Question 1

What does the azure-compliance skill actually do?

Accepted Answer

Two assessments. One runs Azure Quick Review (azqr) across a subscription, resource group, management group, or single service, and produces an Excel workbook with nine sheets: Recommendations, ImpactedResources, Inventory, Advisor, DefenderRecommendations, Azure Policy, Costs, Defender, and OutOfScope. The other audits Key Vault keys, secrets, and certificates for expiration. Both run through MCP tools in the agent — no CLI juggling.

Question 2

What permissions do I need to run it?

Accepted Answer

Reader role on the target subscription or resource group is the floor. azqr needs read access to resource configuration. The Key Vault half needs Key Vault Reader plus data-plane access to list and read secrets, keys, and certificates. Authentication is a plain `az login`.

Question 3

What does the azqr Excel output contain?

Accepted Answer

Nine sheets. Recommendations and ImpactedResources are the two to read first — they list every finding against a concrete resource count. Inventory covers all scanned resources with SKU, tier, and SLA. Advisor and DefenderRecommendations add reliability and security signals. Azure Policy lists non-compliant resources, Costs gives a three-month history, Defender reports plan status, and OutOfScope names what couldn't be scanned.

Question 4

Which services does azqr cover?

Accepted Answer

70+ Azure resource types, including AKS, API Management, App Service, Container Apps, Cosmos DB, Container Registry, Key Vault, Load Balancer, MySQL, PostgreSQL, Redis, Service Bus, SQL Database, Storage Accounts, Virtual Machines, and Virtual Networks. A resource type not on the list lands in OutOfScope.

Question 5

How does the Key Vault expiration audit work?

Accepted Answer

It lists keys, secrets, and certificates in a vault, pulls their expiration metadata, and compares it against a configurable threshold — 30 days by default. Findings split into expired, expiring soon, missing expiration (a null expiresOn is flagged as a security risk), and disabled. Four patterns cover single-vault quick scans, multi-vault compliance reports, single-resource-type focus, and an emergency finder for already-expired items during an incident.

Question 6

How should I prioritize the findings?

Accepted Answer

The skill uses four classes: Critical means immediate remediation for high-impact exposure, High means resolve within days, Medium means plan into the next sprint, Low means track during regular maintenance. Key Vault items get a tighter ladder: expired → rotate immediately, 0-7 days → within 24 hours, 8-30 days → within a week, no expiration → apply a policy, more than 30 days → monitor.

Question 7

How often should I run scans?

Accepted Answer

The reference file recommends weekly Key Vault audits and a full azqr pass weekly or monthly, with findings tracked over time so you can verify remediation actually landed. It also suggests Event Grid notifications 30 days out and a rotation cadence: secrets every 60-90 days, keys annually, certificates per CA requirements — a year max.

Question 8

What are the common failure modes?

Accepted Answer

"Please login" means you skipped `az login`. "Forbidden" means role assignments are wrong — check Reader on the scope, and Key Vault Reader plus data-plane access for the vault pass. "Not found" usually means a wrong subscription or resource group selection. If the MCP Key Vault tools time out past 30 seconds, the reference includes a full `az keyvault` CLI fallback table.

Question 9

Is the 583K install number real?

Accepted Answer

Yes. skills.sh on 2026-09-16 showed azure-compliance at #53 with 583,170 all-time installs and a weekly series of 17,071 → 12,955. It rides the same lockstep curve as the rest of the azure-skills pack — azure-diagnostics 585,469, azure-prepare 585,017, azure-validate 584,169 — with the usual ~1K spread between siblings.

Question 10

Is this a compliance certification tool?

Accepted Answer

No. It audits against Azure best practices and Azure Policy, not SOC 2 or ISO 27001 frameworks. What you get is a prioritized list of security, reliability, performance, cost, and operations issues with remediation guidance — evidence for an audit, not an attestation result.

Security on Top AI Skills

Azure Compliance Skill FAQ: azqr and Key Vault Audits

Frequently Asked Questions

Why an azure-compliance FAQ Exists