphaned or misconfigured resources
- Review Azure security posture
- "Show me expired certificates/keys/secrets in my Key Vault"
- "Check what's expiring in the next 30 days"
- "Audit my Key Vault for compliance"
- "Find secrets without expiration dates"
- "Check certificate expiration dates"

## Prerequisites

- Authentication: user is logged in to Azure via `az login`
- Permissions to read resource configuration and Key Vault metadata

## Assessments

| Assessment | Reference |
|------------|-----------|
| Comprehensive Compliance (azqr) | [references/azure-quick-review.md](references/azure-quick-review.md) |
| Key Vault Expiration | [references/azure-keyvault-expiration-audit.md](references/azure-keyvault-expiration-audit.md) |
| Resource Graph Queries | [references/azure-resource-graph.md](references/azure-resource-graph.md) |

## MCP Tools

| Tool | Purpose |
|------|---------|
| `mcp_azure_mcp_extension_azqr` | Run azqr compliance scans |
| `mcp_azure_mcp_subscription_list` | List available subscriptions |
| `mcp_azure_mcp_group_list` | List resource groups |
| `keyvault_key_list` | List all keys in vault |
| `keyvault_key_get` | Get key details including expiration |
| `keyvault_secret_list` | List all secrets in vault |
| `keyvault_secret_get` | Get secret details including expiration |
| `keyvault_certificate_list` | List all certificates in vault |
| `keyvault_certificate_get` | Get certificate details including expiration |

## Assessment Workflow

1. Select scope (subscription or resource group) for Comprehensive Resources Assessment.
2. Run azqr and capture output artifacts.
3. Analyze Scan Results and summarize findings and recommendations.
4. Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
5. Classify issues and propose remediation or fix steps for each finding.

### Priority Classification

| Priority | Guidance |
|---|---|
| Critical | Immediate remediation required for high-impact exposure |
| High | Resolve within days to reduce risk |
| Medium | Plan a resolution in the next sprint |
| Low | Track and fix during regular maintenance |

## Error Handling

| Error | Message | Remediation |
|---|---|---|
| Authentication required | "Please login" | Run `az login` and retry |
| Access denied | "Forbidden" | Confirm permissions and fix role assignments |
| Missing resource | "Not found" | Verify subscription and resource group selection |

## Best Practices

- Run compliance scans on a regular schedule (weekly or monthly)
- Track findings over time and verify remediation effectiveness
- Separate compliance reporting from remediation execution
- Keep Key Vault expiration policies documented and enforced

## SDK Quick References

For programmatic Key Vault access, see the condensed SDK guides:

- **Key Vault (Python)**: [Secrets/Keys/Certs](references/sdk/azure-keyvault-py.md)
- **Secrets**: [TypeScript](references/sdk/azure-keyvault-secrets-ts.md) | [Rust](references/sdk/azure-keyvault-secrets-rust.md) | [Java](references/sdk/azure-security-keyvault-secrets-java.md)
- **Keys**: [.NET](references/sdk/azure-security-keyvault-keys-dotnet.md) | [Java](references/sdk/azure-security-keyvault-keys-java.md) | [TypeScript](references/sdk/azure-keyvault-keys-ts.md) | [Rust](references/sdk/azure-keyvault-keys-rust.md)
- **Certificates**: [Rust](references/sdk/azure-keyvault-certificates-rust.md)

---

Skills Agentes — https://skillsagentes.com/skills/microsoft/azure-skills/azure-compliance