Azure MCP Server 3.0 released

Microsoft has published the stable version of Azure MCP Server 3.0, introducing new toolsets for Azure Backup, Resilience Management, SRE Agent, Terraform, Advisor, Monitor, Cosmos DB, IoT Hub, and others. This version allows AI agents to analyze the operational context of Azure and act accordingly.

Model Context Protocol adoption

The Model Context Protocol (MCP), an open standard and open-source framework launched by Anthropic in November 2024, was adopted by major AI providers, including OpenAI and Google DeepMind. In December 2025, Anthropic donated the MCP to the Agentic AI Foundation, a fund under the Linux Foundation.

Azure MCP Server features

The Azure MCP Server 3.0 includes support for the MCP protocol, Entra ID authentication via the Azure Identity library, integration with Azure services and tools, and the Azure Skills Plugin with over 26 reusable Azure skills. These skills allow for structured workflows and safeguards for real Azure operations, managed by version control and load on demand.

Release date and improvements

On October 12, 2026, Microsoft published version 3.0 of the Azure MCP Server, expanding the range of Azure operations accessible to AI agents while modifying tool interfaces and default security settings. Sandeep Sen, Product Lead at Microsoft, announced the release, highlighting the integration of more common Azure operations into agents' workflows and the introduction of clearer tool contracts and default security settings for new resources.

Development background

Version 3.0 of the Azure MCP Server is based on the self-hosted remote assistance feature of version 2.0, offering more operational capabilities and more predictable integration. This major third version is the result of 50 beta iterations and hundreds of contributions. The new toolsets introduced in version 3.0 help gather contextual information for Azure operations, including examining vaults, strategies, protectable items, and containers, as well as managing protection and governance.

Resilience and SRE tools

Azure Resilience Management tools allow working with objectives, usage plans and subscriptions, recovery plans and tasks, preparation controls, failover validation, and exercise life cycles. Failover and reactivation actions extend recovery workflows, with the ability to plan and verify these operations before triggering them. The Azure SRE Agent toolkit includes 55 commands, covering agents, skills, threads, scheduled tasks, and workflows.

New command and tool features

The stable version of the server does not change the availability or prerequisites of underlying Azure services. The SRE Agent tools use the Microsoft.App/SREAgentPreview resource provider. New Azure Terraform tools help integrate existing resources into infrastructure as code. Azure Advisor now provides recommendation summaries, metadata, updates, filters related to lifecycle and deprecation, and advice or remediation artifacts.

Enhanced monitoring and data tools

Azure Monitor allows querying metrics across all resources and performing targeted searches in "Basic" and "Auxiliary" log tables. Azure Cosmos DB allows inferring container schemas, retrieving individual or recently modified items, and using full-text and vector search. Azure IoT Hub and Azure IoT Operations allow examining device identities, digital twins, and IoT Hub statistics, querying device data, and identifying IoT Operations instances.

Improved CLI and JSON handling

Version 3.0 offers a new tool design, updated ModelContextProtocol packages, and clearer descriptions for LLM tool selection. The --learn flag in the CLI allows exploring commands and parameters without executing Azure operations. Richer System.Text.Json input schemas conform to specifications, with corrected value types and array element types.

Enhanced security and error handling

Default security settings for new resources include disabling shared key authentication for new storage accounts, HTTPS, TLS 1.2, and disabled anonymous blob access. New Event Hubs namespaces disable local authentication, and new Recovery Services vaults disable public networking. New NFS file shares use RootSquash and in-transit encryption.

Upgrade considerations

Upgrading from version 2.0 or a preversion of version 3.0 requires consulting the complete change log for version 3.x and testing the client before updating shared deployments. Main changes include update discovery and registered calls, removal of obsolete parameters from registered calls, scripts, and prompts, and removal of custom retry policy options in favor of default SDK Azure values.