Agent Skills
› microsoft/azure-skills
› azure-compliance
azure-compliance
GitHub用于执行 Azure 合规性扫描、安全审计及密钥保管库过期检查。支持使用 azqr 评估资源最佳实践，监控 Key Vault 中密钥、秘密和证书的到期情况，并生成修复建议。
Trigger Scenarios
运行合规性扫描
执行安全审计
检查 Key Vault 证书/密钥过期
Install
npx skills add microsoft/azure-skills --skill azure-compliance -g -y
SKILL.md
Frontmatter
{
"name": "azure-compliance",
"license": "MIT",
"metadata": {
"author": "Microsoft",
"version": "1.2.2"
},
"description": "Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy\/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment."
}
Azure Compliance & Security Auditing
Quick Reference
| Property | Details |
|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
Prerequisites
- Authentication: user is logged in to Azure via
az login - Permissions to read resource configuration and Key Vault metadata
Assessments
| Assessment | Reference |
|---|---|
| Comprehensive Compliance (azqr) | references/azure-quick-review.md |
| Key Vault Expiration | references/azure-keyvault-expiration-audit.md |
| Resource Graph Queries | references/azure-resource-graph.md |
MCP Tools
| Tool | Purpose |
|---|---|
mcp_azure_mcp_extension_azqr |
Run azqr compliance scans |
mcp_azure_mcp_subscription_list |
List available subscriptions |
mcp_azure_mcp_group_list |
List resource groups |
keyvault_key_list |
List all keys in vault |
keyvault_key_get |
Get key details including expiration |
keyvault_secret_list |
List all secrets in vault |
keyvault_secret_get |
Get secret details including expiration |
keyvault_certificate_list |
List all certificates in vault |
keyvault_certificate_get |
Get certificate details including expiration |
Assessment Workflow
- Select scope (subscription or resource group) for Comprehensive Resources Assessment.
- Run azqr and capture output artifacts.
- Analyze Scan Results and summarize findings and recommendations.
- Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
- Classify issues and propose remediation or fix steps for each finding.
Priority Classification
| Priority | Guidance |
|---|---|
| Critical | Immediate remediation required for high-impact exposure |
| High | Resolve within days to reduce risk |
| Medium | Plan a resolution in the next sprint |
| Low | Track and fix during regular maintenance |
Error Handling
| Error | Message | Remediation |
|---|---|---|
| Authentication required | "Please login" | Run az login and retry |
| Access denied | "Forbidden" | Confirm permissions and fix role assignments |
| Missing resource | "Not found" | Verify subscription and resource group selection |
Best Practices
- Run compliance scans on a regular schedule (weekly or monthly)
- Track findings over time and verify remediation effectiveness
- Separate compliance reporting from remediation execution
- Keep Key Vault expiration policies documented and enforced
SDK Quick References
For programmatic Key Vault access, see the condensed SDK guides:
- Key Vault (Python): Secrets/Keys/Certs
- Secrets: TypeScript | Rust | Java
- Keys: .NET | Java | TypeScript | Rust
- Certificates: Rust
Version History
-
5b4f0c0
Current 2026-09-22 16:54
同步 GitHub-Copilot-for-Azure 插件文件（#222）
-
ea76537
2026-08-20 03:57
同步GitHub-Copilot-for-Azure插件文件，更新技能定义与工具引用。
- 013b97d 2026-07-25 09:45
