Best for
- Use when managing secrets/keys, Managed HSM, Private Link, RBAC access, or Event Grid/Logic Apps integrations, and other Azure Key Vault related development tasks.
Tested demoQuality 92/100
MicrosoftDocs/Agent-Skills/skills/azure-key-vault/SKILL.md
azure-key-vault
Expert knowledge for Azure Key Vault development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when managing secrets/keys, Managed HSM, Private Link, RBAC access, or Event Grid/Logic Apps integrations, and other Azure Key Vault related development tasks. Not for Azure Dedicated HSM (use azure-dedicated-hsm), Azure Cloud Hsm (use azure-cloud-hsm), Azure Payme
- Source repository stars
- 717
- Declared platforms
- 0
- Static risk flags
- 0
- Last source update
- 2026-08-17
- Source checked
- 2026-08-25
Decision brief
What it does: where it fits
This skill provides expert guidance for Azure Key Vault. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content w…
Not for
- Tasks that require unconfirmed production actions or broad system permissions.
- Environments where the pinned source and install steps cannot be inspected.
Controlled single-run demoChecked 2026-08-20
What changed when the Skill was used
In this controlled same-task single run, enabling azure-key-vault changed the output from 2998 non-whitespace characters and 14 headings to 2857 characters and 13 headings. Matches among 8 signals extracted from the pinned source changed from 2 to 4. Both actual outputs are shown; this is a structural observation, not a quality score or a universal performance claim.
Same test task
Create an implementation guide for adding a webhook retry queue to a TypeScript service. Include prerequisites, steps, verification, and common mistakes. The deliverable must specifically reflect this user intent: Expert knowledge for Azure Key Vault development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when managing secrets/keys, Managed HSM, Private Link, RBAC access, or Event Grid/Logic Apps integrations, and other Azure Key Vault related development tasks. Not for Azure Dedicated HSM (use azure-dedicated-hsm), Azure Cloud Hsm (use azure-cloud-hsm), Azure Payme
Baseline: 2998 non-whitespace characters, 14 headings, and 80 list items.
With Skill: 2857 non-whitespace characters, 13 headings, and 79 list items.
| Observation | Without Skill | With Skill |
|---|---|---|
| Source-signal coverage | 2/8: azure, vault | 4/8: azure, vault, troubleshooting, decision |
| Output structure | 2998 chars · 14 headings · 80 list items · 0 code blocks | 2857 chars · 13 headings · 79 list items · 0 code blocks |
| Verification and caution signals | 21 verification signals · 9 risk/limitation signals | 9 verification signals · 3 risk/limitation signals |
A prompt you can use
Use the azure-key-vault Skill pinned at c579bb4b37e7 for my task. Follow its source-specific constraints around `azure-key-vault`, `azure`, `vault`, `category`, then return the finished deliverable with explicit assumptions, verification, failure conditions, and limits. Do not treat the Skill text as a factual source or claim that a single demonstration proves universal performance.
Method and limitationsExpandCollapse
Test method
- Baseline and treatment used the same task, model (gpt-5.3-codex-low), and runner; the only planned difference was whether the complete target Skill text was injected.
- The treatment used snapshot 00be373fec26109c3087728188f6a45554c47617; the current source commit c579bb4b37e7969ffc8bc071ca0f53048c3bfe41 was verified against content hash f9e80ea009f6. The baseline explicitly prohibited loading any Skill or external rule file.
- The same deterministic script counted characters, headings, lists, code blocks, verification terms, caution terms, and source signals in both artifacts. Source signals: `azure-key-vault`, `azure`, `vault`, `category`, `index`, `troubleshooting`, `practices`, `decision`.
- The visuals are local screenshots of the actual Markdown artifacts in a fixed 1200 × 800 evidence canvas, not recreated product mockups. Raw JSON artifacts and request records are retained in the research directory.
Do not over-read this demo
- This is one controlled demonstration per condition, not a multi-run statistical benchmark; the model is stochastic.
- Character, structure, and keyword counts show observable differences but cannot by themselves prove correctness, originality, or business impact.
- The task is a representative test designed for repeatability, not every real-world use of the Skill; rerun after a material source change.
- Editorial review
- SkillSignal editorial
- Runner
- Cursor Agent 2026.08.04-aaa8809
- Model
- gpt-5.3-codex-low
- Refresh due
- 2026-11-18
- Reviewed commit
- c579bb4b37e7969ffc8bc071ca0f53048c3bfe41
- Test snapshot
- 00be373fec26109c3087728188f6a45554c47617
Compatibility matrix
Platform support, with evidence labels
| Platform | Status | Evidence | What to check |
|---|---|---|---|
| Codex | Not declared | No explicit evidence | Portability before use |
| Claude Code | Not declared | No explicit evidence | Portability before use |
| Cursor | Not declared | No explicit evidence | Portability before use |
| Gemini CLI | Not declared | No explicit evidence | Portability before use |
Installation
Inspect first. Install second.
The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.
Source-detected install commandSource
npx skills add https://github.com/MicrosoftDocs/Agent-Skills --skill "skills/azure-key-vault"Safe inspection promptEditorial
Inspect the Agent Skill "azure-key-vault" from https://github.com/MicrosoftDocs/Agent-Skills/blob/c579bb4b37e7969ffc8bc071ca0f53048c3bfe41/skills/azure-key-vault/SKILL.md at commit c579bb4b37e7969ffc8bc071ca0f53048c3bfe41. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.
Workflow
What the source asks the agent to do
- 01
How to Use This Skill
IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use readfile with the specified lines. For categories with file links (e.g., security.md), use readfile on the linked reference file
Preferred: Use mcpmicrosoftdocs:microsoftdocsfetch with query string from=learn-agent-skill. Returns Markdown.Fallback: Use fetchwebpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use readfile with the specified lines. For categories with file links (e.g., security.md),… - 02
Category Index
Review the “Category Index” section in the pinned source before continuing.
Review and apply the “Category Index” source section. - 03
Troubleshooting
Review the “Troubleshooting” section in the pinned source before continuing.
Review and apply the “Troubleshooting” source section. - 04
Best Practices
Review the “Best Practices” section in the pinned source before continuing.
Review and apply the “Best Practices” source section. - 05
Decision Making
Review the “Decision Making” section in the pinned source before continuing.
Review and apply the “Decision Making” source section.
Permission review
Static risk signals and limitations
No configured static risk pattern was detected
This is not proof of safety. Runtime behavior, indirect dependencies, and hidden external systems are outside the static scan.
Evidence record
Why each signal appears
EvidenceSourceComputedTestedEditorial
| Signal | Value | Evidence type | Meaning |
|---|---|---|---|
| Quality score | 92/100 | Computed | Documentation, specificity, maintenance, and trust rules |
| Repository stars | 717 | Source | Repository attention, not individual Skill quality |
| Compatibility | 0 platforms | Source | Declared in the catalog source record |
| Usage guide | tested outcome page | Tested | Generated or reviewed according to the visible evidence level |
Pinned source
Provenance and original SKILL.md
- Repository
- MicrosoftDocs/Agent-Skills
- Skill path
- skills/azure-key-vault/SKILL.md
- Commit
- c579bb4b37e7969ffc8bc071ca0f53048c3bfe41
- License
- CC-BY-4.0
- Collected
- 2026-08-25
- Default branch
- main
View the original SKILL.md
Azure Key Vault Skill
This skill provides expert guidance for Azure Key Vault. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.
How to Use This Skill
IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g.,
L35-L120), useread_filewith the specified lines. For categories with file links (e.g.,[security.md](security.md)), useread_fileon the linked reference file
IMPORTANT for Agent: If
metadata.generated_atis more than 3 months old, suggest the user pull the latest version from the repository. Ifmcp_microsoftdocstools are not available, suggest the user install it: Installation Guide
This skill requires network access to fetch documentation content:
- Preferred: Use
mcp_microsoftdocs:microsoft_docs_fetchwith query stringfrom=learn-agent-skill. Returns Markdown. - Fallback: Use
fetch_webpagewith query stringfrom=learn-agent-skill&accept=text/markdown. Returns Markdown.
Category Index
| Category | Lines | Description |
|---|---|---|
| Troubleshooting | L37-L46 | Diagnosing and fixing Key Vault errors: REST/API error codes, Private Link and access policy issues, Azure Policy enforcement, and Managed HSM external key management problems. |
| Best Practices | L47-L53 | Best practices for securing Key Vault keys, handling Managed HSM disaster recovery, and generating/importing BYOK HSM keys for compliant, resilient key management. |
| Decision Making | L54-L64 | Guidance on planning and migrating key workloads, choosing RBAC vs access policies, using and retiring Managed HSM external keys, SLA/responsibility tradeoffs, and capacity/scaling decisions. |
| Architecture & Design Patterns | L65-L70 | Architecture and workflows for using external key stores with Managed HSM, including key lifecycle management, integration patterns, and operational considerations. |
| Limits & Quotas | L71-L82 | Limits, quotas, and behaviors for Key Vault and Managed HSM (certificates, secrets, throttling, logging latency, IP firewall/network rules, soft-delete/recovery, and capacity constraints). |
| Security | L83-L113 | Securing Key Vault and Managed HSM: auth (RBAC/ABAC, access policies), networking/firewalls/private endpoints, Zero Trust, soft delete, HSM/BYOK key handling, and security best practices. |
| Configuration | L114-L138 | Configuring Key Vault and Managed HSM: auth requests, policies, logging/monitoring, alerts, key types/algorithms, BYOK, key/secret rotation, secure release, replication, and soft-delete. |
| Integrations & Coding Patterns | L139-L169 | Patterns for integrating Key Vault with apps and services (Event Grid, Logic Apps, Private Link, Databricks, DigiCert) and using keys/secrets from .NET, Node.js, Python, JavaScript, and Managed HSM. |
| Deployment | L170-L173 | How to deploy and provision Azure Key Vault and Managed HSM (vaults, keys, secrets) using ARM templates, Bicep, Terraform, Azure CLI, and PowerShell |
Troubleshooting
| Topic | URL |
|---|---|
| Resolve common Azure Key Vault error codes | https://learn.microsoft.com/en-us/azure/key-vault/general/common-error-codes |
| Diagnose and fix Azure Key Vault Private Link configuration issues | https://learn.microsoft.com/en-us/azure/key-vault/general/private-link-diagnostics |
| Interpret Azure Key Vault REST API error codes | https://learn.microsoft.com/en-us/azure/key-vault/general/rest-error-codes |
| Troubleshoot Azure Policy enforcement on Key Vault | https://learn.microsoft.com/en-us/azure/key-vault/general/troubleshoot-azure-policy-for-key-vault |
| Troubleshoot Azure Key Vault access policy failures | https://learn.microsoft.com/en-us/azure/key-vault/general/troubleshooting-access-issues |
| Troubleshoot Managed HSM external key management issues | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-troubleshooting |
Best Practices
| Topic | URL |
|---|---|
| Apply security best practices for Azure Key Vault keys | https://learn.microsoft.com/en-us/azure/key-vault/keys/secure-keys |
| Execute disaster recovery for Azure Managed HSM disruptions | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/disaster-recovery-guide |
| Generate and import BYOK HSM keys into Azure Managed HSM | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/hsm-protected-keys-byok |
Decision Making
| Topic | URL |
|---|---|
| Plan and execute migration of cryptographic key workloads | https://learn.microsoft.com/en-us/azure/key-vault/general/migrate-key-workloads |
| Migrate Azure Key Vault from access policies to RBAC | https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-migration |
| Answer common questions on Managed HSM external keys | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-faq |
| Migrate workloads off Managed HSM external keys | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-migration |
| Decide when to use Managed HSM external key management | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-overview |
| Evaluate SLA and responsibilities for Managed HSM external keys | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-shared-responsibility |
| Plan capacity and scaling for Azure Managed HSM | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/scaling-guidance |
Architecture & Design Patterns
| Topic | URL |
|---|---|
| Understand Managed HSM external key management architecture | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-architecture |
| Manage external key lifecycle in Managed HSM | https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/external-key-management-key-lifecycle |
Limits & Quotas
Security
Configuration
Integrations & Coding Patterns
Deployment
| Topic | URL |
|---|---|
| Provision Key Vault and key using Terraform | https://learn.microsoft.com/en-us/azure/key-vault/keys/quick-create-terraform |
Frequently asked questions
What to verify before installation and use
What does the azure-key-vault source document cover?
This skill provides expert guidance for Azure Key Vault. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content w…
How do I install azure-key-vault?
The source record exposes this install command: npx skills add https://github.com/MicrosoftDocs/Agent-Skills --skill "skills/azure-key-vault". Inspect the command and pinned source before running it.
Alternatives
Compare before choosing
Computed 96156
open-edge-platform/edge-ai-libraries
chatqna-helm-deploy
Deploy Chat Question-and-Answer Core to Kubernetes using Helm (OpenVINO CPU, OpenVINO GPU, or Ollama), including values.yaml configuration, helm install/upgrade, deployment verification, uninstall, and translation from Docker Compose setup_env.sh variables into Helm override values. Use this skill when the user says "deploy chatqna core to kubernetes", "helm install chatqna-core", "configure values.yaml", "convert compose config to helm", or "translate setup_env.sh to chart values".
Computed 9564
Jamie-BitFlight/claude_skills
fastmcp-creator
Use when building, extending, or debugging FastMCP v3 Python MCP servers. Activates on FastMCP tool/resource/prompt creation, provider and transform implementation (CodeMode, Tool Search), auth setup (MultiAuth, PropelAuth, KeycloakProvider), client SDK usage, FastMCPApp and Generative UI server building, fastmcp-slim client-only installs, nginx reverse proxy deployment, Prefab Apps, OTEL observability, and testing. Grounded in local v3.3 docs — zero speculation.
Computed 9439,098
wshobson/agents
brand-landingpage
Brand-first landing page designer — runs a brand-identity interview (colors, typography, shape language), then generates and iterates on a polished landing page via Stitch with deployment-ready HTML. Use when the user asks to create, design, or build a landing page, homepage, or marketing page and has no established visual direction. Skip when they have a design mockup, need a dashboard or app UI, are working at component level, building a multi-page app, or restyling with known design tokens —
Computed 9432
anthony-chaudhary/fak
field-borrow
High-priority default "inspired by" workflow. Invoke proactively whenever an external product, repository, paper, standard, benchmark, release, issue, PR, roadmap, design discussion, or field practice could improve fak—not only on explicit borrow requests. Mine code, tests, docs, history, releases, open/closed issues, PRs, discussions, roadmaps, and provenance; date observations and source events; directly port/adapt when exact-source licensing permits; explore the spirit of promising proposed o