azure-compliance Skill for Claude: Azure Security and Compliance Audits

Makes Claude run Azure compliance and security audits with azqr and check Key Vault items for expiry.

Installs: 573K; on skills.sh
Stars: 1.6K; on GitHub
Files: 15; besides SKILL.md
Updated: Oct 2026; last repo commit

azure-compliance makes Claude scan an Azure subscription or resource group with azqr and summarize what it finds. It also checks Key Vault keys, secrets and certificates for expiry. Findings are ranked Critical, High, Medium or Low, with a fix for each.

You need to be signed in with az login and have permission to read resource configuration and Key Vault metadata. The skill keeps scanning separate from fixing, so reporting comes first and changes are your call.

Good for

Cloud and security engineers who need a quick Azure posture review
Teams chasing expiring Key Vault secrets, keys and certificates
Ops leads who want findings sorted by priority

Install azure-compliance

Claude Code

Copy this prompt.

Install the azure-compliance skill in Claude Code. Run this command:

/plugin install azure@claude-plugins-official

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Azure CLI signed in.

Pick one route, not both. The plugin installs all the Azure skills and wires in the Azure and Foundry tool servers they call. The skills CLI route installs only the skills named in the command, and does not wire in the Azure or Foundry tool servers, so enable the Azure MCP server separately if you want the tools the skills call. Sign in with az login first.

From the project README. Source.

What's in the skill

When it loads

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

Sections in SKILL.md

Quick Reference
Prerequisites
Assessments
MCP Tools
Assessment Workflow
Priority Classification
Error Handling
Best Practices
SDK Quick References

Key facts

Author: Microsoft
License: MIT (stated in SKILL.md)
GitHub stars: 1,609 for the whole microsoft/azure-skills repo (Nov 2, 2026)
Last commit: Oct 30, 2026
What installs: SKILL.md plus 15 bundled files (guides and examples); no scripts in the file list
Needs: az login; read access to resource config and Key Vault metadata; the azqr tool via Azure MCP
Part of: The azure plugin in microsoft/azure-skills
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk pass
Works in: GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, OpenCode (plugin README)

What it includes

Scans a subscription or resource group with azqr
Claude picks a scope, runs azqr, keeps the output files, and summarizes findings and recommendations.
Runs code · Comprehensive compliance (azqr)
Lists keys, secrets and certificates and when each expires
Uses the keyvault list and get tools to flag expired and expiring items.
Network · Key Vault expiration audit
Cross-subscription queries for orphaned resources and more
A reference file of Azure Resource Graph patterns.
Read · Resource Graph queries
Sorts findings into Critical, High, Medium and Low
Critical needs immediate fixing, High within days, Medium next sprint, Low in regular maintenance.
Priority classification
Key Vault notes for Python, TypeScript, Java, .NET and Rust
Short guides for secrets, keys and certificates in code.
Read · SDK quick references

From the official docs

Permissions

Medium risk

Claude scans resources and can call Key Vault tools for keys, secrets and certificates. Start with one resource group and an account that has metadata access only.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It can call Key Vault secret and key tools
The tool list includes secret_get, key_get and certificate_get. Sign in with an account that has metadata access only.
Scans cover everything in the scope you pick
Start with one resource group, not the whole subscription, and check the findings before sharing them.
Fixing is separate from scanning
The skill says to keep compliance reporting separate from remediation.

Technical details

Scopes	Reads resource configuration across the scope you pick Reads Key Vault key, secret and certificate details Uses your signed-in Azure CLI session

Questions

What does azure-compliance do?

It runs azqr compliance scans on Azure resources and checks Key Vault keys, secrets and certificates for expiry. It then ranks the findings and suggests a fix for each.

How do I install it?

Use the install box at the top of this page. In Claude Code the plugin command installs the Azure skills together with the Azure tools they call, so pick it unless you want this one skill only. Run az login before you start.

What does it need to run?

An Azure sign-in with az login and permission to read resource configuration and Key Vault metadata. The azqr scan runs through the Azure MCP server.

Is it safe?

It is built for reading and reporting, but it can reach Key Vault items, so use a least-privilege account. skills.sh lists Gen Agent Trust Hub, Socket and Snyk as pass.

Does it fix what it finds?

It proposes fix steps for each finding. The SKILL.md advises keeping reporting separate from remediation.

How often should I run it?

The skill suggests weekly or monthly scans and tracking findings over time to confirm fixes worked.

Does it work in the Claude app, Codex or Cursor?

The Azure README lists GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI and OpenCode as hosts for the plugin. It does not list the Claude desktop or web app.

Information

updated Nov 2, 2026

Repository: microsoft/azure-skills
Folder: skills/azure-compliance

microsoft/azure-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 3

microsoft/azure-skills README · github.com
azure-compliance SKILL.md · github.com
azure-compliance on skills.sh · skills.sh