ResourceManagementClient MCP Server

When exposed as tools to an AI coding assistant via the Model Context Protocol (MCP), this API transforms the assistant from a code generator into an active infrastructure operator with deep, real-time awareness of the Azure subscription context. The AI can dynamically query the live state of resource providers, understand which services are available and registered in a specific subscription, and inspect the current policy landscape. This contextual awareness allows the assistant to generate not just syntactically correct, but operationally valid code. For instance, it can automatically check if a required provider like Microsoft.CognitiveServices is registered before generating a script to deploy a resource of that type, or it can fetch existing policy definitions to recommend or create compatible new resources, ensuring generated IaC (Infrastructure as Code) aligns with established governance rules from the outset.

Within an MCP-integrated workflow, a developer can instruct the AI agent to perform sophisticated, multi-step operational tasks through natural language. For example, a developer could say, "Query all registered resource providers in my subscription and identify any that are deprecated," prompting the AI to use the GET providers endpoint to list them and cross-reference with public documentation. Another directive could be, "Audit our policy assignments for any that target virtual machines and report their effect," where the AI would fetch policy assignments via the dedicated endpoint, filter them, and present a summary. The assistant could also be tasked with "Register the Microsoft.DataFactory provider for subscription X," triggering a POST to the register endpoint. Furthermore, it can validate deployment templates by using the calculateTemplateHash endpoint to ensure a template's structural hash matches expectations before a commit, bridging the gap between development and deployment validation.

Critical to the implementation of this API, especially in an AI-assisted context, is a rigorous approach to security and configuration. Although the specified authentication method is noted as "None," in practice, all requests to the Azure Resource Manager must be authenticated via an identity—typically a Service Principal or Managed Identity—and must carry an OAuth 2.0 bearer token. Developers must configure the MCP server with credentials possessing the principle of least privilege: a custom role with precise permissions like Microsoft.Resources/providers/read (for discovery) and Microsoft.Authorization/policyDefinitions/* (for policy management), scoped to the necessary subscription or management group. The PUT and DELETE operations for policy definitions are particularly sensitive and should be gated in the AI toolset to prevent accidental or unauthorized governance changes. Configuration guidelines must emphasize using secure secret storage for credentials, enabling audit logging of all API calls made by the AI, and potentially implementing approval workflows for any state-modifying operations like provider registration or policy updates.