Source: https://atomic-works-test.docs-staging.pageloop.ai/integrations/mcp-store/azure-cloud-ops-mcp-server

# Azure Cloud Ops MCP Server

# Azure MCP server

## Connect the Azure MCP server

Connect Azure MCP server to Atomicwork to manage, monitor, and deploy resources using AI agents.

Connect Azure MCP server to Atomicwork to give Atom, your workflow builders, and your coding agents the ability to manage, monitor, and deploy resources across your Azure environment. By establishing this connection, your AI Workforce can autonomously handle routine cloud operations, investigate active incidents, and retrieve best practices directly from your Azure subscriptions.

Azure MCP server is a self-hosted server that acts on behalf of the signed-in user against your Azure services, so a one-time tenant setup is required before connecting — you register the Azure service principals the app needs, and then a Global Administrator approves access during Connect.

## Before you begin

To set up the Azure MCP server integration, make sure you have the following access permissions:

- **Atomicwork admin access:** You must have organization administrator permissions in Atomicwork to access the MCP Store.
- **Azure administrator access:** You need Global Administrator permissions in your Microsoft Entra (Azure AD) tenant to complete the prerequisite setup and authorize the secure OAuth connection during Connect.

## Complete the prerequisites

Before connecting the integration in Atomicwork, register the required Azure service principals in Azure Cloud Shell. You must be a Global Administrator of your Microsoft Entra (Azure AD) tenant.

1. Open Azure Cloud Shell and start a PowerShell session.

2. Install the Microsoft Graph module by running: `Install-Module Microsoft.Graph -Scope CurrentUser -Force -AllowClobber`

3. Connect to Microsoft Graph with the required scope by running: `Connect-MgGraph -Scopes "Application.ReadWrite.All"`

4. Authenticate via your browser at <https://login.microsoft.com/device> using the device code provided in your terminal.

5. Register the service principals for the Azure services Azure MCP server uses by running the following script:

```powershell
$resources = @(
  "797f4846-ba00-4fd7-ba43-dac1f8f63013",  # Azure Resource Manager
  "e406a681-f3d4-42a8-90b6-c2b029497af1",  # Azure Storage
  "cfa8b339-82a2-471a-a3c9-0fc0be7a4093",  # Azure Key Vault
  "a232010e-820c-4083-83bb-3ace5fc29d0b",  # Azure Cosmos DB
  "2746ea77-4702-4b45-80ca-3c97e680e8b7",  # Azure Data Explorer
  "880da380-985e-4198-81b9-e05b1cc53158",  # Azure Cognitive Search
  "7d312290-28c8-473c-a0ed-8e53749b6d6d",  # Cognitive Services
  "ca7f3f0b-7d91-482c-8e09-c5d840d0eac5",  # Log Analytics
  "80369ed6-5f11-4dd9-bef3-692475845e77",  # Azure Event Hubs
  "022907d3-0f1b-48f7-badc-1ba6abab6d66",  # Azure SQL Database
  "00000003-0000-0000-c000-000000000000"   # Microsoft Graph
)
foreach ($appId in $resources) {
  if (-not (Get-MgServicePrincipal -Filter "appId eq '$appId'" -ErrorAction SilentlyContinue)) {
    New-MgServicePrincipal -AppId $appId | Out-Null
    Write-Host "Created service principal for $appId"
  } else {
    Write-Host "Service principal already exists for $appId"
  }
}
```

This registers the Azure services in your tenant so the connection can be granted access to them. It creates no credentials and grants no access on its own — access is granted when you approve consent during Connect. The script is safe to re-run.

## Connect Azure MCP server to Atomicwork

The integration uses a secure OAuth flow to connect your Azure tenant. Follow these steps to establish the connection:

1. Navigate to Settings > MCP Store and select the Azure MCP server tile.

2. Click Connect to initiate the authorization flow.

3. Log in with your Global Administrator credentials on the Microsoft consent screen and authorize the connection.

4. Once the setup is complete, a list of all available Azure MCP server tools will be displayed on your screen. You can update this list based on your software platform's requirements.

> [!NOTE]
>
> For the tools to return data, each user must have the appropriate Azure role-based access control (RBAC) — for example, at least Reader on the subscriptions they want the agent to act against. Consent allows the app to act on the user's behalf; RBAC determines what that user can actually see.

## Configure tool access for your AI Workforce

After connecting the integration, you can control which tools your AI Coworkers can use.

1. Navigate to AI Workforce > AI Coworkers > Tools.

2. Select the specific AI Coworker you want to configure.

3. Grant granular or complete access to the available Azure MCP server tools by toggling the permissions.

## Supported tool categories

The Azure MCP server integration provides over 250 tools across your cloud infrastructure. The table below outlines the primary tool categories and their capabilities:

| Category                     | Capabilities                                                                                                                 |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| Docs & Best Practices        | Search Microsoft Learn docs, retrieve code samples, and analyze your environment against the Well-Architected Framework.     |
| Infrastructure as Code (IaC) | Retrieve Bicep schemas, browse Terraform Azure Verified Modules (AVM), and generate Azure CLI commands.                      |
| Compute & App Hosting        | Manage Virtual Machines (CRUD operations and power states), AKS clusters, Container Apps, App Services, and Azure Functions. |
| Data & Storage               | Manage and query SQL, PostgreSQL, MySQL, Cosmos DB, Azure Data Explorer (Kusto), and Azure Storage accounts.                 |
| Monitoring & Security        | Run KQL log queries, retrieve metrics, manage Key Vault secrets and certificates, and configure Azure Backup policies.       |
| SRE Agent & Incidents        | Create incident investigation threads, execute automated response plans, and manage scheduled operational tasks.             |

## Troubleshooting

- **Connect fails with AADSTS650052 ("your organization lacks a service principal for …")** — a required Azure service principal is missing in your tenant. Re-run the prerequisite registration script, then try Connect again.
- **Tools connect but return no data** — the signed-in user is missing Azure RBAC on the target subscription(s). Assign at least the Reader role and retry.
- **"Need admin approval" on the consent screen** — Connect must be completed by a Global Administrator; a non-admin cannot grant the required tenant-wide access.

## Where to go next

- **Setting up an AI Coworker** — Learn how to configure and manage tools for your AI agents.
- **Connect the Azure AD MCP server** — Connect your identity directory to query users, groups, and licenses.
- **Connecting Microsoft Intune via the MCP Store** — Enable device management capabilities for your AI Workforce.