Azure compliance skill: azqr scans and Key Vault expiration audits with a coding agent

Source: microsoft/azure-skills · Maintainer: Microsoft · License: MIT · Checked: 26 October 2026

What is the Azure compliance skill?

The Azure compliance skill turns a coding agent into an Azure auditor. It runs Azure Quick Review (azqr) against a subscription or resource group, checks Key Vault keys, secrets and certificates for expiration, and returns a prioritized list of findings with suggested fixes. It is for developers and platform teams who want a quick best-practice and security review without leaving the terminal.

Its description reads: "Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks."

It ships in microsoft/azure-skills, the Azure Skills Plugin, where the README lists it under "Troubleshoot, monitor, and govern" next to azure-diagnostics and appinsights-instrumentation. The SKILL.md frontmatter lists version 1.2.3 and author Microsoft.

As of 26 October 2026, its skills.sh page listed about 566,100 installs (snapshot, 26 October 2026).

What does it do?

The SKILL.md sets a five-step workflow: pick a scope, run azqr and capture its output, summarize the findings, review Key Vault expiration, then classify each issue and propose a fix.

1. azqr scans. Azure Quick Review is a CLI that, in its docs' words, is "specifically designed to analyze Azure resources and identify whether they comply with Azure's best practices and recommendations." The skill runs it through the Azure MCP tool mcp_azure_mcp_extension_azqr. Its reference file supports four scopes: subscription, resource group, management group or a single service type.

The reference says the scan produces an Excel file and tells the agent which sheets to read first:

The azqr README describes the output a little differently: the DefenderRecommendations, Azure Policy and Costs sheets are off by default and turned on with --stages, and Costs holds data for the last calendar month.

Findings get grouped into security, reliability, performance, cost and operations, and the agent ends with a summary table of counts by severity and a short action list.

2. Key Vault expiration audit. A second reference walks through listing and reading every key, secret and certificate in a vault with six Key Vault MCP tools. It flags four things: already expired items, items expiring soon (default threshold 30 days), items with no expiration date set, and disabled items. Its priority scale runs from Critical (expired, rotate now) through High (expires in 0 to 7 days) to Low (more than 30 days left).

3. Resource Graph queries. A third reference gives ready KQL for az graph query: resources missing required tags, tag coverage by type, storage accounts without HTTPS enforcement, resources with public network access, role assignments by principal type, and resource groups without locks. It notes the resource-graph CLI extension is a prerequisite. See Microsoft's Resource Graph overview for the query language.

Fix templates. azqr-remediation-patterns.md has CLI and Bicep snippets for common findings: private endpoints and soft delete for storage, purge protection and RBAC for Key Vault, diagnostics and backup for VMs, Defender and managed identity for AKS, auditing and private endpoints for SQL, and managed identity, HTTPS-only and minimum TLS for App Service.

The skill's own priority guide is short: Critical needs immediate remediation, High within days, Medium in the next sprint, Low during regular maintenance.

How do you install the Azure compliance skill?

Install the full plugin if you can. The skill's scans run through Azure MCP tools, and the plugin is what wires in the Azure MCP Server.

Claude Code: the Azure Skills Plugin. Run inside Claude Code:

/plugin install azure@claude-plugins-official

Or run /plugin and search for "azure". See Claude Code plugins and Claude Code MCP.

GitHub Copilot CLI:

/plugin marketplace add microsoft/azure-skills
/plugin install azure@azure-skills

Codex and Cursor. The README says to run codex plugin marketplace add microsoft/azure-skills, then install azure from /plugins; for Cursor, use the Cursor Marketplace or Settings, then Plugins. See Codex skills and Cursor skills.

Skill only. The command on skills.sh:

npx skills add https://github.com/microsoft/azure-skills --skill azure-compliance

Prerequisites: an Azure subscription, Node.js 18 or later for npx (the README's requirement for starting the MCP servers), and the Azure CLI signed in with az login. The SKILL.md adds "Permissions to read resource configuration and Key Vault metadata," and the azqr reference asks for at least the Reader role on the scope you scan.

How do you use it?

Name the scope and what you care about. The skill is model-invoked, and its trigger list includes "compliance scan", "security audit", "expired certificates", "expiring secrets" and "orphaned resources".

Example prompts (suggestions; the first two are from the skill's azqr reference):

• Check my Azure subscription for compliance issues
• Run azqr on my production resource group
• Audit the kv-payments-prod Key Vault for secrets and certificates expiring in the next 45 days.
• Find every resource in this subscription missing an Environment or CostCenter tag.
• Summarize the critical and high findings from the last scan and draft fixes in Bicep.

Expect it to confirm the scope first, then return a summary table and a ranked action list. On a big subscription, the troubleshooting table suggests narrowing to a resource group if the scan runs long.

Tips and limits

From the repo and skills.sh, not from testing:

• Reporting and fixing are separate. The skill proposes fixes but lists "Separate compliance reporting from remediation execution" as a best practice. Remediation snippets such as disabling public network access can break apps that rely on it, so test them outside production first.
• Read access goes a long way. Reader on a subscription lets the agent see your whole inventory, including SKUs, and an azqr report can include cost data. Scope the role to what you want audited.
• Some advice is the skill's own. Rotation guidance such as "Secrets every 60-90 days, Keys annually" comes from the reference file, not from a cited Microsoft policy. Match it to your organization's rules.
• Results depend on azqr. Coverage of resource types and recommendations comes from azqr itself; the reference says it supports more than 70 resource types. Check the azqr docs for what a scan includes.
• Security audits. On skills.sh, Gen Agent Trust Hub (Safe), Socket and Snyk all rated it Pass on 3 October 2026.

The MIT License lets you copy and change the skill as long as you keep Microsoft's copyright and license notices.

Save it in your Kipt library

A private copy is handy for adding your own rules: required tags, the expiry threshold your security team uses, or which subscriptions count as production. In Kipt, open Skills and paste the skill's GitHub folder link into the import box, or drop the folder or a .zip. The copy holds the skill files, not the plugin's MCP configuration. Skills in your private GitHub repo install into Claude Code or Codex with one command:

npx skills add https://github.com/<you>/<repo>.git --all -g

Kipt is not affiliated with Microsoft.

Similar skills

• Azure diagnostics skill: troubleshoots live Azure issues once something breaks.
• Azure storage skill: the storage reference behind several of azqr's most common findings.
• Entra app registration skill: sets up app identities, client secrets and certificates, the kind of credentials the Key Vault audit tracks.
• Security hardening skill: application-level security practices, a complement to cloud posture checks.
• Semgrep skill: static analysis for the code side of a security review.