Skip to content
skillsafebeta
← Report library
Purpose / Other

Azure Compliance Skill Security Audit

What the author says it does (original text)

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance ass

Independent security check

Do not install or run it yet

Files checked
16
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
High risk

Expiration fallback can expose secret values to the agent and logs

Source references: 6
What we found

The audit only needs metadata such as expiresOn and enabled, but the fallback tells the agent to run `az keyvault secret show` for each secret. That command may return the secret value, and no field projection or value redaction is required. Per-item `keyvault_secret_get` creates the same risk if that tool returns secret contents.

Why this matters

Secret values could enter model context, terminal output, audit records, or session logs, widening credential exposure and potentially affecting the services or accounts that use them.

The audit needs expiration and status metadata, but the fallback specifies `az keyvault secret show` without an output query. If an agent runs it and captures the full response, the secret value could enter chat, terminal history, or logs even though it is unnecessary for this audit. The evidence does not establish whether the MCP `secret_get` returns values. Users can require metadata-only queries and prohibit reading or displaying secret contents.

references/azure-keyvault-expiration-audit.md:15In the instructionsOpen original file
1. **List Resources**: Enumerate keys, secrets, and certificates in target vault(s)2. **Get Details**: Retrieve expiration metadata for each resource3. **Analyze Status**: Compare expiration dates against current date and threshold4. **Generate Report**: Organize findings by priority with actionable recommendations
Show 5 other places
references/azure-keyvault-expiration-audit.md:42In the instructionsOpen original file
## Key Data FieldsWhen retrieving resource details, analyze these fields:- **expiresOn**: Expiration timestamp (null = no expiration set - security risk!)- **enabled**: Resource is active (false = disabled/inactive)- **notBefore**: When resource becomes valid- **createdOn/updatedOn**: For tracking resource age and last rotation- **subject/issuer**: Certificate-specific metadata
references/azure-keyvault-expiration-audit.md:93In the instructionsOpen original file
If Azure MCP Key Vault tools fail, timeout, or are unavailable, use Azure CLI commands as fallback.### CLI Command Reference| Operation | Azure CLI Command ||-----------|-------------------|| List secrets | `az keyvault secret list --vault-name <vault-name>` || Get secret details | `az keyvault secret show --vault-name <vault-name> --name <secret-name>` || List keys | `az keyvault key list --vault-name <vault-name>` || Get key details | `az keyvault key show --vault-name <vault-name> --name <key-name>` || List certificates | `az keyvault certificate list --vault-name <vault-name>` || Get certificate details | `az keyvault certificate show --vault-name <vault-name> --name <cert-name>` |
references/azure-keyvault-expiration-audit.md:108In the instructionsOpen original file
Switch to Azure CLI when:- MCP tool returns timeout error- MCP tool returns "service unavailable" or connection errors- MCP tool takes longer than 30 seconds to respond- Empty response when vault is known to have resources
references/azure-keyvault-expiration-audit.md:44In the instructionsOpen original file
When retrieving resource details, analyze these fields:- **expiresOn**: Expiration timestamp (null = no expiration set - security risk!)- **enabled**: Resource is active (false = disabled/inactive)- **notBefore**: When resource becomes valid- **createdOn/updatedOn**: For tracking resource age and last rotation- **subject/issuer**: Certificate-specific metadata
references/azure-keyvault-expiration-audit.md:91In the instructionsOpen original file
## Fallback Strategy: Azure CLI CommandsIf Azure MCP Key Vault tools fail, timeout, or are unavailable, use Azure CLI commands as fallback.### CLI Command Reference| Operation | Azure CLI Command ||-----------|-------------------|| List secrets | `az keyvault secret list --vault-name <vault-name>` || Get secret details | `az keyvault secret show --vault-name <vault-name> --name <secret-name>` || List keys | `az keyvault key list --vault-name <vault-name>` |
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

The Key Vault RBAC remediation template can interrupt existing data-plane access

Source references: 2
What we found

The template directly enables RBAC authorization without first inventorying access policies, assigning equivalent roles to dependents, testing access, or preparing rollback. This changes the vault's access-control mode rather than merely reporting a finding.

Why this matters

Applications, automation, or administrators relying on legacy access policies may immediately lose access to keys, secrets, and certificates, causing authentication failures or service outages.

This is a state-changing remediation template, not an automatic audit step. However, if a user or agent executes it, `--enable-rbac-authorization true` changes the vault's data-plane authorization mode. The shown template contains no inventory of existing access policies, equivalent role assignments, access test, or rollback procedure, so applications relying on the old policies could lose access. Users can require explicit approval plus dependency, migration, validation, and rollback checks before execution.

references/azqr-remediation-patterns.md:115In the instructionsOpen original file
### Use RBAC for Data Plane**Issue:** Using access policies instead of RBAC**Azure CLI:**```bashaz keyvault update \  --name <vault-name> \  --resource-group <rg-name> \  --enable-rbac-authorization true```
Show 1 other places
references/azure-quick-review.md:67In the instructionsOpen original file
### Step 5: Generate Remediation GuidanceFor each high-priority finding:1. Explain the risk in plain language2. Provide remediation options (Portal, CLI, Bicep)3. Estimate effort and impactSee [azqr-remediation-patterns.md](azqr-remediation-patterns.md) for common fix templates.
Medium risk

Private-endpoint templates do not show DNS or connectivity validation before disabling public access

Source references: 2
What we found

The storage and SQL templates disable public access immediately after creating a private endpoint. The shown steps do not configure private DNS, verify name resolution, or confirm client migration. A private endpoint alone does not ensure existing clients can resolve and reach the service.

Why this matters

Applications may lose access to the storage account or SQL Server and suffer an outage if private DNS or network routing is not ready.

These are remediation templates rather than automatic execution instructions, but running them changes network access. The storage template disables public access immediately after creating a private endpoint, without showing private-DNS setup, name-resolution tests, or client migration checks; the SQL template follows the same sequence. Existing clients could be interrupted if private connectivity is not ready. Users can require DNS, routing, client-connectivity, and rollback validation plus explicit approval before public access is disabled.

references/azqr-remediation-patterns.md:13In the instructionsOpen original file
```bash# Create private endpointaz network private-endpoint create \  --name pe-storage \  --resource-group <rg-name> \  --vnet-name <vnet-name> \  --subnet <subnet-name> \  --private-connection-resource-id $(az storage account show -n <storage-name> -g <rg-name> --query id -o tsv) \  --group-id blob \  --connection-name pe-storage-connection# Disable public accessaz storage account update \  --name <storage-name> \  --resource-group <rg-name> \  --public-network-access Disabled```
Show 1 other places
references/azqr-remediation-patterns.md:272In the instructionsOpen original file
```bash# Create private endpointaz network private-endpoint create \  --name pe-sql \  --resource-group <rg-name> \  --vnet-name <vnet-name> \  --subnet <subnet-name> \  --private-connection-resource-id $(az sql server show -g <rg-name> -n <server-name> --query id -o tsv) \  --group-id sqlServer \  --connection-name pe-sql-connection# Disable public accessaz sql server update \  --resource-group <rg-name> \  --name <server-name> \  --enable-public-network false```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The main workflow runs azqr against a user-selected Azure subscription or resource group, retains the generated report, and analyzes compliance, security, resource configuration, and Key Vault expiration findings.

View source
SKILL.md:70In the instructionsOpen original file
1. Select scope (subscription or resource group) for Comprehensive Resources Assessment.2. Run azqr and capture output artifacts.3. Analyze Scan Results and summarize findings and recommendations.4. Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.5. Classify issues and propose remediation or fix steps for each finding.

The azqr report can contain subscription identifiers, resource groups and names, configuration state, security findings, and three months of cost history. Even without transmission behavior, these artifacts are sensitive cloud-environment inventories and should be protected as security-audit material.

View source
references/azure-quick-review.md:39In the instructionsOpen original file
|-------|----------|----------|| **Recommendations** | All recommendations with impacted resource count | High || **ImpactedResources** | Resources with specific issues to address | High || **Inventory** | All scanned resources with SKU, Tier, SLA details | Medium || **Advisor** | Azure Advisor recommendations | Medium || **DefenderRecommendations** | Microsoft Defender for Cloud findings | High || **Azure Policy** | Non-compliant resources per Azure Policy | Medium || **Costs** | 3-month cost history by subscription | Low || **Defender** | Defender plan status and tiers | Medium || **OutOfScope** | Resources not scanned | Low |
references/azqr-recommendations.md:91In the instructionsOpen original file
|--------|-------------|| Subscription | Subscription ID (may be masked) || Resource Group | Resource group name || Type | Azure resource type || Name | Resource name || Recommendation ID | Links to Recommendations sheet || Recommendation | Issue description || Learn More | Documentation link || Param1-5 | Additional context (varies by recommendation) |

The main instructions separate audit reporting from remediation execution and call for proposing fix steps rather than automatically applying them. The Azure CLI and Bicep material in later references is therefore remediation guidance; users still need to authorize and validate execution separately.

View source
SKILL.md:74In the instructionsOpen original file
4. Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.5. Classify issues and propose remediation or fix steps for each finding.
SKILL.md:95In the instructionsOpen original file
- Run compliance scans on a regular schedule (weekly or monthly)- Track findings over time and verify remediation effectiveness- Separate compliance reporting from remediation execution- Keep Key Vault expiration policies documented and enforced
references/azure-quick-review.md:67In the instructionsOpen original file
### Step 5: Generate Remediation GuidanceFor each high-priority finding:1. Explain the risk in plain language2. Provide remediation options (Portal, CLI, Bicep)3. Estimate effort and impactSee [azqr-remediation-patterns.md](azqr-remediation-patterns.md) for common fix templates.
Start here · InstructionsSKILL.md
azure-compliance
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.

File reference map

References: 20
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records16 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/azure-keyvault-expiration-audit.mdFull text included
  • references/azure-quick-review.mdFull text included
  • references/azure-resource-graph.mdFull text included
  • references/sdk/azure-keyvault-certificates-rust.mdFull text included
  • references/sdk/azure-keyvault-keys-rust.mdFull text included
  • references/sdk/azure-keyvault-keys-ts.mdFull text included
  • references/sdk/azure-keyvault-py.mdFull text included
  • references/sdk/azure-keyvault-secrets-rust.mdFull text included
  • references/sdk/azure-keyvault-secrets-ts.mdFull text included
  • references/sdk/azure-security-keyvault-keys-dotnet.mdFull text included
  • references/sdk/azure-security-keyvault-keys-java.mdFull text included
  • references/sdk/azure-security-keyvault-secrets-java.mdFull text included
  • references/auth-best-practices.mdFull text included
  • references/azqr-recommendations.mdFull text included
  • references/azqr-remediation-patterns.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/auth-best-practices.mdSupporting file
  • references/azqr-recommendations.mdSupporting file
  • references/azqr-remediation-patterns.mdSupporting file
  • references/azure-keyvault-expiration-audit.mdSupporting file
  • references/azure-quick-review.mdSupporting file
  • references/azure-resource-graph.mdSupporting file
  • references/sdk/azure-keyvault-certificates-rust.mdSupporting file
  • references/sdk/azure-keyvault-keys-rust.mdSupporting file
  • references/sdk/azure-keyvault-keys-ts.mdSupporting file
  • references/sdk/azure-keyvault-py.mdSupporting file
  • references/sdk/azure-keyvault-secrets-rust.mdSupporting file
  • references/sdk/azure-keyvault-secrets-ts.mdSupporting file
  • references/sdk/azure-security-keyvault-keys-dotnet.mdSupporting file
  • references/sdk/azure-security-keyvault-keys-java.mdSupporting file
  • references/sdk/azure-security-keyvault-secrets-java.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
references/auth-best-practices.md:3In the instructionsOpen original file
> Source: [Microsoft — Passwordless connections for Azure services](https://learn.microsoft.com/azure/developer/intro/passwordless-overview) and [Azure Identity client libraries](https://learn.microsoft.com/dotnet/azure/sdk/authentication/).
references/auth-best-practices.md:122In the instructionsOpen original file
- [Passwordless connections overview](https://learn.microsoft.com/azure/developer/intro/passwordless-overview)- [Managed identities overview](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview)
references/auth-best-practices.md:123In the instructionsOpen original file
- [Passwordless connections overview](https://learn.microsoft.com/azure/developer/intro/passwordless-overview)- [Managed identities overview](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/overview)- [Azure RBAC overview](https://learn.microsoft.com/azure/role-based-access-control/overview)
Run commands
references/auth-best-practices.md:16In the instructionsOpen original file
| **CI/CD pipelines** | `AzurePipelinesCredential` / `WorkloadIdentityCredential` | Scoped to pipeline identity || **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials for convenience |
references/auth-best-practices.md:81In the instructionsOpen original file
2. **Azure Developer CLI** — `azd auth login`3. **Azure PowerShell** — `Connect-AzAccount`4. **Visual Studio / VS Code** — sign in via Azure extension
references/auth-best-practices.md:87In the instructionsOpen original file
// Local development only — uses CLI/PowerShell/VS Code credentialsconst credential = new DefaultAzureCredential();
Read keys or account settings
references/auth-best-practices.md:16In the instructionsOpen original file
| **CI/CD pipelines** | `AzurePipelinesCredential` / `WorkloadIdentityCredential` | Scoped to pipeline identity || **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials for convenience |
references/auth-best-practices.md:32In the instructionsOpen original file
var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials
references/auth-best-practices.md:33In the instructionsOpen original file
var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials    : new ManagedIdentityCredential();                      // production — deterministic, no fallback chain
Install extra software packages
references/sdk/azure-keyvault-keys-ts.md:8In the instructionsOpen original file
## Installnpm install @azure/keyvault-keys @azure/identity
references/sdk/azure-keyvault-py.md:8In the instructionsOpen original file
## Installpip install azure-keyvault-secrets azure-keyvault-keys azure-keyvault-certificates azure-identity
references/sdk/azure-keyvault-secrets-ts.md:8In the instructionsOpen original file
## Installnpm install @azure/keyvault-secrets @azure/identity
Lines read
1,438
File checksum (to compare versions)
89ae102e995f046e10934aa5243233381f0ffcc86aa1cbbdac17574a654c995d