federalavd-compliance-review

Review FederalAVD configuration evidence against documented NIST, FedRAMP High, DoD IL4 or IL5, CMMC, HIPAA, CJIS, StateRAMP, IRS 1075, ISO 27001, or Zero Trust mappings. Use when assessing parameter files, identifying control gaps, or producing a control-to-feature evidence table.

Jump to install

Repository: Azure/FederalAVD
Last source activity: August 18, 2026 at 18:24
Detected SKILL.md language: English
Stars: 17
Forks: 19

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/Azure/FederalAVD --skill federalavd-compliance-review

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

3 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

federalavd-bicep-maintenance

Modify and validate FederalAVD Bicep templates, generated ARM JSON, parameters, and uiFormDefinition files. Use when changing deployment resources, adding parameters or outputs, synchronizing Bicep with JSON, publishing Template Specs, or debugging portal form behavior.

2026-08-20

avd-alert-kql-validation

Create and review KQL for the FederalAVD AVD Alerts add-on. Use when adding or changing scheduled query alerts, comparing alert logic with Microsoft AVD Insights workbooks, investigating query failures, or documenting intentional workbook deviations.

2026-08-18

federalavd-air-gapped-readiness

Review FederalAVD deployments and image artifacts for Azure Government Secret or Top Secret air-gapped readiness. Use when auditing downloads.json, finding public network dependencies, preparing transfer inventories, validating pre-staged files, or checking that image builds and host pools avoid internet runtime downloads.

2026-08-18

View all from this repository

FederalAVD Compliance Review

This skill produces engineering evidence, not an authorization, attestation, or certification.

Procedure

Ask for the target framework, impact level, Azure cloud, workload type, and all deployment parameter files in scope.

Read docs/compliance.md as the repository authority and verify cited external framework or Azure requirements against current official sources when the conclusion depends on them.

Collect relevant parameter evidence across all supplied files:

& .github/skills/federalavd-compliance-review/scripts/Get-ComplianceParameterEvidence.ps1 `
  -ParameterPath <security-parameters>,<image-management-parameters>,<host-pool-parameters>

Separate controls into automatic, configurable, partial, external, and out of scope. Do not describe a configurable control as implemented without parameter or deployed-resource evidence.

Map each control to the exact Bicep resource, parameter value, diagnostic setting, policy, or external responsibility that provides evidence.

Account for conditional applicability such as pooled versus personal backup, Commercial versus Government regions, and Dedicated Host requirements in IL5 Government regions.

Surface documented gaps, including supplemental Windows Security event collection, MFA and Conditional Access, SIEM integration, ASR where required, and organizational procedures.

Identify absent or conflicting parameter evidence as Not verified, not automatically non-compliant. Defaults must be confirmed in the exact deployed template version.

Produce a table with control, requirement, implementation type, evidence, status, gap, and owner.

State the review scope, source versions or retrieval dates, assumptions, and required assessor validation. Never claim that FederalAVD alone guarantees compliance.

See review boundaries before reporting conclusions.