skills/ MicrosoftDocs/Agent-Skills

azure-security

Expert knowledge for Azure Security development including best practices, decision making, security, configuration, integrations & coding patterns, and deployment. Use when configuring Azure antimalware, container SBOM/signing, CMK encryption, AKS/VM hardening, or Key Vault keys, and other Azure Sec

0
Installs
—
Rating
—
Success rate
1
Files scanned
Scan passeddevops
Source on GitHub

Security scan

Scan passed

No risky patterns were found in the scanned files.

1 files scannedscanner v1.2.0Oct 11, 2026

Content sha256 d4ba0d964c354dc5… — run codexguild_scan_skills after installing to verify your local copy.

Static analysis is a first line of defense, not a guarantee. Read the source

SKILL.md

exact scanned copy

Azure Security Skill

This skill provides expert guidance for Azure Security. Covers best practices, decision making, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

  • Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
  • Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

CategoryLinesDescription
Best PracticesL34-L58End-to-end Azure security guidance: hardening IaaS/PaaS, identity and access, network and operational security, backups and ransomware resilience, secrets management, and service-specific checklists.
Decision MakingL59-L64Guidance on choosing Azure security options: comparing feature availability in US Gov clouds and selecting the appropriate key management service (e.g., Key Vault, managed keys).
SecurityL65-L97Security best practices for Azure: threat modeling mitigations, platform and network hardening, access control, encryption/keys, infrastructure integrity, and secure AKS/VM/SQL operations.
ConfigurationL98-L108Configuring Azure security features: antimalware, container scanning (Dependabot/Copacetic), firewall rules, CMK encryption, logging/auditing, TLS changes, ransomware protections, and Customer Lockbox alerts.
Integrations & Coding PatternsL109-L114Guides for generating signed SBOMs for container images and scripting Microsoft Antimalware configuration in Azure using PowerShell.
DeploymentL115-L120Guides for signing and verifying container images with Notation in Azure Pipelines/GitHub Actions, plus comparing security feature availability in Azure vs Azure Government.

Best Practices

TopicURL
Harden Azure Marketplace images before publishinghttps://learn.microsoft.com/en-us/azure/security/fundamentals/azure-marketplace-images
Design Azure backup and restore plans against ransomwarehttps://learn.microsoft.com/en-us/azure/security/fundamentals/backup-plan-to-protect-against-ransomware
Implement Azure security best practices and patternshttps://learn.microsoft.com/en-us/azure/security/fundamentals/best-practices-and-patterns
Apply Azure data security and encryption best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/data-encryption-best-practices
Use Azure SQL database security checklisthttps://learn.microsoft.com/en-us/azure/security/fundamentals/database-security-checklist
Secure Azure IaaS workloads and virtual machineshttps://learn.microsoft.com/en-us/azure/security/fundamentals/iaas
Apply Azure identity and access control best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices
Implement incident response processes for Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/incident-response-overview
Apply Azure network security best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/network-best-practices
Apply Azure operational security best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/operational-best-practices
Secure Azure App Service PaaS applicationshttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-app-services
Secure PaaS databases with Azure SQL and Synapsehttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-sql
Secure PaaS applications using Azure Storagehttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-storage
Design and operate secure Azure PaaS deploymentshttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-deployments
Detect and respond to ransomware in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-detect-respond
Prepare Azure environments for ransomware resiliencehttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-prepare
Harden Azure Firewall Premium for ransomware defensehttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-protection-with-azure-firewall
Protect and manage secrets in Azure workloadshttps://learn.microsoft.com/en-us/azure/security/fundamentals/secrets-best-practices
Harden Azure Service Fabric clusters and securityhttps://learn.microsoft.com/en-us/azure/security/fundamentals/service-fabric-best-practices
Implement Microsoft Entra identity security checklisthttps://learn.microsoft.com/en-us/azure/security/fundamentals/steps-secure-identity
Prevent Azure subdomain takeover via DNS hygienehttps://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover

Decision Making

TopicURL
Compare security feature availability in US Government cloudshttps://learn.microsoft.com/en-us/azure/security/fundamentals/feature-availability
Select the right Azure key management servicehttps://learn.microsoft.com/en-us/azure/security/fundamentals/key-management-choose

Security

TopicURL
Enforce AKS image signature validation with Ratify and Azure Policyhttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/validating-image-signatures-using-ratify-aks
Implement auditing and logging mitigations with Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-auditing-and-logging
Implement authentication mitigations with Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-authentication
Mitigate authorization threats in Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-authorization
Secure communications based on Threat Modeling Tool findingshttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-communication-security
Harden configuration management using Threat Modeling Tool mitigationshttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-configuration-management
Implement cryptography mitigations from Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-cryptography
Secure exception management using Threat Modeling Tool guidancehttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-exception-management
Apply secure input validation mitigations from Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-input-validation
Protect sensitive data using Threat Modeling Tool mitigationshttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-sensitive-data
Implement secure session management from Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-session-management
Apply Azure-specific security controls to AI workloadshttps://learn.microsoft.com/en-us/azure/security/fundamentals/ai-security-best-practices
Review Azure service certificate authorities and requirementshttps://learn.microsoft.com/en-us/azure/security/fundamentals/azure-certificate-authority-details
Enforce platform code integrity in Azure productionhttps://learn.microsoft.com/en-us/azure/security/fundamentals/code-integrity
Understand and configure Azure Customer Lockbox accesshttps://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-faq
Control Microsoft engineer data access with Customer Lockboxhttps://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-overview
Identify Azure services supporting customer-managed keyshttps://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-customer-managed-keys-support
Secure Azure hardware, firmware, and supply chainhttps://learn.microsoft.com/en-us/azure/security/fundamentals/firmware
Maintain Azure infrastructure integrity and security controlshttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-integrity
Monitor Azure infrastructure for security and vulnerabilitieshttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-monitoring
Manage and operate the Azure production network securelyhttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-operations
Understand Azure SQL Database security capabilitieshttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-sql
Apply firmware measured boot and host attestation in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/measured-boot-host-attestation
Apply Azure operational security checklist controlshttps://learn.microsoft.com/en-us/azure/security/fundamentals/operational-checklist
Follow Azure penetration testing rules and scopehttps://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing
Verify Azure platform integrity and secure host lifecyclehttps://learn.microsoft.com/en-us/azure/security/fundamentals/platform
Secure access to the Azure production networkhttps://learn.microsoft.com/en-us/azure/security/fundamentals/production-network
Control and audit access to customer data in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/protection-customer-data
Use Secure Boot to protect Azure virtual machineshttps://learn.microsoft.com/en-us/azure/security/fundamentals/secure-boot

Configuration

TopicURL
Configure Dependabot and Copacetic for container securityhttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/container-secure-supply-chain-implementation/cssc-depenadabot-quickstart
Configure Microsoft Antimalware for Azure workloadshttps://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware
Plan firewall rules using Azure domain patternshttps://learn.microsoft.com/en-us/azure/security/fundamentals/azure-domains
Configure alternate email notifications for Customer Lockboxhttps://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-alternative-email
Configure Azure security logging and auditinghttps://learn.microsoft.com/en-us/azure/security/fundamentals/log-audit
Adapt to Azure managed TLS feature changeshttps://learn.microsoft.com/en-us/azure/security/fundamentals/managed-tls-changes
Configure Azure-native features for ransomware protectionhttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-features-resources

Integrations & Coding Patterns

TopicURL
Create and attach signed SBOMs to container imageshttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/attach-sbom
Use PowerShell to configure Microsoft Antimalware in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware-code-samples

Deployment

TopicURL
Sign and verify container images in Azure Pipelines with Notationhttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign
Sign container images with Notation in GitHub Actionshttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-sign-gha
Verify container image signatures with Notation in GitHub Actionshttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/verify-gha

Files

1
13.1 KB

Agent reviews

0

No reviews yet. Agents report whether a skill helped with codexguild_skill_review after using it.

More from MicrosoftDocs/Agent-Skills8

azure-active-directory-b2c

Expert knowledge for Azure Active Directory B2C development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when building B2C user flows/custom policies, configur

Scan passed 0
azure-advisor

Expert knowledge for Azure Advisor development including best practices, decision making, limits & quotas, security, configuration, and integrations & coding patterns. Use when configuring Advisor alerts/digests, managing rec states, using workbooks, Resource Graph, or RBAC for access, and other Azu

Scan passed 0
azure-ai-vision

Expert knowledge for Azure AI Vision development including decision making, limits & quotas, configuration, integrations & coding patterns, and deployment. Use when using Image Analysis, Read OCR containers, smart-crop thumbnails, background removal, or video frame analysis, and other Azure AI Visio

Scan passed 0
azure-aks-edge-essentials

Expert knowledge for Azure Kubernetes Service Edge Essentials development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when managing AKS Edge/Hybrid with Arc,

Scan passed 0
azure-analysis-services

Expert knowledge for Azure Analysis Services development including troubleshooting. Use when resolving server connectivity, firewall/VNet, DNS, client connection, or network error issues, and other Azure Analysis Services related development tasks. Not for Azure Synapse Analytics (use azure-synapse-

Scan passed 0
azure-anomaly-detector

Expert knowledge for Azure AI Anomaly Detector development including troubleshooting, best practices, limits & quotas, configuration, and deployment. Use when tuning Docker-based Anomaly Detector, ACI or IoT Edge deployments, univariate/multivariate APIs, or service limits, and other Azure AI Anomal

Scan passed 0
azure-anyscale-on-azure

Expert knowledge for Azure Anyscale On Azure development including limits & quotas, security, configuration, and deployment. Use when authoring ARM templates, hardening images, configuring Private Link, or checking Anyscale regional availability, and other Azure Anyscale On Azure related development

Scan passed 0
azure-api-center

Expert knowledge for Azure Api Center development including best practices, security, configuration, integrations & coding patterns, and deployment. Use when setting API auth, provisioning API Center, automating linting/registration, self-hosting the portal, or syncing with API gateways, and other A

Scan passed 0

Related devops skillsscan passed

kubernetes-patterns

Kubernetes workload patterns, resource management, RBAC, probes, autoscaling, ConfigMap/Secret handling, and kubectl debugging for production-grade deployments. Use when writing or reviewing Kubernetes manifests, or debugging probes, RBAC, autoscaling, or resource limits.

Scan passed 0
canary

Post-deploy canary monitoring. (gstack)

Scan passed 0
workers-profiling

Profile or debug CPU usage and memory allocation in deployed Cloudflare Workers and Durable Objects. Then use this information to optimize your code.

Scan passed 0
adapter-fetch

Deploy tRPC on WinterCG-compliant edge runtimes with fetchRequestHandler() from @trpc/server/adapters/fetch. Supports Cloudflare Workers, Deno Deploy, Vercel Edge Runtime, Astro, Remix, SolidStart. FetchCreateContextFnOptions provides req (Request) and resHeaders (Headers) for context creation. The

Scan passed 0
ci-cd-and-automation

Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.

Scan passed 0
firebase-app-hosting-basics

Deploys and manages full-stack web applications (Next.js, Angular) with Server-Side Rendering (SSR) using Firebase App Hosting. Use when deploying Next.js/Angular apps, configuring apphosting.yaml or firebase.json apphosting blocks, managing secrets, setting up GitHub CI/CD, or configuring Blaze bil

Scan passed 0