Microsoft’s official Azure MCP Server covers an unusually wide surface — Storage, Cosmos DB, Key Vault, Monitor, AKS, App Service, SQL, Service Bus and dozens more — all through your existing Azure credentials and enforced by the same RBAC that governs everything else in the subscription.
Bring your own
Claude Sonnet 4.5
Chat with 60+ AI models on the same workflow — switch to a different model mid-conversation and re-run the same prompt, or use Compare mode to put several side-by-side and balance quality vs. cost.
Your existing Azure identity via az login or a managed identity. The agent gets exactly your RBAC permissions — no more, no less.
How models use it and what it is built for.
Rather than a fixed tool list, the server is organised into service namespaces — `storage`, `cosmos`, `keyvault`, `monitor`, `aks`, `sql` and many others — and you choose how many to expose. That matters more here than on most servers: the full surface is far larger than any model handles well, so the `--namespace` option lets you expose only the services a given agent needs, and `--mode` controls whether tools are presented individually or consolidated per namespace. Authentication uses your Azure CLI login or a managed identity, so the agent inherits your RBAC permissions exactly — there is no separate token to scope, and no way for it to exceed what your account can already do. Two safety features are worth knowing about: `--read-only` refuses every write operation server-side, and elicitation forces an explicit user confirmation before any tool returns a secret, such as a Key Vault password or a connection string. Beyond resource management, the server also carries advisory tools — Azure best practices, Well-Architected Framework guidance, Bicep schemas and Terraform module discovery — that answer design questions without touching a subscription.
Typical tools an AI model can call. Exact names vary by version.
Taken from the official Azure documentation — see Azure MCP Server — Microsoft Learn documentation for the full reference.
Environment variables
AZURE_SUBSCRIPTION_IDDefault subscription for operations. Falls back to your Azure CLI profile if unset.
Client configuration
npx, read-only and scoped to a few namespaces
The recommended starting point. --read-only blocks every write server-side, and limiting namespaces keeps the tool list small enough for reliable selection.
{
"mcpServers": {
"azure": {
"command": "npx",
"args": [
"-y", "@azure/mcp@latest", "server", "start",
"--read-only",
"--namespace", "storage",
"--namespace", "monitor",
"--namespace", "group"
]
}
}
}Full surface
Every namespace, writes included. Run az login first — the server uses that identity.
{
"mcpServers": {
"azure": {
"command": "npx",
"args": ["-y", "@azure/mcp@latest", "server", "start"]
}
}
}Copy any of these into MCP Agent Studio after connecting.
Show me all my resource groups and which ones have no resources in them.
Query my Log Analytics workspace for errors in the last hour and group them by service.
List the blobs in the documents container and tell me the total size.
Which of my Cosmos DB containers have the highest provisioned throughput?
This is not a single-model product: you get the same MCP connection with 60+ models (Claude, GPT, Gemini, DeepSeek, open-weight, and more), you can switch mid-conversation, and you can open Compare mode to run the same prompt against multiple models at once. The card above is a suggested starting point for this server — not the only choice.
Default pick for Azure
Claude Sonnet 4.5
The tool surface here is large and the parameters are fiddly — subscription, resource group, tenant. Sonnet 4.5 tracks that context across a conversation instead of re-asking.
Listing tools proves the server is reachable, not that a model can work with it. Evals go further: they read every tool on the server, write a test suite from its real schemas, and run it — code decides pass/fail on the responses (schema conformance, error codes, pagination, result caps) while a scoring model grades plain-English tasks driven through the tools.
Get a pass/fail report per tool with the evidence behind each verdict — and replay the same suite after every schema change. Destructive tools are excluded from the run.
Run evalsOpen MCP Agent Studio with the connection pre-filled. Add your token, pick any of 60+ models, and start chatting — no install required.
Open Agent StudioCommon questions about connecting, scoping and using it safely.
It is Microsoft’s official MCP server for Azure, distributed as @azure/mcp. It exposes more than fifty Azure services — storage, databases, Key Vault, Monitor, AKS, messaging and more — as tools an AI agent can call using your existing Azure credentials.
Development happens in github.com/microsoft/mcp, under servers/Azure.Mcp.Server. The older Azure/azure-mcp repository was archived in August 2025, so links pointing there — including many third-party server listings — are out of date.
Through your Azure identity: the CLI login from az login, or a managed identity when running in Azure. Access is enforced by Azure RBAC, so the agent can do exactly what your account can do. There is no separate API key to issue or rotate.
Only with an explicit confirmation. Tools that return secrets, connection strings or certificate private keys trigger an elicitation prompt in your client before they run. The --disable-user-confirmation flag removes that check, which Microsoft recommends against outside trusted automation.
No. The full tool surface is much larger than most models handle reliably, and accuracy drops as the list grows. Use --namespace to expose only the services a given agent actually needs, and add --read-only until you are confident in its behaviour.