Skip to content
cccskills
FreePublished on GitHub

azure-security

Expert knowledge for Azure Security development including best practices, decision making, security, configuration, integrations & coding patterns, and deployment. Use when configuring Azure antimalware, container SBOM/signing, CMK encryption, AKS/VM hardening, or Key Vault keys, and other Azure Security related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Information Protection (use azure-information-protection), Azure DDoS Protection (use azure-ddos-protection), Azure Web Application Firewall (use azure-web-application-firewall).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills
Works withGitHubAzure
See how to install

Files included (1)

  • SKILL.md13.1 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Azure Security Skill

This skill provides expert guidance for Azure Security. Covers best practices, decision making, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

  • Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
  • Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

CategoryLinesDescription
Best PracticesL34-L58End-to-end Azure security guidance: hardening IaaS/PaaS, identity and access, network and operational security, backups and ransomware resilience, secrets management, and service-specific checklists.
Decision MakingL59-L64Guidance on choosing Azure security options: comparing feature availability in US Gov clouds and selecting the appropriate key management service (e.g., Key Vault, managed keys).
SecurityL65-L97Security best practices for Azure: threat modeling mitigations, platform and network hardening, access control, encryption/keys, infrastructure integrity, and secure AKS/VM/SQL operations.
ConfigurationL98-L108Configuring Azure security features: antimalware, container scanning (Dependabot/Copacetic), firewall rules, CMK encryption, logging/auditing, TLS changes, ransomware protections, and Customer Lockbox alerts.
Integrations & Coding PatternsL109-L114Guides for generating signed SBOMs for container images and scripting Microsoft Antimalware configuration in Azure using PowerShell.
DeploymentL115-L120Guides for signing and verifying container images with Notation in Azure Pipelines/GitHub Actions, plus comparing security feature availability in Azure vs Azure Government.

Best Practices

TopicURL
Harden Azure Marketplace images before publishinghttps://learn.microsoft.com/en-us/azure/security/fundamentals/azure-marketplace-images
Design Azure backup and restore plans against ransomwarehttps://learn.microsoft.com/en-us/azure/security/fundamentals/backup-plan-to-protect-against-ransomware
Implement Azure security best practices and patternshttps://learn.microsoft.com/en-us/azure/security/fundamentals/best-practices-and-patterns
Apply Azure data security and encryption best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/data-encryption-best-practices
Use Azure SQL database security checklisthttps://learn.microsoft.com/en-us/azure/security/fundamentals/database-security-checklist
Secure Azure IaaS workloads and virtual machineshttps://learn.microsoft.com/en-us/azure/security/fundamentals/iaas
Apply Azure identity and access control best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices
Implement incident response processes for Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/incident-response-overview
Apply Azure network security best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/network-best-practices
Apply Azure operational security best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/operational-best-practices
Secure Azure App Service PaaS applicationshttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-app-services
Secure PaaS databases with Azure SQL and Synapsehttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-sql
Secure PaaS applications using Azure Storagehttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-storage
Design and operate secure Azure PaaS deploymentshttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-deployments
Detect and respond to ransomware in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-detect-respond
Prepare Azure environments for ransomware resiliencehttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-prepare
Harden Azure Firewall Premium for ransomware defensehttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-protection-with-azure-firewall
Protect and manage secrets in Azure workloadshttps://learn.microsoft.com/en-us/azure/security/fundamentals/secrets-best-practices
Harden Azure Service Fabric clusters and securityhttps://learn.microsoft.com/en-us/azure/security/fundamentals/service-fabric-best-practices
Implement Microsoft Entra identity security checklisthttps://learn.microsoft.com/en-us/azure/security/fundamentals/steps-secure-identity
Prevent Azure subdomain takeover via DNS hygienehttps://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover

Decision Making

TopicURL
Compare security feature availability in US Government cloudshttps://learn.microsoft.com/en-us/azure/security/fundamentals/feature-availability
Select the right Azure key management servicehttps://learn.microsoft.com/en-us/azure/security/fundamentals/key-management-choose

Security

TopicURL
Enforce AKS image signature validation with Ratify and Azure Policyhttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/validating-image-signatures-using-ratify-aks
Implement auditing and logging mitigations with Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-auditing-and-logging
Implement authentication mitigations with Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-authentication
Mitigate authorization threats in Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-authorization
Secure communications based on Threat Modeling Tool findingshttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-communication-security
Harden configuration management using Threat Modeling Tool mitigationshttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-configuration-management
Implement cryptography mitigations from Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-cryptography
Secure exception management using Threat Modeling Tool guidancehttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-exception-management
Apply secure input validation mitigations from Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-input-validation
Protect sensitive data using Threat Modeling Tool mitigationshttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-sensitive-data
Implement secure session management from Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-session-management
Apply Azure-specific security controls to AI workloadshttps://learn.microsoft.com/en-us/azure/security/fundamentals/ai-security-best-practices
Review Azure service certificate authorities and requirementshttps://learn.microsoft.com/en-us/azure/security/fundamentals/azure-certificate-authority-details
Enforce platform code integrity in Azure productionhttps://learn.microsoft.com/en-us/azure/security/fundamentals/code-integrity
Understand and configure Azure Customer Lockbox accesshttps://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-faq
Control Microsoft engineer data access with Customer Lockboxhttps://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-overview
Identify Azure services supporting customer-managed keyshttps://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-customer-managed-keys-support
Secure Azure hardware, firmware, and supply chainhttps://learn.microsoft.com/en-us/azure/security/fundamentals/firmware
Maintain Azure infrastructure integrity and security controlshttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-integrity
Monitor Azure infrastructure for security and vulnerabilitieshttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-monitoring
Manage and operate the Azure production network securelyhttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-operations
Understand Azure SQL Database security capabilitieshttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-sql
Apply firmware measured boot and host attestation in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/measured-boot-host-attestation
Apply Azure operational security checklist controlshttps://learn.microsoft.com/en-us/azure/security/fundamentals/operational-checklist
Follow Azure penetration testing rules and scopehttps://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing
Verify Azure platform integrity and secure host lifecyclehttps://learn.microsoft.com/en-us/azure/security/fundamentals/platform
Secure access to the Azure production networkhttps://learn.microsoft.com/en-us/azure/security/fundamentals/production-network
Control and audit access to customer data in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/protection-customer-data
Use Secure Boot to protect Azure virtual machineshttps://learn.microsoft.com/en-us/azure/security/fundamentals/secure-boot

Configuration

TopicURL
Configure Dependabot and Copacetic for container securityhttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/container-secure-supply-chain-implementation/cssc-depenadabot-quickstart
Configure Microsoft Antimalware for Azure workloadshttps://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware
Plan firewall rules using Azure domain patternshttps://learn.microsoft.com/en-us/azure/security/fundamentals/azure-domains
Configure alternate email notifications for Customer Lockboxhttps://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-alternative-email
Configure Azure security logging and auditinghttps://learn.microsoft.com/en-us/azure/security/fundamentals/log-audit
Adapt to Azure managed TLS feature changeshttps://learn.microsoft.com/en-us/azure/security/fundamentals/managed-tls-changes
Configure Azure-native features for ransomware protectionhttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-features-resources

Integrations & Coding Patterns

TopicURL
Create and attach signed SBOMs to container imageshttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/attach-sbom
Use PowerShell to configure Microsoft Antimalware in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware-code-samples

Deployment

TopicURL
Sign and verify container images in Azure Pipelines with Notationhttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign
Sign container images with Notation in GitHub Actionshttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-sign-gha
Verify container image signatures with Notation in GitHub Actionshttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/verify-gha

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

azure-active-directory-b2c

Free

Expert knowledge for Azure Active Directory B2C development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when building B2C user flows/custom policies, configuring IdPs/MFA, securing APIs, automating CI/CD, or monitoring with Sentinel, and other Azure Active Directory B2C related development tasks. Not for Azure Role-based access control (use azure-rbac), Azure Information Protection (use azure-information-protection), Azure Security (use azure-security), Azure Sentinel (use azure-sentinel).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills784Updated Oct 18, 2026

azure-advisor

Free

Expert knowledge for Azure Advisor development including best practices, decision making, limits & quotas, security, configuration, and integrations & coding patterns. Use when configuring Advisor alerts/digests, managing rec states, using workbooks, Resource Graph, or RBAC for access, and other Azure Advisor related development tasks. Not for Cost Management (use azure-cost-management), Azure Monitor (use azure-monitor), Azure Policy (use azure-policy), Azure Security (use azure-security).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills784Updated Oct 18, 2026

azure-ai-vision

Free

Expert knowledge for Azure AI Vision development including decision making, limits & quotas, configuration, integrations & coding patterns, and deployment. Use when using Image Analysis, Read OCR containers, smart-crop thumbnails, background removal, or video frame analysis, and other Azure AI Vision related development tasks. Not for Azure AI Custom Vision (use azure-custom-vision), Azure AI Video Indexer (use azure-video-indexer), Azure AI Document Intelligence (use azure-document-intelligence), Azure AI Immersive Reader (use azure-immersive-reader).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills784Updated Oct 18, 2026

azure-aks-edge-essentials

Free

Expert knowledge for Azure Kubernetes Service Edge Essentials development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when managing AKS Edge/Hybrid with Arc, GitOps, IoT/OPC/ONVIF, TPM/Key Vault secrets, or AI model workloads, and other Azure Kubernetes Service Edge Essentials related development tasks. Not for Azure Kubernetes Service (AKS) (use azure-kubernetes-service), Azure IoT Edge (use azure-iot-edge), Azure Stack Edge (use azure-stack-edge), Azure Container Apps (use azure-container-apps).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills784Updated Oct 18, 2026

azure-analysis-services

Free

Expert knowledge for Azure Analysis Services development including troubleshooting. Use when resolving server connectivity, firewall/VNet, DNS, client connection, or network error issues, and other Azure Analysis Services related development tasks. Not for Azure Synapse Analytics (use azure-synapse-analytics), Azure SQL Database (use azure-sql-database), Azure SQL Managed Instance (use azure-sql-managed-instance), SQL Server on Azure Virtual Machines (use azure-sql-virtual-machines).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills784Updated Oct 18, 2026

azure-anomaly-detector

Free

Expert knowledge for Azure AI Anomaly Detector development including troubleshooting, best practices, limits & quotas, configuration, and deployment. Use when tuning Docker-based Anomaly Detector, ACI or IoT Edge deployments, univariate/multivariate APIs, or service limits, and other Azure AI Anomaly Detector related development tasks. Not for Azure AI Metrics Advisor (use azure-metrics-advisor), Azure Monitor (use azure-monitor), Azure Machine Learning (use azure-machine-learning).

The English summary is being prepared. Showing the original description.

MicrosoftDocs/Agent-Skills784Updated Oct 18, 2026

See all skills by MicrosoftDocs

Report a problem with this skill