What it does

Wraps the Azure REST API as MCP tools. Tools cover resource enumeration (list_subscriptions, list_resource_groups, list_resources), per-service operations (Cosmos DB queries, Storage blob ops, Key Vault secret retrieval, Log Analytics queries), and management plane changes (start/stop VMs, update tags).

When you actually need it

If your infra is on Azure and you want an agent that can answer questions or take actions across it. Common patterns:

1. “What’s running in resource group X right now?” Agent enumerates, returns a structured summary.
2. Log analytics queries from natural language. Agent translates “why was the API slow yesterday” into a KQL query, runs it, summarises the result.
3. Tag governance. Agent finds resources missing required tags, drafts the tag updates, waits for approval, applies.
4. Cost investigation. Agent pulls cost data, identifies anomalies, drafts a writeup.

Setup

Three auth options — pick for your deployment:

• Azure CLI auth (development): the agent inherits whatever az login produced. Works locally; not for production.
• Managed identity (preferred for production agents): no secrets at rest, scope via RBAC.
• Service principal (for CI / cross-cloud): client ID + secret in env. Workable; rotate often.

"azure": {
  "command": "npx",
  "args": ["-y", "@azure/mcp"],
  "env": {
    "AZURE_TENANT_ID":     "…",
    "AZURE_CLIENT_ID":     "…",
    "AZURE_CLIENT_SECRET": "…",
    "AZURE_SUBSCRIPTION_ID": "…"
  }
}

The catch

Azure RBAC is the safety lever. The agent’s permissions are exactly what the auth principal has — no more, no less. Two non-negotiables:

1. Scope the role assignment narrowly. “Reader on one resource group” for explore-only agents. Custom roles with specific Microsoft.Storage/*/read actions for narrower needs. Never Owner or Contributor at the subscription level.
2. Pair with Conditional Access. Block authentication from countries you don’t operate in, require trusted networks, require device compliance. The agent’s effective blast radius drops to “what this principal can do, FROM these network locations”.

For agents that write (start VMs, update configurations, write to Key Vault), add a host-level approval gate so destructive Azure ops require explicit per-call confirmation.