MCP Server Azure Integration: 2026 Setup Guide
A practical guide to Azure MCP Server: what it can do, how to connect it to Copilot Studio or Microsoft Foundry, and how to keep Azure access controlled from day one.
A practical guide to Azure MCP Server: what it can do, how to connect it to Copilot Studio or Microsoft Foundry, and how to keep Azure access controlled from day one.
Executive summary: The Azure MCP Server (azmcp) is Microsoft's first-party MCP server for Azure. It exposes Azure services as agent tools and uses Microsoft Entra ID with Azure RBAC, so access still follows the permissions assigned to the user or managed identity. Use it locally for developer workflows, or deploy it as a remote server for Copilot Studio and Microsoft Foundry agents. For production, add governance before you expand the tool scope.
A good MCP server Azure integration should not start by exposing every Azure tool to an agent. It should start with a narrow operating use case, a scoped identity, and a clear approval model. This guide covers the Azure MCP Server, what it exposes, how to connect it to Copilot Studio or Microsoft Foundry agents, and how to govern it with RBAC and an AI Gateway where appropriate.
Use Azure MCP Server when an agent or IDE assistant needs governed access to Azure operations, such as listing resources, inspecting storage, querying logs, checking configuration, or running approved operational tasks. Start with read-only access and a small namespace. Add write-capable tools only when RBAC, approvals, logging, and ownership are clear.
The Azure MCP Server implements the Model Context Protocol so AI agents and MCP-compatible clients can work with Azure resources through tool calls instead of hand-written SDK or REST requests. In practice, that means a developer or agent can ask for resource groups, inspect storage, query logs, check Key Vault data with confirmation, or run supported operations through a governed Azure identity. The server authenticates through Microsoft Entra ID via the Azure Identity library and works with clients such as GitHub Copilot agent mode, the OpenAI Agents SDK, and Semantic Kernel.
namespace mode by default, or use consolidated, all, or single mode when the workflow needs a different shape.Microsoft's tool reference groups Azure MCP Server tools into more than a dozen categories. The table below is a practical sample, not the full catalog. Always check the official tool reference before designing a production agent.
| Category | Example services | Namespace |
|---|---|---|
| Compute | App Service, Functions, AKS, virtual machines, Service Fabric | appservice, functionapp, aks, compute |
| Databases | Cosmos DB, Azure SQL, PostgreSQL, MySQL, Redis | cosmos, sql, postgres, mysql, redis |
| Storage | Storage accounts, blobs, tables, file shares, file sync | storage, fileshares, storagesync |
| AI and ML | Microsoft Foundry models/deployments, Azure AI Search, Speech | foundry, search, speech |
| DevOps | Bicep schemas, Terraform, deployments, Monitor, Grafana | bicepschema, azureterraform, deploy, monitor |
| Security & identity | Key Vault, Azure RBAC, Confidential Ledger | keyvault, role, confidentialledger |
| Management & governance | Advisor, Policy, Cost/Pricing, Resource Health, Quotas, Backup | advisor, policy, pricing, resourcehealth, quota |
| Messaging & integration | Service Bus, Event Hubs, Event Grid | servicebus, eventhubs, eventgrid |
Typical prompts include: "Show me all my resource groups," "List blobs in my storage container named 'documents'," "Query my Log Analytics workspace for errors in the last hour," or "What's the value of the 'ConnectionString' key in my app configuration?"
Sensitive data requires confirmation. Tools that can return secrets, such as Key Vault values, connection strings, or certificate private keys, trigger an elicitation prompt before they run. There is a disable user confirmation start flag for trusted automation, but it removes an important safety check. Avoid it for production agents that handle user prompts or untrusted input.
The Azure MCP Server can run in two main ways. This choice affects authentication, hosting, networking, and how much governance you need around the agent.
| Mode | Best for | Notes |
|---|---|---|
| Local (STDIO) | An individual developer working in VS Code, Visual Studio, or another supported editor | Uses the developer's own Azure CLI credential; Microsoft explicitly scopes this to developer use within your organization, not external-facing scenarios |
| Remote (HTTPS) | Copilot Studio and Microsoft Foundry agents that need to call it over the network | You self-host it, typically on Azure Container Apps, with a managed identity and its own RBAC role assignment |
Start with the operating model before choosing a tool surface. Azure MCP can expose powerful read and write operations, so the safest implementation is deliberate and incremental.
storage, monitor, or keyvault. Avoid exposing every namespace until you have a tested governance model.For the Azure MCP Server, Copilot Studio uses a Power Apps custom connector configured for the MCP protocol. Microsoft provides an azd template that deploys the remote server and supporting identity pieces, which makes the setup much easier to repeat across environments.
azd init -t azmcp-copilot-studio-aca-mi, then azd up. This provisions the container app, a user-assigned managed identity with a Reader role, and two Entra app registrations (client and server).x-ms-agentic-protocol: mcp-streamable-1.0 — this is what tells the connector to speak MCP.Single-tenant by default. The custom connector doesn't support multi-tenant sign-in out of the box; the client app registration must be restricted to its own tenant. Cross-tenant setups need an extra service principal provisioning step and can be blocked by Power Platform tenant isolation policy.
Microsoft Foundry Agent Service has native MCP tool support, so you do not need a Power Apps custom connector. Foundry can connect to reachable public or private MCP-compatible endpoints, subject to supported authentication and networking setup, and you can require approval before tool calls execute.
from azure.identity import DefaultAzureCredential
from azure.ai.projects import AIProjectClient
from azure.ai.projects.models import PromptAgentDefinition, MCPTool
project = AIProjectClient(
endpoint="your_project_endpoint",
credential=DefaultAzureCredential(),
)
tool = MCPTool(
server_label="azure-mcp",
server_url="https://your-azure-mcp-server-endpoint/mcp",
require_approval="always", # or "never", or a per-tool allow list
project_connection_id="my-mcp-connection",
)
agent = project.agents.create_version(
agent_name="AzureOpsAgent",
definition=PromptAgentDefinition(
model="gpt-5-mini",
instructions="Use MCP tools as needed",
tools=[tool],
),
)require_approval accepts always, never, or a selective list — require approval for anything that writes or changes Azure resources.Once an MCP server is used by production agents, route eligible tools through an AI Gateway backed by Azure API Management. That gives you one governed entry point for traffic controls, logs, and policy enforcement instead of agents calling the server directly.
<inbound>
<base />
<rate-limit-by-key calls="60" renewal-period="60"
counter-key="@(context.Request.IpAddress)" />
</inbound>| Azure MCP Server | Work IQ SharePoint | |
|---|---|---|
| Scope | Azure development, operations, and platform services | SharePoint sites, lists, and files |
| Publisher | Azure developer tools team | Microsoft 365 / Agent 365 |
| Licensing | Depends on host: GitHub Copilot for supported editor use; Copilot Studio or Foundry licensing/billing for agent use; Azure RBAC always applies | Microsoft 365 Copilot license (preview) |
| Typical client | VS Code, Visual Studio, Copilot Studio, Microsoft Foundry | Copilot Studio |
| Governance | Azure RBAC, elicitation, AI Gateway (Foundry) | Microsoft 365 admin center Agent Tools registry |
The two servers solve different problems. A single Copilot Studio agent could use SharePoint tools to read a policy document and Azure MCP tools to check the resource the policy refers to. See our MCP server SharePoint integration setup guide for the SharePoint side.
storage or monitor), to validate the RBAC model against a non-production subscription.azd template, or your own hosting), wire it to the agent, and require approval on every tool call during testing.MCP server Azure integration connects an AI agent or MCP-compatible client to Azure tools through the Azure MCP Server (azmcp). It lets the agent query and manage Azure services through governed tool calls backed by Microsoft Entra ID and Azure RBAC.
No. Work IQ SharePoint is scoped to SharePoint and OneDrive under Microsoft 365 Copilot. The Azure MCP Server is broader and focuses on Azure development, operations, and platform services. A single Copilot Studio agent can use both when a workflow touches SharePoint content and Azure resources.
Deploy it as a remote HTTPS server (Microsoft's azd template targets Azure Container Apps), create a Power Apps custom connector pointed at it with the x-ms-agentic-protocol: mcp-streamable-1.0 property and OAuth 2.0 security, then add that connector to the agent's Tools in Copilot Studio.
It authenticates with your Azure credentials or managed identity and is bound by Azure RBAC, so it can only do what that identity is allowed to do. It also prompts for confirmation before returning secrets, and can run in read-only mode to block writes entirely.
For Microsoft Foundry, route new MCP tools through an AI gateway backed by Azure API Management and apply rate limiting, IP filtering, and audit logging as standard policies. For Copilot Studio, the custom connector is governed by your existing Power Platform DLP policy.
OceanCloud helps teams connect Azure and Microsoft 365 through MCP the right way, with governance, RBAC, and rollout planning built in from day one.
Book a Free 60-Minute Consultation ➜