# Audit Azure Compliance and Key Vault Expiration

Azure teams need a consistent way to identify compliance gaps and expiring Key Vault assets. This skill runs scoped assessments and produces prioritized remediation guidance.

## Install

```bash
npx skillstore add microsoft/azure-compliance
```

## Metadata

- Status: approved
- Slug: microsoft-azure-compliance
- Version: 0.0.0-placeholder
- Author version: 0.0.0-placeholder
- Skillstore revision: r2
- Version status: valid
- Tree hash: 704797c5a3331e49acde623b73aa95dc9861d79f861d6e89a52c4712a2735233
- Author: microsoft
- GitHub username: microsoft
- License: MIT
- Repository: https://github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/azure-compliance/
- Ref: ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, env\_access, network, filesystem
- Quality score: 79
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/microsoft-azure-compliance
- Manifest: https://skillstore.pages.dev/api/skills/microsoft-azure-compliance/manifest

## Capabilities

- Runs azqr compliance assessments at subscription or resource group scope.
- Reviews scan results for security, reliability, policy, cost, and operational findings.
- Audits Key Vault keys, secrets, and certificates for expired, expiring, disabled, or undated items.
- Uses Azure Resource Graph queries to identify configuration and governance gaps.
- Produces prioritized remediation guidance with Azure CLI and Bicep patterns.

## Use Cases

- Subscription compliance review: Scan a selected subscription and prioritize security, reliability, policy, cost, and operational findings.
- Key Vault expiration planning: Find expired, expiring, disabled, or undated keys, secrets, and certificates before they disrupt services.
- Remediation preparation: Translate azqr findings into reviewed Azure CLI or Bicep actions for an approved change window.

## Prompt Templates

### Quick compliance scan

```
Audit subscription <subscription-id> with azqr. Summarize critical and high findings, affected resources, and recommended next steps.
```

### Key Vault expiration review

```
Audit Key Vault <vault-name> for expired items, items expiring within <days> days, disabled items, and missing expiration dates.
```

### Resource group security assessment

```
Assess resource group <resource-group> in subscription <subscription-id>. Correlate azqr and Resource Graph findings, then rank remediation by risk and effort.
```

### Enterprise remediation backlog

```
Assess management group <management-group-id>. Correlate policy, Defender, reliability, and orphaned-resource findings into a prioritized backlog without executing changes.
```

## Limitations

- Requires existing Azure authentication and sufficient read permissions for selected resources.
- Results depend on azqr, Azure MCP, Azure CLI, and service availability.
- It reviews metadata and configuration, not application controls or external compliance evidence.
- Remediation examples can change Azure resources and require independent review before execution.

## Best Practices

- Confirm scope and read permissions before starting any assessment.
- Use Reader access and least-privilege data-plane permissions for Key Vault metadata.
- Review every remediation command and test changes in a nonproduction scope before execution.

## Anti Patterns

- Do not scan every subscription when the user requested one resource group.
- Do not expose secret values, tokens, or complete sensitive inventories in reports.
- Do not execute remediation commands automatically or treat every recommendation as equally urgent.

## Security Audit

- Audited at: 2026-07-23T18:00:46.667\+00:00
- Summary: The skill is documentation-driven and contains no executable scripts. All 76 alerts are benign Markdown, SDK, authentication, Azure endpoint, or scoped remediation examples. No prompt injection, credential exfiltration, covert execution, or malicious intent was found.

## Stats

- Views: 145
- Downloads: 13
- Favorites: 0
- Popularity score: 0