Security Center MCP Server

The Security Center API, provided by the Microsoft Azure Security Center (now integrated into Microsoft Defender for Cloud), is the foundational resource management layer for one of the enterprise's most critical cloud security posture management (CSPM) and workload protection platforms. Its primary function, as exposed by the specific applicationWhitelistings endpoints, is to manage and enforce "adaptive application controls" or application whitelisting policies. These policies allow security administrators and DevOps teams to define and maintain lists of approved, trusted applications that are permitted to run within their Azure environments. The GET endpoints enable the retrieval of either a comprehensive list of all whitelist policies scoped to a subscription or the granular details of a specific policy group identified by name and location. The PUT endpoint facilitates the creation or, more commonly, the update of these whitelisting rules, allowing for the modification of allowed executable lists, file paths, and associated compliance states. This capability is quintessential for enterprises operating in regulated industries, those implementing a zero-trust security model, or any organization seeking to mitigate risks from unauthorized software, ransomware, and fileless attacks by establishing a robust baseline of trusted code execution within their virtual machines and containers.