skilld
All skills
microsoft avatar

/azure-compliance

@2120de9 official
by microsoftmicrosoft/github-copilot-for-azure253 stars
206

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

Ask your Agent

Use this Skill: https://skilld.dev/gh/microsoft/github-copilot-for-azure/azure-compliance

This session only. Nothing lands on disk.

referencessdkazure-security-keyvault-secrets-java.md

≈380 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Key Vault Secrets — Java SDK Quick Reference

Condensed from azure-security-keyvault-secrets-java. Full patterns (async client, secret rotation, backup/restore, config loader) in the azure-security-keyvault-secrets-java plugin skill if installed.

Install

<dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-security-keyvault-secrets</artifactId>
    <version>4.9.0</version>
</dependency>
<dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-identity</artifactId>
</dependency>

Quick Start

Auth: DefaultAzureCredential is for local development. See auth-best-practices.md for production patterns.

import com.azure.security.keyvault.secrets.SecretClientBuilder;
import com.azure.identity.DefaultAzureCredentialBuilder;
var secretClient = new SecretClientBuilder()
    .vaultUrl("https://<vault>.vault.azure.net")
    .credential(new DefaultAzureCredentialBuilder().build())
    .buildClient();

Best Practices

  • Enable soft delete — protects against accidental deletion
  • Use tags — tag secrets with environment, service, owner
  • Set expiration — use setExpiresOn() for credentials that should rotate
  • Content type — set contentType to indicate format (e.g., application/json)
  • Version management — don't delete old versions immediately during rotation
  • Access logging — enable diagnostic logging on Key Vault
  • Least privilege — use separate vaults for different environments

Source: SKILL.md on GitHub

Third-party checks

1 warning16d5 checks · Risk SAFE
  • Gen Agent Trust Hub16d

    This skill includes some potential considerations regarding indirect prompt injection surfaces due to processing Azure environment metadata. While these warrant review, they are used within the skill's intended auditing functionality and present a minimal risk under normal circumstances.

  • Socket16d

    No alerts

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer6mo

    11/16 files flagged

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 2120de9. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 19 hours ago.

Activeupdated 3 weeks ago

Capability

metadata
{
  "author": "Microsoft",
  "version": "0.0.0-placeholder"
}

Topics

  • Security
  • azure
  • compliance
  • audit
  • azqr
  • keyvault
  • certificates
  • secrets
  • expiration

README badge

README badge for microsoft/github-copilot-for-azure/azure-compliance

What it does

Runs Azure compliance and security audits using azqr, plus monitors Key Vault for expired or expiring keys, secrets, and certificates. Identifies orphaned resources, configuration drift, and compliance violations against Azure best practices.

Generated from the current SKILL.md.

Frequently asked

Does this skill work with subscriptions I don't have direct access to?
No. The skill requires you to be authenticated via `az login` and have permissions to read resource configuration and Key Vault metadata in the target subscription or resource group.
What does azqr audit check for?
azqr (Azure Quick Review) runs a comprehensive compliance and best-practices assessment across Azure resources, identifying misconfigurations, orphaned resources, and security posture issues. See the Azure Quick Review reference for the full list of checks.
Can this skill check Key Vault expiration dates?
Yes. The skill includes dedicated tools to list and inspect keys, secrets, and certificates in Key Vault, returning expiration dates and identifying items without expiration policies set.
Does this skill fix compliance issues or just report them?
The skill reports findings and classifies them by priority (Critical, High, Medium, Low), then proposes remediation steps. It does not automatically apply fixes.
What authentication method does this skill require?
You must be logged in to Azure via the `az login` command. The skill uses your existing Azure CLI session to access subscriptions and resources.

Generated from the current SKILL.md. These answers refresh after source changes.