Posture-Check Your Azure AI Deployments Before They Leak

Where this fits

You've just shipped a proof-of-concept using Azure OpenAI, and now it's heading to production. The PM is thrilled, but you're losing sleep over API keys hardcoded in the app, a public endpoint without any firewall, and a model version that's about to be deprecated. You need a fast, comprehensive review of the deployment's security, reliability, and cost posture—before the security team finds it first.

Why agents benefit

• Automates the Well-Architected Framework checklist – Runs targeted Azure CLI reads and Kusto queries to surface anti-patterns like shared dev/prod deployments or disabled content filtering, saving hours of manual audit.
• Identifies silent cost killers – Detects over-provisioned Provisioned Throughput Units (PTU), runaway token consumption, and 429 throttling rates, so you can right-size before the invoice arrives.
• Flags security red flags in one pass – Spots API keys instead of Managed Identity, missing diagnostic settings, and absent APIM gateway for rate limiting—common startup misconfigurations.
• Checks regional resilience – Alerts on single-region deployments, helping you plan for failover before an outage forces it.
• Produces actionable output – The skill returns severity-ranked findings, directly tied to Azure resource IDs, making remediation steps concrete for your team.

Practical scenarios

Pre-launch compliance sweep

Before a client-facing AI feature goes live, run the posture check to uncover public endpoints without firewall rules or missing Content Safety filters. The agent lists each issue with the exact CLI command to fix it—turning a manual security review into a 10-minute automated pass.

Monthly cost and quota review

Your token spend has doubled, and you're hitting 429s during peak hours. The skill queries quota limits, throttling metrics, and PTU utilization, separating what's a scaling problem from what's a configuration problem. You get a clear recommendation: move to APIM for rate limiting or adjust PTU allocation.

Post-incident reliability retro

After a regional outage took down your single-region deployment, you need a resilience audit. The posture check confirms the gap and guides you toward multi-region deployment, while also flagging deprecated model versions that might have contributed to the incident.

Add it to your agent workflow

Install directly with:

npx skills add ricmmartins/azure-sre-agent-skills --skill ai-foundry-posture-check

Then invoke the skill by asking your agent to run an AI workload health check. The agent will use its Azure CLI read tools and Kusto queries to produce a structured report. Example prompt:

Run the AI Foundry posture check on subscription 1234-5678, focusing on security and cost. List critical findings first.

Compare before adopting

Before committing, compare this skill with alternatives on three axes: quality signals—does it align with Microsoft's Well-Architected Framework and recent Foundry updates? Maintenance freshness—check the GitHub repo for recent commits and issue responses. Workflow fit—it assumes your agent already has RunAzCliReadCommands and Kusto access; confirm those are enabled in your environment.

Why it is worth tracking

With 70 stars and an active maintainer, this skill is gaining traction in the Azure SRE community. Its value grows as Foundry evolves—model versions deprecate, quota rules tighten, and cost benchmarks shift. Bookmark it and re-evaluate whenever you upgrade your AI stack or add new regions. For a more detailed breakdown, see the skill page. Tracking it now ensures you're ready for the next production audit.