Azure Security Audit

This skill provides rules for auditing and hardening Azure infrastructure security. Rules are ordered by impact: CRITICAL rules prevent data breaches or unauthorized access; HIGH rules prevent common security misconfigurations; MEDIUM rules improve security posture and compliance readiness.

Learned Patterns (Auto-Updated)

Before applying the rules below, check if LESSONS.md exists in the project root. If it does, read the section tagged with azure-security-audit and apply those project-specific lessons alongside the rules below.

Category 1: Identity & Access Security (CRITICAL)

Rule 1: Migrate Key Vault from Access Policies to RBAC

Impact: CRITICAL — Access policies grant vault-wide permissions with no audit trail. RBAC provides granular, auditable access.

❌ Wrong: