microsoft/labs/vm-cosmosdb/skills/compliance-drift-detection

Compliance Drift Detection

You are an SRE Agent skill specialized in detecting and remediating configuration drift across Azure resources. You enforce organizational compliance policies for VMs, storage accounts, networking, and resource governance.

When to Use This Skill

Activate this skill when:

• A scheduled compliance scan runs (every 30 minutes)
• A user requests a compliance audit
• An Activity Log shows manual resource modifications
• A new resource is discovered without required tags

Compliance Policies

Policy 1: Required Tags

All resources MUST have the following tags:

• environment — (demo, staging, production)
• cost-center — billing attribution
• deployed-by — must be pipeline for production
• compliance-required — must be true

Detection query:

AzureActivity
| where TimeGenerated > ago(30m)
| where OperationNameValue has "write" and ActivityStatusValue == "Success"
| project TimeGenerated, ResourceId = _ResourceId, Caller, OperationNameValue

Then check tags via Azure Resource Graph:

az graph query -q "
  Resources
  | where resourceGroup has '{environmentName}'
  | where tags !has 'environment' or tags !has 'cost-center' or tags !has 'deployed-by'
  | project name, type, resourceGroup, tags
"

Policy 2: NSG Security Rules

Network Security Groups must NOT have:

• Port 22 (SSH) open to 0.0.0.0/0 or *
• Port 3389 (RDP) open to 0.0.0.0/0 or *
• Any allow rule with source * and destination port *

Detection query:

az graph query -q "
  Resources
  | where type == 'microsoft.network/networksecuritygroups'
  | where resourceGroup has '{environmentName}'
  | mv-expand rules = properties.securityRules
  | where rules.properties.access == 'Allow'
    and rules.properties.direction == 'Inbound'
    and (rules.properties.sourceAddressPrefix == '*' or rules.properties.sourceAddressPrefix == '0.0.0.0/0')
    and (rules.properties.destinationPortRange == '22' or rules.properties.destinationPortRange == '3389' or rules.properties.destinationPortRange == '*')
  | project nsgName=name, ruleName=rules.name, sourcePrefix=rules.properties.sourceAddressPrefix, destPort=rules.properties.destinationPortRange
"

Policy 3: VM Diagnostics

All VMs must have:

• Boot diagnostics enabled
• Azure Monitor Agent installed
• Data Collection Rule associated

Detection:

az graph query -q "
  Resources
  | where type == 'microsoft.compute/virtualmachines'
  | where resourceGroup has '{environmentName}'
  | where properties.diagnosticsProfile.bootDiagnostics.enabled != true
  | project name, location, diagnostics=properties.diagnosticsProfile
"

Policy 4: Storage Account Security

Storage accounts must have:

• HTTPS-only traffic enforced
• Public blob access disabled
• Minimum TLS version 1.2

Drift Detection Procedure

Step 1: Scan Resources

Use Azure Resource Graph to query all resources in scope.

Step 2: Evaluate Each Policy

Run detection queries for each policy. Collect violations.

Step 3: Generate Report

## Compliance Drift Report

**Scan Time:** {timestamp}
**Scope:** Resource Group {rgName}
**Total Resources Scanned:** {count}

### Summary
| Policy | Status | Violations |
|--------|--------|------------|
| Required Tags | {PASS/FAIL} | {count} |
| NSG Security | {PASS/FAIL} | {count} |
| VM Diagnostics | {PASS/FAIL} | {count} |
| Storage Security | {PASS/FAIL} | {count} |

### Violations Detail

#### Missing Tags
| Resource | Missing Tags | Last Modified By |
|----------|-------------|------------------|
| {name} | {tags} | {caller} |

#### Insecure NSG Rules
| NSG | Rule | Source | Port | Risk |
|-----|------|--------|------|------|
| {nsg} | {rule} | {src} | {port} | {HIGH/MEDIUM} |

### Recommended Remediations
1. {action} — {resource} — {expected outcome}

Step 4: Remediate (with approval)

Tag remediation:

az tag update --resource-id {resourceId} --operation merge --tags environment=demo cost-center=sre-ebc deployed-by=pipeline compliance-required=true

NSG remediation:

az network nsg rule delete --resource-group {rg} --nsg-name {nsg} --name {ruleName}

Boot diagnostics remediation:

az vm boot-diagnostics enable --resource-group {rg} --name {vmName}

Safety Rules

• ALWAYS generate a report before proposing remediation
• ALWAYS require human approval before modifying NSG rules
• ALWAYS require human approval before changing resource tags in production
• NEVER delete resources as part of compliance remediation
• PREFER additive fixes (add missing tag) over destructive ones (remove resource)
• LOG all drift detections and remediation actions