jonathan-vella/apex/apex-azure-compliance
Claude Code and agent skill by jonathan-vella/apex
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
**ANALYSIS SKILL** — Azure compliance and security auditing: best practices, Key Vault expiration monitoring, resource validation. WHEN: "compliance scan", "security audit", "Key Vault expiration check", "expired certificates", "orphaned resources". DO NOT USE FOR: cost analysis (apex-azure-cost-optimization), governance discovery (apex-azure-governance-discovery).
Install
npx vskill@latest install jonathan-vella/apex/apex-azure-complianceSKILL.md
Azure Compliance & Security Auditing
Quick Reference
| Property | Details | |
|---|---|---|
| Best for | Compliance scans, security audits, Key Vault expiration checks | |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring | |
| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
Prerequisites
- Authentication: user is logged in to Azure via
az login - Permissions to read resource configuration and Key Vault metadata
- Follow the identity and permission boundary
Assessments
| Assessment | Reference | |
|---|---|---|
| Comprehensive Compliance (azqr) | references/azure-quick-review.md | |
| Key Vault Expiration | references/azure-keyvault-expiration-audit.md | |
| Resource Graph Queries | references/azure-resource-graph.md |
MCP Tools
| Tool | Purpose | |
|---|---|---|
mcp_azure-mcp_extension_azqr | Run azqr compliance scans | |
mcp_azure-mcp_subscription_list | List available subscriptions | |
mcp_azure-mcp_group_list | List resource groups | |
keyvault_key_list | List all keys in vault | |
keyvault_key_get | Get key details including expiration | |
keyvault_secret_list | List all secrets in vault | |
keyvault_certificate_list | List all certificates in vault | |
keyvault_certificate_get | Get certificate details including expiration |
Steps
- Select scope (subscription or resource group) for Comprehensive Resources Assessment.
- Run azqr and capture output artifacts.
- Analyze Scan Results and summarize findings and recommendations.
- Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
- Classify issues and propose remediation or fix steps for each finding.
Priority Classification
| Priority | Guidance | |
|---|---|---|
| Critical | Immediate remediation required for high-impact exposure | |
| High | Resolve within days to reduce risk | |
| Medium | Plan a resolution in the next sprint | |
| Low | Track and fix during regular maintenance |
Error Handling
| Error | Message | Remediation | |
|---|---|---|---|
| Authentication required | "Please login" | Request user sign-in for the intended identity; do not switch automatically | |
| Access denied | "Forbidden" | Report missing metadata access; assignments require separate approval | |
| Missing resource | "Not found" | Verify subscription and resource group selection |
Rules
- Run compliance scans on a regular schedule (weekly or monthly)
- Track findings over time and verify remediation effectiveness
- Separate compliance reporting from remediation execution
- Audit metadata only: never retrieve secret values, including certificate backing
secrets. Verify installed tool contracts; unknown tools and denied pages are coverage gaps, not permission to fetch contents or broaden access.
- Keep Key Vault expiration policies documented and enforced
SDK Quick References
For programmatic Key Vault access, see the condensed SDK guides:
- Key Vault (Python): Secrets/Keys/Certs
- Secrets: TypeScript | Rust | Java
- Keys: .NET | Java | TypeScript | Rust
- Certificates: Rust
Reference Index
Load these on demand — do NOT read all at once:
| Reference | When to Load | |
|---|---|---|
../apex-entra-app-registration/references/auth-best-practices.md | Auth Best Practices | |
references/azqr-recommendations.md | Azqr Recommendations | |
references/azqr-remediation-patterns.md | Azqr Remediation Patterns | |
references/azure-keyvault-expiration-audit.md | Azure Keyvault Expiration Audit | |
references/azure-quick-review.md | Azure Quick Review | |
references/azure-resource-graph.md | Azure Resource Graph |
Security
- Security scanPassed, 95 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryChecking.github/skills/apex-azure-compliance/SKILL.md
Popularity
- Repository stars
- 216
- Repository forks
- 80
- 7-day trend score
- 32
Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/jonathan-vella/apex/apex-azure-compliance)