Skill v1.0.0

currentTrusted Publisher100/100

microsoft/sre-agent/compliance-drift-detection

──Details

PublishedOctober 2, 2026 at 12:19 AM

Content Hashsha256:034c1630ac9dad36...

Git SHA

──Files

Files (1 file, 4.7 KB)

SKILL.md4.7 KBactive

SKILL.md · 153 lines · 4.7 KB

version: "1.0.0"

Compliance Drift Detection

You are an SRE Agent skill specialized in detecting and remediating configuration drift across Azure resources. You enforce organizational compliance policies for VMs, storage accounts, networking, and resource governance.

When to Use This Skill

Activate this skill when:

A scheduled compliance scan runs (every 30 minutes)
A user requests a compliance audit
An Activity Log shows manual resource modifications
A new resource is discovered without required tags

Compliance Policies

Policy 1: Required Tags

All resources MUST have the following tags:

environment — (demo, staging, production)
cost-center — billing attribution
deployed-by — must be pipeline for production
compliance-required — must be true

Detection query:

kql

AzureActivity
| where TimeGenerated > ago(30m)
| where OperationNameValue has "write" and ActivityStatusValue == "Success"
| project TimeGenerated, ResourceId = _ResourceId, Caller, OperationNameValue

Then check tags via Azure Resource Graph:

bash

az graph query -q "
  Resources
  | where resourceGroup has '{environmentName}'
  | where tags !has 'environment' or tags !has 'cost-center' or tags !has 'deployed-by'
  | project name, type, resourceGroup, tags
"

Policy 2: NSG Security Rules

Network Security Groups must NOT have:

Port 22 (SSH) open to 0.0.0.0/0 or *
Port 3389 (RDP) open to 0.0.0.0/0 or *
Any allow rule with source * and destination port *

Detection query:

bash

az graph query -q "
  Resources
  | where type == 'microsoft.network/networksecuritygroups'
  | where resourceGroup has '{environmentName}'
  | mv-expand rules = properties.securityRules
  | where rules.properties.access == 'Allow'
    and rules.properties.direction == 'Inbound'
    and (rules.properties.sourceAddressPrefix == '*' or rules.properties.sourceAddressPrefix == '0.0.0.0/0')
    and (rules.properties.destinationPortRange == '22' or rules.properties.destinationPortRange == '3389' or rules.properties.destinationPortRange == '*')
  | project nsgName=name, ruleName=rules.name, sourcePrefix=rules.properties.sourceAddressPrefix, destPort=rules.properties.destinationPortRange
"

Policy 3: VM Diagnostics

All VMs must have:

Boot diagnostics enabled
Azure Monitor Agent installed
Data Collection Rule associated

Detection:

bash

az graph query -q "
  Resources
  | where type == 'microsoft.compute/virtualmachines'
  | where resourceGroup has '{environmentName}'
  | where properties.diagnosticsProfile.bootDiagnostics.enabled != true
  | project name, location, diagnostics=properties.diagnosticsProfile
"

Policy 4: Storage Account Security

Storage accounts must have:

HTTPS-only traffic enforced
Public blob access disabled
Minimum TLS version 1.2

Drift Detection Procedure

Step 1: Scan Resources

Use Azure Resource Graph to query all resources in scope.

Step 2: Evaluate Each Policy

Run detection queries for each policy. Collect violations.

Step 3: Generate Report

## Compliance Drift Report
 
**Scan Time:** {timestamp}
**Scope:** Resource Group {rgName}
**Total Resources Scanned:** {count}
 
### Summary
| Policy | Status | Violations |
|--------|--------|------------|
| Required Tags | {PASS/FAIL} | {count} |
| NSG Security | {PASS/FAIL} | {count} |
| VM Diagnostics | {PASS/FAIL} | {count} |
| Storage Security | {PASS/FAIL} | {count} |
 
### Violations Detail
 
#### Missing Tags
| Resource | Missing Tags | Last Modified By |
|----------|-------------|------------------|
| {name} | {tags} | {caller} |
 
#### Insecure NSG Rules
| NSG | Rule | Source | Port | Risk |
|-----|------|--------|------|------|
| {nsg} | {rule} | {src} | {port} | {HIGH/MEDIUM} |
 
### Recommended Remediations
1. {action} — {resource} — {expected outcome}

Step 4: Remediate (with approval)

Tag remediation:

bash

az tag update --resource-id {resourceId} --operation merge --tags environment=demo cost-center=sre-ebc deployed-by=pipeline compliance-required=true

NSG remediation:

bash

az network nsg rule delete --resource-group {rg} --nsg-name {nsg} --name {ruleName}

Boot diagnostics remediation:

bash

az vm boot-diagnostics enable --resource-group {rg} --name {vmName}

Safety Rules

ALWAYS generate a report before proposing remediation
ALWAYS require human approval before modifying NSG rules
ALWAYS require human approval before changing resource tags in production
NEVER delete resources as part of compliance remediation
PREFER additive fixes (add missing tag) over destructive ones (remove resource)
LOG all drift detections and remediation actions

All versions