Source: https://atomic-works-test.docs-staging.pageloop.ai/integrations/mcp-store/microsoft-azure-mcp-server

# Microsoft Azure MCP Server

# Connecting Microsoft Azure via the MCP Store

Connect your Microsoft Azure environment to Atomicwork via the MCP Store to let AI Coworkers and workflows perform cloud operations across Azure services on your behalf. Once configured, Atom, your AI workflow builder, and your coding agents can query and manage resources in Azure Resource Manager, Azure Storage, Key Vault, Cosmos DB, Azure SQL, and more.

> [!NOTE]
>
> The Microsoft Azure MCP Server is in beta, so upstream changes on Microsoft's end might affect tool use.

## How Microsoft Azure MCP works

Azure MCP operates as a self-hosted server that acts on behalf of the signed-in user. Because it uses delegated permissions, a one-time tenant setup is required in Microsoft Entra ID before connecting. A Global Administrator must register the required Azure service principals in your tenant, then approve access when connecting the integration in Atomicwork.

For tools to retrieve and modify resources, individual users must also have appropriate Azure role-based access control (RBAC) permissions—such as the Reader or Contributor role—on the target subscriptions. While tenant consent permits the application to act on a user's behalf, Azure RBAC determines what resources that user is allowed to access.

## Before you begin

Make sure you meet the following requirements before starting the setup:

- **Global Administrator role:** You must have Global Administrator privileges in your Microsoft Entra ID (Azure AD) tenant to register service principals and grant tenant-wide consent.
- **Azure Cloud Shell access:** Access to Azure Cloud Shell or a local PowerShell environment with the Microsoft Graph PowerShell SDK installed.

## Register required Azure service principals

Run the setup script in Azure Cloud Shell to register the required service principals for each Azure service used by the MCP server.

1. Open Azure Cloud Shell and start a PowerShell session.

2. Install the Microsoft Graph module by running:
   ```powershell
   Install-Module Microsoft.Graph -Scope CurrentUser -Force -AllowClobber
   ```

3. Connect to Microsoft Graph with the required scope by running:
   ```powershell
   Connect-MgGraph -Scopes "Application.ReadWrite.All"
   ```

4. Authenticate in your browser at <https://login.microsoft.com/device> using the code displayed in your terminal.

5. Execute the following script to register the service principals across all supported Azure services:
   ```powershell
   $resources = @(
     "797f4846-ba00-4fd7-ba43-dac1f8f63013",  # Azure Resource Manager
     "e406a681-f3d4-42a8-90b6-c2b029497af1",  # Azure Storage
     "cfa8b339-82a2-471a-a3c9-0fc0be7a4093",  # Azure Key Vault
     "a232010e-820c-4083-83bb-3ace5fc29d0b",  # Azure Cosmos DB
     "2746ea77-4702-4b45-80ca-3c97e680e8b7",  # Azure Data Explorer
     "880da380-985e-4198-81b9-e05b1cc53158",  # Azure Cognitive Search
     "7d312290-28c8-473c-a0ed-8e53749b6d6d",  # Cognitive Services
     "ca7f3f0b-7d91-482c-8e09-c5d840d0eac5",  # Log Analytics
     "80369ed6-5f11-4dd9-bef3-692475845e77",  # Azure Event Hubs
     "022907d3-0f1b-48f7-badc-1ba6abab6d66",  # Azure SQL Database
     "00000003-0000-0000-c000-000000000000"   # Microsoft Graph
   )
   foreach ($appId in $resources) {
     if (-not (Get-MgServicePrincipal -Filter "appId eq '$appId'" -ErrorAction SilentlyContinue)) {
       New-MgServicePrincipal -AppId $appId | Out-Null
       Write-Host "Created service principal for $appId"
     } else {
       Write-Host "Service principal already exists for $appId"
     }
   }
   ```

This script registers the required Azure services in your tenant so that permission consent can be granted during the connection step. It creates no credentials and grants no direct access by itself.

## Connect the integration in Atomicwork

Once your PowerShell terminal setup is complete, connect the integration within Atomicwork.

1. Navigate to Settings > MCP Store > Microsoft Azure.

2. Click the Microsoft Azure tile.

3. Click Connect.

4. Sign in with your Global Administrator credentials and accept the consent screen.

After a successful connection, Atomicwork displays the list of all available Azure tools. You can customize which tools are active based on your organization's operational needs.

## Manage tool access for AI Coworkers and workflows

After connecting the Microsoft Azure MCP server, configure tool access across your AI workforce:

1. Go to AI Workforce > AI Coworker > Tools.

2. Select the relevant AI Coworker and enable specific Azure tools or grant complete tool access.

We recommend following the principle of least privilege when setting up an AI Coworker, giving each AI Coworker only the specific actions required for its role. Additionally, your AI workflow builder and coding agent automatically receive access to the Azure MCP server when building automated workflows or writing custom workflow code scripts.

## Troubleshooting common connection errors

Review the following resolutions if you run into issues during or after setup:

- **Error AADSTS650052:** Your organization lacks a service principal for one or more requested resources. Re-run the PowerShell prerequisite script to register any missing service principals, then click Connect again.

- **Tools connect but return no data:** The user executing the request lacks Azure RBAC on the target subscription or resource group. Assign at least the Reader role in the Azure portal and retry.

- **Need admin approval prompt:** The initial connection and consent must be completed by a Global Administrator. Standard user accounts cannot grant tenant-wide consent.