Security Center MCP Server

The Microsoft Security Center API provides programmatic access to the Advanced Threat Protection settings for resources within an Azure subscription, offered as part of the Microsoft.Security resource provider. This API is a critical component of the broader Microsoft Defender for Cloud ecosystem, enabling organizations to configure and manage a core layer of their cloud security posture management (CSPM) and workload protection strategies. Its primary function is to allow the retrieval and configuration of the advancedThreatProtectionSettings for a specified resource, such as a virtual machine, SQL database, or storage account. By leveraging the GET and PUT operations on the /{resourceId}/providers/Microsoft.Security/advancedThreatProtectionSettings/{settingName} endpoint, security administrators and automated systems can query the current state of threat protection (e.g., enabled or disabled) for a specific resource and, crucially, update this setting to enforce security policies at scale. The typical enterprise use case involves centralizing the management of ATP policies to ensure consistent protection across all eligible resources, automating security hardening for newly deployed infrastructure, and auditing configurations for compliance against internal standards or external regulations.