Azure Compliance Skill FAQ: azqr and Key Vault Audits

Why an azure-compliance FAQ Exists#

Microsoft’s azure-compliance skill (v1.2.2, MIT) is one of the pack’s highest-installed entries, yet most write-ups stop at “it runs azqr.” The SKILL.md routes two distinct jobs — comprehensive resource assessment and Key Vault expiration monitoring — and the reference files carry the actual workflow details: the Excel sheet layout, the scope options, the priority ladder, the CLI fallback. I read all three files plus the live leaderboard on 2026-09-16; every answer above traces to one of them.

The Short Answers#

• Two jobs, one skill. azqr compliance scans plus Key Vault expiry audits.
• Reader role suffices. Read-only access on the target scope; Key Vault needs data-plane read.
• Nine sheets in the workbook. Recommendations and ImpactedResources carry the actionable findings.
• 70+ resource types. Anything unscannable lands in OutOfScope, not in the silent void.
• Weekly cadence. Key Vault every week, full scan weekly or monthly, Event Grid heads-up at 30 days.

Reading the azqr Workbook#

The Excel output is where the skill earns its keep, because the sheet layout tells you what to read in what order. Recommendations and ImpactedResources carry severity-ranked findings with resource counts — that’s the “what is actually wrong” list. Inventory is your “what did we even scan” reference with SKU, tier, and SLA for every resource. Advisor folds in Azure’s own reliability and performance advice, DefenderRecommendations brings the security posture, and Azure Policy flags governance non-compliance with actual policies rather than vibes.

OutOfScope deserves real talk: a resource type azqr can’t scan shows up on its own sheet instead of vanishing. When a compliance pass “looks clean,” check OutOfScope first — a clean report with an empty inventory is a scan that didn’t happen, and the skill names that explicitly. Slow scans get the same treatment: the troubleshooting table says a long-running scan is a reason to narrow scope to a resource group, not to stare at the spinner.

The Key Vault Ladder#

Expiry audits live on their own priority scale because a certificate that expired yesterday is an incident, while one expiring in 25 days is a calendar item. The skill spells out the boundaries: expired means rotate immediately; 0–7 days means within 24 hours; 8–30 days means within a week; no expiration date at all means apply a policy, because a null expiresOn is flagged as a security risk rather than ignored. Active items past 30 days just get monitored.

The rotation cadence in the reference is concrete: secrets every 60–90 days, keys annually, certificates per CA requirements with a one-year ceiling. Event Grid notifications 30 days in advance give you the lead time to schedule a rotation instead of discovering an outage. For incident mode, the emergency pattern scans for already-expired items — negative days — which is the difference between “we’re down, find the cert” and rolling through a checklist.

Skills That Surround It#

azure-compliance pairs with the pack’s other audit tools rather than overlapping them. azure-cost uses azqr as a gate for its optimize workflow, so the compliance scan results feed cost recommendations. azure-validate enforces that a deployment plan is actually Verified before release — compliance finds the problems, validation stops them reaching production in the first place. The Key Vault half also slots into azure-storage work: storage account keys and connection strings follow the same 60–90 day rotation rhythm the vault audit enforces.

Start With One Subscription#

Install with npx skills add https://github.com/microsoft/azure-skills --skill azure-compliance, run az login, and ask the agent to scan a non-production subscription. Ask it to show you the Recommendations sheet summary — severity counts, top three issues, suggested fixes — then run the Key Vault pattern against a single vault and compare its expiry ladder against your rotation calendar. If findings come back with concrete resource names and the OutOfScope sheet explains what it couldn’t see, the skill is working; if it hands you vague “improve security” items, check that the scan actually completed before trusting the summary.