Azure Integration

The Azure MCP server provides universal Azure ARM API access with On-Behalf-Of (OBO) authentication.

Authentication: Azure AD OBO token exchange

Tools

azure_arm_execute

Universal ARM API tool:

Input:
  method: string - HTTP method (GET, POST, PUT, PATCH, DELETE)
  path: string - ARM API path
  api_version: string - API version
  body?: object - Request body (for POST/PUT/PATCH)
  subscription_id?: string - Subscription ID
  meta?: object - Request metadata

Output: ARM REST API response

Design Philosophy

Instead of implementing thousands of specific tools (one per Azure resource operation), the Azure MCP uses a single universal tool that can call any ARM API endpoint.

Common Operations

Resource Groups

// List resource groups
{
  method: 'GET',
  path: '/subscriptions/{subscriptionId}/resourcegroups',
  api_version: '2021-04-01'
}

// Get resource group
{
  method: 'GET',
  path: '/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}',
  api_version: '2021-04-01'
}

// Create resource group
{
  method: 'PUT',
  path: '/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}',
  api_version: '2021-04-01',
  body: {
    location: 'eastus',
    tags: { environment: 'dev' }
  }
}

Virtual Machines

// List VMs in resource group
{
  method: 'GET',
  path: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines',
  api_version: '2023-03-01'
}

// Get VM
{
  method: 'GET',
  path: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}',
  api_version: '2023-03-01'
}

// Start VM
{
  method: 'POST',
  path: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}/start',
  api_version: '2023-03-01'
}

// Stop VM
{
  method: 'POST',
  path: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}/deallocate',
  api_version: '2023-03-01'
}

Storage Accounts

// List storage accounts
{
  method: 'GET',
  path: '/subscriptions/{subscriptionId}/providers/Microsoft.Storage/storageAccounts',
  api_version: '2023-01-01'
}

// Get storage account
{
  method: 'GET',
  path: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{accountName}',
  api_version: '2023-01-01'
}

// List containers
{
  method: 'GET',
  path: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{accountName}/blobServices/default/containers',
  api_version: '2023-01-01'
}

App Services

// List web apps
{
  method: 'GET',
  path: '/subscriptions/{subscriptionId}/providers/Microsoft.Web/sites',
  api_version: '2022-03-01'
}

// Get web app
{
  method: 'GET',
  path: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}',
  api_version: '2022-03-01'
}

// Restart web app
{
  method: 'POST',
  path: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/restart',
  api_version: '2022-03-01'
}

Azure SQL

// List SQL servers
{
  method: 'GET',
  path: '/subscriptions/{subscriptionId}/providers/Microsoft.Sql/servers',
  api_version: '2021-11-01'
}

// List databases
{
  method: 'GET',
  path: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/databases',
  api_version: '2021-11-01'
}

Authentication Flow

1. User authenticates with Azure AD

2. Platform receives user's access token

3. Token exchanged via OnBehalfOfCredential

4. New token scoped to ARM API

5. Request made to Azure with user's permissions

Fallback

When no user token available:

• Uses service principal credentials

• From environment variables or managed identity

API Version

Always specify the correct API version for the resource provider. Find versions at:

• Azure REST API Reference

• Use api_version: '2023-01-01' format

Error Handling

• 401 Unauthorized: Token expired or invalid

• 403 Forbidden: User lacks permissions

• 404 Not Found: Resource doesn't exist

• 400 Bad Request: Invalid request body