Security Center MCP Server

The Security Center API, provided by the Microsoft.Security resource provider, is the foundational interface for managing the critical human notification layer within Azure Security Center, now integrated as Microsoft Defender for Cloud. Its primary function is the programmatic administration of security contacts—designated individuals or distribution lists responsible for receiving high-priority security alerts, health notifications, and advisories from across an organization’s Azure estate. This RESTful API enables enterprises to dynamically configure, query, and automate the lifecycle of these vital notification endpoints. Typical use cases are pervasive in cloud governance and security operations: a DevOps team automating the onboarding of a new subscription by programmatically setting contact details, a security operations center (SOC) ensuring global coverage by rotating regional contacts, or an IT administrator auditing and enforcing a consistent contact policy across hundreds of subscriptions to eliminate notification blind spots. The API provides the essential plumbing to bridge automated threat detection with human response, ensuring that critical security intelligence does not remain siloed within systems but reaches the right personnel immediately.