azure-mcp-platform

MCP server for Azure resource management, AI Foundry, and Entra ID — inspect and operate Azure infrastructure through AI agents.

What is this?

azure-mcp-platform wraps the official Azure MCP Server with production-ready configuration, Entra ID authentication, and platform-engineering patterns for operating Azure environments safely from AI agents.

Built for platform engineers running multi-tenant Azure environments with AI Foundry, AKS, and enterprise SSO via Entra ID.

Available Tools

Quick Start

Prerequisites

• Python 3.11+

• Azure CLI authenticated: az login

• Appropriate Azure RBAC role: Reader minimum

• (Optional) Service principal with Reader + AcrPull for CI environments

Run locally

git clone https://github.com/akkireddy-challa/azure-mcp-platform.git
cd azure-mcp-platform
pip install -r requirements.txt
az login
python server.py

Configure with Claude Desktop

{
  "mcpServers": {
    "azure": {
      "command": "python",
      "args": ["/path/to/azure-mcp-platform/server.py"],
      "env": {
        "AZURE_SUBSCRIPTION_ID": "your-subscription-id",
        "AZURE_TENANT_ID": "your-tenant-id"
      }
    }
  }
}

Example Usage

Ask your AI agent:

• "List all resource groups in my subscription"

• "What AKS clusters are running in the production resource group?"

• "Show me all AI Foundry projects and their model deployments"

• "Which storage accounts in rg-data have public access enabled?"

• "List all users in the platform-engineers Entra group"

Security Model

• Read-only by default: all tools use GET operations only

• Entra ID SSO: authenticates via Azure CLI credential chain or Managed Identity

• No secrets exposed: Key Vault tool lists secret names only, never values

• Subscription-scoped: tools operate within a single configured subscription

• Recommended role: Reader at subscription scope for full read access

# Assign Reader role to a service principal
az role assignment create \
  --assignee <service-principal-id> \
  --role Reader \
  --scope /subscriptions/<subscription-id>

Use Cases at Telia

This pattern is used to allow AI agents to:

• Audit resource configurations across multi-tenant Azure environments

• Cross-reference AKS cluster state with AI Foundry model deployments

• Investigate Entra ID group membership for access reviews

• Inspect cost anomalies by listing resources and their SKUs

Roadmap

• get_cost_analysis — query Azure Cost Management for spend by resource group

• list_policy_assignments — show Azure Policy compliance state

• get_monitor_alerts — list active Azure Monitor alerts

• list_app_registrations — Entra ID app registrations and permissions

• Managed Identity support for AKS pod deployment

• GitHub Actions workflow for CI validation

Related Projects

License

MIT License. See LICENSE for details.

Built by Akkireddy Challa — Platform Engineer at Telia, Stockholm.