The Azure MCP runs as a **local stdio server** using Azure authentication: - **Azure Authentication**: Uses your local Azure credentials (Azure CLI, environment variables, or managed identity) - **Subscription Access**: Can access resources across subscriptions your credentials have permissions for - **Write Operations**: Capable of modifying storage and database content - **Resource Visibility**: All resources accessible to your Azure account are exposed **Security best practices**: Use Azure RBAC to limit permissions to specific resource groups, consider using a service principal with minimal required permissions, enable Azure logging and monitoring for audit trails, avoid using owner-level credentials for routine operations, and regularly review access patterns in Azure Activity Log.

To start using the Azure MCP: 1. **Install Azure CLI** (if needed): Follow instructions at https://docs.microsoft.com/en-us/cli/azure/install-azure-cli 2. **Authenticate with Azure**: Run `az login` to sign in to your Azure account 3. **Select your subscription** (optional): `az account set --subscription "Your Subscription Name"` 4. **Add the MCP to your AI client**: Use `npx -y @azure/mcp@latest server start` 5. **Start managing**: Ask your AI to list storage accounts or query Cosmos DB **Example**: "List all storage containers in my production storage account and show me the largest blobs"