Official Microsoft Azure MCP server that connects Claude and other MCP clients to Azure subscriptions, resource groups, storage, databases, Key Vault, Monitor, App Service, AKS, AI Search, Cosmos DB, RBAC, pricing, and other Azure services through local stdio or self-hosted HTTP transports.
Start in read-only mode and narrow the exposed namespaces or individual tools before enabling broader Azure access. Microsoft documents read-only mode, namespace filters, single-tool mode, and learn mode as controls for reducing the active MCP surface., Azure MCP tools can inspect and manage real cloud resources. Depending on the tool and RBAC role, actions can create, update, delete, deploy, restart, query, or reconfigure resources and can incur cloud spend., Keep human approval on destructive, cost-bearing, deployment, RBAC, Key Vault, database, storage, messaging, and production-environment actions. Do not disable user confirmation for high-risk or sensitive-data commands unless the automation environment is tightly controlled., The server authenticates with Azure credentials available to the local machine or hosted environment. Limit the credential chain with `AZURE_TOKEN_CREDENTIALS`, managed identities, service principals, and least-privilege Azure RBAC where practical., For self-hosted HTTP deployments, configure Entra ID inbound authentication, outbound authentication strategy, network exposure, logging, and per-user versus server-identity audit requirements before sharing the endpoint., Docker setup uses Azure credential environment variables such as `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, and `AZURE_CLIENT_SECRET`; protect those values and never commit the env file., Microsoft documents telemetry environment variables for the server. Review `AZURE_MCP_COLLECT_TELEMETRY` and `AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT` before using the server in sensitive environments., This is the Azure services MCP server. It is distinct from the Azure DevOps MCP server, which focuses on work items, repositories, pull requests, pipelines, wikis, and test plans.
Privacy notes
Tool results can expose tenant IDs, subscription IDs, resource groups, resource names, tags, deployment outputs, Azure Monitor logs, metrics, pricing data, quotas, RBAC assignments, policy data, app settings, database metadata, storage account and blob metadata, and service-specific configuration., Key Vault, App Configuration, Storage, database, Service Bus, Event Hubs, Communication Services, and deployment tools may expose secrets, connection strings, keys, certificates, message contents, sample records, or customer data when the authenticated identity has permission., Microsoft documents user confirmation for tools that handle sensitive data, including Key Vault secrets, connection strings, passwords, certificate private keys, and other confidential values. Treat those prompts as a required guardrail rather than friction., MCP client logs, AI transcripts, local terminal history, hosted server logs, prompt traces, generated runbooks, and downstream tickets can retain Azure resource inventory and returned data outside Azure's original access and retention boundaries., Remote HTTP deployments require Entra ID bearer tokens on inbound requests and a configured outbound Azure authentication strategy. Choose On-Behalf-Of when per-user RBAC and audit trails matter, and managed identity only when the shared-server identity model is acceptable., Read-only mode reduces mutation risk, but it does not make returned Azure metadata or data safe to share with untrusted models, logs, chats, or third-party tools.
Author
Microsoft
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-04
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
78
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Complete
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
Registry metadata indicates a reviewed listing.
Done
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
8 safety and 6 privacy notes across 7 risk areas. Review closely: credentials & tokens, permissions & scopes, network access, third-party handling.
7 areas
SafetyGeneralStart in read-only mode and narrow the exposed namespaces or individual tools before enabling broader Azure access. Microsoft documents read-only mode, namespace filters, single-tool mode, and learn mode as controls for reducing the active MCP surface.
SafetyPermissions & scopesAzure MCP tools can inspect and manage real cloud resources. Depending on the tool and RBAC role, actions can create, update, delete, deploy, restart, query, or reconfigure resources and can incur cloud spend.
SafetyExecution & processesKeep human approval on destructive, cost-bearing, deployment, RBAC, Key Vault, database, storage, messaging, and production-environment actions. Do not disable user confirmation for high-risk or sensitive-data commands unless the automation environment is tightly controlled.
SafetyCredentials & tokensThe server authenticates with Azure credentials available to the local machine or hosted environment. Limit the credential chain with `AZURE_TOKEN_CREDENTIALS`, managed identities, service principals, and least-privilege Azure RBAC where practical.
SafetyNetwork accessFor self-hosted HTTP deployments, configure Entra ID inbound authentication, outbound authentication strategy, network exposure, logging, and per-user versus server-identity audit requirements before sharing the endpoint.
SafetyCredentials & tokensDocker setup uses Azure credential environment variables such as `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, and `AZURE_CLIENT_SECRET`; protect those values and never commit the env file.
SafetyTelemetryMicrosoft documents telemetry environment variables for the server. Review `AZURE_MCP_COLLECT_TELEMETRY` and `AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT` before using the server in sensitive environments.
SafetyNetwork accessThis is the Azure services MCP server. It is distinct from the Azure DevOps MCP server, which focuses on work items, repositories, pull requests, pipelines, wikis, and test plans.
PrivacyCredentials & tokensKey Vault, App Configuration, Storage, database, Service Bus, Event Hubs, Communication Services, and deployment tools may expose secrets, connection strings, keys, certificates, message contents, sample records, or customer data when the authenticated identity has permission.
PrivacyCredentials & tokensMicrosoft documents user confirmation for tools that handle sensitive data, including Key Vault secrets, connection strings, passwords, certificate private keys, and other confidential values. Treat those prompts as a required guardrail rather than friction.
PrivacyExecution & processesMCP client logs, AI transcripts, local terminal history, hosted server logs, prompt traces, generated runbooks, and downstream tickets can retain Azure resource inventory and returned data outside Azure's original access and retention boundaries.
PrivacyCredentials & tokensRemote HTTP deployments require Entra ID bearer tokens on inbound requests and a configured outbound Azure authentication strategy. Choose On-Behalf-Of when per-user RBAC and audit trails matter, and managed identity only when the shared-server identity model is acceptable.
PrivacyThird-party handlingRead-only mode reduces mutation risk, but it does not make returned Azure metadata or data safe to share with untrusted models, logs, chats, or third-party tools.
Safety notes
Start in read-only mode and narrow the exposed namespaces or individual tools before enabling broader Azure access. Microsoft documents read-only mode, namespace filters, single-tool mode, and learn mode as controls for reducing the active MCP surface.
Azure MCP tools can inspect and manage real cloud resources. Depending on the tool and RBAC role, actions can create, update, delete, deploy, restart, query, or reconfigure resources and can incur cloud spend.
Keep human approval on destructive, cost-bearing, deployment, RBAC, Key Vault, database, storage, messaging, and production-environment actions. Do not disable user confirmation for high-risk or sensitive-data commands unless the automation environment is tightly controlled.
The server authenticates with Azure credentials available to the local machine or hosted environment. Limit the credential chain with `AZURE_TOKEN_CREDENTIALS`, managed identities, service principals, and least-privilege Azure RBAC where practical.
For self-hosted HTTP deployments, configure Entra ID inbound authentication, outbound authentication strategy, network exposure, logging, and per-user versus server-identity audit requirements before sharing the endpoint.
Docker setup uses Azure credential environment variables such as `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, and `AZURE_CLIENT_SECRET`; protect those values and never commit the env file.
Microsoft documents telemetry environment variables for the server. Review `AZURE_MCP_COLLECT_TELEMETRY` and `AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT` before using the server in sensitive environments.
This is the Azure services MCP server. It is distinct from the Azure DevOps MCP server, which focuses on work items, repositories, pull requests, pipelines, wikis, and test plans.
Key Vault, App Configuration, Storage, database, Service Bus, Event Hubs, Communication Services, and deployment tools may expose secrets, connection strings, keys, certificates, message contents, sample records, or customer data when the authenticated identity has permission.
Microsoft documents user confirmation for tools that handle sensitive data, including Key Vault secrets, connection strings, passwords, certificate private keys, and other confidential values. Treat those prompts as a required guardrail rather than friction.
MCP client logs, AI transcripts, local terminal history, hosted server logs, prompt traces, generated runbooks, and downstream tickets can retain Azure resource inventory and returned data outside Azure's original access and retention boundaries.
Remote HTTP deployments require Entra ID bearer tokens on inbound requests and a configured outbound Azure authentication strategy. Choose On-Behalf-Of when per-user RBAC and audit trails matter, and managed identity only when the shared-server identity model is acceptable.
Read-only mode reduces mutation risk, but it does not make returned Azure metadata or data safe to share with untrusted models, logs, chats, or third-party tools.
Prerequisites
Azure subscription, tenant, and RBAC permissions for the resources Claude should inspect or manage.
MCP-capable client that can run local stdio servers or connect to a self-hosted HTTP MCP endpoint.
Azure authentication through Azure CLI, Azure PowerShell, Visual Studio, Visual Studio Code, Azure Developer CLI, browser login, service principal environment variables, workload identity, or managed identity.
Node.js 20 LTS or later and `npx` for the `@azure/mcp` package, or `uvx` for `msmcp-azure`, or .NET 10 Preview 6 or later for `Azure.Mcp`.
Clear subscription, tenant, namespace, read-only, and tool exposure plan before connecting an autonomous agent to Azure resources.
Secret-handling plan for Azure credentials, MCP client configuration, Docker `.env` files, server logs, terminal history, and AI transcripts.
The Azure MCP Server is Microsoft's official MCP server for working with Azure
resources from Claude and other MCP-capable clients. It connects an assistant
to Azure subscriptions and services through a local stdio server or a
self-hosted HTTP server, using Azure authentication and RBAC instead of copied
portal screenshots or manually pasted resource details.
The strongest use case is developer-side Azure work where the assistant needs
fresh, permissioned cloud context: list resource groups, inspect storage
containers, check Cosmos DB or PostgreSQL resources, query Azure Monitor,
retrieve pricing or quota information, reason about RBAC assignments, generate
Azure CLI guidance, or look up Azure best-practice recommendations before
changing infrastructure.
Features
Official Microsoft implementation in the microsoft/mcp repository.
Local stdio server through @azure/mcp, Azure.Mcp, or msmcp-azure.
Self-hosted HTTP mode for remote deployments on Azure Container Apps.
Azure Identity based authentication using local developer credentials,
service principals, workload identity, managed identity, or hosted HTTP
authentication flows.
Azure RBAC-backed access to subscriptions, resource groups, and individual
services.
Read-only mode for preventing write operations.
Namespace and individual tool filtering so a client can expose only the
Azure services required for the task.
Learn mode for command and parameter discovery without executing Azure
operations.
Sensitive-data confirmation for tools that may return secrets, connection
strings, passwords, certificate private keys, or other confidential values.
Tool coverage across Azure AI Search, App Configuration, Cosmos DB, Key
Vault, Monitor, RBAC, Redis, Storage, App Service, Functions, AKS, SQL,
PostgreSQL, MySQL, Service Bus, Event Hubs, Event Grid, Azure Policy,
pricing, quotas, Resource Health, Well-Architected guidance, and more.
Setup paths for VS Code, Visual Studio, IntelliJ, Eclipse, Cursor, Cline,
Windsurf, GitHub Copilot CLI, package managers, Docker, and custom MCP
clients.
Sovereign cloud support through the --cloud option or AZURE_CLOUD
environment variable.
Use Cases
Ask Claude to inventory resource groups, storage accounts, app services, AKS
clusters, databases, or Azure AI resources before making infrastructure
changes.
Query Azure Monitor logs or metrics while investigating a failed deployment,
incident, or performance regression.
Inspect RBAC assignments, policy state, quotas, and pricing before planning a
deployment.
Generate Azure CLI or Azure Developer CLI guidance from natural-language
intent while keeping Azure context in the same MCP session.
Work in read-only mode while drafting a migration plan, cost review,
incident summary, or architecture audit.
Narrow the server to namespaces such as storage, keyvault, cosmos,
monitor, or aks when the assistant only needs a bounded Azure surface.
Self-host an HTTP Azure MCP endpoint for approved agents that need shared
access through Entra ID controlled authentication.
Installation
Claude Code with the Node package
Authenticate to Azure first with an approved method such as az login, Visual
Studio Code Azure sign-in, Azure PowerShell, Azure Developer CLI, or managed
identity.
Add the stdio server with the official npm package:
claude mcp add azure-mcp -- npx -y @azure/mcp@latest server start
Confirm the package can list tools before using it in a high-trust workspace:
npx -y @azure/mcp@latest tools list
Other package-manager options
Use the .NET tool when your environment standardizes on NuGet:
dotnet tool install Azure.Mcp
Use the Python package when your environment standardizes on uvx:
Restart the MCP server after changing the exposed namespaces or read-only
setting.
Sovereign cloud selection
Use the command-line cloud option or AZURE_CLOUD when working outside Azure
Public Cloud:
azmcp server start --cloud AzureUSGovernment
AZURE_CLOUD=AzureChinaCloud azmcp server start
Examples
Ask read-only prompts first:
Use the Azure MCP Server to list my Azure subscriptions and resource groups.
Use Azure MCP in read-only mode to list storage accounts in this subscription
and summarize which resource groups they belong to.
Use Azure MCP to query Azure Monitor for errors in this Log Analytics workspace
from the last hour, then summarize the recurring failure patterns.
Use Azure MCP learn mode to show which storage and key vault tools are
available before running any Azure operation.
Use explicit boundaries before allowing write-capable work:
Use only the staging subscription and the appservice namespace. Draft the
deployment plan first, then wait for approval before changing any resource.
Source notes
Microsoft Learn documents the Azure MCP Server as the official way to manage
Azure resources through natural-language commands from GitHub Copilot,
custom AI agents, and MCP-compatible clients.
The official microsoft/mcp repository hosts the Azure MCP Server under
servers/Azure.Mcp.Server and documents the npm, NuGet, PyPI, Docker, IDE,
and remote hosting setup paths.
Microsoft Learn documents developer credentials, managed identity, Azure
RBAC, read-only mode, namespace and tool filtering, learn mode, tool
annotations, user confirmation for sensitive data, and remote HTTP
authentication behavior.
The npm package @azure/mcp, NuGet package Azure.Mcp, PyPI package
msmcp-azure, and Microsoft Container Registry image all map back to the
official Microsoft Azure MCP Server documentation and repository.
Duplicate check
This entry covers Microsoft's general Azure MCP Server for Azure cloud
resources and services. It is intentionally separate from the existing Azure
DevOps MCP Server entry, which focuses on Azure DevOps organizations, work
items, repositories, pull requests, pipelines, wikis, and test plans. Before
submission, the content tree and open PRs were checked for azure-mcp-server,
Azure MCP Server, @azure/mcp, Azure.Mcp.Server, and the official
microsoft/mcp Azure server path; no existing direct Azure MCP Server content
entry or open content PR was found.
Disclosure
This is a source-backed listing for an official Microsoft open-source MCP
server. The submitter is not affiliated with Microsoft, and no sponsorship,
affiliate relationship, or paid placement is involved.
Show that Azure MCP Server for Claude is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/mcp/azure-mcp-server)
How it compares
Azure MCP Server for Claude side by side with 2 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
Official Microsoft Azure MCP server that connects Claude and other MCP clients to Azure subscriptions, resource groups, storage, databases, Key Vault, Monitor, App Service, AKS, AI Search, Cosmos DB, RBAC, pricing, and other Azure services through local stdio or self-hosted HTTP transports.
Official Microsoft Azure DevOps MCP server for querying work items, pull requests, repositories, pipelines, wikis, test plans, and project metadata through remote HTTP or local stdio transports.
Google Cloud gcloud MCP server from googleapis that lets Claude run approved gcloud CLI commands with allowlist and denylist controls for cloud resource inspection, automation, and operations.
✓Start in read-only mode and narrow the exposed namespaces or individual tools before enabling broader Azure access. Microsoft documents read-only mode, namespace filters, single-tool mode, and learn mode as controls for reducing the active MCP surface.
Azure MCP tools can inspect and manage real cloud resources. Depending on the tool and RBAC role, actions can create, update, delete, deploy, restart, query, or reconfigure resources and can incur cloud spend.
Keep human approval on destructive, cost-bearing, deployment, RBAC, Key Vault, database, storage, messaging, and production-environment actions. Do not disable user confirmation for high-risk or sensitive-data commands unless the automation environment is tightly controlled.
The server authenticates with Azure credentials available to the local machine or hosted environment. Limit the credential chain with `AZURE_TOKEN_CREDENTIALS`, managed identities, service principals, and least-privilege Azure RBAC where practical.
For self-hosted HTTP deployments, configure Entra ID inbound authentication, outbound authentication strategy, network exposure, logging, and per-user versus server-identity audit requirements before sharing the endpoint.
Docker setup uses Azure credential environment variables such as `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, and `AZURE_CLIENT_SECRET`; protect those values and never commit the env file.
Microsoft documents telemetry environment variables for the server. Review `AZURE_MCP_COLLECT_TELEMETRY` and `AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT` before using the server in sensitive environments.
This is the Azure services MCP server. It is distinct from the Azure DevOps MCP server, which focuses on work items, repositories, pull requests, pipelines, wikis, and test plans.
✓Start with read-only mode for investigation. The remote server supports the `X-MCP-Readonly: true` header, and the local server supports domain filtering so agents only load the Azure DevOps areas they need.
Azure DevOps write-capable tools can create or update work items, pull requests, pull request comments, branches, wiki pages, test plans, test suites, test cases, and pipeline runs. Keep manual approval on any operation that changes project state.
Treat Azure DevOps PATs, Microsoft Entra tokens, Azure CLI sessions, and MCP configuration as sensitive credentials. Do not paste tokens into prompts, commit them to repositories, or share them in issue/PR threads.
Use toolsets, domains, project defaults, and team defaults to keep the MCP surface narrow. Loading every repo, work item, wiki, pipeline, and test plan tool can confuse the model and expose more context than the task needs.
The remote MCP server is in public preview. Preview behavior, available tools, supported clients, and authentication requirements can change before general availability.
✓gcloud MCP Server executes gcloud CLI commands with the permissions of the active gcloud account.
Allowed commands can create, update, delete, deploy, scale, list, export, or configure Google Cloud resources depending on IAM permissions and selected services.
The server blocks command substitution, pipes, redirection, SSH-style commands, interactive commands, and a default set of sensitive command prefixes, but allowed gcloud commands can still have real infrastructure, billing, IAM, and data impact.
Use allowlists for narrow workflows and service account impersonation with limited roles when possible.
Require human approval for IAM, billing, networking, firewall, storage, database, secret, deployment, delete, and production-impacting commands.
Privacy notes
✓Tool results can expose tenant IDs, subscription IDs, resource groups, resource names, tags, deployment outputs, Azure Monitor logs, metrics, pricing data, quotas, RBAC assignments, policy data, app settings, database metadata, storage account and blob metadata, and service-specific configuration.
Key Vault, App Configuration, Storage, database, Service Bus, Event Hubs, Communication Services, and deployment tools may expose secrets, connection strings, keys, certificates, message contents, sample records, or customer data when the authenticated identity has permission.
Microsoft documents user confirmation for tools that handle sensitive data, including Key Vault secrets, connection strings, passwords, certificate private keys, and other confidential values. Treat those prompts as a required guardrail rather than friction.
MCP client logs, AI transcripts, local terminal history, hosted server logs, prompt traces, generated runbooks, and downstream tickets can retain Azure resource inventory and returned data outside Azure's original access and retention boundaries.
Remote HTTP deployments require Entra ID bearer tokens on inbound requests and a configured outbound Azure authentication strategy. Choose On-Behalf-Of when per-user RBAC and audit trails matter, and managed identity only when the shared-server identity model is acceptable.
Read-only mode reduces mutation risk, but it does not make returned Azure metadata or data safe to share with untrusted models, logs, chats, or third-party tools.
✓Tool results can expose organization names, project names, teams, iteration data, capacity information, work item titles and fields, comments, attachments, pull request discussions, repository file content, branch names, commit metadata, pipeline logs, build artifacts, wiki pages, test plans, and search results.
Work item comments, PR threads, pipeline logs, wiki pages, and attachments often contain customer data, production incident details, credentials, internal URLs, unreleased roadmap information, employee names, or security findings.
MCP client logs, AI transcripts, generated code comments, local terminal history, and downstream ticket summaries can retain Azure DevOps content outside the original Azure DevOps audit, permission, and retention model.
Microsoft Entra authentication exposes the user's organizational identity to the MCP client and constrains access to the authenticated user's Azure DevOps permissions.
✓gcloud output can reveal project IDs, resource names, regions, IAM bindings, service accounts, logs, errors, labels, metadata, URLs, secrets references, billing context, and infrastructure topology.
Authentication state, ADC files, service account impersonation details, access tokens, project IDs, and local gcloud configuration should stay out of prompts and repository files.
Command output may be retained by the MCP client, model provider, terminal logs, shell history, and chat transcripts.
Avoid broad listing or export commands against production projects unless data handling and retention have been reviewed.
Prerequisites
Azure subscription, tenant, and RBAC permissions for the resources Claude should inspect or manage.
MCP-capable client that can run local stdio servers or connect to a self-hosted HTTP MCP endpoint.
Azure authentication through Azure CLI, Azure PowerShell, Visual Studio, Visual Studio Code, Azure Developer CLI, browser login, service principal environment variables, workload identity, or managed identity.
Node.js 20 LTS or later and `npx` for the `@azure/mcp` package, or `uvx` for `msmcp-azure`, or .NET 10 Preview 6 or later for `Azure.Mcp`.
Azure DevOps organization and project membership for the resources Claude should access
Microsoft Entra ID connected Azure DevOps organization for the remote MCP server
Visual Studio Code or Visual Studio for the Microsoft-supported remote MCP preview path
Node.js 20 or later and npx for the optional local `@azure-devops/mcp` stdio server
Node.js 20 or newer with npm or another compatible package runner.
Google Cloud CLI installed and authenticated.
Active gcloud account, project, and configuration scoped to the intended environment.
Least-privilege user or service account impersonation for the allowed cloud actions.
Install
npx -y @azure/mcp@latest server start
claude mcp add azure-devops -- npx -y @azure-devops/mcp YOUR_AZURE_DEVOPS_ORG