generated: '2026-06-20'
method: derived
source: openapi/ (697 specs) + Azure REST reference and identity discovery documents
notes: >-
  Cross-cutting standards Azure conforms to, derived from OpenAPI security
  schemes and documented behavior. Azure uses its own error envelope, not RFC
  9457. OData is used by Azure AD / Microsoft Graph-adjacent and management query
  surfaces ($filter/$top/$skip); coverage varies by resource provider.
standards:
  - id: oauth2
    conforms: true
    evidence: OpenAPI securitySchemes type oauth2 (authorizationCode, clientCredentials, implicit); Entra ID token endpoints.
  - id: oidc
    conforms: true
    evidence: login.microsoftonline.com /.well-known/openid-configuration (200) — Entra ID v2.0 OIDC discovery.
  - id: rfc9116-security-txt
    conforms: true
    evidence: https://www.microsoft.com/.well-known/security.txt (200, MSRC).
  - id: rfc8594-sunset-header
    conforms: false
    evidence: Azure signals retirement via Azure Updates / Lifecycle Policy, not RFC 8594 Sunset headers.
  - id: rfc9457-problem-details
    conforms: false
    evidence: Uses Azure error envelope (top-level "error" object), not application/problem+json.
  - id: odata
    conforms: partial
    evidence: $filter/$top/$skip/$select query options on select management and query APIs.
  - id: pagination
    conforms: true
    evidence: value[] + nextLink continuation pattern across collection responses.
  - id: async-lro
    conforms: true
    evidence: Azure-AsyncOperation / Location + Retry-After long-running-operation protocol.
  - id: apikey
    conforms: true
    evidence: OpenAPI apiKey schemes (header/query) on several data-plane services (e.g. Cognitive Services Ocp-Apim-Subscription-Key).