# mcp-azure [Health: Active]

**Category:** ☁️ Cloud Platforms  
**Repository:** https://github.com/dockndevai/mcp-azure  
**GitHub Stars:** 1  
**npm Downloads (last month):** 610  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mcp-azure

## Description
Azure Resource Manager inventory & ops for AI agents — governed, confirmation-gated.

## Tools
Capabilities this server exposes over MCP:

- **list_subscriptions** — List subscriptions the service principal can see (filtered by allowlist).
- **list_locations** — List the regions available to a subscription.
- **list_resource_groups** — List resource groups in a subscription (filtered by allowlist).
- **list_resources** — List resources in a subscription, or within a specific resource group.
- **get_resource** — Fetch a resource by its full ARM id. Provide the api-version for the resource type.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-azure": {
    "command": "npx",
    "args": ["-y","@dockndevai/mcp-azure"],
    "env": {
      "AZURE_TENANT_ID": "",
      "AZURE_CLIENT_ID": "",
      "AZURE_CLIENT_SECRET": "",
      "AZURE_SUBSCRIPTION_ID": ""
    }
  }
}
```

**Requires environment variables:** `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_SUBSCRIPTION_ID` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What mcp-azure does

The mcp-azure MCP server exposes Azure Resource Manager capabilities to MCP-compatible clients. ARM is the programmatic management layer behind the Azure Portal, so the server works with Azure subscriptions and resources through that API rather than through portal automation.

Its read operations cover subscription discovery, Azure locations, resource groups, resources within a group, and lookup of an individual resource by ARM ID. With the appropriate access mode, an agent can also create resource groups, merge tags onto resources, and start, stop, restart, or deallocate virtual machines. Delete operations are separated into admin-level tools for resource groups and individual resources.

## How it works

The server runs over the standard MCP process model and can be launched with `npx` from the published `@dockndevai/mcp-azure` package. Azure authentication uses an Entra ID service principal, with tenant, client, secret, and subscription values supplied through environment variables.

Capabilities are selected by `AZURE_MODE`. In `read-only` mode, only inventory tools are registered. `read-write` adds resource-group creation, tagging, and VM power controls. `admin` adds deletion tools, but deletion still requires the separate delete setting and typed confirmation.

Governance checks apply before guarded operations run. Subscription and resource-group allowlists restrict scope, protected groups remain readable but cannot be changed, and a location allowlist limits where new resource groups may be created. Destructive or high-impact actions can request human approval through MCP elicitation. Clients without elicitation use the relevant allow-setting gate instead.

## Setup and configuration

Add the package to Claude Code with `claude mcp add`, or configure it as an `npx`-based server in a client configuration file. The same command pattern supports clients such as Claude Desktop, Cursor, and Windsurf. Codex is also listed as an MCP-capable client for the project.

To run the mcp-azure MCP server, provide `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, and `AZURE_SUBSCRIPTION_ID`. Set `AZURE_MODE` according to the required access level; it defaults to `read-only`.

Optional controls include `AZURE_SUBSCRIPTION_ALLOWLIST`, `AZURE_RESOURCE_GROUP_ALLOWLIST`, `AZURE_PROTECTED_RESOURCE_GROUPS`, and `AZURE_LOCATION_ALLOWLIST`. Deletion requires both `AZURE_MODE=admin` and `AZURE_ALLOW_DELETE=true`. When confirmation is enabled, the supplied `confirm` value must match the target name. `AZURE_DRY_RUN` validates and logs write or administrative intent without applying it, while `AZURE_AUDIT_LOG` controls JSON audit lines written to stderr.

## Tools and capabilities

Read tools, available from `read-only` upward:

- `list_subscriptions`
- `list_locations`
- `list_resource_groups`
- `list_resources`
- `get_resource`

Write tools, available from `read-write` upward:

- `create_resource_group`
- `tag_resource`
- `control_vm`

Admin tools, available only in `admin` mode and subject to delete controls:

- `delete_resource_group`
- `delete_resource`

These tools support workflows such as checking which region contains each resource group, inspecting resources in a group, applying tags, and changing a VM's power state.

## Limitations and notes

The server does not provide unrestricted Azure access by default. Read-only mode is the default, and tools above the selected mode are not registered. Resource operations can also be refused by subscription, resource-group, protected-group, or location policy.

Deletion has multiple safeguards: administrative mode, the delete enablement variable, and typed confirmation. Dry-run mode returns after validation and intent logging, so it is suitable for checking policy behavior without making the requested change. Audit records are emitted as JSON lines to standard error when auditing is enabled.

The repository includes tests for governance modes, scope restrictions, location rules, deletion, and confirmation behavior. Running from source requires installing dependencies, building the project, and starting `node dist/index.js` with the environment configured.

_Full upstream README: https://allmcps.com/mcp/mcp-azure/readme_