Azure Security Audit
MCP Server
- Server: azure-network-mcp (shared with azure-network-ops)
- Command:
python mcp-servers/azure-network-mcp/azure_network_mcp_server.py(stdio transport) - Requires:
AZURE_TENANT_ID,AZURE_CLIENT_ID,AZURE_CLIENT_SECRET,AZURE_SUBSCRIPTION_ID - Read-only: All operations are observation-only
Relevant Tools
Primary Audit Tools
| Tool | What It Does |
|---|---|
azure_audit_nsg_compliance | Run CIS Azure Foundations Benchmark against all or specific NSGs |
azure_list_nsgs | List all NSGs with orphan detection (no subnet/NIC associations) |
azure_get_nsg_rules | Full rule list sorted by priority for a specific NSG |
azure_get_effective_security_rules | Effective aggregated rules on a NIC (all NSGs combined) |
Supporting Context Tools
| Tool | What It Does |
|---|---|
azure_get_network_watcher_status | Flow log configuration and retention checks |
azure_get_vnet_details | Subnet-to-NSG associations for VNet topology context |
azure_list_firewalls | Azure Firewall policies for layered security context |
CIS Azure Foundations Benchmark Rules
The compliance audit checks these rules from the CIS Azure Foundations Benchmark:
| Rule | Severity | What It Checks |
|---|---|---|
| 6.1 | Critical | RDP (port 3389) not open to 0.0.0.0/0 from internet |
| 6.2 | Critical | SSH (port 22) not open to 0.0.0.0/0 from internet |
| 6.3 | High | No unrestricted UDP (all ports) from internet |
| 6.4 | Medium | NSG flow logs enabled with >= 90 day retention |
Workflow: Full NSG Compliance Audit
When asked "audit NSG compliance" or "check Azure security posture":
- Discover:
azure_list_nsgs-- get all NSGs, note orphaned ones - Audit:
azure_audit_nsg_compliance-- run CIS checks against all NSGs - Deep dive: For each Critical/High finding:
azure_get_nsg_rules-- review the full rule set for context- Identify which subnets/NICs are affected via associations
- Effective rules: For critical NICs:
azure_get_effective_security_rules-- verify aggregated effective rules
- Flow logs:
azure_get_network_watcher_status-- check flow log coverage - Report: Summarize by severity, list affected resources, provide remediation steps
Workflow: Incident Response -- Suspicious Access
When investigating a potential security incident:
azure_get_effective_security_rulesfor the target NIC -- what traffic is allowed?azure_get_nsg_rulesfor each associated NSG -- which specific rules permit traffic?azure_audit_nsg_complianceon the specific NSG -- any known compliance gaps?azure_get_network_watcher_status-- check if flow logs captured the traffic- Cross-reference with azure-network-ops VNet tools for full topology context
Integration with azure-network-ops
This skill uses tools from the same azure-network-mcp server as azure-network-ops. The skills are complementary:
- azure-network-ops: Broad network topology, connectivity, and health monitoring
- azure-security-audit: Focused NSG compliance, security rule analysis, and posture assessment
Use both together for a complete Azure networking and security picture.
Important Rules
- Read-only: Never modify NSG rules, flow logs, or any Azure resources
- Severity prioritization: Always report Critical findings first, then High, Medium, Low
- Remediation guidance: Include specific remediation steps for every finding
- GAIT logging: All audit operations are logged for compliance trail
- Subscription scope: Audit can cover all NSGs or filter by specific NSG/resource group
Failure Behavior
- On a tool error (timeout, unreachable host, malformed response), report the failure and its error message directly to the user rather than fabricating or guessing at results.
- For a confirmed read-only call, check connectivity and retry once if appropriate. For any call that changes state or sends a message, a timeout does not prove the action failed: inspect current state or delivery status before retrying, preserve the required approval/change gates, and do not repeat an action whose outcome is unknown.
