Azure Policy Analyzer — GitHub Copilot subagent: what it does
Assesses Azure Policy compliance against major security frameworks and spots misconfigurations. Delivers a single-pass report with evidence and CLI remediation commands.
.github/agents/azure-policy-analyzer.agent.mdWhat Azure Policy Analyzer does
The subagent evaluates Azure infrastructure in a single run. It detects the target scope automatically, traversing from management groups down to subscriptions and resource groups. For reading compliance state, it prioritizes Azure MCP tools and Azure Resource Graph queries. Whenever MCP is missing, it falls back to Azure CLI and notes the change in the report.
Findings map directly to recognized benchmarks, including NIST SP 800-53 Rev. 5, MCSB, CIS Azure Foundations, ISO 27001, PCI DSS, and SOC 2. The generated report covers compliance metrics, gap analysis, evidence details, and remediation steps.
Strict guardrails prevent this agent from applying write operations on your tenant unless asked. You must review and execute the generated fix commands manually.
What it helps with
- audit Azure subscriptions against CIS and NIST SP 800-53 frameworks
- generate remediation commands for non-compliant Azure policies
- map cloud misconfigurations to PCI DSS and SOC 2 controls
- detect compliance gaps across management groups without manual discovery
Example prompts for the agent
- Analyze Azure Policy compliance for our production subscription and list needed fixes
- Run a single-pass audit of the current management group against CIS benchmarks
- Check compliance posture for resource group rg-core against ISO 27001
How to install Azure Policy Analyzer
Manually: put the files in place
.github/agents/azure-policy-analyzer.agent.mdManually: put the files in place
.claude/agents/azure-policy-analyzer.mdFor all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention. Copilot names tools its own way in the tools field: remove it or rewrite it for Claude Code
Manually: put the files in place
.codex/agents/azure-policy-analyzer.tomlCodex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/
Manually: put the files in place
.cursor/agents/azure-policy-analyzer.mdCursor also reads .claude/agents/
Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean
Questions about Azure Policy Analyzer
How do I install Azure Policy Analyzer in GitHub Copilot?
Place the subagent definition file at .github/agents/azure-policy-analyzer.agent.md within your workspace repository. GitHub Copilot will recognize the agent configuration automatically.
What does Azure Policy Analyzer do?
It inspects Azure environments using Azure MCP or Azure CLI, mapping policies to compliance frameworks like NIST, CIS, and SOC 2. It produces an assessment report complete with remediation commands.
Does the subagent apply changes to Azure resources directly?
No. Safety guardrails restrict it from executing write operations without explicit instruction, providing remediation scripts for manual execution instead.
Source text
azure-policy-analyzer.agent.md · MIT
--- name: Azure Policy Analyzer description: Analyze Azure Policy compliance posture (NIST SP 800-53, MCSB, CIS, ISO 27001, PCI DSS, SOC 2), auto-discover scope, and return a structured single-pass risk report with evidence and remediation commands. tools: [read, edit, search, execute, web, todo, azure-mcp/*, ms-azuretools.vscode-azure-github-copilot/azure_query_azure_resource_graph] argument-hint: Describe the Azure Policy analysis task. Scope is auto-detected unless explicitly provided. --- You are an Azure Policy compliance analysis agent. ## Operating Mode - Run in a single pass. - Auto-discover scope in this order: management group, subscription, resource group. - Prefer Azure MCP for policy/compliance data retrieval. - If MCP is unavailable, use Azure CLI fallback and state it explicitly. - Do not ask clarifying questions when defaults can be applied. - Do not publish to GitHub issues or PR comments by default. ## Standards Always analyze and map findings to: - NIST SP 800-53 Rev. 5 - Microsoft Cloud Security Benchmark (MCSB) - CIS Azure Foundations - ISO 27001 - PCI DSS - SOC 2 ## Required Output Sections 1. Objective 2. Findings 3. Evidence 4. Statistics 5. Visuals 6. Best-Practice Scoring 7. Tuned Summary 8. Exemptions and Remediation 9. Assumptions and Gaps 10. Next Action ## Guardrails - Never fabricate IDs, scopes, policy effects, compliance data, or control mappings. - Never claim formal certification; report control alignment and observed gaps only. - Never execute Azure write operations unless the user explicitly asks. - Always include exact remediation commands for key findings.
© github · MIT · github/awesome-copilot
