Apex Azure Compliance
jonathan-vella/apex
ANALYSIS SKILL — Azure compliance and security auditing: best practices, Key Vault expiration monitoring, resource validation.
Run Azure compliance and security audits with azqr plus Key Vault expiration checks.
Install Azure Compliance
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-compliance -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install microsoft/GitHub-Copilot-for-Azure azure-compliance --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/azure-skills/skills/azure-compliance .claude/skills/azure-compliance && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "azure-compliance" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/azure-compliance into .claude/skills/azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "azure-compliance", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/azure-complianceType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-compliance -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install microsoft/GitHub-Copilot-for-Azure azure-compliance --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/azure-skills/skills/azure-compliance .agents/skills/azure-compliance && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "azure-compliance" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/azure-compliance into .agents/skills/azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "azure-compliance", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-compliance -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install microsoft/GitHub-Copilot-for-Azure azure-compliance --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/azure-skills/skills/azure-compliance .cursor/skills/azure-compliance && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "azure-compliance" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/azure-compliance into .cursor/skills/azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "azure-compliance", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/microsoft/GitHub-Copilot-for-Azure.git --path plugins/azure-skills/skills/azure-compliance--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-compliance -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install microsoft/GitHub-Copilot-for-Azure azure-compliance --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/azure-skills/skills/azure-compliance .gemini/skills/azure-compliance && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "azure-compliance" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/azure-compliance into .gemini/skills/azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "azure-compliance", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install microsoft/GitHub-Copilot-for-Azure azure-complianceInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-compliance -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/azure-skills/skills/azure-compliance .github/skills/azure-compliance && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "azure-compliance" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/azure-compliance into .github/skills/azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "azure-compliance", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-compliance -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install microsoft/GitHub-Copilot-for-Azure azure-compliance --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/azure-skills/skills/azure-compliance .opencode/skills/azure-compliance && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "azure-compliance" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/azure-compliance into .opencode/skills/azure-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "azure-compliance", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
azure-compliance- GitHub stars
- 255
- Used in
- 2 other repos
- Token cost
- ~997 tokens
- SKILL.md length
- 308 words
- Files
- 17 (incl. references)
- Skills in repo
- 61
- Repo updated
- First seen
- Licence
- MIT
At a glance
Run Azure compliance and security audits with azqr plus Key Vault expiration checks.
- Works in 5 steps: Select scope (subscription or resource… → Run azqr and capture output artifacts. → Analyze Scan Results and summarize… → …
- Tasks that involve Security review
- SKILL.md covers Quick Reference, Prerequisites, Assessments and MCP Tools, plus 4 more sections
- Calls az
What it does
Azure Compliance is an agent skill from microsoft/GitHub-Copilot-for-Azure, published by the product's own GitHub organization. Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
Its SKILL.md is about 1000 tokens, which your agent loads only when the skill is triggered. The skill folder holds 18 other files, including reference files (for example `references/auth-best-practices.md`, `references/azqr-recommendations.md` and `references/azqr-remediation-patterns.md`).
It sits in Security, covering Security review and Secrets management. It works with Microsoft Azure, Azure Key Vault and Model Context Protocol. The repository describes itself as: GitHub Copilot for Azure. The licence is MIT.
When your agent uses it
- Tasks that involve Security review
- Tasks that involve Secrets management
Example prompts
- “/azure-compliance”
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- Select scope (subscription or resource group) for Comprehensive Resources Assessment.
- Run azqr and capture output artifacts.
- Analyze Scan Results and summarize findings and recommendations.
- Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
- Classify issues and propose remediation or fix steps for each finding.
What it can do on your machine
Read from SKILL.md and the folder at commit ce94fce. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
az
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use az, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Azure Compliance loads about 997 tokens when it runs, and up to ~12k if it reads all its reference files. Until then it costs about 106 tokens; SKILL.md has 308 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from microsoft/GitHub-Copilot-for-Azure at commit ce94fce, republished under its MIT licence (© microsoft). 308 words, ~997 tokens.
Download SKILL.mdSave it as
.claude/skills/azure-compliance/SKILL.md (or your agent's skills folder). This skill also uses 16 other files; get the full folder from GitHub.- name
- azure-compliance
- description
- Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
- license
- MIT
- metadata.author
- Microsoft
- metadata.version
- 0.0.0-placeholder
Azure Compliance & Security Auditing
Quick Reference
| Property | Details |
|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
Prerequisites
- Authentication: user is logged in to Azure via
az login - Permissions to read resource configuration and Key Vault metadata
Assessments
| Assessment | Reference |
|---|---|
| Comprehensive Compliance (azqr) | references/azure-quick-review.md |
| Key Vault Expiration | references/azure-keyvault-expiration-audit.md |
| Resource Graph Queries | references/azure-resource-graph.md |
MCP Tools
| Tool | Purpose |
|---|---|
mcp_azure_mcp_extension_azqr | Run azqr compliance scans |
mcp_azure_mcp_subscription_list | List available subscriptions |
mcp_azure_mcp_group_list | List resource groups |
keyvault_key_list | List all keys in vault |
keyvault_key_get | Get key details including expiration |
keyvault_secret_list | List all secrets in vault |
keyvault_secret_get | Get secret details including expiration |
keyvault_certificate_list | List all certificates in vault |
keyvault_certificate_get | Get certificate details including expiration |
Assessment Workflow
- Select scope (subscription or resource group) for Comprehensive Resources Assessment.
- Run azqr and capture output artifacts.
- Analyze Scan Results and summarize findings and recommendations.
- Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
- Classify issues and propose remediation or fix steps for each finding.
Priority Classification
| Priority | Guidance |
|---|---|
| Critical | Immediate remediation required for high-impact exposure |
| High | Resolve within days to reduce risk |
| Medium | Plan a resolution in the next sprint |
| Low | Track and fix during regular maintenance |
Error Handling
| Error | Message | Remediation |
|---|---|---|
| Authentication required | "Please login" | Run az login and retry |
| Access denied | "Forbidden" | Confirm permissions and fix role assignments |
| Missing resource | "Not found" | Verify subscription and resource group selection |
Best Practices
- Run compliance scans on a regular schedule (weekly or monthly)
- Track findings over time and verify remediation effectiveness
- Separate compliance reporting from remediation execution
- Keep Key Vault expiration policies documented and enforced
SDK Quick References
For programmatic Key Vault access, see the condensed SDK guides:
- Key Vault (Python): Secrets/Keys/Certs
- Secrets: TypeScript | Rust | Java
- Keys: .NET | Java | TypeScript | Rust
- Certificates: Rust
© microsoft, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 16 other files (references) in plugins/azure-skills/skills/azure-compliance of microsoft/GitHub-Copilot-for-Azure.
- SKILL.md
- references/auth-best-practices.md
- references/azqr-recommendations.md
- references/azqr-remediation-patterns.md
- references/azure-keyvault-expiration-audit.md
- references/azure-quick-review.md
- references/azure-resource-graph.md
- references/sdk/azure-keyvault-certificates-rust.md
- references/sdk/azure-keyvault-keys-rust.md
- references/sdk/azure-keyvault-keys-ts.md
- references/sdk/azure-keyvault-py.md
- references/sdk/azure-keyvault-secrets-rust.md
- references/sdk/azure-keyvault-secrets-ts.md
- references/sdk/azure-security-keyvault-keys-dotnet.md
- references/sdk/azure-security-keyvault-keys-java.md
- references/sdk/azure-security-keyvault-secrets-java.md
- version.json
Open the folder on GitHubat commit ce94fce
Used in 4 other repositories
We found 5 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 2 other GitHub owners. This page covers the copy in microsoft/GitHub-Copilot-for-Azure, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Azure Compliance next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Azure Compliance this skillmicrosoft/GitHub-Copilot-for-Azure | 255 | 2 repos | ~997 | Automated safety check: Pass | MIT | |
| Apex Azure Compliancejonathan-vella/apex | 217 | — | ~1.6k | Automated safety check: Pass | MIT | |
| Azure Usagefcakyon/claude-codex-settings | 1.2k | — | ~461 | Automated safety check: Pass | Apache-2.0 | |
| Pki Designvinayaklatthe/microsoft-security-skills | 175 | — | ~2.1k | Automated safety check: Pass | MIT | |
| Azure Keyvault Pymicrosoft/skills | 3.1k | — | ~2.4k | Automated safety check: Pass | MIT | |
| Security Reviewktnyt/cclsp | 675 | — | ~565 | Automated safety check: Pass | MIT |
Similar skills
Azure Usage
fcakyon/claude-codex-settings
This skill should be used when user asks to "query Azure resources", "list storage accounts", "manage Key Vault secrets", "work with Cosmos DB", "check AKS clusters", "use Azure MCP", or interact…
Pki Design
vinayaklatthe/microsoft-security-skills
Guidance for designing public key infrastructure (PKI) and certificate management on Azure and hybrid environments.
- Official
Azure Keyvault Py
microsoft/skills
Azure Key Vault SDK for Python. An agent skill from microsoft/skills.
Security Review
ktnyt/cclsp
Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling.
- Official
Azsdk Common Live And Recorded Tests
Azure/azure-sdk-tools
Deploy test resources and run Azure SDK tests in live, record, or playback mode.
More from microsoft/GitHub-Copilot-for-Azure
All 61 skills in this repo- Official
Capacity
microsoft/GitHub-Copilot-for-Azure
Discovers available Azure OpenAI model capacity across regions and projects.
- Official
Deploy Model
microsoft/GitHub-Copilot-for-Azure
Unified Azure OpenAI model deployment skill with intelligent intent-based routing.
- Official
Azure Storage
microsoft/GitHub-Copilot-for-Azure
Azure Storage Services including Blob Storage, File Shares, Queue Storage, Table Storage, and Data Lake.
- Official
Microsoft Foundry
microsoft/GitHub-Copilot-for-Azure
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end.
- Official
Entra Agent Id
microsoft/GitHub-Copilot-for-Azure
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant)…
- Official
Azure Kubernetes Automatic Readiness
microsoft/GitHub-Copilot-for-Azure
Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility.
Related
Categories
Questions about Azure Compliance
What does Azure Compliance do?
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Azure Compliance is an agent skill from microsoft/GitHub-Copilot-for-Azure, published by the product's own GitHub organization. Run Azure compliance and security audits with azqr plus Key Vault expiration checks.
When should I use Azure Compliance?
Azure Compliance fits situations like: tasks that involve Security review; tasks that involve Secrets management.
How do I install Azure Compliance in Claude Code?
Run `npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-compliance -a claude-code`. Or copy the skill folder (plugins/azure-skills/skills/azure-compliance in microsoft/GitHub-Copilot-for-Azure) into .claude/skills/azure-compliance in your project. Claude Code loads it when a task matches its description.
How do I install Azure Compliance in Codex?
Run `npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-compliance -a codex`. Or copy the skill folder (plugins/azure-skills/skills/azure-compliance in microsoft/GitHub-Copilot-for-Azure) into .agents/skills/azure-compliance in your project. Codex loads it when a task matches its description.
Can I use Azure Compliance in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-compliance -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/azure-compliance, .gemini/skills/azure-compliance, .github/skills/azure-compliance and .opencode/skills/azure-compliance in your project.
What does Azure Compliance need to run?
Going by SKILL.md and its folder, Azure Compliance needs the command-line tools its instructions call (az).
Does Azure Compliance access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Azure Compliance safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Azure Compliance use?
Azure Compliance is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Azure Compliance use?
About 997 tokens (SKILL.md is roughly 4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 11k tokens, read only when the agent opens those files.
What are the alternatives to Azure Compliance?
Skills that share tags, products or a category with Azure Compliance: Apex Azure Compliance (jonathan-vella/apex, 217 stars), Azure Usage (fcakyon/claude-codex-settings, 1.2k stars), Pki Design (vinayaklatthe/microsoft-security-skills, 175 stars) and Azure Keyvault Py (microsoft/skills, 3.1k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Azure Compliance?
microsoft (a GitHub organization, an official publisher) maintains it in microsoft/GitHub-Copilot-for-Azure, which has 255 GitHub stars. The repository holds 61 skills in this directory. The repository was last updated on October 9, 2026.
Source: microsoft/GitHub-Copilot-for-Azure on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.