Azure MCP Server

Official Microsoft MCP server that exposes 40+ Azure services to AI agents under the developer's own Entra ID credentials.

Free· Server is free and MIT-licensed. Azure resource usage is billed separately at standard Azure rates based on whatever services the agent queries or mutates.MCP Servers

Visit website →

Best for

Azure-centric engineering teams that want a GitHub Copilot, Claude Code, or Cursor agent to inspect resources, query Log Analytics/Kusto, and scaffold IaC against real subscriptions using the developer's existing Entra ID credentials.

Skip if

Multi-cloud shops that need a single MCP for AWS/GCP as well, or anyone wanting a hosted, no-Azure-account demo — you must bring your own Azure tenant, RBAC, and billing.

Azure MCP Server is Microsoft's official Model Context Protocol server for the Azure cloud, giving AI agents structured, authenticated access to more than 40 Azure services through a single MCP endpoint. It reached general availability as v2.0 and, following an August 2025 repo consolidation, is now developed inside the microsoft/mcp monorepo while the original Azure/azure-mcp repository stays live as an MIT-licensed archive that redirects new work to the new home. Coverage spans data and analytics (Cosmos DB, Azure SQL, Data Explorer/Kusto, Synapse), infrastructure (VMs, AKS, Container Apps, App Service, Virtual Desktop), security (Key Vault, RBAC, Policy, Backup, Confidential Ledger), storage (Blob, Files, Container Registry), monitoring (Azure Monitor, Log Analytics, Application Insights, Health Models), integration (Event Grid, Service Bus, Communication Services), AI/ML (Microsoft Foundry model management and knowledge indexes, Azure AI Search vector search, Speech Services), plus management primitives like Resource Groups, Subscriptions, Terraform export, Bicep, Azure Advisor, and Well-Architected Framework guidance. Authentication piggybacks on the official Azure Identity SDK, so an agent inherits whatever the developer is already signed in with via `az login`, environment credentials, managed identity, or Entra ID service principals — no long-lived tokens are stored inside the server. It ships in every distribution channel a Microsoft team is likely to touch: NuGet dotnet tool, npm package, PyPI/uvx, Docker image, and MCPB bundles for Claude Desktop, with first-class configs for VS Code (stable and Insiders), Visual Studio 2022/2026, IntelliJ, Eclipse, and Claude Code. Sovereign clouds (Azure China, Azure US Government) are supported alongside Azure Public. Typical prompts look like "list the storage accounts in resource group X," "run this KQL against my Log Analytics workspace," "show web apps that lack HTTPS-only," or "export this subscription to Terraform," and the server returns structured results the agent can reason over.

Editor's take

This is the reference implementation of what a first-party cloud MCP should look like: huge service surface, real auth, sovereign-cloud support, and packaging in every runtime a dev already has installed. The archived-then-consolidated repo history is a mild papercut, but v2.0 GA plus the microsoft/mcp home make it the default Azure MCP to reach for.

— The AI Tool Bible editorial team

Pros

✅ Broadest official Azure surface for MCP — 40+ services covering data, compute, security, monitoring, storage, and AI in one server
✅ Backed by Microsoft with GA (v2.0) status, active development in the microsoft/mcp monorepo, and MIT licensing
✅ Uses the standard Azure Identity SDK, so existing az CLI, managed identity, or Entra ID credentials just work — no bespoke token handling
✅ Ships in every distribution a dev team already uses: NuGet, npm, PyPI/uvx, Docker, MCPB, plus native configs for VS Code, Visual Studio, IntelliJ, Eclipse, and Claude Code
✅ Supports sovereign clouds (Azure China, US Government) alongside Public, which most third-party Azure integrations do not
✅ Includes higher-order helpers like Terraform export, Resource Graph queries, Well-Architected recommendations, and Cosmos DB schema inference
✅ Sensible safety posture: least-privilege RBAC, opt-out telemetry, and explicit `--dangerously-*` flags gate risky operations

Cons

⚠️ Original Azure/azure-mcp repo is archived — anyone bookmarking the old URL needs to follow the pointer to microsoft/mcp for issues and PRs
⚠️ Only useful if you live in Azure; there is no cross-cloud abstraction, so multi-cloud teams still need separate MCP servers for AWS and GCP
⚠️ Agents inherit the caller's RBAC, which means a broadly-scoped developer identity can trigger broadly-scoped destructive actions if the client lacks confirmation UX
⚠️ Telemetry is on by default and has to be disabled per environment variable, which some regulated shops will need to audit
⚠️ Coverage is wide but not always deep — some services expose only list/query verbs, so complex admin flows still fall back to the portal, az CLI, or ARM/Bicep
⚠️ MCP itself is still a young protocol; Microsoft explicitly recommends a security review before wiring the server into production automations

Use cases

Natural-language Azure resource inventoryLog Analytics and Kusto (KQL) querying from an agentCosmos DB schema inference and document lookupTerraform export of existing subscriptionsKey Vault secret and certificate inspection under RBACAzure Monitor and Application Insights triageWell-Architected Framework and Azure Advisor recommendationsAKS and Container Apps operations from Copilot/Claude CodeAzure AI Search vector index managementIaC scaffolding with Bicep and landing-zone generation