What it is
Azure MCP Server puts tools for more than 45 Azure service areas in one server, from Storage, Cosmos DB and Key Vault to AKS, Monitor, Backup and SRE Agent. Release notes put the individual tool count at 506 in the late 3.0 betas and 410 in 4.0.0-beta.1. Version 3.0.0 shipped on 12 October 2026 and 4.0 betas followed from 19 October. It ships in VS Code, Visual Studio, IntelliJ and Eclipse through GitHub Copilot for Azure, as a Claude Code plugin, and as npm, NuGet, PyPI and Docker packages.
Run it with npx -y @azure/mcp@latest server start after signing in to Azure; the server uses those credentials through the Azure Identity SDK. npm's latest tag currently points at 4.0.0-beta.2, so @latest installs a beta. It can also be self-hosted as a remote HTTP endpoint on Azure Container Apps. The code lives in microsoft/mcp; the old Azure/azure-mcp repository was archived in August 2025.
Install
npx -y @azure/mcp@latest server startOur review
Microsoft has built a server that covers nearly all of Azure, and its size is both the point and the problem. The late 3.0 betas listed 506 individual tools, from Storage and Key Vault to Backup vault governance, resilience drills and 55 SRE Agent commands. No model should see all of them at once.
The defaults recognise this. Namespace mode, the default, collapses each service into one tool, and a single-tool mode goes further; you can also enable only the services you want, such as storage and keyvault, and a read-only flag blocks write operations. Version 3.0 added secure-by-default creation, so new Storage accounts have Shared Key authentication disabled and new Recovery Services vaults have public network access off, along with anti-SSRF checks on endpoints.
Access follows Azure RBAC. The README says plainly that autonomous or misconfigured clients may perform destructive actions within the signed-in user's rights, so an agent running as a subscription Owner can delete whatever that Owner can. A dedicated identity with Reader, plus narrow write roles where a job needs them, is the sensible start. Telemetry to Microsoft is on by default; setting AZURE_MCP_COLLECT_TELEMETRY to false turns it off.
The release pace cuts both ways. Microsoft ships on Tuesdays and Thursdays and the server updates itself by default, and npm's latest tag now resolves to 4.0.0-beta.2, whose notes include breaking changes to the resiliency tools. Teams that want a stable tool surface should pin 3.0.0 rather than take @latest. Microsoft's separate servers for Azure DevOps and AKS do narrower jobs with far fewer tools to load.
Where it earns its place
A platform engineer looking after 30 Azure subscriptions
Find idle disks and oversized VMs before the monthly cost review
Run read-only with the optimization, compute and advisor namespaces; the agent lists Advisor recommendations and unattached-disk counts across subscriptions. The server is free, and a few hundred read calls sit well inside ARM's 250-request bucket per subscription.
An on-call SRE at a SaaS company running on AKS
Pull logs and metrics for a failing service during an incident
With the monitor and aks namespaces enabled, the agent runs Log Analytics queries and batch metrics calls from VS Code or Claude Code. A Reader identity keeps it from changing anything while the person driving it is half awake.
A cloud governance lead at a regulated bank
Check backup and resilience posture without granting write access
The azurebackup and resiliency tools report vault settings such as soft delete and immutability; read-only mode and a Reader role limit it to inspection. Switch off Microsoft telemetry with an environment variable before rollout.
Before you commit
- Setup
- Sign in with az login or another Azure Identity method, then add npx -y @azure/mcp@latest server start, the VS Code extension, or the Claude Code plugin (/plugin install azure@claude-plugins-official). .NET dnx, uvx and Docker routes are also documented; a first tool call takes minutes.
- Integrations
- More than 400 individual tools across 45+ service areas, grouped by namespace by default: storage, keyvault, cosmos, monitor, aks, azurebackup, advisor, sreagent and many more. Read-only mode removes writes; service filters and --disable-proxy-tools trim the list further.
- Data and privacy
- The server acts with your Azure RBAC rights, so it can read Key Vault secrets or Storage data if your roles allow. It runs locally or in your own Container Apps deployment rather than on a Microsoft-hosted endpoint, but telemetry goes to Microsoft unless AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT is false.
- Cost at scale
- The server is MIT-licensed and free; you pay for the Azure resources it creates or queries. Azure Resource Manager throttles per region with a bucket of 250 reads per subscription per principal, refilling at 25 a second, and 200 writes refilling at 10; an agent looping over metrics can drain it.
- Limits
- Tool sprawl if namespace mode is turned off, breaking changes between betas, and some tools need extra CLIs such as azqr on PATH. The README notes that destructive-operation safeguards are not standardised across MCP clients.
What's good
- Covers 45+ Azure service areas in one server
- Namespace mode, service filters and a read-only flag
- Uses Azure Identity and RBAC; never stores tokens itself
- Ships for VS Code, Visual Studio, JetBrains, Eclipse and Claude Code
What's not
- Hundreds of tools if filtering is switched off
- npm @latest currently installs a 4.0 beta
- Telemetry to Microsoft on by default
- Several overlapping Microsoft servers to choose from
Best for
Teams on Azure who want an agent to query and manage resources across many services.
Alternatives
Azure MCP Server: common questions
- Is Azure MCP Server worth it?
- Broad enough to run most of an Azure estate from a chat window, which is exactly why it should start in read-only mode with three or four namespaces. We rate it 4.3 out of 5.
- How much does Azure MCP Server cost?
- Free and MIT-licensed. Azure resources it touches are billed as usual.
- What are the downsides of Azure MCP Server?
- Hundreds of tools if filtering is switched off; npm @latest currently installs a 4.0 beta; telemetry to Microsoft on by default; several overlapping Microsoft servers to choose from.
- Who is Azure MCP Server best for?
- Teams on Azure who want an agent to query and manage resources across many services.
- How much does Azure MCP Server cost for a team or in production?
- The server is MIT-licensed and free; you pay for the Azure resources it creates or queries. Azure Resource Manager throttles per region with a bucket of 250 reads per subscription per principal, refilling at 25 a second, and 200 writes refilling at 10; an agent looping over metrics can drain it.
- Is Azure MCP Server safe for company data?
- The server acts with your Azure RBAC rights, so it can read Key Vault secrets or Storage data if your roles allow. It runs locally or in your own Container Apps deployment rather than on a Microsoft-hosted endpoint, but telemetry goes to Microsoft unless AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT is false.
- What are the best Azure MCP Server alternatives?
- The closest alternatives we have reviewed are AWS MCP Server and Terraform MCP Server.
Answers checked Oct 22, 2026.
Make Azure MCP Server? Show this rating on your site
