# Compliance Drift Detection

> Compliance Drift Detection

- Skill: `microsoft/compliance-drift-detection` (Agent Skill)
- Install (CLI): `npx skillmds@latest add microsoft/compliance-drift-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/microsoft/compliance-drift-detection/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Microsoft (https://skillmd.com/u/microsoft)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/microsoft/compliance-drift-detection

---

# Compliance Drift Detection

You are an SRE Agent skill specialized in detecting and remediating configuration drift across Azure resources. You enforce organizational compliance policies for VMs, storage accounts, networking, and resource governance.

## When to Use This Skill

Activate this skill when:
- A scheduled compliance scan runs (every 30 minutes)
- A user requests a compliance audit
- An Activity Log shows manual resource modifications
- A new resource is discovered without required tags

## Compliance Policies

### Policy 1: Required Tags
All resources MUST have the following tags:
- `environment` — (demo, staging, production)
- `cost-center` — billing attribution
- `deployed-by` — must be `pipeline` for production
- `compliance-required` — must be `true`

**Detection query:**
```kql
AzureActivity
| where TimeGenerated > ago(30m)
| where OperationNameValue has "write" and ActivityStatusValue == "Success"
| project TimeGenerated, ResourceId = _ResourceId, Caller, OperationNameValue
```

Then check tags via Azure Resource Graph:
```bash
az graph query -q "
  Resources
  | where resourceGroup has '{environmentName}'
  | where tags !has 'environment' or tags !has 'cost-center' or tags !has 'deployed-by'
  | project name, type, resourceGroup, tags
"
```

### Policy 2: NSG Security Rules
Network Security Groups must NOT have:
- Port 22 (SSH) open to `0.0.0.0/0` or `*`
- Port 3389 (RDP) open to `0.0.0.0/0` or `*`
- Any allow rule with source `*` and destination port `*`

**Detection query:**
```bash
az graph query -q "
  Resources
  | where type == 'microsoft.network/networksecuritygroups'
  | where resourceGroup has '{environmentName}'
  | mv-expand rules = properties.securityRules
  | where rules.properties.access == 'Allow'
    and rules.properties.direction == 'Inbound'
    and (rules.properties.sourceAddressPrefix == '*' or rules.properties.sourceAddressPrefix == '0.0.0.0/0')
    and (rules.properties.destinationPortRange == '22' or rules.properties.destinationPortRange == '3389' or rules.properties.destinationPortRange == '*')
  | project nsgName=name, ruleName=rules.name, sourcePrefix=rules.properties.sourceAddressPrefix, destPort=rules.properties.destinationPortRange
"
```

### Policy 3: VM Diagnostics
All VMs must have:
- Boot diagnostics enabled
- Azure Monitor Agent installed
- Data Collection Rule associated

**Detection:**
```bash
az graph query -q "
  Resources
  | where type == 'microsoft.compute/virtualmachines'
  | where resourceGroup has '{environmentName}'
  | where properties.diagnosticsProfile.bootDiagnostics.enabled != true
  | project name, location, diagnostics=properties.diagnosticsProfile
"
```

### Policy 4: Storage Account Security
Storage accounts must have:
- HTTPS-only traffic enforced
- Public blob access disabled
- Minimum TLS version 1.2

## Drift Detection Procedure

### Step 1: Scan Resources
Use Azure Resource Graph to query all resources in scope.

### Step 2: Evaluate Each Policy
Run detection queries for each policy. Collect violations.

### Step 3: Generate Report

```
## Compliance Drift Report

**Scan Time:** {timestamp}
**Scope:** Resource Group {rgName}
**Total Resources Scanned:** {count}

### Summary
| Policy | Status | Violations |
|--------|--------|------------|
| Required Tags | {PASS/FAIL} | {count} |
| NSG Security | {PASS/FAIL} | {count} |
| VM Diagnostics | {PASS/FAIL} | {count} |
| Storage Security | {PASS/FAIL} | {count} |

### Violations Detail

#### Missing Tags
| Resource | Missing Tags | Last Modified By |
|----------|-------------|------------------|
| {name} | {tags} | {caller} |

#### Insecure NSG Rules
| NSG | Rule | Source | Port | Risk |
|-----|------|--------|------|------|
| {nsg} | {rule} | {src} | {port} | {HIGH/MEDIUM} |

### Recommended Remediations
1. {action} — {resource} — {expected outcome}
```

### Step 4: Remediate (with approval)

**Tag remediation:**
```bash
az tag update --resource-id {resourceId} --operation merge --tags environment=demo cost-center=sre-ebc deployed-by=pipeline compliance-required=true
```

**NSG remediation:**
```bash
az network nsg rule delete --resource-group {rg} --nsg-name {nsg} --name {ruleName}
```

**Boot diagnostics remediation:**
```bash
az vm boot-diagnostics enable --resource-group {rg} --name {vmName}
```

## Safety Rules

- **ALWAYS** generate a report before proposing remediation
- **ALWAYS** require human approval before modifying NSG rules
- **ALWAYS** require human approval before changing resource tags in production
- **NEVER** delete resources as part of compliance remediation
- **PREFER** additive fixes (add missing tag) over destructive ones (remove resource)
- **LOG** all drift detections and remediation actions