Azure Compliance
microsoft/GitHub-Copilot-for-Azure
Run Azure compliance and security audits with azqr plus Key Vault expiration checks.
ANALYSIS SKILL — Azure compliance and security auditing: best practices, Key Vault expiration monitoring, resource validation.
Install Apex Azure Compliance
$ npx skills add jonathan-vella/apex --skill apex-azure-compliance -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install jonathan-vella/apex apex-azure-compliance --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/skills/apex-azure-compliance .claude/skills/apex-azure-compliance && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "apex-azure-compliance" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-compliance into .claude/skills/apex-azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-compliance", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-complianceType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add jonathan-vella/apex --skill apex-azure-compliance -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install jonathan-vella/apex apex-azure-compliance --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.github/skills/apex-azure-compliance .agents/skills/apex-azure-compliance && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "apex-azure-compliance" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-compliance into .agents/skills/apex-azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-compliance", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add jonathan-vella/apex --skill apex-azure-compliance -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install jonathan-vella/apex apex-azure-compliance --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.github/skills/apex-azure-compliance .cursor/skills/apex-azure-compliance && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "apex-azure-compliance" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-compliance into .cursor/skills/apex-azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-compliance", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/jonathan-vella/apex.git --path .github/skills/apex-azure-compliance--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add jonathan-vella/apex --skill apex-azure-compliance -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install jonathan-vella/apex apex-azure-compliance --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.github/skills/apex-azure-compliance .gemini/skills/apex-azure-compliance && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "apex-azure-compliance" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-compliance into .gemini/skills/apex-azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-compliance", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install jonathan-vella/apex apex-azure-complianceInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add jonathan-vella/apex --skill apex-azure-compliance -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .github/skills && cp -r skills-src/.github/skills/apex-azure-compliance .github/skills/apex-azure-compliance && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "apex-azure-compliance" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-compliance into .github/skills/apex-azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-compliance", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add jonathan-vella/apex --skill apex-azure-compliance -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install jonathan-vella/apex apex-azure-compliance --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.github/skills/apex-azure-compliance .opencode/skills/apex-azure-compliance && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "apex-azure-compliance" agent skill from https://github.com/jonathan-vella/apex/tree/main/.github/skills/apex-azure-compliance into .opencode/skills/apex-azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apex-azure-compliance", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
apex-azure-compliance- GitHub stars
- 217
- Token cost
- ~1.6k tokens
- SKILL.md length
- 385 words
- Files
- 15 (incl. references)
- Skills in repo
- 39
- Repo updated
- First seen
- Licence
- MIT
At a glance
ANALYSIS SKILL — Azure compliance and security auditing: best practices, Key Vault expiration monitoring, resource validation.
- Works in 5 steps: Select scope (subscription or resource… → Run azqr and capture output artifacts. → Analyze Scan Results and summarize… → …
- : cost analysis (apex-azure-cost-optimization)
- SKILL.md covers Quick Reference, Prerequisites, Assessments and MCP Tools, plus 5 more sections
- Calls az
What it does
Apex Azure Compliance is an agent skill from jonathan-vella/apex. ANALYSIS SKILL — Azure compliance and security auditing: best practices, Key Vault expiration monitoring, resource validation. WHEN: "compliance scan", "security audit", "Key Vault expiration check", "expired certificates", "orphaned resources". DO NOT USE FOR: cost analysis (apex-azure-cost-optimization), governance discovery (apex-azure-governance-discovery).
Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 16 other files, including reference files (for example `references/azqr-recommendations.md`, `references/azqr-remediation-patterns.md` and `references/azure-keyvault-expiration-audit.md`).
It sits in DevOps & Cloud, covering Secrets management and Security review. It works with Microsoft Azure, Azure Key Vault and Model Context Protocol. The repository describes itself as: APEX turns Azure platform engineering requirements into verified, deploy-ready IaC — powered by GitHub Copilot agents, real-time pricing, and built-in compliance. The licence is MIT.
When your agent uses it
- : cost analysis (apex-azure-cost-optimization)
- Governance discovery (apex-azure-governance-discovery)
Example prompts
- “compliance scan”
- “security audit”
- “Key Vault expiration check”
- “/apex-azure-compliance”
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- Select scope (subscription or resource group) for Comprehensive Resources Assessment.
- Run azqr and capture output artifacts.
- Analyze Scan Results and summarize findings and recommendations.
- Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
- Classify issues and propose remediation or fix steps for each finding.
What it can do on your machine
Read from SKILL.md and the folder at commit b8e5908. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
az
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use az, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Apex Azure Compliance loads about 1.6k tokens when it runs, and up to ~12k if it reads all its reference files. Until then it costs about 97 tokens; SKILL.md has 385 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from jonathan-vella/apex at commit b8e5908, republished under its MIT licence (© jonathan-vella). 385 words, ~1,584 tokens.
Download SKILL.mdSave it as
.claude/skills/apex-azure-compliance/SKILL.md (or your agent's skills folder). This skill also uses 14 other files; get the full folder from GitHub.- name
- apex-azure-compliance
- description
- **ANALYSIS SKILL** — Azure compliance and security auditing: best practices, Key Vault expiration monitoring, resource validation. WHEN: "compliance scan", "security audit", "Key Vault expiration check", "expired certificates", "orphaned resources". DO NOT USE FOR: cost analysis (apex-azure-cost-optimization), governance discovery (apex-azure-governance-discovery).
- user-invocable
- true
- disable-model-invocation
- false
- argument-hint
- Azure resource scope and compliance checks
- license
- MIT
- metadata.author
- Microsoft
- metadata.version
- 1.0.2
Azure Compliance & Security Auditing
Quick Reference
| Property | Details |
|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
Prerequisites
- Authentication: user is logged in to Azure via
az login - Permissions to read resource configuration and Key Vault metadata
- Follow the identity and permission boundary
Assessments
| Assessment | Reference |
|---|---|
| Comprehensive Compliance (azqr) | references/azure-quick-review.md |
| Key Vault Expiration | references/azure-keyvault-expiration-audit.md |
| Resource Graph Queries | references/azure-resource-graph.md |
MCP Tools
| Tool | Purpose |
|---|---|
mcp_azure-mcp_extension_azqr | Run azqr compliance scans |
mcp_azure-mcp_subscription_list | List available subscriptions |
mcp_azure-mcp_group_list | List resource groups |
keyvault_key_list | List all keys in vault |
keyvault_key_get | Get key details including expiration |
keyvault_secret_list | List all secrets in vault |
keyvault_certificate_list | List all certificates in vault |
keyvault_certificate_get | Get certificate details including expiration |
Steps
- Select scope (subscription or resource group) for Comprehensive Resources Assessment.
- Run azqr and capture output artifacts.
- Analyze Scan Results and summarize findings and recommendations.
- Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
- Classify issues and propose remediation or fix steps for each finding.
Priority Classification
| Priority | Guidance |
|---|---|
| Critical | Immediate remediation required for high-impact exposure |
| High | Resolve within days to reduce risk |
| Medium | Plan a resolution in the next sprint |
| Low | Track and fix during regular maintenance |
Show full SKILL.md (173 more words)Show less
Error Handling
| Error | Message | Remediation |
|---|---|---|
| Authentication required | "Please login" | Request user sign-in for the intended identity; do not switch automatically |
| Access denied | "Forbidden" | Report missing metadata access; assignments require separate approval |
| Missing resource | "Not found" | Verify subscription and resource group selection |
Rules
- Run compliance scans on a regular schedule (weekly or monthly)
- Track findings over time and verify remediation effectiveness
- Separate compliance reporting from remediation execution
- Audit metadata only: never retrieve secret values, including certificate backing secrets. Verify installed tool contracts; unknown tools and denied pages are coverage gaps, not permission to fetch contents or broaden access.
- Keep Key Vault expiration policies documented and enforced
SDK Quick References
For programmatic Key Vault access, see the condensed SDK guides:
- Key Vault (Python): Secrets/Keys/Certs
- Secrets: TypeScript | Rust | Java
- Keys: .NET | Java | TypeScript | Rust
- Certificates: Rust
Reference Index
Load these on demand — do NOT read all at once:
| Reference | When to Load |
|---|---|
../apex-entra-app-registration/references/auth-best-practices.md | Auth Best Practices |
references/azqr-recommendations.md | Azqr Recommendations |
references/azqr-remediation-patterns.md | Azqr Remediation Patterns |
references/azure-keyvault-expiration-audit.md | Azure Keyvault Expiration Audit |
references/azure-quick-review.md | Azure Quick Review |
references/azure-resource-graph.md | Azure Resource Graph |
© jonathan-vella, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 14 other files (references) in .github/skills/apex-azure-compliance of jonathan-vella/apex.
- SKILL.md
- references/azqr-recommendations.md
- references/azqr-remediation-patterns.md
- references/azure-keyvault-expiration-audit.md
- references/azure-quick-review.md
- references/azure-resource-graph.md
- references/sdk/azure-keyvault-certificates-rust.md
- references/sdk/azure-keyvault-keys-rust.md
- references/sdk/azure-keyvault-keys-ts.md
- references/sdk/azure-keyvault-py.md
- references/sdk/azure-keyvault-secrets-rust.md
- references/sdk/azure-keyvault-secrets-ts.md
- references/sdk/azure-security-keyvault-keys-dotnet.md
- references/sdk/azure-security-keyvault-keys-java.md
- references/sdk/azure-security-keyvault-secrets-java.md
Open the folder on GitHubat commit b8e5908
Compare with similar skills
Apex Azure Compliance next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Apex Azure Compliance this skilljonathan-vella/apex | 217 | — | ~1.6k | Automated safety check: Pass | MIT | |
| Azure Compliancemicrosoft/GitHub-Copilot-for-Azure | 255 | 2 repos | ~997 | Automated safety check: Pass | MIT | |
| Azure Usagefcakyon/claude-codex-settings | 1.2k | — | ~461 | Automated safety check: Pass | Apache-2.0 | |
| Azure Keyvault Pymicrosoft/skills | 3.1k | — | ~2.4k | Automated safety check: Pass | MIT | |
| Azsdk Common Live And Recorded TestsAzure/azure-sdk-tools | 134 | — | ~1.5k | Automated safety check: Notes | MIT | |
| Managing Workflow Secretsbitwarden/ai-plugins | 155 | — | ~4k | Automated safety check: Pass | Custom licence |
Similar skills
- Official
Azure Usage
fcakyon/claude-codex-settings
This skill should be used when user asks to "query Azure resources", "list storage accounts", "manage Key Vault secrets", "work with Cosmos DB", "check AKS clusters", "use Azure MCP", or interact…
- Official
Azure Keyvault Py
microsoft/skills
Azure Key Vault SDK for Python. An agent skill from microsoft/skills.
- Official
Azsdk Common Live And Recorded Tests
Azure/azure-sdk-tools
Deploy test resources and run Azure SDK tests in live, record, or playback mode.
- Official
Managing Workflow Secrets
bitwarden/ai-plugins
Bitwarden's canonical pattern for using a secret inside a GitHub Actions job: authenticate to Azure with the OIDC triad, pull the secret from an Azure Key Vault via the bitwarden/gh-actions…
Azure Keyvault
sickn33/agentic-awesome-skills
Manage secrets and certificates in Azure Key Vault. An agent skill from sickn33/agentic-awesome-skills.
More from jonathan-vella/apex
All 39 skills in this repoApex Azure Diagnostics
jonathan-vella/apex
WORKFLOW SKILL — Debug Azure production issues: Container Apps, Functions, App Service, AKS, VMs and messaging, with KQL log analysis.
Apex Azure Governance Discovery
jonathan-vella/apex
ANALYSIS SKILL — Azure Policy discovery: effective assignments (incl.
Apex Context Management
jonathan-vella/apex
UTILITY SKILL — Two-mode context-window management. An agent skill from jonathan-vella/apex.
Apex Python Diagrams
jonathan-vella/apex
UTILITY SKILL — Python diagram generation for Azure architectures, WAF/cost/compliance charts, ERDs, swimlanes, timelines, and wireframes.
Apex Terraform Search Import
jonathan-vella/apex
WORKFLOW SKILL — Manual-only discovery and import of existing Azure resources into Terraform management.
Apex Vendor Prompting
jonathan-vella/apex
ANALYSIS SKILL — Manual-only audit of Anthropic Claude Opus 5.5 / Sonnet 5.5 and OpenAI GPT-6 / GPT-5.6 prompting guidance and APEX conventions.
Related
Categories
Questions about Apex Azure Compliance
What does Apex Azure Compliance do?
ANALYSIS SKILL — Azure compliance and security auditing: best practices, Key Vault expiration monitoring, resource validation. Apex Azure Compliance is an agent skill from jonathan-vella/apex. ANALYSIS SKILL — Azure compliance and security auditing: best practices, Key Vault expiration monitoring, resource validation.
When should I use Apex Azure Compliance?
Apex Azure Compliance fits situations like: : cost analysis (apex-azure-cost-optimization); governance discovery (apex-azure-governance-discovery).
How do I install Apex Azure Compliance in Claude Code?
Run `npx skills add jonathan-vella/apex --skill apex-azure-compliance -a claude-code`. Or copy the skill folder (.github/skills/apex-azure-compliance in jonathan-vella/apex) into .claude/skills/apex-azure-compliance in your project. Claude Code loads it when a task matches its description.
How do I install Apex Azure Compliance in Codex?
Run `npx skills add jonathan-vella/apex --skill apex-azure-compliance -a codex`. Or copy the skill folder (.github/skills/apex-azure-compliance in jonathan-vella/apex) into .agents/skills/apex-azure-compliance in your project. Codex loads it when a task matches its description.
Can I use Apex Azure Compliance in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jonathan-vella/apex --skill apex-azure-compliance -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/apex-azure-compliance, .gemini/skills/apex-azure-compliance, .github/skills/apex-azure-compliance and .opencode/skills/apex-azure-compliance in your project.
What does Apex Azure Compliance need to run?
Going by SKILL.md and its folder, Apex Azure Compliance needs the command-line tools its instructions call (az).
Does Apex Azure Compliance access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Apex Azure Compliance safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Apex Azure Compliance use?
Apex Azure Compliance is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Apex Azure Compliance use?
About 1.6k tokens (SKILL.md is roughly 6.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 11k tokens, read only when the agent opens those files.
What are the alternatives to Apex Azure Compliance?
Skills that share tags, products or a category with Apex Azure Compliance: Azure Compliance (microsoft/GitHub-Copilot-for-Azure, 255 stars), Azure Usage (fcakyon/claude-codex-settings, 1.2k stars), Azure Keyvault Py (microsoft/skills, 3.1k stars) and Azsdk Common Live And Recorded Tests (Azure/azure-sdk-tools, 134 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Apex Azure Compliance?
jonathan-vella (a GitHub user) maintains it in jonathan-vella/apex, which has 217 GitHub stars. The repository holds 39 skills in this directory. The repository was last updated on October 10, 2026.
Source: jonathan-vella/apex on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.