Template MCP Server

The Azure MCP Server is Microsoft's server for working with Azure from an AI agent. It covers dozens of services, from Storage and Key Vault to AKS, Monitor and Cosmos DB, and runs under your own Azure sign-in. The old Azure/azure-mcp repository was archived in August 2025. The maintained code now lives in microsoft/mcp, under MIT. We checked it on 31 October 2026.

Where the old repo went

This is the question that sends people to this page, so we answer it first.

The old README says the archive happened on 25 August 2025 and that "the Azure MCP team is using github.com/microsoft/mcp to develop the code and issues formerly in this repository". Open issues there, not in the old repo. The microsoft/mcp repository is a catalog of official Microsoft MCP servers, and the Azure one is the biggest part of it.

Quick facts

The latest version is a beta. The README does not hide that, since the version number says it. For a tool that can change cloud resources, read that as a reason to start read-only.

What it does

The README opens with a plain claim: "Azure MCP Server supercharges your agents with Azure context across numerous Azure services." In practice an agent can list your storage containers, query a Cosmos DB account, read Key Vault entries your identity may see, check Advisor recommendations or look at Monitor logs, then act on them.

The service list in the README is long. It includes Microsoft Foundry, Azure Advisor, AI Search, Speech, App Configuration, App Service, Backup, Communication Services, Compute, Container Apps, Container Registry, Cosmos DB, Data Explorer, Database for PostgreSQL, Event Grid, Event Hubs, File Shares, Key Vault, AKS, Managed Grafana, Monitor, NetApp Files, Quota, Resource Health, Retail Pricing, SQL Database, SignalR, Storage, Migrate, Resource Manager, Terraform, the Well-Architected Framework and Workbooks. We did not count tools.

Some entries stand out. There is an Azure CLI Generate tool and an Azure Terraform tool, which help an agent write commands and infrastructure code. There is a Retail Pricing tool that does not touch your resources. There is an SRE Agent entry. The Advisor section lists prompts such as "What should I fix first? Show my top 10 Advisor recommendations" and also actions such as marking a recommendation completed or dismissing it, which are writes.

Example prompts, sorted by risk

The README lists many sample prompts per service. We sorted a few by what they do to your account.

With --read-only, the first three work and the rest should be refused. That split is a good way to test that your setup does what you think. Run a read prompt, then a write prompt, and confirm the write fails.

Server modes

With dozens of services, tool count would crowd an agent's context. The server has three modes to handle that, shown in the commands reference and the VS Code settings.

You can also filter which services load. In the VS Code extension the setting is azureMcp.enabledServices, for example storage and Key Vault only. On the command line, azmcp server start takes one --namespace flag per service, such as --namespace storage --namespace keyvault, per the commands reference.

What it costs

The server is free and MIT licensed. What it does costs whatever the Azure resources cost. Creating a Cosmos DB account or deploying a model in Foundry through the agent is billed like any other creation. The Retail Pricing tool can help an agent check price before it acts. The server itself does not add a fee, as far as the pages we read say.

Authentication

Microsoft's Authentication guide explains the two transports.

For local use the server walks a chain and uses the first credential that works: environment credentials, Visual Studio, VS Code, Azure CLI, Azure PowerShell, Azure Developer CLI, then an interactive browser sign-in. You can pin one credential by setting AZURE_TOKEN_CREDENTIALS, for example to AzureCliCredential. Set AZURE_MCP_ONLY_USE_BROKER_CREDENTIAL=true to use the OS broker (Web Account Manager on Windows) only.

Whatever credential wins, the identity needs the right Azure RBAC roles. The guide's example is Storage Blob Data Reader for storage reads. This is the key control. The agent can do what your identity can do, no more.

For pipelines, the guide suggests workload identity federation through an Azure Resource Manager service connection on Azure Pipelines, and AZURE_CLIENT_ID, AZURE_CLIENT_SECRET and AZURE_TENANT_ID for other CI systems.

Install it in each agent

Sign in to Azure first. The README says to authenticate before running the server, and the quickest local route is az login. Microsoft documents VS Code, Visual Studio, IntelliJ, Eclipse, Antigravity, Claude Code and GitHub Copilot CLI. Codex and OpenCode lines are our adaptation.

Claude Code

From the README, the Azure plugin bundles the server with Azure-related agents and skills:

/plugin install azure@claude-plugins-official

By hand, our adaptation:

claude mcp add azure -- npx -y @azure/mcp@latest server start

Antigravity

From the README, in mcp_config.json (global file ~/.gemini/config/mcp_config.json, workspace file .agents/mcp_config.json):

{
  "mcpServers": {
    "azure-mcp-server": {
      "command": "npx",
      "args": ["-y", "@azure/mcp@latest", "server", "start"]
    }
  }
}

The README also describes the route through the agent side panel: MCP Servers, Manage MCP Servers, View raw config. Gemini CLI is Code Assist enterprise only now, so we skip it.

Cursor

The same Node entry works in ~/.cursor/mcp.json. The README gives it as the generic mcp.json option:

{
  "mcpServers": {
    "azure-mcp-server": {
      "command": "npx",
      "args": ["-y", "@azure/mcp@latest", "server", "start"]
    }
  }
}

The README also offers a .NET route with dnx Azure.Mcp (needs the .NET 10 SDK) and a Python route with uvx.

Codex

Our adaptation, in ~/.codex/config.toml:

[mcp_servers.azure]
command = "npx"
args = ["-y", "@azure/mcp@latest", "server", "start", "--read-only"]

The --read-only flag is in the commands reference. Remove it when you are ready for writes.

OpenCode

Our adaptation, in opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "azure": {
      "type": "local",
      "command": ["npx", "-y", "@azure/mcp@latest", "server", "start", "--read-only"]
    }
  }
}

VS Code and others

The README's recommended route is the VS Code extension (ms-azuretools.vscode-azure-mcp-server), which exposes azureMcp.serverMode, azureMcp.enabledServices and azureMcp.readOnly. It also covers Visual Studio 2022 and 2026, IntelliJ IDEA, Eclipse and the GitHub Copilot CLI. For field names across agents, see MCP clients.

Remote setup

Some clients need HTTP, such as Microsoft Foundry and Copilot Studio, and teams may want one shared deployment. The README says you can host the server as a remote endpoint and points to azd templates in the repository. Inbound requests then carry Entra ID bearer tokens.

Security notes

• Your identity is the boundary. The server acts as you. Use a least-privilege identity and Azure RBAC for the job. A reader role is a better start than Contributor.
• Read-only. Start with --read-only. It blocks write operations.
• Beta software. Version 4.0.0-beta.4 may change tool names and behaviour.
• SSRF settings. The extension includes azureMcp.dangerouslyDisableSsrfProtectionsByNamespace, with the README's own warning to use it only if you understand the risk. Leave it alone. The CLI form is --dangerously-disable-ssrf-protections-by-namespace.
• Support logs. The --dangerously-write-support-logs-to-dir option writes diagnostic logs. Treat the files as sensitive.
• Secrets. Key Vault tools can read secrets your identity may read. Anything read goes to the model provider.
• Prompt injection. Log lines, tags, blob contents and database rows are data written by others. Do not let an agent that reads them also hold broad write rights.
• Sovereign clouds. Use --cloud AzureChinaCloud or AZURE_CLOUD to point at China or US Government clouds, and sign in to that cloud first.
• Telemetry. The README says telemetry is on by default, with a stream to your own Application Insights resource if you set a connection string and a separate stream to Microsoft. Set AZURE_MCP_COLLECT_TELEMETRY=false to turn all of it off, or AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT=false to stop only the Microsoft stream.

Limits and known issues

• The latest build is a beta.
• The README warns that the tool list is large, so use namespace mode or filter services.
• RBAC errors are the most common failure, and the fix is a role assignment, not a server setting.
• Package choice affects prerequisites: .NET 10 SDK for dnx, Node.js LTS for npx, uv for uvx.
• Some clients need the remote setup, which means hosting something yourself.

Alternatives

Which agents it suits

Claude Code has a plugin. VS Code, Visual Studio and IntelliJ have first-class routes, since Microsoft builds for its own editors first. Antigravity is documented. Codex, Cursor and OpenCode use the generic stdio entry. If your agent runs in a hosted environment that cannot run npx, plan for the remote setup.

Our take

This is the right place to start for Azure work, and moving to microsoft/mcp is a sign the team is investing in it. The service coverage is broad, the modes handle tool count, authentication reuses the tools you already sign in with, and there is a real read-only switch.

Our caution is about the beta label and the breadth. A server that can reach 40-odd services is a lot of surface for an agent. We would run it read-only, with namespace mode and only the services you need, using a reader identity. Add write rights for one resource group at a time.

This is our reading of the documentation, not a hands-on test.

A short setup checklist

1. Sign in with az login, or pick another credential.
2. Check your identity's RBAC roles on the target resources.
3. Add the server to your agent with --read-only.
4. Filter services to what you need.
5. Ask for a list of storage containers or resource groups.
6. Check for any beta changes in the release notes before updating.
7. Move to write access for one scope only.
8. Review activity in the Azure Activity Log.

See also the MCP server list and best MCP servers.

Frequently asked questions

Where did the Azure/azure-mcp repository go?

It was archived on 25 August 2025. Development continues in microsoft/mcp.

How do I install the Azure MCP Server?

Add npx -y @azure/mcp@latest server start as a stdio server, or use the Claude Code plugin or VS Code extension. Sign in to Azure first.

Can I stop it making changes?

Yes, with --read-only. Azure RBAC on your identity applies too.

How does it authenticate?

Locally, through a chain of developer credentials ending in an interactive browser sign-in.

Is it open source?

Yes. microsoft/mcp is MIT licensed.