azure-compliance

Audit Azure resources for compliance, security posture, and Key Vault expiration issues.

Updated Jan 23, 2026
One-click install
npx skills add https://github.com/stephschofield/beth --skill azure-compliance-stephschofield
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: azure-compliance
Source: https://github.com/stephschofield/beth/tree/main/.github/skills/azure-compliance
Command: npx skills add https://github.com/stephschofield/beth --skill azure-compliance-stephschofield

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Azure environments accumulate misconfigurations, orphaned resources, and expiring Key Vault credentials that create security risks and outages. This Skill automates compliance scanning and expiration auditing so you can find and fix issues before they cause incidents. ## Core Features & Use Cases - Comprehensive Compliance Scans: Run Azure Quick Review (azqr) against subscriptions or resource groups to assess resources against Azure best practices, APRL recommendations, Defender for Cloud findings, and Azure Policy compliance. - Key Vault Expiration Monitoring: Audit keys, secrets, and certificates across vaults to find expired, expiring, or missing-expiration resources, with prioritized remediation guidance. - Remediation Guidance: Get prioritized findings (Critical/High/Medium/Low) with ready-to-use Azure CLI and Bicep fix templates for common issues like missing private endpoints, disabled soft delete, and weak TLS. - Use Case: Ask "Check what's expiring in my Key Vault in the next 30 days" to receive a report of expiring certificates and secrets with rotation recommendations, or run a full azqr scan to identify orphaned resources and security gaps across a subscription. ## Quick Start Ask the agent to run an azqr compliance scan on your Azure subscription and summarize the critical security findings with remediation steps.

Frequently Asked Questions about azure-compliance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an Azure compliance scan with azqr?▼

Run an azqr scan through the Azure MCP tool by specifying a subscription ID and optionally a resource group. The scan produces an Excel report with recommendations, impacted resources, Defender findings, and policy compliance status.

How to check Azure Key Vault for expiring secrets and certificates?▼

Use the Key Vault MCP tools to list keys, secrets, and certificates, then inspect each item's expiresOn field against a configurable day threshold (default 30 days). Findings are grouped into expired, expiring soon, and missing-expiration categories.

What permissions are needed for an Azure compliance assessment?▼

You need to be authenticated via az login and hold at least the Reader role on the target subscription or resource group. Key Vault audits additionally require data plane access to read keys, secrets, and certificates.

What should I do if the Azure MCP Key Vault tools fail?▼

Fall back to Azure CLI commands such as az keyvault secret list and az keyvault secret show when MCP tools time out, return connection errors, or take longer than 30 seconds. Verify vault name, subscription context, and RBAC permissions first.

Which Azure resource types does azqr support?▼

azqr supports over 70 Azure resource types including AKS, App Service, Storage Accounts, SQL Database, Key Vault, Cosmos DB, Virtual Machines, Virtual Networks, Redis, and Service Bus. Unsupported resources appear in the OutOfScope sheet of the report.