Apex Azure Compliance

---
name: apex-azure-compliance
user-invocable: true
disable-model-invocation: false
argument-hint: "Azure resource scope and compliance checks"
description: '**ANALYSIS SKILL** — Azure compliance and security auditing: best practices, Key Vault expiration monitoring, resource validation. WHEN: "compliance scan", "security audit", "Key Vault expiration check", "expired certificates", "orphaned resources". DO NOT USE FOR: cost analysis (apex-azure-cost-optimization), governance discovery (apex-azure-governance-discovery).'
license: MIT
metadata:
  author: Microsoft
  version: "1.0.2"
---

# Azure Compliance & Security Auditing

## Quick Reference

| Property             | Details                                                                  |
| -------------------- | ------------------------------------------------------------------------ |
| Best for             | Compliance scans, security audits, Key Vault expiration checks           |
| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring      |
| MCP tools            | azqr, subscription and resource group listing, Key Vault item inspection |

## Prerequisites

- Authentication: user is logged in to Azure via `az login`
- Permissions to read resource configuration and Key Vault metadata
- Follow the [identity and permission boundary](../apex-entra-app-registration/references/auth-best-practices.md#identity-and-permission-boundary)

## Assessments

| Assessment                      | Reference                                                                                      |
| ------------------------------- | ---------------------------------------------------------------------------------------------- |
| Comprehensive Compliance (azqr) | [references/azure-quick-review.md](references/azure-quick-review.md)                           |
| Key Vault Expiration            | [references/azure-keyvault-expiration-audit.md](references/azure-keyvault-expiration-audit.md) |
| Resource Graph Queries          | [references/azure-resource-graph.md](references/azure-resource-graph.md)                       |

## MCP Tools

| Tool                              | Purpose                                      |
| --------------------------------- | -------------------------------------------- |
| `mcp_azure-mcp_extension_azqr`    | Run azqr compliance scans                    |
| `mcp_azure-mcp_subscription_list` | List available subscriptions                 |
| `mcp_azure-mcp_group_list`        | List resource groups                         |
| `keyvault_key_list`               | List all keys in vault                       |
| `keyvault_key_get`                | Get key details including expiration         |
| `keyvault_secret_list`            | List all secrets in vault                    |
| `keyvault_certificate_list`       | List all certificates in vault               |
| `keyvault_certificate_get`        | Get certificate details including expiration |

## Steps

1. Select scope (subscription or resource group) for Comprehensive Resources Assessment.
2. Run azqr and capture output artifacts.
3. Analyze Scan Results and summarize findings and recommendations.
4. Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
5. Classify issues and propose remediation or fix steps for each finding.

### Priority Classification

| Priority | Guidance                                                |
| -------- | ------------------------------------------------------- |
| Critical | Immediate remediation required for high-impact exposure |
| High     | Resolve within days to reduce risk                      |
| Medium   | Plan a resolution in the next sprint                    |
| Low      | Track and fix during regular maintenance                |

## Error Handling

| Error                   | Message        | Remediation                                      |
| ----------------------- | -------------- | ------------------------------------------------ |
| Authentication required | "Please login" | Request user sign-in for the intended identity; do not switch automatically |
| Access denied           | "Forbidden"    | Report missing metadata access; assignments require separate approval |
| Missing resource        | "Not found"    | Verify subscription and resource group selection |

## Rules

- Run compliance scans on a regular schedule (weekly or monthly)
- Track findings over time and verify remediation effectiveness
- Separate compliance reporting from remediation execution
- Audit metadata only: never retrieve secret values, including certificate backing
  secrets. Verify installed tool contracts; unknown tools and denied pages are
  coverage gaps, not permission to fetch contents or broaden access.
- Keep Key Vault expiration policies documented and enforced

## SDK Quick References

For programmatic Key Vault access, see the condensed SDK guides:

- **Key Vault (Python)**: [Secrets/Keys/Certs](references/sdk/azure-keyvault-py.md)
- **Secrets**: [TypeScript](references/sdk/azure-keyvault-secrets-ts.md) | [Rust](references/sdk/azure-keyvault-secrets-rust.md) | [Java](references/sdk/azure-security-keyvault-secrets-java.md)
- **Keys**: [.NET](references/sdk/azure-security-keyvault-keys-dotnet.md) | [Java](references/sdk/azure-security-keyvault-keys-java.md) | [TypeScript](references/sdk/azure-keyvault-keys-ts.md) | [Rust](references/sdk/azure-keyvault-keys-rust.md)
- **Certificates**: [Rust](references/sdk/azure-keyvault-certificates-rust.md)

## Reference Index

Load these on demand — do NOT read all at once:

| Reference                                       | When to Load                    |
| ----------------------------------------------- | ------------------------------- |
| `../apex-entra-app-registration/references/auth-best-practices.md` | Auth Best Practices             |
| `references/azqr-recommendations.md`            | Azqr Recommendations            |
| `references/azqr-remediation-patterns.md`       | Azqr Remediation Patterns       |
| `references/azure-keyvault-expiration-audit.md` | Azure Keyvault Expiration Audit |
| `references/azure-quick-review.md`              | Azure Quick Review              |
| `references/azure-resource-graph.md`            | Azure Resource Graph            |