Skip to main content

​
At a glance

  • Availability: Experimental (how to enable).
  • Authentication: OAuth 2.0.
  • Connection: A user authorizes the connection in the provider’s consent screen.
  • Scopes: https://management.azure.com/user_impersonation, offline_access.
  • Provider documentation: Authentication reference.

​
Credentials

Set these per environment. See Connect an integration. These variables are required only when you supply your own OAuth app. If a managed app is available, you can connect without setting them. Provider permissions and consent still apply.

​
Setup

  1. Get an Azure subscription: Sign in at https://portal.azure.com with a Microsoft account. New accounts can create a free subscription with trial credit at https://azure.microsoft.com/free, which is enough to test every tool in this connector.
  2. Register an Azure app: In the Azure portal, open Microsoft Entra ID > App registrations > New registration. Choose ‘Accounts in any organizational directory and personal Microsoft accounts’ (or your single tenant) and add your callback URL as a Web redirect URI.
  3. Add the Azure Service Management delegated permission: Under API permissions, select Add a permission > Azure Service Management > Delegated permissions, and add user_impersonation. This lets the connector call Azure Resource Manager as the signed-in user.
  4. Create a client secret: Under Certificates & secrets, create a client secret. Set MICROSOFT_CLIENT_ID to the Application (client) ID and MICROSOFT_CLIENT_SECRET to the secret value.
  5. Create test resources: Create a resource group with a small VM (e.g. B1s) and a storage account so the list and VM power tools have something to return. Deallocate the VM when done to avoid charges.

​
Provider notes

  • The signed-in user needs Azure RBAC roles on the subscription: Reader is enough for the list tools, and Virtual Machine Contributor (or Contributor) is required to start and deallocate VMs.
  • Start and deallocate are asynchronous: a 202 Accepted response means the operation was queued, not that it has finished; re-run List Virtual Machines with statusOnly=true to check the power state.
  • Deallocate (not just stop) releases the compute hardware so the VM stops incurring compute charges; disks continue to bill.
  • Each Azure resource provider versions its API independently, which is why every tool carries its own api-version default.
  • List Function and Web Apps returns all Microsoft.Web/sites resources; filter client-side on the ‘kind’ field (e.g. ‘functionapp’) to isolate function apps.
Provider API reference.

​
Tools

​
Verify the connection

Call a read tool such as azure__list_subscriptions with arguments for your account. Confirm that the result comes from the intended account or workspace before enabling write tools.