mcp-microsoft/servers/Azure.Mcp.Server/CHANGELOG.md

CHANGELOG 📝

The Azure MCP Server updates automatically by default whenever a new release comes out 🚀. We ship updates twice a week on Tuesdays and Thursdays 😊

4.0.0-beta.5 (2026-11-03)

Features Added

• Added azmcp advisor insight list command to list Azure Advisor insights (idle resources, zonal resiliency, service retirement) with typed KPIs for a Service Group, a subscription, or all accessible Service Groups and subscriptions when no scope is given. Supports --service-group or --subscription (mutually exclusive), --insight-name, --top, and --tenant. [#3938]

Bugs Fixed

• Reduced repeated Kusto query latency by caching access tokens per client and refreshing them before expiration. [#4027]
• Improved exception handling to preserve authentication, cancellation, and service error details, and correctly identify missing resources and malformed AppLens responses. [#3795]
• Fixed concurrent first calls to namespace tools corrupting the tool-list cache and causing subsequent calls to fail until the server restarts. [#4057]
• Fixed concurrent external MCP client initialization, single-tool discovery cache publication, and overlapping tool-loader disposal. Canceling a caller no longer cancels shared client initialization. [#4057]
• Honor remote MCP tool-list time-to-live values and refresh cached proxy tools when they expire. [#3780]

Other Changes

• Added scheduled Azure MCP release-preparation pull requests at noon Pacific on Tuesdays and Thursdays outside Microsoft US holidays, with configurable release-owner mentions. [#4067]

4.0.0-beta.4 (2026-10-29)

Features Added

• Added azmcp advisor servicegroupintelligence get command to get the Azure Advisor status (On Track, Attention Needed, At Risk, Critical, Unavailable) and criticality of one Service Group or all Service Groups. Supports --service-group, --criticality, --status, --top, and --tenant. Includes an explanation of how the overall status is calculated. [#3952]
• Added monitor ingestion upload to send custom log data to Azure Monitor through the Logs Ingestion API using a data collection rule, and monitor ingestion validate to check log data against payload requirements and the stream schema declared by a data collection rule before ingestion. [#3954]
• Added azurebackup operation get to read asynchronous operation status at Recovery Services vault or protected-item scope, returning timestamps, safe errors, and actual job IDs when present without treating operation IDs as job IDs. [#3839]
• Re-enabled ADME tools after GA release. [#4044]
• Added optional --include-reference-source-data to search_knowledge_base_retrieve to return source document fields for citations while preserving service defaults when omitted. Knowledge source metadata lookups are cached when the cache service is enabled. [#3871]
• Added netappfiles account create, netappfiles account get, and netappfiles account update commands for creating, retrieving, and updating Azure NetApp Files accounts. [#3708]
• Added Azure IoT Hub message-routing troubleshooting tools: [#3894]
  • iothub_routing_endpoint-health: Get the current IoT Hub-reported health snapshot for one or all routing custom endpoints
  • iothub_routing_endpoint-diagnostics: Get time-windowed routing evidence for one or all custom endpoints, including IoT Hub routing delivery metrics, current target existence, and target metrics for Event Hubs, Service Bus, Blob Storage, and Cosmos DB
• iothub_hub_get now returns the hub's configured message-routing custom endpoints in routingEndpoints. [#3894]

Bugs Fixed

• Fixed Kusto tools rejecting Azure Resource Graph Kusto endpoints (*.arg.core.windows.net), which the Kusto SDKs already trust. [#4029]
• Apply --storage-type when creating Recovery Services vaults with azurebackup vault create --vault-type rsv. The requested redundancy is now set through the vault backup storage config, invalid values are rejected before any vault is created, and a storage-config failure reports that the vault was created and how to retry with azurebackup vault update --redundancy. [#4033]
• Azure IoT Hub tools now reject hub and resource group names that don't follow Azure naming rules before calling Azure. Previously, values such as rg1/../rg2 could send the request to a different resource group or IoT Hub. [#3894]

4.0.0-beta.3 (2026-10-22)

Features Added

• Added the storage disk diagnose tool for Storage Intelligence disk performance and throttling analysis, with optional tenant selection and validated endpoint overrides. [#3580]
• Added the resiliency drill run generate-report tool to generate or refresh the report for a drill run and return the operation, completion state, and report summary, and the drill run get-report-download-url tool to get a short-lived, read-only download URL for the generated report. [#4018]
• Added resilience goal assignment create, update, delete, recommend-capacity, refresh-resources, and update-resources tools for service-group-scoped zonal resiliency, service-level targets, participation, attestation, and user confirmation. [#4014]
• Exposed the remaining GA SDK request fields on existing resiliency tools: drill create/update --identity, --chaos-resource-properties, --recovery-plan-properties, and --monitoring-properties (plus --resource-group on update, which must match the creation-time resource group); drill run failover --user-consent; recoveryplan create None identity, --default-group-unique-id, and CustomRunbook action associatedIdentity; recoveryplan resource update CrossZoneVMRecovery protection; and usage plan create --tags. [#4014]
• Added the resiliencyagent tool area with commands for general Azure resiliency guidance, application architecture assessment, resilient Bicep, ARM JSON, or Terraform generation, review of existing infrastructure-as-code, and consent-based local file attachment. The agent's clarifying questions use MCP elicitation, and generated templates and reports are returned as native MCP file resources. [#3845]

Bugs Fixed

• Resiliency recoveryplan resource update now reports a rejected long-running operation as a bad request with the service error code instead of surfacing the successful status of its final poll. [#4014]

4.0.0-beta.2 (2026-10-20)

Features Added

• Added GA goal-assignment identity, Health Model and SLI configuration to resiliency drill create/update, including sparse PATCH and explicit clearing. Drill validation accepts an optional operation selector and requires source locations except for explicit Reprotect. Reprotect supports selected recovery resources. [#3968]

Breaking Changes

• Resiliency usage-plan create now accepts only the GA Standard plan type; the preview-only Basic plan type has been removed. [#3968]
• Removed the --recoveryplan option from resiliency drill create and update. The GA API treats recoveryPlanId as read-only, so the value was never sent; the service links the service group's recovery plan automatically. [#3968]
• Resiliency goal assignment get responses now return the GA requireZonalResiliency, serviceLevelResources, and errorDetails fields, and goal resource get responses return resourceArmId and zonalResiliency. The preview-only goalAssignmentType, goalTemplateId, high-availability and disaster-recovery participation/attestation/exclusion fields, and serviceGroupMemberships have been removed. [#3968]

Bugs Fixed

• Corrected drill resource include, update, and exclude inputs and examples to require drill-resource IDs rather than underlying VM IDs, and reject identifiers belonging to another drill. [#3968]
• Corrected drill-run failover selections to accept full drill-resource IDs under the requested service group and drill rather than recovery-resource IDs. [#3968]
• Drill-run reprotect now always sends a request body; without selected resources it sends empty reprotect properties, because the service does not process a reprotect request without a body. [#3968]
• Forward drill action operation IDs in the query as well as the header for resync readiness, validation, resource add/update, start, and end, matching the existing run-action routing. [#3968]
• Resiliency drill get, create, and update responses now include the drill's managed identity, and drill resync, validation, resource add-or-update, and run mark-complete responses always include hasCompleted. [#3968]

Other Changes

Dependency Updates

• Updated Azure.ResourceManager.ResilienceManagement to 1.0.0 and migrated existing resiliency drill, usage-plan, recovery-plan, and recovery-job operations to the GA 2026-10-01 API. [#3968]

4.0.0-beta.1 (2026-10-19)

Features Added

• Added --prioritized to advisor recommendation summary to rank active recommendation types by priority in subscription and service-group scopes. Each prioritized group returns its distinct affected-resource count and a prioritizationSignals object explaining its rank; --top defaults to 10. [#3945]
• Added --show-prioritization-signals to Advisor recommendation listing to optionally return the original signalBreakdown payload when available, preserving its backend-provided JSON shape. Defaults to false; enabling signals requires --prioritized true in subscription and Service Group scopes. Requests with signals enabled and prioritized false or omitted are rejected before querying Azure. [#3946]
• Updated optimization recommendation list to make --subscription optional. When it is omitted, all accessible subscriptions in the signed-in session's default tenant (or the tenant given by --tenant) are queried. Results now include a diskRecommendationSummary with the number of unattached-disk recommendations and a link to take action in the Azure portal, and use retail savings when a recommendation has no extended savings data. [#3899]
• Extended azurebackup policy update with 11 RSV Azure VM options for hourly schedules on existing Enhanced (V2) policies, subtype assertions, instant recovery retention and resource-group prefixes, snapshot consistency, archive tiering, and resource tags. Existing Hourly schedules support partial updates; switching an Enhanced policy to Hourly requires all hourly fields. Standard/Enhanced subtype assertions do not migrate policies. Archive modes are TierAfter and TierRecommended, not CopyOnExpiry; --smart-tier false explicitly disables archive tiering. [#3791]
• Extended the Azure Advisor recommendation list tool to support the Azure Service Group scope (--service-group) as an alternative to the subscription scope, and added a --prioritized option that surfaces and ranks recommendations by contextual criticality score. Recommendation results now include contextual fields (criticality, criticalityScore, scoreChangedAt, savings) and the serviceGroupId identifier when present. [#3942]
• Added Azure service-group scope to advisor recommendation summary while preserving existing subscription and configured-default subscription behavior. [#3942]
• Extended the advisor recommendation update tool to update service-group-scoped recommendations. [#3942]
• Added private-preview monitor traces commands to query distributed traces from Azure Monitor Workspaces enabled for Trace Store: account list, field list, query run, query resume, and query cancel. Query calls collect results pages within bounded time and row budgets, preserving received data when resumption is needed. Consolidated mode exposes query resumption separately with non-idempotent metadata. [#3922]
• Added a read-only Azure Device Provisioning Service tool for retrieving service configuration and linked IoT Hub metadata without exposing connection strings or keys. [#3898]

Breaking Changes

• optimization recommendation list no longer returns unattached-disk recommendations as individual rows in recommendations; they are reported only through the new diskRecommendationSummary, which applies the same suppression and exclusion filters as the list. [#3899]

Bugs Fixed

• Fixed PyPI wheel packaging failing with an invalid System.Object[] version after a shared engineering-script update. [#3985]
• Fixed Azure Backup protect, update-protection, and undelete tools returning an async operation id in the jobId field. The operation id is not a backup job id, so azurebackup job get returned 404 and the tool wasted its full job-polling budget on a non-existent job. The operation id is now surfaced in a dedicated operationId field, jobId is populated only when a real ConfigureBackup job is found, and guidance points to azurebackup protecteditem get for verification. [#3838]
• Prioritized and ordinary listing share the existing scope and 64-character recommendation name filters. Service Group scope matches the full canonical ARM serviceGroupId. [#3946]
• Prioritized Advisor listing requires a recommendation type ID and uses that type's metadata category to select one instance metric in ARG. Cost types convert daily potential savings to an annual value using 12 times 30.4, fall back to annual savings, and round the selected annual score to two decimal places before sorting; missing or invalid savings sort last and zero remains valid. Other types sort by criticalityScore descending, treating missing scores as zero. Ties use effective retirement date ascending with unknown dates last, then case-insensitive resource name and recommendation ID. Both listing modes retain the same matching records, including Security and tracked recommendations. Non-prioritized ordering is unchanged. [#3946]
• Fixed optimization recommendation tools querying Azure Resource Graph with a token for the default tenant instead of the tenant passed in --tenant or the subscription's own tenant; tenant display names are now also accepted. [#3899]
• Fixed server start exiting with code 1 and no output when startup fails, for example when ASPNETCORE_URLS binds beyond loopback without ALLOW_INSECURE_EXTERNAL_BINDING=true. The error response is now written to stderr, so stdout stays reserved for the stdio transport. [#3913]
• Merge RSV VM policy updates into the existing policy, preserving unmentioned settings modeled by the SDK, including unmodified retention tiers, unmentioned tags, and instant recovery resource-group suffixes, subject to schedule reconciliation. Unknown wire field preservation is not guaranteed. Preserve retention times on unrelated updates and reconcile them on explicit schedule changes. Validate Daily/Hourly daily-retention and Weekly weekly-retention prerequisites, requiring explicit weekly retention before removing positive daily retention when switching to Weekly. Require effective instant recovery retention of 5 days for Standard Weekly schedule, retention, or instant recovery updates, preserving omission and allowing unrelated tags-only or time-zone-only updates. Convert explicitly supplied hourly window starts from the effective local time zone (request, existing policy, then UTC) to UTC using the deterministic 2000-01-01 baseline. Reject unknown zones and invalid or ambiguous baseline local times. Preserve omitted hourly timestamps and existing UTC behavior; Daily/Weekly time parsing is unchanged. Future seasonal DST adjustments are not calculated. Preserve comma-separated Daily/Weekly schedule times and reconcile every retention time on explicit schedule updates. Retain exception diagnostics in policy-update logs while preserving sanitized top-level Azure error messages. [#3791]
• Made Azure Backup recovery point listing resilient to malformed Azure Files recovery points. The RecoveryServicesBackup SDK could throw a UriFormatException while deserializing a single file-share recovery point, failing the entire 'azurebackup recoverypoint get' call; the service now skips the offending item and returns the remaining valid recovery points. [#3861]
• Replaced the opaque NullReferenceException surfaced by 'azurebackup policy update' with an actionable error. The SDK can fail to materialize the updated policy from the service response for some IaaS VM policy shapes even though the change was submitted; the tool now returns a clear message directing the user to verify the policy with 'azurebackup policy get'. [#3861]
• ManagedLustre: Fix issue where defaults were not applied which would return 400 during job creation. [#3833]
• Fixed PyPI packages to launch each MCP server's configured executable instead of always using azmcp. [#3984]

Other Changes

• Advisor recommendation summary now takes category, impact, subcategory, and retirement date only from recommendation-type metadata, without recommendation-instance fallback, and excludes recommendations whose type has no English metadata from every grouping. [#3945]
• Combined Advisor recommendation metadata filtering and enrichment into one server-side ARG join using English metadata for both listing modes and scopes. Prioritized listing sorts and selects top + 1 records in ARG to detect truncation without fetching every page. Removed the client-side ranking models and pagination helpers. [#3946]
• Updated Azure optimization tool descriptions to refer to results as cost optimization recommendations instead of Azure Advisor. [#3899]
• optimization recommendation tools now ignore service-group-scoped Advisor records (recommendations, suppressions, and configurations whose properties.serviceGroupId is set) in every Resource Graph query. [#3899]
• Added shared Advisor recommendation scope and ARG query infrastructure for reuse by update, summary, and future list service-group support, and exposed nullable serviceGroupId in recommendation properties. [#3942]

3.0.0 (2026-10-12)

🚀 New Major Release — Azure MCP Server 3.0

We're excited to announce the third major release of the Azure MCP Server! Version 3.0 builds on the 2.0 release with a broader and more consistent tool surface, secure-by-default resource creation, stricter input and endpoint validation, richer Azure Backup, Advisor, and resiliency capabilities, and a new MCP protocol and tool design foundation. This release spans 50 beta iterations and hundreds of contributions.

Key Features & Improvements

• More Tools and Services: Introduced new namespaces since 2.0 and expanded existing toolsets, including:
  • Azure Backup – azurebackup: vaults, policies, protection, protectable items and containers, recovery points, jobs, governance (soft delete, immutability, Multi-User Authorization, Resource Guards), customer-managed key encryption, private endpoints, and cross-region restore
  • Azure Resilience Management – resiliency: goals, usage plans and enrollments, recovery plans, recovery jobs, readiness and failover validation, and resilience drills
  • Azure SRE Agent – sreagent: 55 commands to manage agents, skills, connectors, hooks, threads, scheduled tasks, incidents, and workflows
  • Azure Terraform – azureterraform: AzureRM/AzAPI provider documentation, Azure Verified Modules, aztfexport export, and conftest policy validation
  • Azure Optimization – optimization: cost-saving recommendations, alternative VM/VMSS SKU options, and utilization explanations
  • Azure IoT Hub – iothub and Azure IoT Operations – iotoperations
  • Azure Insights – insights: infrastructure insights from Azure Resource Graph aggregation and MCP sampling
  • Azure Advisor – advisor: recommendation list, summary, update, apply-to-IaC, metadata, and remediation tools
  • Azure Cosmos DB – cosmos, Azure Compute – compute (VM power state and creation validation), Azure App Service – appservice (web app change-state), Azure Monitor – monitor (batch metrics and Log Analytics table search), and Azure Managed Lustre – managedlustre (filesystem expansion) received new tools
• Secure by Default: New resources are created with safer defaults, including Storage accounts with Shared Key authentication disabled, Event Hubs namespaces with local authentication disabled, NFS file shares with RootSquash and encrypted transit, and Recovery Services vaults with public network access disabled
• Security Hardening: Cloud-specific endpoint validation based on Microsoft.Security.AntiSSRF across data-plane and management-plane tools, namespace-scoped validation overrides, and telemetry that no longer records option values
• Cleaner, More Accurate Tool Contracts: Unused parameters, custom retry policy options, and confirmation-only options were removed from tools across all namespaces, unknown parameters are rejected, result payloads were normalized, and input schemas are generated with richer, spec-accurate System.Text.Json schemas
• Structured Output: Tools can advertise an outputSchema and return structuredContent in all server modes with --structured-output-mode
• Latest MCP Protocol: Migrated to the MCP 2026-07-28 stateless protocol with automatic backward compatibility for clients using the 2025-11-25 protocol
• More Flexible Server Options: Added --disable-proxy-tools, learn-mode discovery for azmcp commands, an operationPlane field in tools list output, and Azure Pipelines workload identity federation authentication
• Improved Reliability and Diagnostics: More accurate HTTP status codes and actionable error messages, clearer credential errors, additional telemetry, and startup, concurrency, and resource usage benchmarks

Getting Started

Install the Azure MCP Server from your preferred platform:

• VS Code: Install the Azure MCP Server extension in VS Code
• VS Code Insiders: Install the Azure MCP Server extension in VS Code Insiders
• Visual Studio 2022: Install GitHub Copilot for Azure
• Visual Studio 2026: Install the Azure and AI Development workload
• Claude and GitHub Copilot CLI: Install the Azure Skills Plugin
• IntelliJ IDEA: Install the Azure Toolkit for IntelliJ
• Eclipse IDE: Install the Azure Toolkit for Eclipse
• NuGet: Run dotnet tool install -g Azure.Mcp --version 3.0.0
• npm: Run npx @azure/mcp@3.0.0
• Docker: Run docker pull mcr.microsoft.com/azure-mcp:3.0.0
• PyPI: Run pip install msmcp-azure==3.0.0
• MCP Bundles: Download the .mcpb file for your platform/architecture and open it with your client, like Claude Desktop:
  • Linux: x64 | ARM64
  • macOS: x64 | ARM64
  • Windows: x64 | ARM64

Documentation

• Complete Command Reference
• Authentication
• Remote Server Deployment
• Connecting to Sovereign Clouds
• Troubleshooting
• Contributing Guidelines

Thank You

This release was made possible by the incredible efforts of our engineering team, partners, contributors, and the invaluable feedback from our users and the open-source community. We want to extend a huge thank you to everyone who contributed, tested, and provided feedback throughout the development of Azure MCP Server 3.0!

For a complete history of changes included in this release, see entries for versions 3.0.0-beta.1 through 3.0.0-beta.50.

---

Other Changes since 2.0.0

Breaking Changes

Tool Contract Cleanup:

• Removed unused parameters (such as subscription, resource-group, tenant, auth-method, user, and sender-name) from tools across nearly all namespaces, including Advisor, AKS, App Configuration, App Lens, Application Insights, Azure Migrate, Communication, Compute, Confidential Ledger, Container Apps, Deploy, Event Grid, Event Hubs, Foundry Extensions, Key Vault, Load Testing, Managed Lustre, MySQL, PostgreSQL, Quota, Redis, Resource Health, Search, Service Bus, SQL, Storage, and others. Update any scripts or saved prompts that pass these options
• Removed custom retry policy options from all tools and shared Azure service APIs; the Azure SDK retry defaults are used instead
• Removed the confirmation-only --force parameter from sql server delete
• Tool calls with unknown parameters are now explicitly rejected
• Normalized result payloads for several tools in best practices, Functions, Monitor, Search, SQL, and Well-Architected Framework to consistent, named result objects (for example { bestPractices }, { results }, { servers }, and { guidance })

Namespace, Tool, and Option Renames:

• Replaced monitor healthmodels entity get with monitor healthmodels list and monitor healthmodels get
• Moved shared server code from Azure.Mcp.Core.* to Microsoft.Mcp.Core.* namespaces (for example Azure.Mcp.Core.Commands → Microsoft.Mcp.Core.Commands). Because logger categories are derived from type namespaces, any logging configuration that targets the old categories (for example Logging:LogLevel:Azure.Mcp.Core entries in appsettings.json or log filters in environment variables) must be updated to the new Microsoft.Mcp.Core categories to keep applying

Secure-by-Default Behavior:

• New Storage accounts disable Shared Key authentication by default, while continuing to require HTTPS, TLS 1.2, and disabled anonymous blob access
• New Event Hubs namespaces disable local authentication by default
• New NFS file shares default to RootSquash with encrypted transit
• compute vm create and compute vmss create now require --image, and the Win2019Datacenter and Ubuntu2004 image aliases were removed
• The MySQL and PostgreSQL database query tools are now marked destructive and non-read-only, and no longer filter statements by SQL verb. The signed-in user's database permissions determine what a statement may do. In consolidated mode they moved to a new execute_azure_database_query tool

Bugs Fixed

• Fixed not-found conditions returning HTTP 500/400 instead of 404 and command validation failures returning HTTP 500 instead of 400
• Fixed numerous Azure Backup, Cosmos DB, Event Hubs, Key Vault, MySQL, PostgreSQL, Redis, SQL, and Storage tool issues found through telemetry and live testing
• Fixed CLI log messages and exceptions being written to stdout instead of stderr, which could corrupt JSON and JSON-RPC output
• Fixed trimmed and packaged distributions failing to bind options for some tools
• Fixed the npm wrapper modifying the calling project's package.json and lockfile when auto-installing a platform package

Other Changes

• Migrated tools to the new tool design and updated to the latest ModelContextProtocol packages
• Improved CLI startup time for targeted command invocations by ~39%
• Added telemetry for tool source, learn usage, tool parameters, and annotations, with improved privacy protections for validation failures
• Extensive tool description improvements across namespaces for better LLM selection accuracy

3.0.0-beta.50 (2026-10-06)

Breaking Changes

• Recovery Services vault creation now disables public network access by default. Use --enable-public-network-access true to explicitly enable public access. This option is not supported for Data Protection vaults. [#3755]
• New NFS shares default to RootSquash with encrypted transit. Explicit options remain available, while omitted security settings preserve existing shares during updates. [#3759]

Bugs Fixed

• Fixed azurebackup protecteditem get silently returning an incomplete or empty list for Data Protection Backup vaults; when a backup instance repeatedly fails to deserialize (commonly an empty or malformed resourceGroupId) the truncated listing now surfaces as an error instead of being reported as a successful result. [#3840]
• Improved Azure Advisor tool selection by distinguishing global recommendation metadata lookups from subscription-scoped recommendation records. [#3817]
• The extension_azqr tool is now advertised only for local execution when Azure Quick Review CLI version 3.0.0 or later is installed. [#3503]
• Fixed --tool filtering to match exposed tool names exactly, ignoring case, so selecting a tool no longer exposes or allows calls to other tools whose names are substrings of it. [#3837]
• Updating an existing file share now replaces supplied tag values and preserves unrelated tags without duplicate-key errors. [#3759]
• Prevented option values from appearing in validation failure telemetry while preserving client-facing error messages. [#3792]
• Added namespace-aware endpoint validation for Azure SRE Agent data-plane and Azure Storage blob and table endpoints. [#3820]
• Validated PostgreSQL server inputs against the configured Azure cloud before acquiring credentials or opening database connections. [#3740]
• Validate Azure Retail Prices requests against cloud-specific endpoints before sending initial or paginated requests. [#3740]
• Validate raw Azure Resource Manager requests from Quota and Resource Health against cloud-specific management endpoints, and safely escape generated Resource Health OData filter values. [#3740]
• Fixed Azure SRE Agent tool selection so that investigate this issue prompts route to the investigate tool instead of the read-only get-thread tool. [#3826]
• Rejected Speech endpoints now fail without falling back to another transcription method. [#3740]

Other Changes

• Added cloud-specific endpoint validation for Azure AI Search and Azure AI Speech data-plane requests. [#3740]
• Hardened Service Bus namespace validation to require bare DNS hostnames and added cloud-specific endpoint validation for Service Fabric ARM requests and pagination. [#3740]

3.0.0-beta.49 (2026-10-01)

Breaking Changes

• Removed the ADME tools temporarily for GA release. [#3805]
• Azure Backup vault creation now checks for an existing Recovery Services or Backup vault and rejects it instead of updating it. Use azurebackup_vault_update to modify existing vaults. Creation also requires permission to read the target vault. [#3800]
• Creating EventHub Namespaces now disable local authentication by default. Explicit options remain available to enable it, while omitted security options preserve existing Namespaces during updates. [#3758]
• New Storage accounts now disable Shared Key authentication by default while continuing to require HTTPS, TLS 1.2, and disabled anonymous blob access. An explicit option remain available to enable Shared Key authentication. [#3761]

Bugs Fixed

• Fixed resilience drill create failing with a generic service error when no recovery plan was specified. The tool now sends SystemAssigned identity for RecoveryPlanProperties and the legacy MonitoringProperties required by the 2026-04-01-preview API flow. [#3801]
• Added namespace-aware endpoint validation for Event Grid, Foundry Extensions, IoT Hub, Key Vault, Load Testing, Managed HSM, Managed Lustre, Monitor metrics and web tests, and MySQL endpoints. [#3694]
• Corrected the read-only annotation on the Azure Communication Services email and SMS send tools (communication_email_send, communication_sms_send). They are now correctly marked as write operations so they are excluded when the server runs with --read-only. [#3818]
• Clarified the RemediationNotAvailableForTenant response and directs users to the Advisor recommendation for available guidance. [#3816]
• Client telemetry now records canonical client name and version values, using <Unknown> when unavailable and mapping plugin client names with a client type fallback. [#3793]
• Updating an existing EventHub Namespace now replaces supplied tag values and preserves unrelated tags without duplicate-key errors. [#3758]

3.0.0-beta.48 (2026-09-29)

Features Added

• Added support for customer-specific resource application IDs when authenticating ADME requests. [#3789]

Breaking Changes

• Removed the resiliency goal template get tool. [#3790]

Bugs Fixed

• Fix issue where validation for AKS resource group was removed. [#3785]
• Tool name and area telemetry now validates identities before recording them, uses <Unknown> for rejected identities, and normalizes command names. Single-proxy mode enforces namespace filters for learning and execution. [#3749]
• Fixed the tools list and --learn CLI metadata reporting every option's type as string. Option types now reflect the underlying value type (string, integer, number, boolean, or array), consistent with the MCP tool inputSchema. Array options additionally report an elementType describing the array's element type (for example, string for a string array). [#3772]

Other Changes

• Added validation of the platform landing zone download URL in the Azure Migrate tools before the file is retrieved. [#3731]
• Added validation of outbound documentation URLs in the Azure Terraform tools to confirm requests target the expected GitHub hosts. [#3731]
• Added endpoint validation for Confidential Ledger data-plane requests to confirm the ledger endpoint matches the expected service domain for the target cloud. [#3731]

3.0.0-beta.47 (2026-09-24)

Other Changes

Dependency Updates

• Updated the .NET SDK to version 10.0.401. [#3751]

3.0.0-beta.46 (2026-09-22)

Features Added

• Expanded the azurebackup policy get tool response contract to return the full Azure Backup policy representation for both Recovery Services vaults (RSV) and Backup vaults (DPP). RSV policies now include a details object exposing schedule policy, retention policy (simple and long-term daily/weekly/monthly/yearly schedules), tiering policies, sub-protection policies, and workload-specific properties (time zone, instant restore settings, snapshot consistency, compression). DPP policies now include a dppDetails object exposing datasource types, object type, and backup/retention rules with their schedules, tagging criteria, and lifecycle settings. Existing top-level fields are preserved. The contract mirrors the current Azure Backup SDK surface and will be revisited when the underlying Azure.ResourceManager SDK packages are upgraded. [#3720]
• Added --public-network-access and --user-assigned-identity parameters to the azurebackup vault update tool (RSV): --public-network-access toggles the Recovery Services vault networking Enabled/Disabled state, and --user-assigned-identity attaches user-assigned managed identities when --identity-type is UserAssigned or SystemAssigned,UserAssigned. Added --private-dns-zone-ids and --private-dns-zone-group-name parameters to the azurebackup vault privateendpoint create tool to create a Private DNS zone group linking the new Private Endpoint to one or more Private DNS zones. [#3703]
• Added support for authenticating with Azure Pipelines workload identity federation service connections through AzurePipelinesCredential. [#3388]

Breaking Changes

• Renamed the Azure Resilience Management CLI namespace from azmcp resilience to azmcp resiliency and all MCP tool wire-name prefixes from resilience_* to resiliency_*. Clients that invoke tools directly or use tool allow-lists, saved tool names, or namespace filters must replace the old CLI namespace and MCP tool-name prefix with the new values. [#3689]
• Removed the unused user parameter from the postgres server config get, postgres server param get, and postgres server param set tools. [#3648]

Bugs Fixed

• Improved ADME schema validation, simplified health response, request timeouts, and guidance for unauthorized responses caused by unknown or incorrectly cased data partitions. [#3696]
• Storage tools (storage blob get, storage blob upload, storage blob container create, storage blob container get, storage table list, storage account get) now return specific, actionable error messages for common failures instead of raw exception text, including missing data-plane RBAC roles (403), create-only conflicts (409), and not-found (404) cases. storage account create now validates the account name up front and documents naming rules, and storage account get documents Azure Resource Graph propagation delay. [#3697]
• Fixed Resource Graph queries failing with No accessible tenant found when an explicit tenant is supplied. [#3718]
• Return concise errors listing available command names instead of full help when namespace or consolidated tool routing cannot resolve a command, including external-server routing. [#3630]
• The npm wrapper no longer writes @azure/mcp-<platform>-<arch> into the calling project's package.json and lockfile when it auto-installs a missing platform package. The install now targets a private directory inside the wrapper package, or a per-user cache directory when that is not writable, instead of the inherited working directory. Later runs reuse that install rather than running npm again, and npm's output no longer goes to stdout, which carries the MCP protocol stream in server start. [#3184]
• Event Grid topic lookup now requires a resource group when multiple topics in a subscription have the same name. [#3710]

Other Changes

• Support hostname, domain suffix, IPv4 CIDR notation, and IPv6 host literals in NO_PROXY bypass list, and respect lowercase proxy environment variables on Unix (#3338). [#3675]

3.0.0-beta.45 (2026-09-17)

Features Added

• Added namespace-scoped emergency overrides for endpoint SSRF validation and began migrating service endpoint checks to Microsoft.Security.AntiSSRF. [#3603]

Breaking Changes

• Removed protected-item from the azurebackup protecteditem protect and update-protection tools, removed the non-functional aks-included-namespaces and aks-excluded-namespaces parameters from protecteditem protect, and removed the non-functional container filter from azurebackup protectableitem list. [#3641]
• Removed the unused sender-name parameter from the communication email send tool. [#3638]
• Removed the unused user, encoding-format, and dimensions parameters from foundryextensions openai embeddings-create, stream from foundryextensions openai chat-completions-create, and auth-method from foundryextensions openai models-list. [#3640]
• Removed the unused subscription parameter from all Key Vault tools. [#3644]
• Removed the unused subscription and resource-group parameters from the mysql database query and mysql table schema get tools. [#3646]
• Removed the unused subscription parameter from the storage blob get, storage blob upload, storage blob container create, storage blob container get, and storage table list tools. [#3649]

3.0.0-beta.44 (2026-09-15)

Features Added

• Updated Azure Resource Manager Storage Sync to 1.4.0, added Cloud Endpoint change enumeration interval support, and exposed detailed sync activity progress. [#3524]
• Added the advisor remediation get tool to retrieve the remediation package that explains how to fix or resolve a specific Azure Advisor recommendation type id. Depending on the recommendation, the package returns one of three output types: remediation guidance (manual, human-readable steps), a hybrid of manual steps plus executable artifacts, or executable artifacts (Azure CLI, PowerShell, Bicep, ARM template, and terraform) — along with ordered steps, parameters, and verification. [#3242]
• Added an Azure Data Manager for Energy tool to search OSDU data with query pagination by default and explicit cursor pagination for snapshots, bulk processing, and results beyond 10000. [#3627]
• Added Azure Data Manager for Energy tools to list, fetch, and retrieve OSDU records and record versions. [#3611]
• Added azmcp azurebackup container register to register an Azure Storage account with a Recovery Services vault as an Azure File share backup container, with idempotent re-registration and an optional storage account management lock. [#3652]
• Added azmcp azurebackup protectableitem inquire to trigger discovery of Azure File shares on a registered backup container, identified by container name or storage account. [#3652]
• Enhanced azmcp azurebackup protectableitem list to document the Azure File share discovery workflow (register container, then inquire) and the AzureFileShare workload-type filter. [#3652]
• Added azmcp azurebackup container get command to look up a single Recovery Services vault (RSV) protection container by fully qualified --container name or by --storage-account (bare name or ARM resource ID). When a bare storage account name is provided the container name is derived automatically under the vault's --resource-group. When the container is not registered the response is HTTP 200 with registered: false and container: null so callers can drive idempotent register/refresh flows without treating 'not registered yet' as an error. Only Recovery Services vaults (RSV) are supported; Backup vaults (DPP) return HTTP 400. [#3522]
• Added azmcp azurebackup container list-available to list storage accounts that a Recovery Services vault can register for Azure File share backup, with optional OData and storage-account filters. [#3552]
• Added azmcp azurebackup container refresh to trigger the Recovery Services vault RefreshContainers (discovery) operation. Defaults to Azure File share storage account discovery (backupManagementType eq 'AzureStorage'); pass --filter to scope discovery to AzureIaasVM or AzureWorkload containers instead. RSV only; DPP (Backup) vaults return a 400 ValidationError. The command is a fire-and-forget POST that returns HTTP 202 Accepted with no body, so the response reports acceptance status rather than a discovered container list. This is a prerequisite for enabling Azure File share backup end-to-end from MCP. [#3521]

Breaking Changes

• Normalized result payloads for the following tools:
  • advisor recommendation apply now returns the resulting rules in a { rules } object.
  • azurebestpractices get, azurebestpractices ai_app, and azureterraformbestpractices get now return the resulting best practices in a { bestPractices } object.
  • functions language list and functions project get now return the resulting singleton values as direct objects.
  • monitor healthmodels list now returns the resulting health models in a { healthModels } object.
  • monitor resource log query and monitor workspace log query now return the resulting rows in a { results } object.
  • monitor instrumentation orchestrator-start, orchestrator-next, send-brownfield-analysis, and send-enhancement-select now return the resulting scalar value in a { result } object.
  • search index query now returns the resulting rows in a { results } object.
  • sql server get now returns the resulting servers in a { servers } object.
  • wellarchitectedframework serviceguide get now returns the resulting guidance in a { guidance } object.
• Removed Unspecified from ToolOperationPlane. Tool metadata now defaults to NotApplicable; missing, unknown, or legacy unspecified operation-plane JSON values deserialize as NotApplicable. [#3614]
• Updated the MySQL database query tool to be destructive, non-idempotent, and non-read-only. The tool no longer rejects statements based on SQL verb or keyword filtering; the signed-in user's database permissions determine what a statement may do. Empty, oversized, commented, and stacked statements are still rejected. [#3202]
• In consolidated mode, mysql_database_query and postgres_database_query moved out of the read-only get_azure_databases_details tool into a new execute_azure_database_query tool that reflects their destructive metadata. [#3202]
• Updated the PostgreSQL database query tool to be destructive, non-idempotent, and non-read-only. The tool no longer rejects statements based on SQL verb or dangerous identifier filtering; the signed-in user's database permissions determine what a statement may do. Empty, oversized, commented, and stacked statements are still rejected. [#3202]

Bugs Fixed

• Fixed an issue where --mode single spawned child processes for tools managed in the repository. [#3466]
• Fixed unclear error when using Azure File Shares tools in clouds where the Microsoft.FileShares resource provider is not yet available. [#3605]
• Fixed Azure Backup documentation and option descriptions: moved the AKS-specific options from azurebackup policy create to azurebackup protecteditem protect in azmcp-commands.md, and enumerated the valid --workload-type aliases accepted by azurebackup protectableitem list (SQL/SQLDatabase, SQLInstance, SAPHana/SAPHanaDatabase, SAPHanaSystem, SAPHanaDBInstance/SAPHanaDBI, VM/IaaSVM/VirtualMachine, FileShare/AzureFileShare/AFS, SAPAse/SAPAseDatabase/ASE/Sybase) in both azmcp-commands.md and the command's --workload-type option description. [#3494]
• Fixed invalid command metadata by classifying monitor workspace log search as a data-plane operation and replacing six malformed command IDs in Compute and Managed Lustre with valid GUIDs. [#3614]
• Fixed role_assignment_list returning an empty result for management group scopes. The Resource Graph query was always scoped to a subscription, so assignments made directly on a management group were never visible. Scope matching is also anchored now, so a scope ending in rg1 no longer matches rg10, and the queried scope is echoed in the response. [#3579]
• Fixed marketplace_product_list and marketplace_product_get failing with a deserialization error when the Marketplace catalog returned a pricing type, CSP state, or other value that was not modeled locally. These fields are open enums in the service contract and are now surfaced as strings. [#3653]
• Fixed MySQL server parameter updates failing when changing a system-default value by setting the configuration source to user-override. [#3621]
• Bounded resilience usage plan and enrollment creation and updates to 10 minutes while waiting for provisioning to complete. [#3610]
• Added missing ADME, Insights, IoT Hub, IoT Operations, Optimization, and Resilience Management namespaces to the VS Code extension service selector. [#3643]
• Added correlation-id to responses for debugging and relaxed Azure Data Manager for Energy record ID and kind validation to avoid rejecting values accepted by the service. [#3657]

Other Changes

• Added startup performance benchmarks and end-to-end measurement script (eng/scripts/Test-StartupPerformance.ps1) that measures CLI cold-start time and MCP startup time across stdio (default, namespace, all-tools) and remote HTTP transports, reporting cold vs. warm latency, p50/p95/p99 percentiles, server readiness time, tools/list JSON serialization time, and exact GPT-4o token budgets for each payload. A tool-catalog scaling benchmark measures discovery cost at current and projected tool counts. Results are gated against a baseline with tiered budgets (p50/p95 within 10%, p99 within 20%, scaling efficiency within 15%), summarized in a running trend report (eng/scripts/Update-StartupPerformanceTrend.ps1), and wired into the nightly AzDO pipeline via a new Perf stage in common.yml. [#2510]
• Added concurrency, throughput, and scalability validation for the Azure MCP Server. A new end-to-end harness (eng/scripts/Measure-ConcurrencyScaling.ps1 with a --mcp-concurrency mode) launches the server over HTTP and sweeps a ladder of concurrency levels, driving parallel MCP clients at each level and recording throughput, latency p50/p95/p99, error/timeout rate, concurrency scaling efficiency, and a state-isolation signal (concurrent responses whose tool count does not match the expected count, indicating cross-request leakage or a thread-safety failure). The resulting saturation curve shows where throughput plateaus. Results are gated against a baseline with the tiered budgets from issue (throughput within 10%, p95 latency and scaling efficiency within 15%, p99 latency within 20%, error-rate increase within 0.5 percentage points, and no state leakage), and wired into the AzDO perf pipeline. [#2510]
• Added command-dispatch and transport overhead benchmarks for the Azure MCP Server. New BenchmarkDotNet micro-benchmarks (CommandDispatchBenchmarks) measure each server-only dispatch layer in isolation — routing, argument parsing, option binding, validation, the execution frame, and response serialization — using a deterministic no-op command so no Azure work is included, which pinpoints the responsible layer for a regression. A new end-to-end harness (eng/scripts/Measure-DispatchOverhead.ps1 with --mcp-dispatch-stdio/--mcp-dispatch-http modes) times tools/list over stdio and HTTP and subtracts to isolate transport-specific overhead. Results are gated against a baseline with the tiered budgets from issue (p50/p95 within 10%, p99 within 20%, transport-overhead changes above 5% reported), and wired into the AzDO perf pipeline. [#2510]
• Required all command metadata properties to be explicitly declared while preserving existing tool metadata values. [#3614]
• Added CPU, memory, and handle resource baselines for the Azure MCP Server (eng/scripts/Measure-ResourceUsage.ps1 and a new --mcp-resource harness) that sample process resource counters across the idle, startup, discovery, steady-state, and sustained soak phases under configurable concurrency. Soak leak detection fits a least-squares trend (with a warmup exclusion) to flag unbounded memory or handle growth. Results are gated against a baseline with the tiered budgets from issue (steady-state CPU and memory within 10%, peak memory within 15%, no unbounded soak growth), and wired into the AzDO perf pipeline. [#2510]
• Added a versioned, machine-readable performance workload catalog (eng/perf-workloads.json) and controlled-environment definition for the Azure MCP Server. The catalog defines every perf workload (startup, discovery scaling, dispatch, resource, concurrency) with its harness, transport, server mode, warm-up, repetitions, and metrics, plus shared environment requirements, statistical rules, and baseline-qualification governance. Every measurement harness now embeds a self-describing environment block (commit, runtime, OS, CPU, machine memory, and workload catalog version) in its results, and the default measured repetitions were raised to at least 10. [#2510]

3.0.0-beta.43 (2026-09-10)

Features Added

• Added Azure IoT Operations toolset with iotoperations instance list and iotoperations instance get commands to list and get Azure IoT Operations instances (Microsoft.IoTOperations/instances) in a subscription or resource group.
• azmcp azurebackup protecteditem get now exposes a richer Azure Backup protected-item representation for both RSV and DPP workloads, including lifecycle, recovery, protection-state, and workload-specific extended properties, so callers can inspect the current state before updating protection. [#3600]
• azmcp azurebackup vault get now returns managed identity details for RSV and DPP vaults, including identity type, principal ID, tenant ID, and attached user-assigned identity resource IDs with their principal and client IDs. [#3600]
• Added an operationPlane field to tool metadata in azmcp tools list output, identifying each tool as data, control, both, or notApplicable. A tool's plane is the API it acts against to produce the requested result; Resource Manager calls made only as setup, to locate the target, do not count toward it. Every tool is classified. [#3368]
• Added monitor workspace log search for synchronous, bounded searches of Basic and Auxiliary Log Analytics tables. [#3581]
• Added commands to delete Azure Resilience Management usage plans and usage plan enrollments. [#3601]

Breaking Changes

• Renamed the user-invocable /resilience-recovery-operations skill to /resilience-management-operations; update saved prompts and workflows to use the new invocation name. [#3601]

Bugs Fixed

• Preserved configured consolidated-tool descriptions and structured output when single mode starts child namespace servers. [#3581]
• Corrected Analytics-table routing guidance when Log Analytics table metadata omits the plan-change timestamp. [#3581]
• Fixed log search playback tests to use sanitized workspace and column metadata. [#3581]

3.0.0-beta.42 (2026-09-08)

Features Added

• Added support for commands to provide sanitized telemetry messages for failed tool calls. [#3426]
• Added the Optimization toolset for Azure Advisor cost-optimization recommendations: [#3429]
  • optimization recommendation list: List top cost-saving recommendations for a subscription, ranked by impact and currency-normalized annual savings.
  • optimization recommendation alternatives: Get alternative resize/SKU options for a VM or VM Scale Set, with inclusion/exclusion filters.
  • optimization recommendation explain: Explain a recommendation and project current-versus-target-SKU utilization time-series from Azure Monitor.
• Added Azure Data Manager for Energy health check and schema get and list tools. [#3445]
• Added the azmcp resilience drill run add-notes command to append notes to a resilience drill run. [#3379]
• Added the azmcp resilience drill run failover command to start failover for a resilience drill run. [#3379]
• Added the azmcp resilience drill run reprotect command to re-establish protection for failed-over resources in a drill run. [#3379]
• Added the azmcp resilience drill run resume command to resume a failover drill run paused after fault injection. [#3379]
• Expanded advisor recommendation summary with lifecycle status, metadata subcategory, service-retirement date, and recommendation type groupings and filters. [#3520]
• Added recoveryplan failover, finalize, and reprotect commands, plus recovery job retry and resume commands for Azure Resilience Management. [#3447]

Breaking Changes

• Changed advisor recommendation summary --group-by recommendation-type so groups[].key is the recommendation type ID GUID instead of recommendation problem text. Use groups[].label for the friendly display name; callers that relied on problem-text keys must migrate. [#3520]

Bugs Fixed

• Improved the get_azure_ai_resources_details consolidated tool description to explicitly mention Azure Cognitive Search, knowledge sources, knowledge bases, and indexes so that related prompts correctly trigger this tool in consolidated mode. [#3041]
• Corrected impacted resource type summary keys, added metadata-authoritative category and impact values, rejected invalid summary filters and top limits, excluded legacy non-64-character Advisor recommendation IDs to prevent old/new engine duplicates, and reserved nonempty serviceGroupId recommendations for the future service-group flavor. [#3520]

Other Changes

• Standardized the Azure Resilience Management recovery plan option name as recoveryplan. [#3447]

3.0.0-beta.41 (2026-09-03)

Features Added

• Added --recommendation-type-id, --sub-category, multi-value --tracking-ids, --retirement-date, and --status filters to azmcp advisor recommendation list. Status supports New, Postponed, Dismissed, and Completed, and defaults to New. Recommendation type IDs require canonical GUID format and intersect correctly with metadata-backed filters. Pass multiple tracking IDs as space-separated values after one option. Tracking IDs and retirement date can be used independently or together. With either filter, --sub-category is optional; when specified, it must be ServiceUpgradeAndRetirement. Metadata-backed filters now page through all Azure Resource Graph metadata results to avoid failures or incomplete matches when more than 1,000 records qualify. [#3307]
• Added completionType, recommendationDismissReason, and postponedUntilDateTime to Advisor recommendation list results when Azure Resource Graph provides them. [#3307]
• Added a resilience drill resource add-or-update tool. [#3370]
• Added a resilience drill check-resync-readiness tool. [#3370]
• Added the azmcp resilience drill run mark-complete command to mark a drill run stage complete and disable further retries on it. [#3370]
• Added a resilience drill validate-for-execution tool. [#3370]
• Added the advisor recommendation update tool to set an Azure Advisor recommendation state to New, Postponed, Dismissed, or Completed. [#3303]

Breaking Changes

• Changed the azmcp advisor recommendation list response from the flat resourceId, recommendationText, category, impact, and impactedResourceType fields to an ARM-style id, name, type, and properties payload. Callers must read the impacted resource ID from properties.resourceMetadata.resourceId, recommendation text from properties.shortDescription.problem, and category and impact from properties. [#3307]

Other Changes

• Applied recommendation metadata filtering and enrichment uniformly across all Advisor categories, including Security. Incompatible category and metadata-filter combinations now return no matching recommendations instead of a category-specific validation error. [#3307]

3.0.0-beta.40 (2026-09-02)

Features Added

• Added --disable-proxy-tools to server start options to disable tools that are proxied from sources configured in /Resources/registry.json. [#3287]
• Added Azure IoT Hub device and query read tools: [#3180]
  • iothub_device_show: Show a device identity from an IoT Hub device registry
  • iothub_device_stats: Get device statistics for an IoT Hub identity registry
  • iothub_device_twin_get: Get a device twin from an IoT Hub device registry
  • iothub_query_run: Run an IoT Hub query (raw SQL or structured predicates) and return a single page of results; a bare SELECT * also returns a discoveredFields catalog of queryable field paths
• Added the resilience recovery plan validate-for-reprotect tool to report per-resource reprotect qualification and blocking reasons. [#3356]
• Added the resilience recovery plan validate-for-operation tool to check whether a plan is eligible to start a specified recovery operation. [#3356]
• Added the resilience drill end tool. [#3353]
• Added the resilience drill start tool. [#3353]
• Added the azmcp monitor metrics batchquery command for querying Azure Monitor metrics across multiple resources in a single request. [#3393]
• azmcp azurebackup policy update now accepts the full IaasVM policy surface (time zone, schedule frequency/times/days-of-week, and weekly/monthly/yearly long-term retention flags) for parity with az backup policy set. Legacy --schedule-time and --daily-retention-days continue to work unchanged. [#3432]
• MCP tools can now advertise an outputSchema and return structuredContent in all execution modes when explicitly enabled with --structured-output-mode duplicated or --structured-output-mode compact; omitting the option preserves content-only responses. In all mode, output schemas are generated from each opted-in command's source-generated JsonTypeInfo, with App Configuration as the first pilot. Namespace, consolidated, and single modes use stable tagged aggregate schemas for command discovery, routed results, and guidance messages.
• Added selective disk backup support for RSV IaaS VM protected items. azurebackup protecteditem protect now accepts --disk-list-setting (include|exclude|resetexclusionsettings), --disks-list (comma-separated data-disk LUNs, e.g. 0,1,3), and --exclude-all-data-disks to back up only the OS disk. Applies to RSV IaaS VM only. In-guest workloads (SQL / SAP HANA / SAP ASE in IaaS VM), Azure File Share, and all DPP (Backup vault) datasources return a validation error when disk-exclusion options are supplied. See https://learn.microsoft.com/azure/backup/selective-disk-backup-restore. [#3400]
• Added azurebackup protecteditem update-protection command to change the backup policy and/or selective disk configuration on an already-protected RSV IaaS VM. Requires at least one of --policy, --disk-list-setting, --disks-list, or --exclude-all-data-disks. IaaS VM only: DPP vaults, RSV in-guest workloads (SQL / SAP HANA / SAP ASE), and Azure File Share are not supported. [#3400]

Breaking Changes

• Removed the confirmation-only --force parameter from SQL server delete and --confirm parameters from SRE Agent delete tools. [#3415]
• Removed custom retry policy options from subscription and resource group tools and shared Azure service APIs. [#3419]
• Removed custom retry policy options from Redis, Resilience Management, Resource Health, Search, and Service Bus tools. [#3412]
• Removed custom retry policy options from Authorization, Azure Backup, and Azure Migrate tools. [#3405]
• Removed custom retry policy options from Communication, Compute, Container Apps, and Cosmos tools. [#3406]
• Removed custom retry policy options from Device Registry, Event Grid, Event Hubs, File Shares, and Foundry Extensions tools. [#3407]
• Removed custom retry policy options from Function App, Grafana, Insights, IoT Hub, Key Vault, and Kusto tools. [#3409]
• Removed custom retry policy options from Load Testing, Managed Lustre, Marketplace, Monitor, Policy, and Postgres tools. [#3410]
• Removed custom retry policy options from Service Fabric, SignalR, Speech, SQL, SRE Agent, Storage, and Storage Sync tools. [#3413]
• Removed custom retry policy options from Virtual Desktop and Workbooks tools. [#3414]
• Removed custom retry policy options from ACR, Advisor, AKS, App Configuration, Application Insights, and App Service tools. [#3404]
• azurebackup governance immutability now requires --immutability-type (AsPerPolicy or TimeBased). TimeBased additionally requires --immutability-duration-days between 30 and 36135. Locked state is IRREVERSIBLE. [#3430]
• azurebackup governance soft-delete now requires --soft-delete-retention-days between 14 and 180. AlwaysOn state is IRREVERSIBLE. [#3430]

Bugs Fixed

• Nested command options ([OptionContainer]) are now preserved in trimmed Azure MCP Server distributions. [#3376]
• Azure Backup: azmcp_azurebackup_vault_list and other vault-listing paths now surface a RequestFailedException (with the original HTTP status) whenever either the RSV or DPP backend returns a RequestFailedException, instead of wrapping mixed-failure cases in an InvalidOperationException. Restores meaningful HTTP status codes (e.g. 422, 429) and prevents classifying real Azure service failures as MCP-side bugs. [#3448]
• Azure Backup: azmcp_azurebackup_protecteditem_get (DPP path) no longer fails the entire list when a single backup instance deserializes to an unknown polymorphic subtype. The DPP protected-item enumerator now skips individual bad items (matching the resilient pattern already used for DPP policy listing) and returns the remaining valid items. [#3448]
• Azure Backup: azmcp_azurebackup_governance_find-unprotected now validates the --resource-type-filter value up-front and returns a customer-facing 400 (RequestFailedException) for malformed inputs or workload aliases (e.g. mssql, saphana, sapase, azurefiles) with a hint pointing to the vault-discovery path. Previously the tool threw an ArgumentException that was classified as an MCP-side bug. [#3448]
• Azure Backup: Added regression coverage for azmcp_azurebackup_backup_status against DPP-only ARM resource types (e.g. Microsoft.Compute/disks) to pin the null-cast in the ARM-type-to-DataSourceType mapping and prevent the previously-observed ArgumentNullException. [#3448]
• Azure Backup: azmcp_azurebackup_disasterrecovery_enable-crr — DPP vault Enable-CRR now preserves existing FeatureSettings sibling fields on the PATCH payload. The newer Azure.ResourceManager.DataProtectionBackup api-version rejects a bare FeatureSettings PATCH containing only CrossRegionRestoreState. This is a follow-on to the SDK upgrade in PR #3279. [#3450]
• Azure Backup: azmcp_azurebackup_disasterrecovery_enable-crr — RSV vault Enable-CRR Vault-PATCH fallback (triggered by BMSUserErrorRedundancySettingsUseVaultApi) now preserves the existing RedundancySettings.StandardTierStorageRedundancy sibling field on the PATCH payload. The newer Azure.ResourceManager.RecoveryServices api-version rejects state-only PATCH on Properties.RedundancySettings. Follow-on to PR #3279. [#3450]
• Azure Backup: azmcp_azurebackup_protecteditem_undelete — searching for the soft-deleted backup instance no longer blanks out the entire list when the DPP SDK throws on an unknown polymorphic discriminator introduced by a newer service version. Uses the resilient enumerator pattern already established in ListPoliciesAsync. [#3450]
• Azure Backup: azmcp_azurebackup_recoverypoint_get (list mode) — DPP recovery-point enumeration no longer blanks out the entire list when a single item throws on an unknown polymorphic discriminator introduced by a newer service version. Uses the resilient enumerator pattern already established in ListPoliciesAsync. [#3450]
• Namespace and single-proxy routing failures now consistently identify tool-call error responses with isError: true.
• Fixed azurebackup governance immutability and azurebackup governance soft-delete payloads that were silently broken by the RecoveryServices SDK 1.3.0 upgrade. Immutability now always sends ImmutabilityConfiguration.Type when the state is not Disabled (required on api-version 2026-05-01+), and soft-delete always sends SoftDeleteRetentionPeriodInDays plus EnhancedSecurityState (required on api-version 2026-02-01+). Regression-prevention unit tests target the payload builders directly. [#3430]

Other Changes

Dependency Updates

• Updated ModelContextProtocol packages to 2.2.0. [#3496]

3.0.0-beta.39 (2026-08-27)

Features Added

• Added support for creating, replacing, and removing additional recovery groups and their manual or Custom Runbook pre/post actions through the azmcp resilience recoveryplan create command. [#3352]
• Added the resilience recovery plan validate-for-failover tool to report per-resource failover qualification and blocking reasons. [#3354]
• Added the azmcp resilience drill delete command to delete a resilience drill from an Azure service group. [#3343]
• Added AMLFS expansion job commands (create, get, delete) to resize Azure Managed Lustre filesystem storage capacity. [#3344]
• Added the resilience drill create command for creating or updating zonal and regional drills in Azure service groups. [#3320]
• Added the resilience drill update tool for changing supporting resource placement, RBAC setup mode, and recovery plan association. [#3324]
• Added azurebackup resourceguard command group with create, get, and delete operations for managing Multi-User Authorization Resource Guards. [#3322]
• Added azurebackup security disable-mua command to explicitly disable Multi-User Authorization on a vault. [#3322]
• Added azurebackup vault privateendpoint command group for managing Private Endpoints (v2 experience) on Recovery Services vaults (RSV). Includes create, get, delete, and approve-reject (with an --action approve|reject parameter) operations. Backup vaults (DPP) are not supported and return a clear error directing users to RSV. [#3345]

Breaking Changes

• Renamed azurebackup security configure-mua to azurebackup security enable-mua. [#3322]

Bugs Fixed

• Aligned resilience recovery group and action input validation with the service API contract. [#3352]
• Fixed azurebackup security configure-mua (now enable-mua) silently disabling MUA when --resource-guard-id was omitted. The parameter is now required for enabling MUA; use the new azurebackup security disable-mua command to disable. [#3322]

3.0.0-beta.38 (2026-08-25)

Features Added

• Added the azmcp resilience drill run get command to list runs of a resilience drill or get a specific drill run. [#3318]
• Added the azmcp resilience drill run resource get command to list resources of a resilience drill run or get a specific drill run resource. [#3318]
• Added the azmcp resilience recoveryplan checkreadiness command to discover and assess whether a recovery plan and its protected resources are ready for recovery operations. The command waits for the readiness job and returns its status, errors, failed tasks, and failed resources. [#3268]
• The azmcp search index query command now uses the full Lucene query syntax by default and supports a new optional --query-type option to select between simple, full, and semantic queries. [#3251]

Breaking Changes

• Renamed the recovery plan command group from azmcp resilience recovery plan to azmcp resilience recoveryplan and the recovery job command group from azmcp resilience recovery job to azmcp resilience recoveryjob. Existing get commands now use the corresponding single-word resource group names. [#3268]

3.0.0-beta.37 (2026-08-20)

Features Added

• azurebackup vault get now accepts an optional --expand parameter (comma-separated: security, mua, all) to include extended vault posture fields (encryption key URI, cross-region restore state, MUA resource guard link). For DPP vaults, encryptionState is also returned from the service. RSV vaults omit encryptionState because the Recovery Services vault GET API does not return an explicit state field. Default output shape is unchanged. [#1718]
• Added the azmcp resilience recovery plan create command to create or fully update a Zonal recovery plan with an explicitly selected system-assigned, user-assigned, or combined identity. Updates can switch identity types while preserving existing recovery groups. [#3268]
• Added the azmcp resilience recovery plan delete command to delete a recovery plan from an Azure service group. The command is idempotent and reports whether a plan was deleted. [#3268]
• Added the azmcp resilience recovery plan update-resources command to include, exclude, configure, or remove recovery resources, including their recovery groups, associated identities, and protection settings. The command validates mandatory protection settings before first inclusion while preserving existing settings on sparse updates. [#3268]

Bugs Fixed

• Fixed azmcp eventgrid events publish so that failures publishing events to an Event Grid topic now propagate as errors (with the correct HTTP status code) instead of being swallowed and reported as a successful (HTTP 200) response with a Failed status. [#3326]

Other Changes

• Updated capture of ToolParameters for multi-step server modes. [#3296]
• Improved Event Grid performance by looking up a topic or system topic directly by name when a resource group is supplied, instead of enumerating every topic in the resource group. [#3308]

3.0.0-beta.36 (2026-08-18)

Features Added

• azurebackup vault get now accepts an optional --expand parameter (comma-separated: security, mua, all) to include extended vault posture fields (encryption key URI, cross-region restore state, MUA resource guard link). For DPP vaults, encryptionState is also returned from the service. RSV vaults omit encryptionState because the Recovery Services vault GET API does not return an explicit state field. Default output shape is unchanged.
• Added the 'azmcp resilience drill get' command to list or retrieve drill details for a service group. [#3232]
• Added the 'azmcp resilience drill resource get' command to list or retrieve resources associated with a drill. [#3232]

Breaking Changes

• Tool calls with unknown parameters are now explicitly rejected. [#3282]

3.0.0-beta.35 (2026-08-13)

Other Changes

• Improved foundry and foundryexensions namespace-level tool descriptions.

3.0.0-beta.34 (2026-08-11)

Features Added

• Added the 'azmcp resilience usageplan create' command to create or update a resilience usage plan in a resource group, including its plan type. [#3166]
• Added the 'azmcp resilience usageplan enrollment create' command to create or update an enrollment under a resilience usage plan, associating it with a service group. [#3166]

Bugs Fixed

• Improved the Azure Quick Review (azqr) tool, extension namespace, and consolidated tool descriptions so that prompts asking to scan a subscription for compliance issues or compliance recommendations reliably select the extension_azqr tool in All and Namespace modes. [#3134]

3.0.0-beta.33 (2026-08-06)

Features Added

• Added azmcp advisor metadata get to retrieve the global Azure Advisor recommendation-type metadata catalog entry (by recommendation type id) from Azure Resource Graph. [#3178]

Breaking Changes

• Renamed advisor_recommendation-type_list to advisor_metadata_list and moved recommendation-type discovery from the Advisor ARM API to the global Azure Resource Graph metadata catalog with richer localized details and filters for subcategory, Service Health tracking ID, and service-retirement date. Service-retirement filters (tracking ID or retirement date) apply to the ServiceUpgradeAndRetirement subcategory, and conflicting subcategory filters are rejected. [#3197]

Other Changes

• Added new telemetry collection for 'IsLearn' (indicates if the tool call attempted learning), 'ToolSource' (indication on where the invoked tool is from), 'ToolParameters' (the names of the tool parameters), and 'ToolAnnotations' (the annotations of the tool). [#3156]

3.0.0-beta.32 (2026-08-04)

Bugs Fixed

• Display a warning when VS Code MCP access is disabled and provide a shortcut to the MCP access setting.
• Fixed a bug in EventHubs where creating a new event hub or consumer group could throw an InvalidOperationException instead of succeeding, because the NullableResponse<T>.Value accessor was dereferenced without checking HasValue first. [#3187]

3.0.0-beta.31 (2026-07-31)

Other Changes

• Removed IServiceProvider from CommandContext and downstream locations where no longer used. [#3185]

3.0.0-beta.30 (2026-07-28)

Breaking Changes

• Removed unused parameters from Core tools. [#3137]
• Removed legacy tool design creation. [#3137]

Bugs Fixed

• sql database create and sql database update now return a validation error for unrecognized --read-scale values instead of silently ignoring them. [#3129]

Other Changes

Dependency Updates

• Updated ModelContextProtocol packages to 2.0.0-preview.3. [#3145]

3.0.0-beta.29 (2026-07-23)

Features Added

• Added azmcp iothub device list to list device identities in an Azure IoT Hub device registry. The command returns device metadata without authentication keys, defaults --max-count to 100 and returns a validation error when it is less than 1 or greater than 100, and flags truncated (with an explanatory message) when the hub contains more devices than were returned.
• Added Azure IoT Hub integration updates including command docs, e2e prompts, README service coverage, consolidated tool mapping, and CODEOWNERS ownership. [#3005]

Breaking Changes

• Removed unused parameters from Quota tools. [#3066]
• Removed unused parameters from Confidential Ledger tools. [#3092]
• Removed unused parameters from Compute tools. [#3096]
• Removed unused parameters from Communication tools. [#3099]
• Removed unused parameters from Azure Migrate tools. [#3102]
• Removed unused parameters from Azure ISV tools. [#3103]
• Removed unused parameters from Advisor tools. [#3111]

Bugs Fixed

• Properly pass tenant and retry options in Azure Migrate tools. [#3102]
• Authenticated commands now return a clear, actionable error message when Azure credentials are unavailable (CredentialUnavailableException), guiding users to run az login instead of surfacing a generic authentication failure. [#3056]

Other Changes

• Migrated Azure Terraform tools to new tool pattern. [#3101]
• Migrated Cloud Architect tools to new tool design. [#3130]
• Migrated Azure MCP Server to the MCP 2026-07-28 stateless protocol (SDK 2.0.0-preview.1). HTTP clients using the new protocol must now include Mcp-Method and Mcp-Name routing headers on every POST request. Clients on the previous 2025-11-25 protocol are unaffected — the server auto-negotiates backward compatibility. [#3016]
• Added a server usage rule instructing agents to consult the troubleshooting guide (https://aka.ms/azmcp/troubleshooting) when an Azure MCP tool call fails, including retrying with the correct tenant and/or subscription parameter for authentication, authorization, tenant, or subscription context errors. [#3054]

3.0.0-beta.28 (2026-07-21)

Breaking Changes

• Removed unused parameters from Speech tools. [#3060]
• Removed unused parameters from Workbooks tools. [#3050]
• Removed unused parameters from Well Architected Framework tools. [#3047]
• Removed unused parameters from Resilience Management tools. [#3064]
• Removed unused parameters from Redis tools. [#3065]
• Removed unused parameters from Pricing tools. [#3067]
• Removed unused parameters from Policy tools. [#3068]
• Removed unused parameters from MySql tools. [#3069]
• Removed unused parameters from Marketplace tools. [#3070]
• Removed unused parameters from Managed Lustre tools. [#3078]
• Removed unused parameters from Load Testing tools. [#3079]
• Removed unused parameters from Key Vault tools. [#3080]
• Removed unused parameters from Grafana tools. [#3081]
• Removed unused parameters from Function App tools. [#3083]
• Removed unused parameters from Extension tools. [#3085]
• Removed unused parameters from Event Hubs tools. [#3086]
• Removed unused parameters from Event Grid tools. [#3087]
• Removed unused parameters from Device Registry tools. [#3088]
• Removed unused parameters from Deploy tools. [#3090]
• Removed unused parameters from Container Apps tools. [#3091]
• Removed unused parameters from Bicep Schema tools. [#3100]

Bugs Fixed

• Updated option binding to use more appropriate arity choices based on multi-value parameters (arrays), single-value parameters (anything but boolean flags), and flags (boolean flags). [#3047]

Other Changes

• Migrated Function tools to new design. [#3082]
• Modernized MCP tool inputSchema generation to use System.Text.Json.Schema.JsonSchemaExporter instead of the previous reflection-based mapper. Emitted input schemas are now richer and more spec-accurate: object roots always include additionalProperties: false, Guid options use format: "uuid", nullable value types are typed as ["<type>", "null"], and nested object/array options produce full nested schemas. [#2995]

3.0.0-beta.27 (2026-07-16)

Breaking Changes

• Removed unused parameters from Search tools. [#2954]
• Removed unused parameters from Sql tools. [#2956]
• Removed unused parameters from SignalR tools. [#3061]
• Removed unused parameters from Service Fabric tools. [#3062]
• Removed unused parameters from Service Bus tools. [#3063]

3.0.0-beta.26 (2026-07-14)

Features Added

• Added azmcp insights get command to derive infrastructure insights from Azure Resource Graph aggregation combined with MCP sampling. [#2711]

Bugs Fixed

• Unrecognized AZURE_TOKEN_CREDENTIALS values (e.g. typos) now log a warning listing valid values instead of silently falling back to the default credential chain. [#3001]
• Fixed a thread-safety issue in CustomChainedCredential where concurrent calls to GetToken/GetTokenAsync before initialization could construct duplicate credential chains. The credential is now initialized via Lazy<T> (ExecutionAndPublication) to guarantee single initialization under concurrent access. [#3001]

Other Changes

Dependency Updates

• Updated @microsoft/vscode-azext-utils from ~2 to ~4 (4.1.1) and @vscode/vsce from 3.7.1 to 3.9.2 in the VS Code extension. [#3001]

3.0.0-beta.25 (2026-07-10)

Breaking Changes

• Replaced the broken monitor healthmodels entity get command with monitor healthmodels list and monitor healthmodels get. [#2979]

Other Changes

• Added Claude Code installation instructions to the Azure MCP Server README, covering installation of the Azure plugin from Anthropic's official plugin marketplace. [#3003]

3.0.0-beta.24 (2026-07-08)

Bugs Fixed

• Fixed an issue where the on-behalf-of token tenant comparison was case-sensitive, causing valid requests to be rejected when the configured tenant ID casing differed from the JWT 'tid' claim. [#2907]

3.0.0-beta.23 (2026-07-02)

Features Added

• Added the resilience toolset (Azure Resilience Management) with read-only get commands for goals (templates, assignments, resources), usage plans and enrollments, and recovery plans (plans, resources, jobs). [#2948]
• Added support for AVM pattern modules (avm-ptn-*) in the Azure Terraform avm tools. The azureterraform avm list tool now returns both resource and pattern modules, each tagged with a moduleType field, and avm versions/avm get work for pattern modules as well as resource modules. [#2946]

Breaking Changes

• Removed unused parameters from Resource Health tools. [#2952]

3.0.0-beta.22 (2026-06-30)

Breaking Changes

• Removed unused parameters from tools in the following namespaces:
  • App Configuration [#2871]
  • App Service [#2875]
  • Authorization [#2885]
  • Azure Backup [#2888]
  • Cosmos DB [#2935]
  • Kusto [#2922]
  • Monitor [#2940]
  • SRE Agent [#2937]
  • Storage [#2922]
  • Virtual Desktop [#2941]
  • PostgreSQL [#2942]
  • Foundry Extensions [#2949]
  • Storage Sync [#2950]
• Parameters --label and --label-filter are now mutually exclusive in appconfig kv get. [#2871]

Bugs Fixed

• Fixed handling of nullable numeric options in Foundry Extensions tools. They were previously being ignored due to a type mismatch between the System.CommandLine Option definition type and the retrieval type. [#2949]
• Fixed missing --tags option in the storagesync service create tool. [#2950]
• eventhubs namespace-get now correctly supports subscription-wide listing when --resource-group is omitted, and treats a whitespace resource group as not provided for robust scope handling. [#2961]
• foundryextensions resource-get routing and terminology were clarified to improve namespace tool selection confidence, and validation now fails fast when --resource-name is provided without --resource-group. [#2961]

3.0.0-beta.21 (2026-06-23)

Features Added

• Added azmcp advisor recommendation summary command to aggregate recommendations server-side grouped by recommendation-type, category, impact, or resource-type. --group-by is optional and defaults to category when omitted, surfacing the high-level themes (Cost, Security, Reliability, etc.). Returns the full per-bucket count and a true TotalRecommendations over the filtered population. Optional --top is a presentation cap on the number of displayed buckets (defaults to all); the Unknown bucket is always pushed to the tail and preserved across slicing so uncategorized items remain visible. Added optional --category, --impact, --resource-type, --resource, and --search filters to both azmcp advisor recommendation list and azmcp advisor recommendation summary; --search supports natural-language phrases like 'related to Microsoft Foundry'. Both commands now return only active recommendations (status 'New'), excluding dismissed and postponed ones. Also added --top to azmcp advisor recommendation list. [#2732]
• Added azmcp advisor recommendation-type list to list the catalog of Advisor recommendation types via the ARM Advisor metadata API. Each entry surfaces the recommendation's category, impact level, target resource type, and sub-category. Results are sorted by impact (High → Medium → Low). Supports optional filters --resource-type, --impact, and --category. Useful both for greenfield (empty environments) and brownfield (onboarding new resource types) scenarios. [#2830]
• Added an optional --schema parameter to azmcp postgres list for listing tables in non-public PostgreSQL schemas (defaults to public), and removed unused --subscription/--resource-group parameters from the PostgreSQL data-plane commands: database query, table schema get. [#2864]

Breaking Changes

• Removed auth mode from aks_cluster_get and aks_nodepool_get tools as they don't use that parameter. [#2868]
• Removed unused parameters from App Lens tools. [#2872]

Bugs Fixed

• Cap azmcp postgres list database and table results at 10,000 entries to prevent unbounded enumeration on large servers. When the results are truncated, the response includes a resultsTruncated: true flag. [#2920]
• Fixed the SQL db get and elastic-pool list tools returning resources from every server in the resource group, or a database from the wrong server, instead of only the requested server. Listing databases, listing elastic pools, and retrieving a single database by name are now scoped to the specified server. [#2865]
• Fixed Azure SQL tools failing with a cryptic ARM error when a subscription display name (instead of a subscription ID) was provided. The sql server show, sql server list, sql server create, and sql db rename operations now resolve the subscription through the subscription service. [#2861]

Other Changes

• Improved resource querying in Aks tools. [#2852]
• Clarified the azmcp redis create tool description to convey that provisioning is asynchronous and callers should poll provisioningState until it shows 'Succeeded' before connecting. [#2863]

3.0.0-beta.20 (2026-06-18)

Bugs Fixed

• Changed the default HTTP status code for command validation failures (CommandValidationException) from 500 (Internal Server Error) to 400 (Bad Request). [#2900]

• Optimized BaseAzureResourceService.ExecuteResourceQueryAsync to reduce ARM calls from two to one in the success path. [#2735]

3.0.0-beta.19 (2026-06-16)

Breaking Changes

• Removed unused parameters from Application Insights tools. [#2874]

Bugs Fixed

• Fixed several issues in the MySQL toolset: [#2677]
  • azmcp mysql list now works when --resource-group is omitted. It now lists all MySQL servers across the subscription using a single ARM API call, matching the behavior of the PostgreSQL toolset.
  • --user is no longer required for ARM-only commands (server config get, server param get, server param set). It is now only required for commands that open a direct database connection (database query, table schema get).
  • Resource-group and parameter not-found errors now return HTTP 404 instead of HTTP 500, enabling callers to distinguish missing resources from unexpected failures.
  • The query safety validator's compiled regex is now initialized once at startup rather than on every call, improving performance and ensuring AOT compatibility.
• Fixed PostgreSQL server configuration commands (server config get, server param get, server param set) to honor the --tenant and retry policy options when making ARM calls, enabling sovereign cloud authentication and configurable retries. [#2862]
• Added Azure OpenAI endpoint validation to the Cosmos DB vector search tool (cosmos_database_container_item_vector-search). [#2895]
• Fixed Redis list failing with a NullReferenceException when a cache has no Redis configuration (common for Basic/Standard tier caches), which previously caused all caches to be dropped from the response. Not-found errors (e.g. subscription or resource group not found) now return a 404 status instead of 500. [#2886]
• Fixed azureterraform_azapi_get returning 500 InternalServerError for invalid resource type or API version inputs. The tool now returns 400 BadRequest with an actionable message, enabling agents to auto-correct and retry with valid inputs. [#2657]

Other Changes

• Added documentation for KQL query validation restrictions (max 10,000 characters, tautology pattern rejection, management/control command rejection) for azmcp kusto query, azmcp monitor resource log query, and azmcp monitor workspace log query. [#2814]

3.0.0-beta.18 (2026-06-12)

Features Added

• Added an optional --resource-group parameter to azmcp cosmos list so account listing is scoped to the resource group and Cosmos DB account key lookups resolve the account directly instead of enumerating every account in the subscription. [#2839]

Breaking Changes

• Event Hubs namespace create/update now rejects invalid --sku-tier values with a validation error instead of silently defaulting to Standard. [#2678]
• Removed auth mode from acr_registry_list and acr_registry_repository_list tools as they don't use that parameter. [#2825]

Bugs Fixed

• Fixed multiple issues in the EventHubs toolset:
  • Namespace delete now reports "not found" instead of "deleted successfully" when the namespace does not exist.
  • Event Hub status values are now matched case-insensitively, and --status is correctly applied when updating. Previously it was accepted but silently discarded. [#2678]
• Fixed an issue where the Cosmos DB QueryItems operation silently parsed non-success (e.g. throttled or auth-failure) responses as data. The response is now validated before parsing so failures surface as errors. [#2836]
• Fixed Cosmos DB account lookup to use case-insensitive name matching and return a 404 (KeyNotFoundException) instead of a generic error when an account is not found. [#2839]
• Fixed an issue where a valid subscription name or ID containing the words subscription or default could be incorrectly treated as a placeholder value and replaced with the default subscription. [#2849]
• Azure Backup: Replace InvalidOperationException with ArgumentException/KeyNotFoundException for user-input validation errors so the telemetry classifier correctly categorizes them as Customer errors instead of MCP Tool Bugs. [#2841]
• Fixed azurebackup_vault_list and azurebackup_governance_find-unprotected so that when both the RSV and DPP backends fail with RequestFailedException, a single RequestFailedException is surfaced (preserving the HTTP status and combining both error messages) instead of an InvalidOperationException. This ensures the failure is correctly classified as an Azure service error rather than an MCP-side bug. [#2805]
• Fixed azurebackup_policy_get and azurebackup_policy_list (DPP vaults) failing with FormatException from XmlConvert.ToTimeSpan when policies contain ISO 8601 duration values that the Azure SDK cannot parse (e.g. fractional seconds, week designators in retention rules). policy_list now skips policies that the SDK cannot parse and returns the rest; policy_get falls back to listing the vault's policies and matching by name. Tracks the Azure SDK gap in Azure.ResourceManager.DataProtectionBackup. [#2805]

3.0.0-beta.17 (2026-06-09)

Breaking Changes

• Removed resource group, tenant, auth method, and retry options from cloudarchitect_design tool as they aren't used. [#2822]

Bugs Fixed

• Fixed Cosmos DB query validator to use a cached static Regex instead of recompiling a new Regex on every validation, improving performance and AOT compatibility. [#2834]
• Fixed Cosmos DB cache keys to include subscription, tenant, and authentication method. [#2838]
• Replaced misleading error logging in CosmosListCommand, removing the always-null ResourceGroup field and adding non-sensitive diagnostic context (Subscription, Account, Database) consistent with MySqlListCommand and PostgresListCommand. [#2837]
• Fixed AVM module-not-found errors returning HTTP 422 instead of 400 by using ArgumentException for invalid module names. [#2676]

3.0.0-beta.16 (2026-06-01)

Breaking Changes

• Changed server property names in appsettings.json to be scoped to MicrosoftMcp instead of the root level. [#2779]

3.0.0-beta.15 (2026-05-29)

Bugs Fixed

• Fixed trimmed/package runtime option binding failures for tools like Kusto query/sample by preserving public parameterless constructors required for reflection-based option activation. [#2773]

3.0.0-beta.14 (2026-05-28)

Features Added

• Added a new advisor recommendation apply tool that helps in applying Azure Advisor recommendations to IaC files (ARM, Terraform) by returning rules. [#2686]
• Added five Azure Cosmos DB MCP tools: [#2644]
  • cosmos database container schema infer: Infer container schema by sampling documents
  • cosmos database container item list-recent: Return the most recently modified documents
  • cosmos database container item get: Look up a document by id, with optional partition key for point reads
  • cosmos database container item text-search: FullTextContains-based property search
  • cosmos database container item vector-search: VectorDistance similarity search using Azure OpenAI-generated embeddings

Breaking Changes

• The compute vm delete and compute vmss delete tools now return a not-found outcome (Success: false) when the target resource does not exist, instead of reporting a successful deletion. This may affect automation that previously treated non-existent VM/VMSS deletions as success. [#2687]

Bugs Fixed

• Fixed issues for the following tools:
  • Azure App Configuration: [#2683]
    • The user-supplied --retry-policy is now applied to all data-plane key-value operations for App Configuration (kv get, kv set, kv delete, kv lock); previously it was only applied to the ARM store-discovery call, causing custom retry settings to have no effect on actual configuration reads and writes.
  • Azure Backup: [#2726]
    • Reject unknown --workload-type values for protectableitem list at the tool boundary with a 400 ValidationError instead of leaking a 500 ArgumentException from the service layer.
    • When both RSV and DPP vault listings fail (in vault get without --vault-type and in governance find-unprotected), the server now surfaces a single meaningful exception instead of leaking a raw AggregateException.
    • Resolve subscription name to subscription ID via ISubscriptionService before constructing ARM ResourceIdentifiers, so every tool now accepts a subscription display name in --subscription instead of failing with FormatException.
  • Azure Compute: [#2687]
    • vm update and vmss update now correctly clear all tags when --tags '' is passed.
    • DetermineOsType now uses word-boundary token matching: it no longer misidentifies images with 'win' mid-word (e.g., 'twin-ubuntu') as Windows, and now correctly identifies Visual Studio on Windows images (e.g., 'vs-2022-comm-latest-win11-n-gen2') as Windows.
  • Azure Event Grid: [#2753]
    • Corrected the topic list tool description to remove unsupported claims related to access keys and requiring a topic/subscription.
  • Azure Service Bus: [#2680]
    • The --subscription option was incorrectly required on queue details, topic details, and topic subscription details and has been removed since the namespace FQDN is sufficient for authentication.
    • topic details incorrectly returned "Subscription not found" when a topic did not exist; the error message now correctly reads "Topic not found".
    • Malformed namespace names (containing path separators or other invalid characters) raised a SecurityException; they now raise an ArgumentException to correctly signal invalid input rather than a security violation.

Other Changes

• We now emit the AzSubscriptionGuid telemetry tag from each Azure Backup tool so per-subscription telemetry works in namespace server mode. [#2734]
• Centralized KQL query safety validation in Azure.Mcp.Core. This validation is now enforced for all Monitor log/workspace query execution paths, preventing unsafe tautology and management-tool patterns. [#2747]
• Changed the SslMode in PostgreSQL tools to Require instead of the default Prefer to align with other tools like those in the MySQL namespace. [#2749]
• Expanded the Azure MCP enabledServices namespace options to include currently registered Azure tool namespaces and removed legacy azuremanagedlustre alias. [#2758]
• Added more validations to the compute vm create and compute vmss create tools. [#2764]
• The appconfig kv delete tool response now includes an existed field (true if the key was present and deleted, false if it was already absent) and a human-readable message, allowing callers to distinguish a successful deletion from a no-op on a non-existent key. [#2683]

3.0.0-beta.13 (2026-05-26)

Features Added

• Added a new namespace for Azure SRE Agent (Microsoft.App/SREAgentPreview) tools with 55 commands across 11 sub-groups: agents, skills, connectors, hooks, threads, scheduledtasks, incidents, workflows, docs, architecture, and commonprompts. Supports listing/creating/updating SRE Agent resources, managing sub-agents and tools, registering data connectors (Kusto/MCP), configuring safety hooks, running investigations, scheduling tasks, declaring incidents, generating workflows, querying memories, and producing remediation plans against the SRE Agent data plane. [#2611]

Bugs Fixed

• Fixed three bugs in storage account create: [#2674]
  • Subscription display names (e.g. "My Subscription") now resolve correctly instead of failing with a FormatException — consistent with all other storage commands.
  • The --access-tier option now documents all valid values (Hot, Cool, Cold, Premium); Cold and Premium were silently accepted but never listed, making them undiscoverable.
  • The --sku option description now clarifies that storage account create creates StorageV2 accounts and defaults to Standard_LRS if no SKU is specified.
• Fixed ArgumentNullException in azurebackup_backup_status for DPP-only ARM resource types (e.g. Microsoft.DocumentDB/databaseAccounts, AKS, Disk, Blob). The implicit string-to-BackupDataSourceType conversion is now bypassed via an explicit nullable cast so unmapped types correctly route through the DPP vault lookup. [#2724]

3.0.0-beta.12 (2026-05-22)

Features Added

• Added a new --nfs-encryption-in-transit option to File Shares create/update tools. [#2648]

Bugs Fixed

• Updated Container App tools to accept a --tenant parameter. [#2702]
• Fixed not-found conditions in SubscriptionService, TenantService, and ResourceGroupService returning HTTP 500/400 instead of HTTP 404. [#2703]
• Updated App Lens tools to return a response with a "resource not found" message instead of throwing an exception when no resource matches the given name, so telemetry no longer reports these expected cases as tool failures. [#2700]
• Fixed issues in Key Vault tools: [#2671]
  • keyvault admin settings get now correctly applies the default retry policy
  • keyvault certificate import now returns HTTP status code 400 for invalid certificate data instead of 500
  • keyvault key create now accepts the correct valid types (RSA, RSA-HSM, EC, EC-HSM) for the --key-type parameter
  • keyvault key list now includes all keys (managed and non-managed) when --include-managed is true instead of returning only managed keys

Other Changes

Dependency Updates

• Upgraded Azure.ResourceManager.FileShares to GA version from 1.0.0-beta.2 to 1.0.0. [#2648]

3.0.0-beta.11 (2026-05-20)

Features Added

• Added a tool for managing VM power state (start/stop/restart/deallocate) called compute_vm_power-state. [#2498]
• Overhauled the azurebackup_policy_create tool with comprehensive schedule, retention, archive tiering, and advanced backup capabilities across RSV and DPP vaults, including 38+ new flags, a pre-flight PolicyCreateValidator, and expanded workload-type alias support. [#2504]
• Added a new tool called azurebackup_security_configure_encryption to enable Customer-Managed Key (CMK) encryption on Recovery Services vaults and Backup vaults using Azure Key Vault keys. [#2609]
• Added ARM MCP registry integration and exposed ARM MCP tools in Azure MCP so users can discover and invoke ARM-focused capabilities. [#2571]

Bugs Fixed

• Fixed azurebackup_policy_create body shapes for DPP vault-tier copy, vaulted Blob/ADLS, SAP HANA snapshot, and RSV smart-tier to match Az CLI and service schemas. Removed unused DPP-only flags. [#2504]
• Improved Azure Resource Health error handling to preserve non-success ARM response details and return clearer guidance for conflict responses such as missing or in-progress Microsoft.ResourceHealth provider registration. [#2577]
• Fixed the following Azure Backup issues: [#2621]
  • Fixed a null-reference crash in azurebackup_backup_status by adding a null guard in MapArmResourceTypeToBackupDataSourceType
  • Fixed azurebackup_governance_find-unprotected to support nested ARM resource types (e.g., Microsoft.Sql/servers/databases) by relaxing the resource type regex from single-segment to multi-segment
  • Fixed the following RSV-backed Azure Backup tools to accept subscription names (in addition to IDs) by removing the GUID-only ValidateSubscriptionFormat check that violated MCP conventions:
    • azurebackup_vault_create
    • azurebackup_vault_get
    • azurebackup_vault_update
    • azurebackup_policy_create
    • azurebackup_policy_get
    • azurebackup_protecteditem_protect
    • azurebackup_protecteditem_get
    • azurebackup_protecteditem_undelete
    • azurebackup_protectableitem_list
    • azurebackup_job_get
    • azurebackup_recoverypoint_get
    • azurebackup_governance_immutability
    • azurebackup_governance_soft-delete
    • azurebackup_disasterrecovery_enable-crr
  • Fixed serialization issue in azurebackup_job_get by handling FormatExceptions thrown from the Azure SDK's XmlConvert.ToTimeSpan in DppBackupOperations.ListJobsAsync
  • Fixed telemetry tags not being emitted by returning "auto"/"unspecified" instead of null for unset values, since Activity.AddTag(key, null) is a no-op in .NET
• Removed restrictions on what kinds of web sites the AppLens tool can diagnose. [#2596]

Dependency Updates

• Updated the following dependencies: [#2667]
  • Azure.Core: 1.51.1 → 1.55.0
  • Azure.Identity: 1.17.0 → 1.21.0
  • Azure.Identity.Broker: 1.3.1 → 1.6.0
  • System.ClientModel: 1.9.0 → 1.11.0

3.0.0-beta.10 (2026-05-07)

Other Changes

• Fixed PluginTelemetryCommand tool name validation to use the host-created CommandFactory, ensuring the full registered tool set is validated correctly. [#2583]
• Improved MSAL exception handling by capturing richer PII-safe telemetry details and mapping MsalServiceException and MsalClientException more accurately. [#2587]

3.0.0-beta.9 (2026-05-05)

Features Added

• Added azurebackup security configure-mua command to enable or disable Multi-User Authorization on Recovery Services vaults and Backup vaults. [#2544]
• Added Win2022Datacenter1P image alias for the first-party shared gallery Windows Server 2022 image (/sharedGalleries/WINDOWSSERVER.1P/images/2022-DATACENTER-AZURE-EDITION/versions/latest) that does not require a marketplace purchase plan. [#2533]
• Added Ubuntu2604 image alias for azmcp vm create mapping to marketplace URN Canonical:ubuntu-26_04-lts:server:latest. [#2533]

Breaking Changes

• Updated azmcp compute vm create and azmcp compute vmss create to require the --image parameter, removing the default Ubuntu 24.04 LTS image when omitted. Users must now specify an alias, Marketplace URN, or shared gallery image ID. [#2533]
• Changed Win2022Datacenter image alias to use the WindowsServer2022 marketplace offer instead of the deprecated WindowsServer offer. [#2533]
• Removed the Win2019Datacenter image alias, use the marketplace URN format (MicrosoftWindowsServer:WindowsServer:2019-datacenter-gensecond:latest) directly if Windows Server 2019 is needed. [#2533]
• Removed the Ubuntu2004 image alias from azmcp vm create. Ubuntu 20.04 LTS reached end of standard support on May 31, 2025 and is no longer recommended for new VMs. Use Ubuntu2204 or Ubuntu2404, or specify the Marketplace URN (Canonical:0001-com-ubuntu-server-focal:20_04-lts-gen2:latest) if Ubuntu 20.04 is still required. [#2533]

Other Changes

• Optimized CLI startup time for targeted command invocations by ~39% (945ms to 573ms). [#2569]

3.0.0-beta.8 (2026-05-01)

Features Added

• Added appservice_webapp_change-state tool to change the running state of an App Service web app. [#1934]

Bugs Fixed

• Improved Resource Health availability status errors for unsupported resource types. [#2554]
• Fixed parameter handling to honor the optional --resource-group parameter, which was previously not passed through to the service layer, causing subscription-wide results to always be returned regardless of the specified resource group for the following tools: [#2552]
  • appconfig_account_list
  • grafana_list
  • kusto_cluster_list
  • monitor_workspace_list
  • search_service_list
  • storage_account_get
• Fixed issue where exceptions written to stdout were incorrectly interpreted as JSON RPC response. [#2559]

Other Changes

• Improved Azure Functions tool descriptions and prompts for better AI agent tool selection and invocation. [#2517]

3.0.0-beta.7 (2026-04-30)

Features Added

• Added azurebackup_policy_update command for modifying RSV backup policy schedule and retention settings. [#2452]

Bugs Fixed

• Fixed CLI mode log messages being written to stdout instead of stderr, ensuring agents and pipelines consuming stdout receive clean JSON only. Logs can be viewed with 2>&1 or captured separately using 2> file.log. [#2535]

Other Changes

• Fixed telemetry-triaged failures by hardening input validation and null handling as well as by migrating RSV soft-delete and cross-region restore to supported Vault Patch APIs. [#2518]

3.0.0-beta.6 (2026-04-28)

Features Added

• Added Azure Terraform toolset with 10 tools: AzureRM and AzAPI provider documentation, Azure Verified Modules listing/versions/documentation, aztfexport resource/resource group/query export, and conftest workspace/plan policy validation: [#2382]
  • azureterraform_azurerm_get
  • azureterraform_azapi_get
  • azureterraform_avm_list
  • azureterraform_avm_versions
  • azureterraform_avm_get
  • azureterraform_aztfexport_resource
  • azureterraform_aztfexport_resourcegroup
  • azureterraform_aztfexport_query
  • azureterraform_conftest_workspace
  • azureterraform_conftest_plan
• Updated Marketplace tool to use API version 2025-05-01 and added new response model fields: offerId, mixProductId, offeringType, licenseManagementType, hasRIPlans, leadGeneration, and experienceConfig. [#2502]
• Added learn-mode discovery for azmcp commands. AI agents can use the azmcp CLI --learn flag, and MCP tool flows surface the same command and parameter discovery behavior without executing Azure operations. [#2455]

Breaking Changes

• Updated Marketplace product_get by removing --market and --pricing-audience (now fetched from the subscription), renaming ProductsListResponse fields (Items → Value, NextPageLink → NextLink), and changing Badge, ProductType, and PricingAudience from enums to strings. [#2502]

Bugs Fixed

• Fixed azurebackup vault create --vault-type dpp to enable a system-assigned managed identity by default, preventing subsequent protecteditem protect failures with VaultMSIUnauthorized (existing vaults unaffected; use azurebackup vault update --identity-type SystemAssigned if needed). [#2470]
• Fixed azurebackup protecteditem protect to return the real protect outcome (instead of a synthetic Accepted + non-resolvable base64 job id): RSV now polls the underlying ConfigureBackup job to a terminal state and returns its actual status (Completed, CompletedWithWarnings, Failed, Cancelled, or InProgress if polling exceeds the budget) plus error details; DPP now waits for completion, reads back the backup instance, returns the actual protectionStatus (e.g., ProtectionConfigured), and no longer includes a misleading jobId (use azurebackup protecteditem get/list to verify). [#2470]
• Fixed RSV IaaS VM protection in azurebackup protecteditem protect by submitting the protect request directly (removing the 180s container-discovery pre-poll), preventing timeouts for newly created VMs and matching az backup protection enable-for-vm behavior. [#2470]

Other Changes

• Added an automated end-to-end (E2E) testing tool that uses the GitHub Copilot SDK to validate Azure MCP tool invocations from prompt fixtures. [#1830]
• Improved deploy tool invocation by rewriting tool descriptions and defaulting previously required options, and restricted deploy_app_logs_get to local-only mode (LocalRequired=true). [#2418]
• Added custom telemetry dimensions to Azure Backup MCP commands. [#2505]

2.0.2 (2026-04-24)

Breaking Changes

• Renamed --detector-name parameter to --detector-id in appservice_webapp_diagnostic_diagnose command to accurately reflect that the parameter expects a detector ID, not a display name. [#2469]

Bugs Fixed

• Fixed App Service diagnostic_list returning detector display names instead of detector IDs, causing diagnostic_diagnose to fail with 404 Not Found errors. [#2469]

Other Changes

• Fixed MCPB packaging to only include the platform a bundle was created for. Also updated the descriptions in manifest.json, as well as its list of keywords to reflect new namespace additions. [#2461]

Dependency Updates

• Updated the following System dependencies: [#2461]
  • System.CommandLine: 2.0.1 → 2.0.6
  • System.Formats.Asn1: 10.0.2 → 10.0.6
  • System.IdentityModel.Tokens.Jwt: 8.15.0 → 8.17.0
  • System.Net.ServerSentEvents: 10.0.2 → 10.0.6
  • System.Numerics.Tensors: 10.0.2 → 10.0.6
  • System.Text.Json: 10.0.2 → 10.0.6

3.0.0-beta.5 (2026-04-23)

Breaking Changes

• Changed default VM size for vm create and vmss create commands from Standard_DS1_v2 (older generation) to Standard_D2s_v5 (2 vCPU, 8 GB RAM, D-series v5) [#2415]
• Renamed --detector-name parameter to --detector-id in appservice_webapp_diagnostic_diagnose command to accurately reflect that the parameter expects a detector ID, not a display name. [#2458]

Bugs Fixed

• Fixed App Service diagnostic_list returning detector display names instead of detector IDs, causing diagnostic_diagnose to fail with 404 Not Found errors. [#2458]

Other Changes

• Added a -Verify flag to Update-Solution.ps1 that checks whether .slnx solution files are up to date without overwriting them, and integrated this verification into Analyze-Code.ps1 so stale solution files are caught before merge. [#2430]

3.0.0-beta.4 (2026-04-21)

Features Added

• Added Azure Backup toolset for vault management, backup policies, protection, jobs, recovery points, governance, and disaster recovery. Tools added: azurebackup_vault_get, azurebackup_vault_create, azurebackup_vault_update, azurebackup_policy_get, azurebackup_policy_create, azurebackup_protecteditem_get, azurebackup_protecteditem_protect, azurebackup_protectableitem_list, azurebackup_backup_status, azurebackup_job_get, azurebackup_recoverypoint_get, azurebackup_governance_find-unprotected, azurebackup_governance_immutability, azurebackup_governance_soft-delete, azurebackup_disasterrecovery_enable-crr. [#2116]
• Added a new azurebackup protecteditem undelete command that restores soft-deleted backup items to an active protection state for both RSV (Recovery Services vault) and DPP (Data Protection) vault types. [#2441]

Bugs Fixed

• Added validation in SearchService.GetSearchEndpoint to prevent URL injection if called without prior ValidateServiceName check. [#2420]
• Fixed compute_vmss_update tool returning HTTP 400 when only --capacity, --overprovision, or --enable-auto-os-upgrade is provided by correcting option type definitions to use nullable types. [#2421]

3.0.0-beta.3 (2026-04-16)

Features Added

• Added prefix support to storage_blob_get and storage_blob_container_get. [#2378]

Bugs Fixed

• Restored non-sensitive diagnostic context (Subscription, ResourceGroup, Server, Database) to error logging in MySqlListCommand and PostgresListCommand, replacing the previous {@Options} pattern that could leak credentials such as the PostgreSQL Password field. [#2393]

3.0.0-beta.2 (2026-04-14)

Features Added

• Added --output option to functions template get command with New (default) and Add values for controlling template file output. [#2178]
• Added --disable-caching to server start options to disable caching. [#2330]
• Added endpoint validation for Service Bus namespace parameter to ensure it resolves to a valid Azure Service Bus domain. [#2347]

Bugs Fixed

• Fixed endpoint validation on non-Public cloud environments. [#2320]
• Replaced structured logging of entire options objects with explicit non-sensitive identifiers in error log statements across all commands. [#2334]
• Added URI validation for disk creation source parameter to enforce HTTPS and Azure Blob Storage endpoints. [#2335]
• Added input validation for Azure Storage account names in StorageService. [#2348]
• Allowed KQL comments (//) and let statements (;) in Kusto query validation. Management commands and tautologies remain blocked. [#2385]

Other Changes

• Enhanced the description for the main Azure Monitor command group to provide a more comprehensive overview of its capabilities and usage. [#2325]
• Added query parameterization for SQL-based tools (MySQL, PostgreSQL, Cosmos DB) and input sanitization for KQL-based tools (Kusto, Monitor, Deploy), with shared helpers in Microsoft.Mcp.Core. [#2355]

2.0.1 (2026-04-14)

Bugs Fixed

• Allowed KQL comments (//) and let statements (;) in Kusto query validation. Management commands and tautologies remain blocked. [#2387]

2.0.0 (2026-04-09)

🚀 New Major Release — Azure MCP Server 2.0

We're thrilled to announce the second major release of the Azure MCP Server! Version 2.0 represents a significant evolution from the 1.0 release, bringing remote HTTP deployment, dramatically expanded Azure service coverage, comprehensive security hardening, and major performance improvements. This release spans 40 beta iterations and hundreds of contributions.

Key Features & Improvements

• Deploy as a Remote MCP Server: Deploy the Azure MCP Server as a shared, multi-user HTTP service with Entra ID authentication and On-Behalf-Of (OBO) authorization
• Use with Sovereign Clouds: Full support for Azure Government and Azure operated by 21Vianet Cloud (Azure in China) clouds across multiple services
• More Docker Options: AMD64 and ARM64 images are now available. Trimmed binaries cut image size by ~60% compared to initial Docker builds
• New Installation Methods: Added two new distribution formats:
  • PyPI: With UVX support for Python/uv-based workflows
  • MCP Bundles (.mcpb): A portable format compatible with Claude Desktop
• Security Hardening: Comprehensive input validation, SSRF protection, SQL/KQL injection prevention, query parameterization, and endpoint validation across all services
• User Confirmation Prompts: Added user confirmation prompts for sensitive and destructive operations via MCP elicitation
• Foundry Integration: Added integration with the external Microsoft Foundry MCP server (https://mcp.ai.azure.com) providing agent lifecycle, batch evaluation, prompt optimization, and project connection management tools
• More Tools: Increased tool coverage from 170+ to 260+ across 50+ services, including the following new namespaces:
  • Azure Advisor – advisor
  • Azure Compute – compute
  • Azure Container Apps – containerapps
  • Azure Device Registry – deviceregistry
  • Azure File Shares – fileshares
  • Azure Functions – functions
  • Azure Migrate – azuremigrate
  • Azure Policy – policy
  • Azure Pricing – pricing
  • Azure Service Fabric – servicefabric
  • Azure Storage Sync – storagesync
  • Azure Well-Architected Framework – wellarchitectedframework
• Improved Performance: Server startup reduced from ~20s to ~1-2s when proxied MCP servers are enabled (Microsoft Documentation, Azure Developer CLI, Microsoft Foundry)

Getting Started

Install the Azure MCP Server from your preferred platform:

• VS Code: Install the Azure MCP Server extension in VS Code
• VS Code Insiders: Install the Azure MCP Server extension in VS Code Insiders
• Visual Studio 2022: Install GitHub Copilot for Azure
• Visual Studio 2026: Install the Azure and AI Development workload
• Claude and GitHub Copilot CLI: Install the Azure Skills Plugin
• IntelliJ IDEA: Install the Azure Toolkit for IntelliJ
• Eclipse IDE: Install the Azure Toolkit for Eclipse
• NuGet: Run dotnet tool install -g Azure.Mcp --version 2.0.0
• npm: Run npx @azure/mcp@2.0.0
• Docker: Run docker pull mcr.microsoft.com/azure-mcp:2.0.0
• PyPI: Run pip install msmcp-azure==2.0.0
• MCP Bundles: Download the .mcpb file for your platform/architecture and open it with your client, like Claude Desktop:
  • Linux: x64 | ARM64
  • macOS: x64 | ARM64
  • Windows: x64 | ARM64

Documentation

• Complete Command Reference
• Authentication
• Remote Server Deployment
• Connecting to Sovereign Clouds
• Troubleshooting
• Contributing Guidelines

Thank You

This release was made possible by the incredible efforts of our engineering team, partners, contributors, and the invaluable feedback from our users and the open-source community. We want to extend a huge thank you to everyone who contributed, tested, and provided feedback throughout the development of Azure MCP Server 2.0!

For a complete history of changes included in this release, see entries for versions 2.0.0-beta.1 through 2.0.0-beta.40.

---

Other Changes since 1.0.0

Breaking Changes

Tool Consolidation: Numerous related tools were consolidated for a more streamlined tool surface:

• Cosmos DB/MySQL/PostgreSQL: Consolidated list commands:
  • Removed cosmos account list, cosmos database list, and cosmos database container list – use cosmos list with the appropriate parameters to route hierarchically
  • Removed postgres server list, postgres database list, postgres table list – use postgres list with the appropriate parameters to route hierarchically
  • Removed mysql server list, mysql database list, mysql table list – use mysql list with the appropriate parameters to route hierarchically
• Key Vault: Merged get/list tools:
  • Removed keyvault key list – use keyvault key get without providing a key name to list keys in a key vault
  • Removed keyvault secret list – use keyvault secret get without providing a secret name to list secrets in a key vault
  • Removed keyvault certificate list – use keyvault certificate get without providing a certificate name to list certificates in a key vault
• Monitor WebTest: Merged get/list and create/update tools:
  • Removed monitor webtests list – use monitor webtests get without providing a WebTest name to list WebTests in a resource group
  • Removed monitor webtests update – use monitor webtests createorupdate for both create and update scenarios
• SQL: Merged show/list tools:
  • Removed sql db show and sql db list – use sql db get without providing a database name to list databases in a server
  • Removed sql server show and sql server list – use sql server get without providing a server name to list servers in a subscription
• Load Testing: Merged list/get and create/update tools:
  • Removed loadtesting testrun list – use loadtesting testrun get without providing a TestRun name to list test runs in a resource group
  • Removed loadtesting testrun update – use loadtesting testrun createorupdate for both create and update scenarios
• Resource Health: Merged get/list tools:
  • Removed resourcehealth availability-status list – use resourcehealth availability-status get without providing a resource ID to list availability status for multiple resources

Namespace, Tool, and Option Renames:

• Foundry: Split the foundry namespace into foundryextensions for in-process tools and foundry for tools proxied from the external Microsoft Foundry MCP server.
  • The following tools were migrated to the external server under new names:
    • foundry agents list → foundry agent get
    • foundry agents create → foundry agent update
    • foundry agents connect → foundry agent invoke
    • foundry models list → foundry model catalog list
    • foundry models deploy → foundry model deploy
    • foundry models deployments list → foundry model deployment get
    • foundry agents query-and-evaluate → foundry evaluation agent batch eval create
    • foundry agents evaluate → foundry evaluator catalog get
• Best Practices: Renamed the following tools:
  • get bestpractices get → get azure bestpractices get
  • get bestpractices ai app → get azure bestpractices ai app
• Options: Renamed the following options:
  • Server-wide: --insecure-disable-elicitation → --dangerously-disable-elicitation
  • Tool listing with tools list: --namespaces → --namespace-mode
  • Getting pipeline deployment guidance with deploy pipeline guidance get:
    • --use-azd-pipeline-config → --is-azd-project,
    • --azd-iac-options → --iac-options

Database Security:

• PostgreSQL tools now require SSL and verify the server's full certificate chain before creating database connections. This SSL mode provides both eavesdropping protection and man-in-the-middle protection. See SSL Mode VerifyFull for more details.

Miscellaneous:

• Removed support for custom URL-based authority hosts in --cloud. The option now accepts only well-known cloud names
• Narrowed subscription list response to include only subscriptionId, displayName, state, tenantId, and isDefault
• Removed the following options for the deploy pipeline guidance get tool:
  • --organization-name
  • --repository-name
  • --github-environment-name

Bugs Fixed

• Fixed SignalR caching where runtime results were not stored
• Fixed retained-buffer leaks across services and tool loaders
• Fixed Linux stdio watcher regression where using CWD as content root could exhaust inotify watchers
• Added regex timeouts and cancellation propagation to prevent hangs

Other Changes

• Removed JSON pretty printing from serialization to reduce token usage
• Extensive tool description improvements across all namespaces for better LLM selection accuracy

2.0.0-beta.40 (2026-04-07)

Other Changes

• Added query parameterization for SQL-based tools (MySQL, PostgreSQL, Cosmos DB) and input sanitization for KQL-based tools (Kusto, Monitor, Deploy), with shared helpers in Microsoft.Mcp.Core. [#2362]

2.0.0-beta.39 (2026-04-06)

Features Added

• Added endpoint validation for the namespace parameter in servicebus tools to ensure it resolves to a valid Azure Service Bus domain. [#2349]

Bugs Fixed

• Added input validation for Azure Storage account names in StorageService. [#2350]

2.0.0-beta.38 (2026-04-03)

Bugs Fixed

• Replaced structured logging of entire options objects with explicit non-sensitive identifiers in error log statements across all commands. [#2336]
• Added URI validation for disk creation source parameter to enforce HTTPS and Azure Blob Storage endpoints. [#2339]

2.0.0-beta.37 (2026-04-02)

Bugs Fixed

• Fix endpoint validation on non-Public cloud environments. [#2322]

Other Changes

• Added a ClientName option and ToolArea model property to the plugin-telemetry tool. ClientType will be deprecated once usage data decreases. [#2324]

3.0.0-beta.1 (2026-04-01)

Breaking Changes

• Updated internal namespaces to align with the Microsoft.Mcp.Core convention:
  • Azure.Mcp.TestUtilities → Microsoft.Mcp.Core.TestUtilities #2300
  • Microsoft.Mcp.Core.Areas.Server.Commands → Microsoft.Mcp.Core.Areas.Server.Commands.ServerInstructions #2301
  • Fixed Microsoft.Mcp.Core.Areas.Tools namespaces #2303
  • Azure.Mcp.Core.Commands → Microsoft.Mcp.Core.Commands #2304
  • Azure.Mcp.Core.Extensions → Microsoft.Mcp.Core.Extensions #2306
  • Azure.Mcp.Core.Helpers → Microsoft.Mcp.Core.Helpers #2310
  • Azure.Mcp.Core.Logging → Microsoft.Mcp.Core.Logging #2312
  • Azure.Mcp.Core.Commands → Microsoft.Mcp.Core.Commands #2319
  • Azure.Mcp.Core.Services → Microsoft.Mcp.Core.Services #2321

Dependency Updates

• Updated ModelContextProtocol and ModelContextProtocol.AspNetCore dependencies to version 1.1.0. #1963

2.0.0-beta.36 (2026-03-31)

Bugs Fixed

• Added service name validation for Azure AI Search tools. #2307

2.0.0-beta.35 (2026-03-30)

Bugs Fixed

• Configured the right audience based on Cloud configuration when creating SDK clients for tools in:
  • AppConfiguration [#2287]
  • Container Registry [#2286]
  • Monitor Query [#2285]
  • Search [#2283]
• Fixed JSON deserialization issues for resourcehealth events with timezone-less datetime values. [#2293]

Other Changes

• Added skill name and tool name validation to the plugin-telemetry tool. Skill names are validated against an allowlist to prevent logging of customer-defined custom skill names. Tool names are validated by stripping known client prefixes (Claude Code, VS Code, Copilot CLI) and matching against registered commands or area names, with normalized names logged for consistent telemetry. Added an allowlist for Azure extension tools that are not azmcp commands but still tracked. Expanded the plugin file-reference allowlist with additional azure-enterprise-infra-planner reference paths. [#2291]
• Refactored PluginTelemetryCommand to use constructor injection for allowlist providers and lazy resolution of ICommandFactory via IServiceProvider to avoid circular dependency during startup. [#2291]

2.0.0-beta.34 (2026-03-27)

Features Added

• Added --dangerously-disable-retry-limits server start option to bypass retry policy bounds enforcement when explicitly required. [#2239]

Breaking Changes

• Removed support for custom URL-based authority hosts in the --cloud option. The option now accepts only well-known cloud names. Unrecognized values now throw an ArgumentException instead of defaulting to the public cloud. Supported values are: [#2257]
  • AzureCloud
  • AzurePublicCloud
  • Public
  • AzurePublic
  • AzureChinaCloud
  • China
  • AzureChina
  • AzureUSGovernment
  • AzureUSGovernmentCloud
  • USGov
  • USGovernment

Bugs Fixed

• Enforced read-only and HTTP mode restrictions at tool execution time, not just during tool listing. [#2226]
• Improved reliability by adding regex timeouts to prevent hangs, limiting large resource listings, and allowing cancellation to propagate correctly through exception handling. [#2223]
• Fixed Cosmos DB cache key generation to include the authentication method, preventing incorrect client reuse across authentication types. [#2217]
• Fixed validation gap in BaseAzureResourceService where the additionalFilter parameter could be concatenated into Resource Graph queries without validation. Pipe operators are now rejected. [#2217]
• Added input validation for ledger names in ConfidentialLedgerService to ensure only valid characters are accepted. [#2211]
• Fixed elicitation for GitHub Copilot CLI by updating from UntitledSingleSelectEnumSchema to TitledSingleSelectEnumSchema. [#2253]
• Fixed incorrect SignalR caching where runtime results were not stored in the cache, causing every request to re-fetch instead of returning cached data. [#2254]
• Added CacheKeyBuilder to construct cache keys using characters disallowed in Azure resource and subscription names, preventing cache collisions in multi-client remote scenarios. [#2259]
• Added vault name validation in KeyVaultService to prevent unsafe input from being interpolated into Key Vault and Managed HSM URIs. [#2238]

Other Changes

• Enforced upper bounds on retry policy values to prevent excessively large retry configurations. [#2239]
• Bumped @azure/msal-browser to 5.2.0+ to comply with Component Governance requirements. [#2260]
• Removed references to the non-existent --public-access-level parameter from the storage_blob_container_create tool description and associated e2e test prompts. [#2264]

2.0.0-beta.33 (2026-03-25)

Features Added

• Updated secret elicitation to require explicit user confirmation before proceeding with sensitive operations. [#2197]

Bugs Fixed

• Added IPv4 format validation and blocked dangerous IP ranges in the sql_server_firewall-rule_create command to prevent overly permissive firewall rules. [#2206]
• Improved HttpRequestException handling to return the actual HTTP status code when available instead of defaulting to 503 Service Unavailable. [#2200]

Other Changes

• Extended elicitations/user consent prompts to cover destructive operations (delete, modify, create) in addition to secret operations, and consolidated both into a single prompt to avoid duplicate confirmation. [#2208]

2.0.0-beta.32 (2026-03-24)

Features Added

• Added blocklist validation for security-sensitive PostgreSQL server parameters (audit logging, TLS/SSL, authentication, shared libraries, row-level security) in the server param set command to prevent accidental weakening of server security. [#2164]
• Added --public-network-access option to the redis_create command to control public network access for Azure Managed Redis resources (defaults to disabled). [#2179]

Bugs Fixed

• Fixed PostgreSQL and MySQL server name validation to require allowed Azure domain suffixes when a fully qualified domain name is provided. [#2159]
• Fixed Cosmos DB credential authentication to strictly honor the requested authentication method instead of falling back to account-key authentication. [#2162]
• Fixed snapshot lookup in the FileShares namespace to use exact resource ID matching instead of substring matching. [#2168]
• Improved Cosmos DB query validator to detect a broader range of boolean tautology patterns. [#2171]
• Fixed the sql_server_create command to default --public-network-access to Disabled for secure-by-default server creation. [#2181]

Other Changes

• Centralized Foundry and Azure OpenAI endpoint validation using the shared EndpointValidator with sovereign cloud support. [#2162]
• Added file path validation and canonicalization for the speech_stt_recognize and speech_tts_synthesize commands. [#2162]
• Added skill name allowlist validation to the plugin-telemetry tool to prevent logging of customer-defined custom skill names, and expanded the plugin file-reference allowlist with additional azure-enterprise-infra-planner reference paths. [#2149]
• Removed structured logging of the full options payload from the sql_server_create command to prevent accidental exposure of sensitive values. [#2158]
• Updated Docker release pipeline to publish additional minor version tags (e.g., 2.0, 2.0-amd64, 2.0-arm64) allowing consumers to pin to a minor release stream. [#2144]

2.0.0-beta.31 (2026-03-20)

Features Added

• Added new compute commands to delete VMs and VM scale sets with --force-deletion support: [#2065]
  • compute_vm_delete
  • compute_vmss_delete
• Added containerapps_list tool to list Azure Container Apps in a subscription. [#1981]
• Enhanced monitor instrumentation tools with framework-aware onboarding for .NET, Node.js, and Python, including guidance for Application Insights 3.x migration and Azure Monitor Distro adoption, and added the send_enhancement_select tool to submit selected enhancements to an active orchestrator session. [#2115]
• Added default subscription resolution from the Azure CLI profile (~/.azure/azureProfile.json) for all subscription-scoped commands, falling back to AZURE_SUBSCRIPTION_ID environment variable. [#1974]
• Added group_resource_list tool to list all resources within an Azure Resource Group, including generic and non-specialized resources. [#1975]

Breaking Changes

• Renamed the following monitor tools to use dash-separated names instead of underscores: [#2134]
  • get-learning-resource
  • orchestrator-start
  • orchestrator-next
  • send-brownfield-analysis
• Narrowed the subscription list command response model to include only (subscriptionId, displayName, state, tenantId, isDefault) instead of the full Azure SDK SubscriptionData type. [#1974]

Other Changes

• Added skill name and tool name validation to the plugin-telemetry tool. Skill names are validated against an allowlist to prevent logging of customer-defined custom skill names. Tool names are validated by stripping known client prefixes (Claude Code, VS Code, Copilot CLI) and matching against registered commands or area names, with normalized names logged for consistent telemetry. Added an allowlist for Azure extension tools that are not azmcp commands but still tracked. Expanded the plugin file-reference allowlist with additional azure-enterprise-infra-planner reference paths. [#2149]
• Refactored PluginTelemetryCommand to use constructor injection for allowlist providers and lazy resolution of ICommandFactory via IServiceProvider to avoid circular dependency during startup.
• Improved tool descriptions to enhance LLM selection accuracy for the following tools: [#2131]
  • extension_azqr
  • extension_cli_generate
  • extension_cli_install

2.0.0-beta.30 (2026-03-19)

Breaking Changes

• Moved the following tools from the monitorinstrumentation namespace to the monitor namespace: [#2087]
  • list_learning_resources
  • get_learning_resource
  • orchestrator_start
  • orchestrator_next
  • send_brownfield_analysis
• Consolidated the list_learning_resources and get_learning_resource tools into a single get_learning_resource tool in the monitor namespace. [#2113]

Other Changes

• Extended command telemetry to include additional attributes (plugin-version, skill-name, skill-version). [#2114]
• Reviewed MCP tool Command definitions and resolved validation inconsistencies, aligning implementations with tool development guidelines and improving consistency across multiple tool areas. [#2086]

2.0.0-beta.29 (2026-03-18)

Features Added

• Added new compute tool for deleting Azure managed disks: [#2059]
  • compute_disk_delete

Bugs Fixed

• Fixed SQL injection vulnerability in MySQL query validation that allowed bypassing safety checks via version-specific comments and UNION-based attacks. [#2083]
• Hardened Postgres SQL query validator to block set-operation keywords (UNION, INTERSECT, EXCEPT), additional dangerous system catalogs, and fixed false-positive comment detection inside string literals. [#2096]
• Hardened SSRF protection in EndpointValidator against IPv6 transition mechanism bypass vectors (IPv4-mapped, 6to4, Teredo, NAT64, NAT64v2, IPv4-compatible), added wildcard DNS blocklist, trailing-dot FQDN normalization, and sanitized error messages to prevent IP address leakage. [#2066]

Other Changes

• Added GitHub API rate limiting handling, runtime configuration support, and live test infrastructure for the Azure.Mcp.Tools.Functions toolset. [#2071]
• Removed hardcoded Model Context Protocol version in favor of using the latest supported by the C# SDK. [#2101]
• Added tenant parameter support to Azure Resource Graph queries in BaseAzureResourceService, enabling queries to run against the intended tenant context. [#1945]

1.0.4 (2026-03-18)

Bugs Fixed

• Fixed SQL injection vulnerability in MySQL query validation that allowed bypassing safety checks via version-specific comments and UNION-based attacks. [#2108]
• Hardened Postgres SQL query validator to block set-operation keywords (UNION, INTERSECT, EXCEPT), additional dangerous system catalogs, and fixed false-positive comment detection inside string literals. [#2097]

2.0.0-beta.28 (2026-03-17)

Features Added

• Enhanced Azure File Shares private endpoint connection management with improved reliability and updated SDK support. [#1823]
• Added new monitorinstrumentation tools that analyze a local workspace and return step-by-step guidance to instrument applications with Azure Monitor: [#1960]
  • list_learning_resources
  • get_learning_resource
  • orchestrator_start
  • orchestrator_next
  • send_brownfield_analysis
• Enhanced the wellarchitectedframework serviceguide get tool to act as a list command when no service parameter is provided, reducing the total number of tools. [#2020]
• Expanded the PostgreSQL query validator blocklist with additional dangerous functions and system catalogs. [#2067]
• Added a hidden plugin-telemetry tool to emit skill/tool invocation telemetry for agent scenarios (e.g., Copilot CLI), including validated and sanitized file references via an embedded allowlist. [#1979]

Breaking Changes

• Removed the following tools from the foundryextensions namespace: [#2037]
  • agents_get-sdk-sample
  • threads_create
  • threads_list
  • threads_get-messages

Bugs Fixed

• Improved the applens resource diagnose tool to use ARG-based resource discovery with optional subscription, resource group, and resource type parameters. [#2018]
• Added filtering on LocalRequired when running in remote mode. [#2017]
• Fixed the postgres list tool incorrectly requiring --resource-group and --user when listing servers at the subscription scope. Both parameters are now optional as intended. [#2015]
• Fixed a connection string injection vulnerability in PostgreSQL and MySQL tools by using parameterized connection string builders instead of string interpolation. [#2056]
• Fixed KQL injection vulnerabilities in Kusto tools where user-controlled table names were directly interpolated into KQL commands without escaping, allowing arbitrary command execution. [#2070]
• Fixed credential chain crash from InteractiveBrowserCredential failure. [#2076]

Other Changes

• Improved testability of the following namespaces by removing a dependency on CommandContext.ServiceProvider in ExecuteAsync:
  • appservice [#1900]
  • foundryextensions [#1990]
  • redis [#1888]
  • storage [#1880]
  • loadtesting [#2062]
  • kusto [#2061]
  • marketplace [#2064]
  • keyvault [#2060]
  • managedlustre [#2063]
• Refactored tools in the following namespaces to use constructor dependency injection instead of resolving services via context.GetService<T>() in ExecuteAsync:
  • communication [#1913]
  • eventhubs [#1986]
  • eventgrid [#1985]
• Reintroduced capturing error information in telemetry with standard exception.message, exception.type, and exception.stacktrace telemetry tags, replacing the ErrorDetails tag. [#1942]
• Improved descriptions for better LLM selection accuracy for the following:
  • The deploy_architecture_diagram_generate and deploy_plan_get tools [#2023]
  • The search index get, search index query, and search service list tools [#2038]
  • The azuremigrate namespace [#2043]
  • The resourcehealth namespace [#2025]
• Centralized ARM access token acquisition in BaseAzureService via GetArmAccessTokenAsync, eliminating duplicated inline credential and token fetching logic across service implementations. [#2033]
• Updated Landing Zone URL in the azuremigrate tools to use aka.ms links. [#2028]
• Standardized CacheService TTLs across services by introducing centralized CacheDurations tiers (subscription 12h→2h; service data 1h→5m). [#1973]
• Switched Docker publishing to 1ES tasks for pushing images to ACR and split the release process into separate load and multi-arch manifest publish steps. [#2069]
• Updated eng/common from the tools repo, pulling in shared engineering pipeline/script changes and dependency/lockfile refreshes. [#2030]

Dependency Updates

• Updated .NET SDK from 10.0.103 to 10.0.201. [#2072]
• Updated Azure.ResourceManager.FileShares from 1.0.0-beta.1 to 1.0.0-beta.2. [#1823]
• Updated Azure.Bicep.Types from 0.6.27 to 0.6.50. [#1574]

1.0.3 (2026-03-17)

Bugs Fixed

• Fixed a connection string injection vulnerability in PostgreSQL and MySQL tools by replacing raw string interpolation with NpgsqlConnectionStringBuilder and MySqlConnectionStringBuilder, preventing parameter override attacks from user-controlled inputs. [#2057]
• Expanded the PostgreSQL query validator blocklist to include additional dangerous functions and system catalogs. [#2074]
• Addressed a KQL injection vulnerability in Kusto tools caused by directly interpolating user-controlled table names into queries without proper escaping, which could enable arbitrary command execution. [#2084]

2.0.0-beta.27 (2026-03-12)

Features Added

• Added compute disk create and compute disk update commands for managing Azure managed disks. [#1936]
• Added Azure Device Registry namespace list command (azmcp deviceregistry namespace list) [#1961]
• Added Azure Functions toolset with three new tools: functions_language_list for listing supported languages, functions_project_get for retrieving project initialization files, and functions_template_get for listing and fetching function template source code. [#1959]
• CodeToCloud feature parity improvements for Deploy and Quota areas: [#1663]
  • Support deployment using Azure CLI with Bicep/Terraform
  • Support creation of a deploy-to-existing-resources plan
  • New resource type support in quota checks, including SQL, MySQL, and CosmosDB
  • New IaC rules added for better support regarding code quality, configuration success and security

Breaking Changes

• azmcp deploy pipeline guidance get option renames and removals: [#1663]
  • --use-azd-pipeline-config renamed to --is-azd-project
  • --azd-iac-options renamed to --iac-options
  • --organization-name, --repository-name, and --github-environment-name options removed
  • --pipeline-platform and --deploy-option added as new options This new design allows an overall better user experience to generate CI/CD pipeline to Azure.

Other Changes

• AzureIsv: Improved testability by removing dependency on CommandContext.ServiceProvider in ExecuteAsync. [#1902]
• Compute: Improved testability by removing dependency on CommandContext.ServiceProvider in ExecuteAsync. [#1914]
• Refactored Azure Migrate commands to use constructor dependency injection instead of context.GetService() [#1909]
• Refactored FunctionAppGetCommand to use constructor dependency injection for IFunctionAppService instead of resolving it via context.GetService<T>() in ExecuteAsync. [#1991]
• Refactored Azure.Mcp.Tools.Extension commands to use constructor dependency injection instead of resolving services via context.GetService<T>() in ExecuteAsync. [#1988]
• Refactored Azure.Mcp.Tools.Grafana to use constructor dependency injection instead of resolving services via context.GetService<T>() in ExecuteAsync. [#1992]

2.0.0-beta.26 (2026-03-10)

Features Added

• Added DeviceCodeCredential support for headless environments (Docker, WSL, SSH tunnels, CI) where browser-based interactive authentication is unavailable. It is automatically used as a last-resort fallback in the default and dev credential chains, and can also be selected exclusively by setting AZURE_TOKEN_CREDENTIALS=DeviceCodeCredential. Not available in stdio or http server transport modes. [#1908]

• Added Azure Compute VM create/update and VMSS create/update. [#1705]

• Added Azure Well-Architected Framework service guide tool to provide architectural best practices, design patterns, and recommendations based on the five pillars: reliability, security, cost optimization, operational excellence, and performance efficiency. [#1964]

• Remove duplicate WWW-Authenticate response header [#1774]

Other Changes

• AppLens: Improved testability by removing dependency on CommandContext.ServiceProvider in ExecuteAsync. [#1884]
• Acr: Improved testability by removing dependency on CommandContext.ServiceProvider in ExecuteAsync. [#1881]
• Aks: Improved testability by removing dependency on CommandContext.ServiceProvider in ExecuteAsync. [#1883]
• Authorization: Improved testability by removing dependency on CommandContext.ServiceProvider in ExecuteAsync. [#1901]
• Advisor: Improved testability by removing dependency on CommandContext.ServiceProvider in ExecuteAsync. [#1882]
• Refactored ApplicationInsights tools to use constructor dependency injection. [#1899]

2.0.0-beta.25 (2026-03-06)

Features Added

• Added new tools available via the external Azure AI Foundry MCP server (https://mcp.ai.azure.com) that provide capabilities not previously available in Azure MCP Server: [#1771]
  • agent_container_control: Control an agent container
  • agent_container_status_get: Get the status of an agent container
  • agent_definition_schema_get: Get the schema for an agent definition
  • agent_invoke: Invoke an agent interactively
  • evaluation_agent_batch_eval_create: Create a batch evaluation run for an agent
  • evaluation_dataset_batch_eval_create: Create a batch evaluation run using a dataset
  • evaluator_catalog_create: Create a custom evaluator in the catalog
  • evaluator_catalog_delete: Delete an evaluator from the catalog
  • evaluator_catalog_get: Get an evaluator from the catalog
  • evaluator_catalog_update: Update an evaluator in the catalog
  • project_connection_create: Create a connection in a Foundry project
  • project_connection_delete: Delete a connection from a Foundry project
  • project_connection_get: Get details of a Foundry project connection
  • project_connection_list: List connections in a Foundry project
  • project_connection_list_metadata: List metadata for connections in a Foundry project
  • project_connection_update: Update a connection in a Foundry project
  • prompt_optimize: Optimize a prompt for a specific model
• Added eng/scripts/Preflight.ps1 developer CI preflight check script with format, spelling, build, tool metadata, README validation, unit test, and AOT analysis steps. [#1893]
• Added tools for web app diagnostics. [#1907]
• Added Azure Monitor Instrumentation operations for deterministic onboarding and migration guidance in local workspaces, including learning resources and orchestrated execution flow:
  • monitorinstrumentation_list_learning_resources
  • monitorinstrumentation_get_learning_resource
  • monitorinstrumentation_orchestrator_start
  • monitorinstrumentation_orchestrator_next
  • monitorinstrumentation_send_brownfield_analysis

Breaking Changes

• Foundry tools previously under the foundry namespace have moved to the new foundryextensions namespace within Azure MCP Server, retaining direct in-process access to Azure OpenAI, knowledge indexes, agent threads, and resources: [#1771]
  • foundryextensions_agents_get_sdk_sample: Get an SDK code sample for Azure AI Foundry Agents
  • foundryextensions_knowledge_index_list: List knowledge indexes in a Foundry project
  • foundryextensions_knowledge_index_schema: Get the schema of a knowledge index
  • foundryextensions_openai_chat_completions_create: Create a chat completion using an Azure OpenAI deployment
  • foundryextensions_openai_create_completion: Create a text completion using an Azure OpenAI deployment
  • foundryextensions_openai_embeddings_create: Create embeddings using an Azure OpenAI deployment
  • foundryextensions_openai_models_list: List available Azure OpenAI models
  • foundryextensions_resource_get: Get details about a Foundry resource
  • foundryextensions_threads_create: Create a new agent thread
  • foundryextensions_threads_get_messages: Get messages from an agent thread
  • foundryextensions_threads_list: List agent threads
• The following Azure AI Foundry tools were renamed as part of the migration to the external Foundry MCP server (https://mcp.ai.azure.com). See the Breaking Changes entry for the full list of removed tools: [#1771]
  • foundry_agents_list → agent_get
  • foundry_agents_create → agent_update
  • foundry_agents_connect → agent_invoke
  • foundry_models_list → model_catalog_list
  • foundry_models_deploy → model_deploy
  • foundry_models_deployments_list → model_deployment_get
  • foundry_agents_query-and-evaluate → evaluation_agent_batch_eval_create
  • foundry_agents_evaluate → evaluator_catalog_get

Bugs Fixed

• Fixed JSON Schema generation for OpenAI Codex model compatibility: added additionalProperties: false, enum types now emit as string with named values, added enum array to enum properties, empty descriptions are omitted instead of serialized as empty strings. [#1893]
• Fixed argument parsing to support camelCase parameter names and flat argument structures sent by Codex and other OpenAI models. [#1893]
• Fixed flaky VisualStudioToolNameTests by using in-process CommandFactory instead of external process with timeout. [#1893]
• Fixed Linux stdio watcher regression where using CWD as content root could exhaust inotify watchers (ENOSPC). Host builders now use AppContext.BaseDirectory as content root. [#1935]

Other Changes

• Added Cloud to telemetry to denote which Azure cloud the tool is using. [#1918]

Dependency Updates

• Updated Microsoft.Identity.Web and Microsoft.Identity.Web.Azure from 4.4.0-preview.1 to 4.4.0. [#1896]

1.0.2 (2026-03-05)

Bugs Fixed

• Improved input validation in ResourceHealth and Kusto tools: ResourceHealth now validates resource IDs using Azure.Core.ResourceIdentifier.Parse(), and Kusto validates cluster URIs with domain suffix and hostname allowlist to prevent SSRF attacks. [#1742]
• Improvement to learning experience by ignoring command parameter, which resulted in neither learning nor a tool call to happen. Learning is now always invoked when learn=true is passed. [#1743]

Other Changes

• Begin capturing information for the MCP client request's _meta store. [#1743]
• Removed ErrorDetails from telemetry. [#1743]
• Added processor architecture to captured telemetry. [#1743]
• Resolved incorrect/missing setting of IsServerCommandInvoked in telemetry. [#1743]

2.0.0-beta.24 (2026-03-03)

Features Added

• Added App Service web app deployment retrieval tool. [#1898]

Breaking Changes

• Consolidated sql_db_show and sql_db_list commands into a single sql_db_get command, and sql_server_show and sql_server_list commands into a single sql_server_get command. [#1897]

Bugs Fixed

• Fixed multiple bugs for the Azure Workbooks tool [#1646]

2.0.0-beta.23 (2026-02-27)

Features Added

• Disable external process commands (azqr) in HTTP remote mode for security. [#1522]
• Added the appservice_webapp_get tool to retrieve details about Web Apps. [#1810]
• Added the following App Service Web App settings tools: [#1831]
  • appservice_webapp_settings_get-appsettings: Get application settings for an App Service Web App
  • appservice_webapp_settings_update-appsettings: Update application settings for an App Service Web App

Breaking Changes

• Consolidated the cosmos_account_list, cosmos_database_list, and cosmos_database_container_list commands into a single cosmos_list command. [#1821]

Bugs Fixed

• Fixed azqr tool calls failing due to costs parameter removed in latest version. [#1739]
• Fixed OAuth Protected Resource Metadata flows in Azure Container Apps (ACA) by reading the X-Forwarded-Proto header (opt-in via AZURE_MCP_DANGEROUSLY_ENABLE_FORWARDED_HEADERS) to correctly construct the scheme in WWW-Authenticate challenge responses and the OAuth PRM endpoint. [#1820]

Other Changes

• Improve testability by removing dependency on CommandContext.ServiceProvider in the ExecuteAsync() method for App Configuration *Command classes. [#1815]

Dependency Updates

• Updated the following dependencies: [#1819]
  • ModelContextProtocol: 0.8.0-preview.1 to 1.0.0
  • ModelContextProtocol.AspNetCore: 0.8.0-preview.1 to 1.0.0
  • Microsoft.Extensions.AI.Abstractions: 10.2.0 to 10.3.0
• Updated Azure.Security.ConfidentialLedger from version 1.4.1-beta.2 to 1.4.1-beta.3. [#1814]

2.0.0-beta.22 (2026-02-24)

Features Added

• The Azure MCP Server is now also available as an MCP Bundle (.mcpb), compatible with clients such as Claude Desktop and Claude Code. [#1681]
• Added sovereign cloud endpoint support for the AppLens, Application Insights, App Service, Azure Migrate, Confidential Ledger, Cosmos, Extension, Foundry, Key Vault, Kusto, Marketplace, Monitor, MySql, Postgres, Pricing, Quota, Resource Health, Search, Service Fabric, Speech, and Storage services. [#1729]
• Added endpoint validation for Azure Communication Services, App Configuration, and Container Registry. [#1765]
• Added the "createmigrateproject" action in the azuremigrate_platformlandingzone_request tool to create a new Azure Migrate project if one doesn't exist. [#1724]

Breaking Changes

• Consolidated Resource Health availability-status commands: merged resourcehealth_availability-status_get and resourcehealth_availability-status_list into a single dual-mode resourcehealth_availability-status_get command. The command now accepts an optional --resourceId parameter: when provided, it returns a single resource's availability status; when omitted, it lists all resources. Tool name changed from resourcehealth_availability-status_list to use only resourcehealth_availability-status_get. [#1796]

Bugs Fixed

• (Undocumented fix from version 2.0.0-beta.21) Added validation logic for endpoint parameters in Foundry tools. [#1658]
• Fixed error handling to ensure error messages are preserved for missing parameters. [#1751]

Other Changes

• Switched Docker base image to runtime-deps:10.0-alpine. Since the server binary is self-contained, the full ASP.NET runtime base is unnecessary. Expected ~20-25% image size reduction (for example, azure-mcp images arm64: 648MB to ~482MB, amd64: 784MB to ~624MB). [#1782]
• Improved the storage_table_list tool description for better LLM tool selection. [#1800]

2.0.0-beta.21 (2026-02-19)

Features Added

• Enabled trimmed binary for Docker and HTTP transport support for all distributions, reducing the Azure MCP Docker image size by ~40% (arm64: 1.21 GB to ~648 MB, amd64: 1.31 GB to ~784 MB). [#1760]

Other Changes

• Add McpServerName to telemetry. [#1755]

2.0.0-beta.20 (2026-02-17)

Features Added

• Added two new Azure Service Fabric managed clusters tools: [#1696]
  • servicefabric_managedcluster_node_get: List all nodes in a Service Fabric managed cluster
  • servicefabric_managedcluster_nodetype_restart: Restart nodes from a Service Fabric managed cluster

Other Changes

• Resolve gaps in the capture of certain telemetry tags. [#1718]
• Improved formatting of the --help CLI command and added examples. [#1640]
• Added prompt templates documentation (docs/prompt-templates.md) showing how to set tenant and subscription context once using .github/copilot-instructions.md or at the start of chat sessions, eliminating repetitive prompting. [#1744]
• Improved error message for tenant mismatch authentication errors with actionable resolution steps. [#1737]

Dependency Updates

• Updated .NET tooling to stable version: 10.0.100-preview.7+ → 10.0.103. [#1740]
• Updated Microsoft.Azure.Kusto.Data and Microsoft.Azure.Kusto.Ingest from version 14.0.1 to 14.0.3. [#1740]

2.0.0-beta.19 (2026-02-12)

Features Added

• Added compute_disk_get tool to retrieve Azure managed disk information that supports listing all disks in a subscription, listing disks in a resource group, and getting specific disk details. [#1559]
• Added support for OAuth-protected registry servers by allowing oauthScopes in registry.json for HTTP-transport servers. [#1509]

Breaking Changes

• Consolidated KeyVault get/list commands - separate list commands removed: [#1653]
  • Removed keyvault_key_list - use keyvault_key_get without providing a key name
  • Removed keyvault_secret_list - use keyvault_secret_get without providing a secret name
  • Removed keyvault_certificate_list - use keyvault_certificate_get without providing a certificate name
• Consolidated Monitor WebTest commands – (get/list merged into monitor_webtests_get, create/update merged into monitor_webtests_createorupdate): [#1678]
  • Removed monitor_webtests_list – use monitor_webtests_get without providing a WebTest name
  • Removed monitor_webtests_update – use monitor_webtests_createorupdate for both create and update scenarios
• Consolidated MySQL and PostgreSQL list commands – separate server/database/table list tools removed: [#1710]
  • Removed postgres_server_list, postgres_database_list, postgres_table_list – use postgres_list with appropriate parameters to route hierarchically
  • Removed mysql_server_list, mysql_database_list, mysql_table_list – use mysql_list with appropriate parameters to route hierarchically
• Consolidated Load Testing TestRun commands – separate list/update commands removed: [#1711]
  • Removed loadtesting_testrun_list – use loadtesting_testrun_get for retrieving test runs
  • Removed loadtesting_testrun_update – use loadtesting_testrun_createorupdate for both create and update scenarios

Other Changes

• Added processor architecture to captured telemetry. [#1691]

2.0.0-beta.18 (2026-02-10)

Features Added

• AMD64 and ARM64 Docker images of the Azure MCP Server are now available. [#1651]

Bugs Fixed

• Added CORS policy to restrict cross-origin requests to localhost when running in unauthenticated development environment. [#1609]
• Fixed elicitation prompts failing with 'Form mode elicitation requests require a requested schema' error by using simple accept/decline prompts instead of form-based schemas for sensitive tool confirmations. [#1668]

2.0.0-beta.17 (2026-02-05)

Features Added

• Added log telemetry support for customer-owned AppInsights. [#1638]
• Added support for dangerous persistent logging configuration in VSIX extension, allowing users to specify a directory for detailed debug logs via the azureMcp.dangerouslyWriteSupportLogsToDir setting. [#1639]

Bugs Fixed

• Improved input validation in ResourceHealth and Kusto tools: [#1634]
  • ResourceHealth: Added resource ID validation using Azure.Core.ResourceIdentifier.Parse()
  • Kusto: Added cluster URI validation with domain suffix and hostname allowlist

Other Changes

• Added cancellation token support so deploy operations can be cancelled cleanly and consistently. [#1627]
• Improved cancellation behavior for async enumerators by adding support for CancellationToken, making it easier to correctly stop long-running or streaming async iteration. [#1649]

2.0.0-beta.16 (2026-02-03)

Features Added

• Added Azure Compute VM operations with flexible compute vm get command that supports listing all VMs in a subscription, listing VMs in a resource group, getting specific VM details, and retrieving VM instance view with runtime status: [#1482]
  • compute_vm_get
• Added Virtual Machine Scale Set (VMSS) get operations to retrieve VMSS information including listing across subscriptions or resource groups, getting specific VMSS details, and retrieving individual VM instances within a scale set: [#1482]
  • compute_vmss_get
• Added Azure Retail Pricing MCP tool for querying Azure service pricing information: [#1621]
  • pricing_get

Bugs Fixed

• Added support for new versions of Azure AI Search knowledge bases and those set to 'minimal' reasoning effort. [#1422]

Other Changes

• Removed ErrorDetails from telemetry. [#1625]
• Updated bestpractices tool description to ask LLM to use azure skills. [#1622]
• Updated swa app deployment instructions in bestpractices tool. [#1637]

2.0.0-beta.15 (2026-01-29)

Features Added

• Added host information to tools execution telemetry. [#1604]

Bugs Fixed

• Fixed async disposal pattern in CosmosService by implementing IAsyncDisposable and replacing async void Dispose with proper async disposal. [#1532]
• Fixed a regression that disabled telemetry for remote Azure MCP server. [#1602]

Other Changes

• Added AreResultsTruncated to tools that list resources using Resource Graph. [#1526]
• Improved server startup performance by parallelizing external MCP server initialization, reducing startup time from ~20 seconds to ~1-2 seconds when using registry-based servers. [#1534]

2.0.0-beta.14 (2026-01-27)

Features Added

• Added MCP tool for List Advisor Recommendations - advisor_recommendations_list. [#1519]
• Added new Azure Managed Lustre fileshare blob import management tools: [#1492]
  • managedlustre_fs_blob_import_create
  • managedlustre_fs_blob_import_get
  • managedlustre_fs_blob_import_cancel
  • managedlustre_fs_blob_import_delete
• Added Sovereign Cloud support for the Azure MCP server. Select services require additional changes and remain unsupported. [#1533]
• Added support for Azure Migrate platform landing zone operations with two new commands: [#1524]
  • azmcp_azuremigrate_platformlandingzone_getguidance - provides scenario-based guidance for Azure Landing Zone configurations including policy search and archetype-based policy listing
  • azmcp_azuremigrate_platformlandingzone_request - enables checking, generating, updating and downloading, platform landing zone configurations based on user inputs
• Added UVX support, enabling running MCP servers via uvx for improved Python/uv-based workflows. [#1359]

Other Changes

• Optimized --version flag to bypass full service initialization, reducing response time from ~10s to <3s. [#1531]
• Replaced the in-house HttpClientService with the built-in .NET IHttpClientFactory for HTTP client creation/management, improving configurability and aligning with recommended .NET patterns. [#1564]
• Added the internal utility ToolMetadataExporter to export current azmcp tool metadata (supporting Azure MCP metadata/telemetry documentation workflows). [#992]

2.0.0-beta.13 (2026-01-22)

Other Changes

• Improved Foundry project endpoint parameter description. [#1555]

2.0.0-beta.12 (2026-01-20)

Bugs Fixed

• Update outdated schema version within server.json to 2025-12-11 [#1527]

2.0.0-beta.11 (2026-01-16)

Features Added

• Added 12 Azure File Shares tools for managing Azure managed file shares: [#1419]
  • File Share tools (5): CheckNameAvailability, Create, Delete, Get, Update
  • File Share Snapshot tools (4): Create, Delete, Get, Update
  • Informational tools (3): GetLimits, GetProvisioningRecommendation, GetUsageData
• Added support for listing and viewing individual Azure Policy assignments in subscriptions or scopes. [#1483]

Breaking Changes

• Renamed the --insecure-disable-elicitation server startup option to --dangerously-disable-elicitation to align with the naming convention used by other dangerous options (e.g., --dangerously-disable-http-incoming-auth). The old option name is no longer supported. [#1374]
• Renamed the storagesync_cloudendpoint_triggerchangedetection tool to storagesync_cloudendpoint_changedetection. The --directory-path parameter is now required. Added new optional parameters: --change-detection-mode (supports 'Default' or 'Recursive') and --paths (array of relative paths for change detection).
• Renamed the following commands: [#1474]
  • get_bestpractices_get → get_azure_bestpractices_get
  • get_bestpractices_ai_app → get_azure_bestpractices_ai_app

Other Changes

• Updated repository to build projects using .NET 10. [#1221]
• Switched to Azure.ResourceManager.Monitor library to query metrics, list metrics definitions and metrics namespaces. [#1409]

Dependency Updates

• Removed System.Linq.AsyncEnumerable package dependency as it is no longer used. [#1221]
• Replaced Azure.Monitor.Query package dependency with Azure.ResourceManager.Monitor to query metrics, list metrics definitions and metrics namespaces. [#1409]
• Updated versions for the following dependencies: [#1221, #1409, #1465, #1501]
  • Azure.Core: 1.49.0 → 1.50.0
  • Azure.Identity: 1.16.0 → 1.17.1
  • Azure.Identity.Broker: 1.3.0 → 1.3.1
  • Azure.AI.OpenAI: 2.7.0-beta.1 → 2.8.0-beta.1
  • ModelContextProtocol: 0.4.0-preview.3 → 0.6.0-preview.1
  • ModelContextProtocol.AspNetCore: 0.4.0-preview.3 → 0.6.0-preview.1
  • Microsoft.AspNetCore.SignalR.Client: 9.0.9 → 10.0.1
  • Microsoft.Extensions.AI.Abstractions: 9.10.0 → 10.2.0
  • Microsoft.Extensions.AI.Evaluation: 9.10.0 → 10.2.0
  • Microsoft.Extensions.AI.Evaluation.Quality: 9.10.0 → 10.2.0
  • Microsoft.Extensions.AI.OpenAI: 9.10.0-preview.1.25513.3 → 10.2.0-preview.1.26063.2
  • Microsoft.Extensions.Caching.Memory: 9.0.9 → 10.0.2
  • Microsoft.Extensions.Configuration: 9.0.9 → 10.0.2
  • Microsoft.Extensions.Configuration.EnvironmentVariables: 9.0.9 → 10.0.2
  • Microsoft.Extensions.Configuration.Json: 9.0.9 → 10.0.2
  • Microsoft.Extensions.DependencyInjection: 9.0.9 → 10.0.2
  • Microsoft.Extensions.Hosting: 9.0.9 → 10.0.2
  • Microsoft.HybridRow: 1.1.0-preview3 → 1.1.0-preview4
  • Microsoft.Identity.Abstractions: 9.5.0 → 10.0.0
  • Microsoft.Identity.Web: 4.0.1 → 4.3.0
  • Microsoft.Identity.Web.Azure: 4.0.1 → 4.3.0
  • Microsoft.NET.Test.Sdk: 17.13.0 → 18.0.1
  • Npgsql: 9.0.3 → 10.0.1
  • System.CommandLine: 2.0.0-rc.1.25451.107 → 2.0.1
  • System.Formats.Asn1: 9.0.9 → 10.0.2
  • System.IdentityModel.Tokens.Jwt: 8.14.0 → 8.15.0
  • System.Net.ServerSentEvents: 10.0.0-rc.1.25451.107 → 10.0.2
  • System.Numerics.Tensors: 9.0.0 → 10.0.2
  • System.Text.Json: 9.0.9 → 10.0.2

2.0.0-beta.10 (2026-01-09)

Features Added

• Added Azure Managed Lustre HSM (Hierarchical Storage Management) autoimport and autoexport job management tools:
  • managedlustre_fs_blob_autoimport_create - Create autoimport jobs to sync data from Azure Blob Storage to Lustre filesystem
  • managedlustre_fs_blob_autoimport_get - Get details of specific autoimport job(s)
  • managedlustre_fs_blob_autoimport_cancel - Cancel running autoimport jobs
  • managedlustre_fs_blob_autoimport_delete - Delete autoimport job records
  • managedlustre_fs_blob_autoexport_create - Create autoexport jobs to sync data from Lustre filesystem to Azure Blob Storage
  • managedlustre_fs_blob_autoexport_get - Get details of specific autoexport job(s)
  • managedlustre_fs_blob_autoexport_cancel - Cancel running autoexport jobs
  • managedlustre_fs_blob_autoexport_delete - Delete autoexport job records
• Added support for listing tables in Azure Storage via command azmcp_storage_table_list. [#743]

2.0.0-beta.9 (2026-01-06)

Features Added

• Added 18 Azure Storage Sync tools for managing cloud synchronization of file shares: [#1419]
  • StorageSyncService tools (4): Create, Delete, Get, Update
  • RegisteredServer tools (3): Get, Unregister, Update
  • SyncGroup tools (3): Create, Delete, Get
  • CloudEndpoint tools (4): Create, Delete, Get, TriggerChangeDetection
  • ServerEndpoint tools (4): Create, Delete, Get, Update
• Added support for logging to local files using the --dangerously-write-support-logs-to-dir option for troubleshooting and support scenarios. When enabled, detailed debug-level logs are written to automatically-generated timestamped log files (e.g., azmcp_20251202_143052.log) in the specified folder. All telemetry is automatically disabled when support logging is enabled to prevent sensitive debug information from being sent to telemetry endpoints. [#1305]

Bugs Fixed

• Fixed a serialization issue in the Foundry Agent File Search tool. [#1205]

Other Changes

• Switched to a new Azure.Monitor.Query.Logs package to query logs from Azure Monitor. [#1309]
• Replace hard-coded strings for Azure.Mcp.Server with ones from IConfiguration. [#1269]
• Add hardcoded minimum TLS version of 1.2 to Storage account creation tool. [#1445]
• Switched to Azure.ResourceManager.Monitor library to query metrics, list metrics definitions and metrics namespaces. [#1409]

Dependency Updates

• Updated Azure.Bicep.Types from 0.6.1 to 0.6.27. [#1331]
• Updated Microsoft.Azure.Mcp.AzTypes.Internal.Compact from 0.2.802 to 0.2.804. [#1348]

2.0.0-beta.8 (2025-12-11)

Breaking Changes

• Retired the azureaibestpractices namespace and moved its AI app best practices tool into the bestpractices namespace. azmcp azureaibestpractices get (tool azureaibestpractices_get) became azmcp get bestpractices ai_app (tool get_bestpractices_ai_app), which was later renamed to azmcp get azure bestpractices ai_app (tool get_azure_bestpractices_ai_app) in 2.0.0-beta.11. [#1323]

Bugs Fixed

• Fixed an issue where the AI Best Practices tool would get called instead of the Best Practices tool. [#1323]

2.0.0-beta.7 (2025-11-25)

Bugs Fixed

• Fixed elicitation flow to request user confirmation only once for security prompts. Previously, users saw two dialogs (input form + confirmation); now they see a single confirmation dialog (Submit/Cancel) for sensitive operations. [#1225]

Other Changes

• Removed usage of writeIndented = true (pretty printing) from JsonSourceGenerationOptions to reduce token usage. [#1226]
• Updated .NET tooling to stable version: 10.0.100-preview.7.25380.108 → 10.0.100. [#1243]

1.0.1 (2025-11-25)

Features Added

• Added support for User-Assigned Managed Identity via AZURE_CLIENT_ID environment variable. [#1038]

Bugs Fixed

• Fixed elicitation flow to request user confirmation only once for security prompts. Previously, users saw two dialogs (input form + confirmation); now they see a single confirmation dialog (Submit/Cancel) for sensitive operations. [#1232]

2.0.0-beta.6 (2025-11-20)

Features Added

• Added a [hidden] command server_info to provide server information (name, version) so server metadata is programmatically parsed in telemetry. [#1164]

• Added OpenTelemetry tracing support with Azure Monitor exporter for HTTP transport mode, allowing self-hosted instances to export traces to Application Insights when APPLICATIONINSIGHTS_CONNECTION_STRING is configured. [#1227]

Bugs Fixed

• Improved performance of AI Code generation in Visual Studio 2026. [#1179]
• Updated the AzureAIBestPractices tool to recommend AIProjectClient instead of PersistentAgentsClient. [#1209]

Other Changes

• We now capture information for the MCP client request's _meta store. [#1154]
• Renamed Microsoft Azure AI Foundry to Microsoft Foundry. [#1211]
• Added version display to CLI help output. The version now appears on the first line when running any help command (e.g., azmcp --help). [#1161]

2.0.0-beta.5 (2025-11-14)

Features Added

• Enabled HTTPS redirection by default when running server start --transport http. This can be opted-out with AZURE_MCP_DANGEROUSLY_DISABLE_HTTPS_REDIRECTION when not needed. [#1169]
• Updated the User-Agent string to include transport type (stdio or http) for better telemetry and monitoring of Azure service calls. [#1146]
• Added support for creating new Redis resources via the redis_create command. [#1093]

Breaking Changes

• Updated HttpClientService to ignore the DefaultUserAgent string set in HttpClientOptions. [#1146]

Bugs Fixed

• Removed the DefaultUserAgent configuration from ApplicationInsightsSetup that had a hardcoded version and set the User-Agent string for all other service areas that used the HttpClientService. [#1146]

Other Changes

• Added a CancellationToken parameter to async methods to more I[SomeService] interfaces. [#1178]
• Update server to support official MCP repository. [#1104]

2.0.0-beta.4 (2025-11-13)

Features Added

• PostgreSQL MCP tools now support both Microsoft Entra authentication and native database authentication. The default is Entra authentication, users can switch to native database authentication by providing the --auth-type parameter with the value PostgreSQL. If native authentication is selected, the user must also provide the user password via the --password parameter. [#1011]
• Telemetry: [#1150]
  • Enabled telemetry collection for the HTTP transport mode.
  • Refactored Azure Monitor exporter configuration to support multiple exporters with separate user-provided and Microsoft telemetry streams.
  • Added the AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT environment variable to control Microsoft-specific telemetry collection (enabled by default).

Bugs Fixed

• PostgreSQL MCP tools has improved the error message reported in case of failure deserializing some of the columns returned by a query. Non out-of-the-box types like vector cannot be deserialized and will now report a clear error message indicating which column caused the issue and an action plan so AI agents can recover from it. [#1024]
• Fixed exit code when invoking --help flag. Commands like tools list --help now correctly return exit code 0 instead of 1 when successfully displaying help output. [#1118]

Other Changes

• Added a CancellationToken parameter to async methods to more I[SomeService] interfaces. [#1133]
• Upgraded dependency version of coverlet.collector from 6.0.2 to 6.0.4. [#1153]

2.0.0-beta.3 (2025-11-11)

Features Added

• Added Azure AI Best Practices toolset providing comprehensive guidance for building AI apps with Microsoft Foundry and Microsoft Agent Framework. Includes model selection guidance, SDK recommendations, and implementation patterns for agent development. [#1031]
• Added support for text-to-speech synthesis via the command speech_tts_synthesize. [#902]

Breaking Changes

• PostgreSQL MCP tools now require SSL and verify the server's full certificate chain before creating database connections. This SSL mode provides both eavesdropping protection and man-in-the-middle protection. See SSL Mode VerifyFull for more details. [#1023]

Bugs Fixed

• Updated a codepath --mode namespace where learn=true wouldn't always result in agent learning happening. [#1122]
• Use the correct Assembly to find Version for telemetry. [#1122]

Other Changes

• Refactored duplicate elicitation handling code in CommandFactoryToolLoader and NamespaceToolLoader into a shared BaseToolLoader.HandleSecretElicitationAsync method. [#1028]

2.0.0-beta.2 (2025-11-06)

Features Added

• Added support for speech recognition from an audio file with Fast Transcription via the command azmcp_speech_stt_recognize. [#1054]
• Added support for User-Assigned Managed Identity via the AZURE_CLIENT_ID environment variable. [#1033]
• Added the following features for deploying as a Remote MCP Server:
  • Added support for HTTP transport, including both incoming and outgoing authentication. Incoming authentication uses Entra ID, while outgoing authentication can either use Entra On-Behalf-Of (OBO) or the authentication configured in the host environment. [#1020]
  • Added support for the --dangerously-disable-http-incoming-auth command-line option to disable the built-in incoming authentication. Use this option only if you plan to provide your own incoming authentication mechanism, and with caution, as it exposes the server to unauthenticated access. [#1037]
• Enhanced the tools list command with new filtering and output options: [#741]
  • Added the --namespace option to filter tools by one or more service namespaces (e.g., 'storage', 'keyvault').
  • Added the --name-only option to return only tool names without descriptions or metadata.
• Added the following Microsoft Foundry tools: [#945]
  • foundry_agents_create: Create a new Microsoft Foundry agent.
  • foundry_agents_get-sdk-sample: Get a code sample to interact with a Foundry Agent using the Microsoft Foundry SDK.
  • foundry_threads_create: Create a new Microsoft Foundry Agent Thread.
  • foundry_threads_list: List all Microsoft Foundry Agent Threads.
  • foundry_threads_get-messages: Get messages in a Microsoft Foundry Agent Thread.

Breaking Changes

• Renamed the --namespaces option to --namespace-mode in the tools list command for better clarity when listing top-level service namespaces. [#741]

Bugs Fixed

• Fixed an issue that spawned child processes per namespace for consolidated mode. [#1002]
• Improved the agent learning experience by ignoring the command parameter, which resulted in neither learning nor a tool call to happen. Learning is now always invoked when learn=true is passed. [#1057]
• Added descriptions to tool metadata to ensure enough information is present in the CLI to generate docs for metadata. [#1043]

Other Changes

• Added a CancellationToken parameter to IBaseCommand.ExecuteAsync() [#1056]
• Added a CancellationToken parameter to async methods to many, but not yet all, I[SomeService] interfaces [#1056]
• Telemetry:
  • Added ToolId into telemetry, based on IBaseCommand.Id, a unique GUID for each command. [#1018]
  • Added support for exporting telemetry to OTLP exporters by configuring the environment variable AZURE_MCP_ENABLE_OTLP_EXPORTER=true. [#1018]
  • Disabled telemetry for the HTTP transport. [#1072]

2.0.0-beta.1 (2025-10-29)

• Initial beta release to validate updated release infrastructure and versioning strategy. No functional changes from 1.x series.

1.0.0 (2025-10-27)

🎉 First Stable Release

We're excited to announce the first stable release of the Azure MCP Server! This milestone represents months of development, extensive testing, and valuable feedback from our community. The Azure MCP Server provides seamless integration between AI agents and 40+ Azure services through the Model Context Protocol (MCP) specification.

What's Included in 1.0.0

The Azure MCP Server now offers:

• Comprehensive Azure Service Coverage: Support for 40+ Azure services including Storage, Key Vault, Cosmos DB, SQL, Kubernetes (AKS), Microsoft Foundry, Event Hubs, Service Bus, PostgreSQL, MySQL, Redis, Azure Monitor, Application Insights, and many more
• Multiple Installation Methods: Available through NuGet, NPM, and Docker; or as an extension/plugin for VS Code, Visual Studio 2022, and IntelliJ IDEA.
• Flexible Server Modes:
  • Namespace mode (default): Organizes tools by service for easy discovery
  • Consolidated mode: Groups tools by tasks and actions for streamlined workflows
  • Single mode: All tools behind one unified "azure" tool
  • All mode: Exposes every tool individually for maximum control
• Advanced Authentication: Supports multiple Azure authentication methods with credential chaining
• Production Ready: Includes comprehensive error handling, retry policies, telemetry, and extensive test coverage
• Developer Friendly: Native AOT compilation support, read-only mode for safe exploration, and detailed documentation

Key Features

• 170+ Azure Commands across Storage, Databases, AI Services, Monitoring, and more
• Enterprise Support: Proxy configuration, managed identity authentication, and secure credential handling
• Performance Optimizations: Selective caching for expensive operations and efficient HTTP client management

Getting Started

Install the Azure MCP Server from your preferred platform:

• VS Code: Install the Azure MCP Server extension
• Visual Studio 2022: Install GitHub Copilot for Azure
• IntelliJ IDEA: Install Azure Toolkit for IntelliJ
• NuGet: dotnet tool install -g Azure.Mcp --version 1.0.0
• npm: npx @azure/mcp@1.0.0
• Docker: docker pull mcr.microsoft.com/azure-mcp:1.0.0

Documentation

• Complete Command Reference
• Authentication Guide
• Troubleshooting
• Contributing Guidelines

Thank You

This release wouldn't have been possible without the contributions from our community, extensive testing from early adopters, and collaboration with the MCP ecosystem. Thank you for your feedback, bug reports, and feature requests that helped shape this stable release.

For a complete history of pre-release changes, see versions 0.9.9 through 0.0.10 below.

0.9.9 (2025-10-24)

Other Changes

• Set telemetry fields for ToolArea and ToolName when "single" mode is used. [#952]
• Added instructions on when to not use azd init [#942]

0.9.8 (2025-10-23)

Features Added

• Adds unique identifier to MCP tools. [#940]

Bugs Fixed

• Fixed SKU configuration bug in SQL database create and update commands. [#925]
• Fixed a serialization issue with Foundry tools. [#904]

Other Changes

• Set telemetry fields for ToolArea and ToolName when "consolidated" mode is used or a server is loaded from registry.json. [#933]

0.9.7 (2025-10-22)

Bugs Fixed

• Increased Kusto HttpClient timeout from 100 seconds to 240 seconds to support long-running queries. [#907]
• Provide installation instructions when azd or other registry components are missing. [#926]

Other Changes

• Improved the following tool namespace descriptions for better LLM tool selection, including usage patterns, messaging scenarios, and when not to use their tools:
  • Service Bus [#923]
  • Application Insights [#928]
• Updated the description of the azmcp_appservice_database_add command to decrease ambiguity and increase selection accuracy by LLMs. [#912]

0.9.6 (2025-10-21)

Features Added

• Added instructions to the best practices tool for the GitHub coding agent on how to configure the Azure MCP Server. [#888]

Bugs Fixed

• Fixed an issue where azmcp_entra_administrator_list was not listing administrators correctly. [#891]
• Fixed an issue where azmcp_sql_server_firewall_rule_list was not listing firewall rules correctly. [#891]
• Fixed an issue preventing the ServerStarted telemetry event from being published. [#905]
• Fixed an issue where MCP tools were missing the 'title' metadata, causing Visual Studio to display raw tool names instead of user-friendly titles. [#898]

Other Changes

• Added tool name length validation to ensure all tool names stay within 48 character limit for compatibility with MCP clients. [#881]

Dependency Updates

• Updated the following libraries:
  • ModelContextProtocol.AspNetCore: 0.4.0-preview.2 → 0.4.0-preview.3. [#887]

0.9.5 (2025-10-20)

Bugs Fixed

• Update the server.json file in the NuGet distribution to match the 2025-09-29 schema version (latest from the MCP Registry). [#870]

Other Changes

• Updated how IsServerCommandInvoked telemetry is captured to more correctly report whether learning or tool call was performed. [#874]
• Added tool name length validation to ensure all tool names stay within 48 character limit for compatibility with MCP clients. [#881]

0.9.4 (2025-10-17)

Features Added

• Added a new server startup "consolidated" mode, which groups Azure MCP tools by tasks and actions tools conduct. This can be enabled by using the --consolidated flag. [#784]

Breaking Changes

• Removes the azmcp_ prefix from all commands. [#868]

Other Changes

Dependency Updates

• Updated the following dependencies: [864]
  • Azure.ResourceManager.ResourceGraph: 1.1.0-beta.4 → 1.1.0
  • Azure.Core: 1.48.0 → 1.49.0

0.9.3 (2025-10-16)

Bugs Fixed

• Fixed a bug where user confirmation (elicitation) stopped working between versions 0.8.5 and 0.9.2. [#824]
• Fixed IsServerCommandInvoked always appearing to be true. [#837]
• Fixed ToolName always showing up as the tool area even if an MCP tool was invoked. [#837]
• Update the server.json in the NuGet distribution to match the 2025-09-29 server.json schema version (latest from the MCP Registry). [#870]

Other Changes

• Updated the description of the following Communications commands to decrease ambiguity and increase selection accuracy by LLMs: [#804]
  • azmcp_communication_email_send
  • azmcp_communication_sms_send
• Improved the description of the --enable-insecure-transports server startup option. [#839]

0.9.2 (2025-10-15)

Bugs Fixed

• Fixed retained-buffer leaks across services (Kusto, EventGrid, AppLens, Speech, Cosmos, Foundry, NetworkResourceProvider) and tool loaders (BaseToolLoader, ServerToolLoader, NamespaceToolLoader, SingleProxyToolLoader) by disposing JsonDocument/HttpResponseMessage instances and cloning returned JsonElements. (#817)

Other Changes

• Telemetry capture is disabled in non-release builds. (#783)

0.9.1 (2025-10-14)

Bugs Fixed

• Fixed an issue where azmcp_sql_db_rename would not work as expected. [#615]

Other Changes

• MCP server start options are now included in telemetry logs. (#794)
• Updated the description of the following Workbook commands to decrease ambiguity and increase selection accuracy by LLMs: [#787]
  • azmcp_workbook_show
  • azmcp_workbook_update

0.9.0 (2025-10-13)

Features Added

• Added support for sending an email via Azure Communication Services via the command azmcp_communication_email_send. [#690]
• Added the following Event Hubs commands: [#750]
  • azmcp_eventhubs_consumergroup_update: Create or update a consumer group for an Event Hub.
  • azmcp_eventhubs_consumergroup_get: Get details of a consumer group for an Event Hub
  • azmcp_eventhubs_consumergroup_delete: Delete a consumer group from an Event Hub
  • azmcp_eventhubs_eventhub_update: Create or update an Event Hub within a namespace
  • azmcp_eventhubs_eventhub_get: Get details of an Event Hub within a namespace
  • azmcp_eventhubs_eventhub_delete: Delete an Event Hub from a namespace
  • azmcp_eventhubs_namespace_update: Create or update an Event Hubs namespace
  • azmcp_eventhubs_namespace_delete: Delete an existing Event Hubs namespace.
• Added support for listing Microsoft Foundry (Cognitive Services) resources or getting details of a specific one via the command azmcp_foundry_resource_get. [#762]
• Added support for Azure Monitor Web Tests management operations: [#529]
  • azmcp_monitor_webtests_create: Create a new web test in Azure Monitor
  • azmcp_monitor_webtests_get: Get details for a specific web test
  • azmcp_monitor_webtests_list: List all web tests in a subscription or optionally, within a resource group
  • azmcp_monitor_webtests_update: Update an existing web test in Azure Monitor
• Added the following Azure CLI commands:
  • azmcp_extension_cli_generate: Generate Azure CLI commands based on user intent. [#203]
  • azmcp_extension_cli_install: Get installation instructions for Azure CLI, Azure Developer CLI and Azure Functions Core Tools. [#74]
• Added support for Azure AI Search knowledge bases and knowledge sources commands: [#719]
  • azmcp_search_knowledge_base_list: List knowledge bases defined in an Azure AI Search service.
  • azmcp_search_knowledge_base_retrieve: Execute a retrieval operation using a specified knowledge base with optional multi-turn conversation history.
  • azmcp_search_knowledge_source_list: List knowledge sources defined in an Azure AI Search service.

Breaking Changes

• Replaced azmcp_redis_cache_list and azmcp_redis_cluster_list with a unified azmcp_redis_list command that lists all Redis resources in a subscription. [#756]
  • Flattened azmcp_redis_cache_accesspolicy_list and azmcp_redis_cluster_database_list into the aforementioned azmcp_redis_list command. [#757]

Bugs Fixed

• Fix flow of Activity.Current in telemetry service by changing ITelemetryService's activity calls to synchronous. [#558]

Other Changes

• Added more deployment related best practices. [#698]
• Added IsServerCommandInvoked telemetry field indicating that the MCP tool call resulted in a command invocation. [#751]
• Updated the description of the following commands to decrease ambiguity and increase selection accuracy by LLMs:
  • AKS (Azure Kubernetes Service): [#771]
    • azmcp_aks_cluster_get
    • azmcp_aks_nodepool_get
  • Marketplace: [#761]
    • azmcp_marketplace_product_list
  • Storage: [#650]
    • azmcp_storage_account_get
    • azmcp_storage_blob_get
    • azmcp_storage_blob_container_create
    • azmcp_storage_blob_container_get

Dependency Updates

• Updated the following libraries:
  • Azure.Search.Documents: 11.7.0-beta.6 → 11.7.0-beta.7. [#719]
  • ModelContextProtocol.AspNetCore: 0.4.0-preview.1 → 0.4.0-preview.2. [#767]

0.8.6 (2025-10-09)

Features Added

• Added --tool option to start Azure MCP server with only specific tools by name, providing fine-grained control over tool exposure. This option switches server mode to --all automatically. The --namespace and --tool options cannot be used together. [#685]
• Added support for getting ledger entries on Azure Confidential Ledger via the command azmcp_confidentialledger_entries_get. [#705]
• Added support for listing an Azure resource's activity logs via the command azmcp_monitor_activitylog_list. [#720]

Breaking Changes

• Unified required parameter validation: null or empty values now always throw ArgumentException with an improved message listing all invalid parameters. Previously this would throw either ArgumentNullException or ArgumentException for only the first invalid value. [#718]

Other Changes

• Telemetry:
  • Added ServerMode telemetry tag to distinguish start-up modes for the MCP server. [#738]
  • Updated ToolArea telemetry field to be populated for namespace (and intent/learn) calls. [#739]

0.8.5 (2025-10-07)

Features Added

• Added the following OpenAI commands: [#647]
  • azmcp_foundry_openai_chat-completions-create: Create interactive chat completions using Azure OpenAI chat models in Microsoft Foundry.
  • azmcp_foundry_openai_embeddings-create: Generate vector embeddings using Azure OpenAI embedding models in Microsoft Foundry
  • azmcp_foundry_openai_models-list: List all available OpenAI models and deployments in an Azure resource.
• Added support for sending SMS messages via Azure Communication Services with the command azmcp_communication_sms_send. [#473]
• Added support for appending tamper-proof ledger entries backed by TEEs and blockchain-style integrity guarantees in Azure Confidential Ledger via the command azmcp_confidentialledger_entries_append. [#705]
• Added the following Azure Managed Lustre commands:
  • azmcp_azuremanagedlustre_filesystem_subnetsize_validate: Check if the subnet can host the target Azure Managed Lustre SKU and size [#110].
  • azmcp_azuremanagedlustre_filesystem_create: Create an Azure Managed Lustre filesystem. [#50]
  • azmcp_azuremanagedlustre_filesystem_update: Update an Azure Managed Lustre filesystem. [#50]
• Added support for listing all Azure SignalR runtime instances or getting detailed information about a single one via the command azmcp_signalr_runtime_get. [#83]

Breaking Changes

• Renamed azmcp_azuremanagedlustre commands to azmcp_managedlustre. [#345]
  • Renamed azmcp_managedlustre_filesystem_required-subnet-size to azmcp_managedlustre_filesystem_subnetsize_ask. [#111]
• Merged the following Azure Kubernetes Service (AKS) tools: [#591]
  • Merged azmcp_aks_cluster_list into azmcp_aks_cluster_get, which can perform both operations based on whether --cluster is passed.
  • Merged azmcp_aks_nodepool_list into azmcp_aks_nodepool_get, which can perform both operations based on whether --nodepool is passed.

Bugs Fixed

• Improved description of Load Test commands. [#92]
• Fixed an issue where Azure Subscription tools were not available in the default (namespace) server mode. [#634]
• Improved error message for macOS users when interactive browser authentication fails due to broker threading requirements. The error now provides clear guidance to use Azure CLI, Azure PowerShell, or Azure Developer CLI for authentication instead. [#684]
• Added validation for the Cosmos query command azmcp_cosmos_database_container_item_query. [#524]
• Fixed the construction of Azure Resource Graph queries for App Configuration in the FindAppConfigStore method. The name filter is now correctly passed via the additionalFilter parameter instead of tableName, resolving "ExactlyOneStartingOperatorRequired" and "BadRequest" errors when setting key-value pairs. [#670]
• Updated the description of the Monitor tool and corrected the prompt for command azmcp_monitor_healthmodels_entity_gethealth to ensure that the LLM picks up the correct tool. [#630]
• Fixed "BadRequest" error in Azure Container Registry to get a registry, and in EventHubs to get a namespace. [#729]
• Added redundancy in Dockerfile to ensure the azmcp in the Docker image is actually executable. [#732]

Other Changes

• Updated the description of azmcp_bicepschema_get to increase selection accuracy by LLMs. [#649]
• Update the ToolName telemetry field to use the normalized command name when the CommandFactory tool is used. [#716]
• Updated the default tool loading behavior to execute namespace tool calls directly instead of spawning separate child processes for each namespace. [#704]

Dependency updates

• Updated Microsoft.Azure.Cosmos.Aot from 0.1.2-preview.2 to 0.1.4-preview.2, which upgrades the transitive Newtonsoft.Json dependency to 13.0.4. [#662]

0.8.4 (2025-10-02)

Features Added

• Added support to return metadata when using the azmcp_tool_list command. [#564]
• Added support for returning a list of tool namespaces instead of individual tools when using the azmcp_tool_list command with the --namespaces option. [#496]

Breaking Changes

• Merged azmcp_appconfig_kv_list and azmcp_appconfig_kv_show into azmcp_appconfig_kv_get which can handle both listing and filtering key-values and getting a specific key-value. [#505]

Bugs Fixed

• Fixed the name of the Key Vault Managed HSM settings get command from azmcp_keyvault_admin_get to azmcp_keyvault_admin_settings_get. [#643]
• Removed redundant DI instantiation of MCP server providers, as these are expected to be instantiated by the MCP server discovery mechanism. [#644]
• Fixed App Lens having a runtime error for reflection-based serialization when using native AoT MCP build. [#639]
• Added validation for the PostgreSQL database query command azmcp_postgres_database_query.[#518]

Other Changes

• Change base Docker image from bookworm-slim to alpine. [#651]
• Refactored tool implementation to use Azure Resource Graph queries instead of direct ARM API calls:
  • Grafana [#628]
• Updated the description of the following commands to increase selection accuracy by LLMs:
  • App Deployment: azmcp_deploy_app_logs_get [#640]
  • Kusto: [#666]
    • azmcp_kusto_cluster_get
    • azmcp_kusto_cluster_list
    • azmcp_kusto_database_list
    • azmcp_kusto_query
    • azmcp_kusto_sample
    • azmcp_kusto_table_list
    • azmcp_kusto_table_schema
  • Redis: [#655]
    • azmcp_redis_cache_list
    • azmcp_redis_cluster_list
  • Service Bus: azmcp_servicebus_topic_details [#642]

Dependency Updates

• Updated the ModelContextProtocol.AspNetCore version from 0.3.0-preview.4 to 0.4.0-preview.1. [#576]
• Removed the following dependencies:
  • Azure.ResourceManager.Grafana [#628]

0.8.3 (2025-09-30)

Features Added

• Added support for Azure Developer CLI (azd) MCP tools when azd CLI is installed locally - [#566]
• Added support to proxy MCP capabilities when child servers leverage sampling or elicitation. [#581]
• Added support for publishing custom events to Event Grid topics via the command azmcp_eventgrid_events_publish. [#514]
• Added support for generating text completions using deployed Azure OpenAI models in Microsoft Foundry via the command azmcp_foundry_openai_create-completion. [#54]
• Added support for speech recognition from an audio file with Azure AI Services Speech via the command azmcp_speech_stt_recognize. [#436]
• Added support for getting the details of an Azure Event Hubs namespace via the command azmcp_eventhubs_namespace_get. [#105]

Breaking Changes

Bugs Fixed

• Fixed an issue with the help option (--help) and enabled it across all commands and command groups. [#583]
• Fixed the following issues with Kusto commands:
  • azmcp_kusto_cluster_list and azmcp_kusto_cluster_get now accept the correct parameters expected by the service. [#589]
  • azmcp_kusto_table_schema now returns the correct table schema. [#530]
  • azmcp_kusto_query does not fail when the subscription id in the input query is enclosed in double quotes anymore. [#152]
  • All commands now return enough details in error messages when input parameters are invalid or missing. [#575]

Other Changes

• Refactored tool implementation to use Azure Resource Graph queries instead of direct ARM API calls:
  • Authorization [607]
  • AppConfig [606]
  • ACR [622]
• Fixed the names of the following MySQL and Postgres commands: [#614]
  • azmcp_mysql_server_config_config → azmcp_mysql_server_config_get
  • azmcp_mysql_server_param_param → azmcp_mysql_server_param_get
  • azmcp_mysql_table_schema_schema → azmcp_mysql_table_schema_get
  • azmcp_postgres_server_config_config → azmcp_postgres_server_config_get
  • azmcp_postgres_server_param_param → azmcp_postgres_server_param_get
  • azmcp_postgres_table_schema_schema → azmcp_postgres_table_schema_get
• Updated the description of the following commands to increase selection accuracy by LLMs:
  • Microsoft Foundry: [#599]
    • azmcp_foundry_agents_connect
    • azmcp_foundry_models_deploy
    • azmcp_foundry_models_deployments_list
  • App Lens: azmcp_applens_resource_diagnose [#556]
  • Cloud Architect: azmcp_cloudarchitect_design [#587]
  • Cosmos DB: azmcp_cosmos_database_container_item_query [#625]
  • Event Grid: [#552]
    • azmcp_eventgrid_subscription_list
    • azmcp_eventgrid_topic_list
  • Key Vault: [#608]
    • azmcp_keyvault_certificate_create
    • azmcp_keyvault_certificate_import
    • azmcp_keyvault_certificate_get
    • azmcp_keyvault_certificate_list
    • azmcp_keyvault_key_create
    • azmcp_keyvault_key_get
    • azmcp_keyvault_key_list
    • azmcp_keyvault_secret_create
    • azmcp_keyvault_secret_get
    • azmcp_keyvault_secret_list
  • MySQL: [#614]
    • azmcp_mysql_server_param_set
  • Postgres: [#562]
    • azmcp_postgres_database_query
    • azmcp_postgres_server_param_set
  • Resource Health: [#588]
    • azmcp_resourcehealth_availability-status_get
    • azmcp_resourcehealth_service-health-events_list
  • SQL: [#594]
    • azmcp_sql_db_delete
    • azmcp_sql_db_update
    • azmcp_sql_server_delete
  • Subscriptions: azmcp_subscription_list [#559]

Dependency Updates

• Removed the following dependencies:
  • Azure.ResourceManager.Authorization [#607]
  • Azure.ResourceManager.AppConfiguration [#606]
  • Azure.ResourceManager.ContainerRegistry [#622]

0.8.2 (2025-09-25)

Bugs Fixed

• Fixed azmcp_subscription_list to return empty enumerable instead of null when no subscriptions are found. [#508]

0.8.1 (2025-09-23)

Features Added

• Added support for listing SQL servers in a subscription and resource group via the command azmcp_sql_server_list. [#503]
• Added support for renaming Azure SQL databases within a server while retaining configuration via the azmcp sql db rename command. [#542]
• Added support for Azure App Service database management via the command azmcp_appservice_database_add. [#59]
• Added the following Microsoft Foundry agents commands: [#55]
  • azmcp_foundry_agents_connect: Connect to an agent in a Microsoft Foundry project and query it
  • azmcp_foundry_agents_evaluate: Evaluate a response from an agent by passing query and response inline
  • azmcp_foundry_agents_query_and_evaluate: Connect to an agent in a Microsoft Foundry project, query it, and evaluate the response in one step
• Enhanced AKS managed cluster information with comprehensive properties. [#490]
• Added support retrieving Key Vault Managed HSM account settings via the command azmcp-keyvault-admin-settings-get. [#358]

Breaking Changes

• Removed the following Storage tools: [#500]
  • azmcp_storage_blob_batch_set-tier
  • azmcp_storage_datalake_directory_create
  • azmcp_storage_datalake_file-system_list-paths
  • azmcp_storage_queue_message_send
  • azmcp_storage_share_file_list
  • azmcp_storage_table_list
• Updated the OpenWorld and Destructive hints for all tools. [#510]

Bugs Fixed

• Fixed MCP server hanging on invalid transport arguments. Server now exits gracefully with clear error messages instead of hanging indefinitely. [#511]

Other Changes

• Refactored Kusto service implementation to use Azure Resource Graph queries instead of direct ARM API calls. [#528]
• Refactored Storage service implementation [#539]
  • Replaced direct ARM API calls in azmcp_storage_account_get with Azure Resource Graph queries.
  • Updated azmcp_storage_account_create to use the GenericResource approach instead of direct ARM API calls.
• Updated IAreaSetup API so the area's command tree is returned rather than modifying an existing object. It's also more DI-testing friendly. [#478]
• Updated CommandFactory.GetServiceArea to check for a tool's service area with or without the root azmcp prefix. [#478]

Dependency Updates

• Removed the following dependencies:
  • Azure.ResourceManager.Kusto [#528]

0.8.0 (2025-09-18)

Features Added

• Added the --insecure-disable-elicitation server startup switch. When enabled, the server will bypass user confirmation (elicitation) for tools marked as handling secrets and execute them immediately. This is INSECURE and meant only for controlled automation scenarios (e.g., CI or disposable test environments) because it removes a safety barrier that helps prevent accidental disclosure of sensitive data. [#486]
• Enhanced Azure authentication with targeted credential selection via the AZURE_TOKEN_CREDENTIALS environment variable: [#56]
  • "dev": Development credentials (Visual Studio → Visual Studio Code → Azure CLI → Azure PowerShell → Azure Developer CLI)
  • "prod": Production credentials (Environment → Workload Identity → Managed Identity)
  • Specific credential names (e.g., "AzureCliCredential"): Target only that credential
  • Improved Visual Studio Code credential error handling with proper exception wrapping for credential chaining
  • Replaced custom DefaultAzureCredential implementation with explicit credential chain for better control and transparency
  • For more details, see Controlling Authentication Methods with AZURE_TOKEN_CREDENTIALS
• Enhanced AKS nodepool information with comprehensive properties. [#454]
• Added support for updating Azure SQL databases via the command azmcp_sql_db_update. [#488]
• Added support for listing Event Grid subscriptions via the command azmcp_eventgrid_subscription_list. [#364]
• Added support for listing Application Insights code optimization recommendations across components via the command azmcp_applicationinsights_recommendation_list. #387
• Errata: The following was announced as part of release `0.7.0, but was not actually included then.
  • Added support for creating and deleting SQL databases via the commands azmcp_sql_db_create and azmcp_sql_db_delete. [#434]
• Restored support for the following Key Vault commands: [#506]
  • azmcp_keyvault_key_get
  • azmcp_keyvault_secret_get

Breaking Changes

• Redesigned how conditionally required options are handled. Commands now use explicit option registration via extension methods (.AsRequired(), .AsOptional()) instead of legacy patterns (UseResourceGroup(), RequireResourceGroup()). [#452]
• Removed support for the AZURE_MCP_INCLUDE_PRODUCTION_CREDENTIALS environment variable. Use AZURE_TOKEN_CREDENTIALS instead for more flexible credential selection. For migration details, see Controlling Authentication Methods with AZURE_TOKEN_CREDENTIALS. [#56]
• Merged azmcp_appconfig_kv_lock and azmcp_appconfig_kv_unlock into azmcp_appconfig_kv_lock_set which can handle locking or unlocking a key-value based on the --lock parameter. [#485]

Other Changes

• Update azmcp_foundry_models_deploy to use "GenericResource" for deploying models to Azure AI Services. [#456]

Dependency Updates

• Replaced the Azure.Bicep.Types.Az dependency with Microsoft.Azure.Mcp.AzTypes.Internal.Compact. [#472]

0.7.0 (2025-09-16)

Features Added

• Added support for getting a node pool in an AKS managed cluster via the command azmcp_aks_nodepool_get. [#394]
• Added support for diagnosing Azure Resources using the App Lens API via the command azmcp_applens_resource_diagnose. [#356]
• Added elicitation support. An elicitation request is sent if the tool annotation secret hint is true. [#404]
• Added azmcp_sql_server_create, azmcp_sql_server_delete, azmcp_sql_server_show to support SQL server create, delete, and show commands. [#312]
• Added the support for getting information about Azure Managed Lustre SKUs via the following command azmcp_azuremanagedlustre_filesystem_get_sku_info. [#100]
• Added support for creating and deleting SQL databases via the commands azmcp_sql_db_create and azmcp_sql_db_delete. [#434]
• azmcp_functionapp_get can now list Function Apps on a resource group level. [#427]

Breaking Changes

• Merged azmcp_functionapp_list into azmcp_functionapp_get, which can perform both operations based on whether --function-app is passed. [#427]
• Removed Azure CLI (az) and Azure Developer CLI (azd) extension tools to reduce complexity and focus on native Azure service operations. [#404].

Bugs Fixed

• Marked the secret hint of azmcp_keyvault_secret_create tool to "true". [#430]

Other Changes

• Replaced bicep tool dependency on Azure.Bicep.Types.Az package with Microsoft.Azure.Mcp.AzTypes.Internal.Compact package. [#472]

0.6.0 (2025-09-11)

Features Added

• The Azure MCP Server is now also available on NuGet.org [#368]
• Added support for listing node pools in an AKS managed cluster via the command azmcp_aks_nodepool_list. [#360]

Breaking Changes

• To improve performance, packages now ship with trimmed binaries that have unused code and dependencies removed, resulting in significantly smaller file sizes, faster startup times, and reduced memory footprint. Learn more. [#405]
• Merged azmcp_search_index_describe and azmcp_search_index_list into azmcp_search_index_get, which can perform both operations based on whether --index is passed. [#378]
• Merged the following Storage tools: [#376]
  • azmcp_storage_account_details and azmcp_storage_account_list into azmcp_storage_account_get, which supports the behaviors of both tools based on whether --account is passed.
  • azmcp_storage_blob_details and azmcp_storage_blob_list into azmcp_storage_blob_get, which supports the behaviors of both tools based on whether --blob is passed.
  • azmcp_storage_blob_container_details and azmcp_storage_blob_container_list into azmcp_storage_blob_container_get, which supports the behaviors of both tools based on whether --container is passed.
• Updated the descriptions of all Storage tools. [#376]

Other Changes

Dependency updates

• Updated the following dependencies: [#380]
  • Azure.Core: 1.47.1 → 1.48.0
  • Azure.Identity: 1.15.0 → 1.16.0

0.5.13 (2025-09-10)

Features Added

• Added support for listing all Event Grid topics in a subscription via the command azmcp_eventgrid_topic_list. [#43]
• Added support for retrieving knowledge index schema information in Microsoft Foundry projects via the command azmcp_foundry_knowledge_index_schema. [#41]
• Added support for listing service health events in a subscription via the command azmcp_resourcehealth_service-health-events_list. [#367]

Breaking Changes

• Updated/removed options for the following commands: [#108]
  • azmcp_storage_account_create: Removed the ability to configure enable-https-traffic-only (always true now), allow-blob-public-access (always false now), and kind (always StorageV2 now).
  • azmcp_storage_blob_container_create: Removed the ability to configure blob-container-public-access (always false now).
  • azmcp_storage_blob_upload: Removed the ability to configure overwrite (always false now).

Bugs Fixed

• Fixed telemetry bug where "ToolArea" was incorrectly populated in with "ToolName". [#346]

Other Changes

• Added telemetry to log parameter values for the azmcp_bestpractices_get tool. [#375]
• Updated tool annotations. [#377]

Dependency updates

• Updated the following dependencies:
  • Azure.Identity: 1.14.0 → 1.15.0 [#352]
  • Azure.Identity.Broker: 1.2.0 → 1.3.0 [#352]
  • Microsoft.Azure.Cosmos.Aot: 0.1.1-preview.1 → 0.1.2-preview.1 [#383]
• Updated the following dependency to improve .NET Ahead-of-Time (AOT) compilation support: [#363]
  • Azure.ResourceManager.StorageCache: 1.3.1 → 1.3.2

0.5.12 (2025-09-04)

Features Added

• Added azmcp_sql_server_firewall-rule_create and azmcp_sql_server_firewall-rule_delete commands. [#121]

Bugs Fixed

• Fixed a bug in MySQL query validation logic. [#81]

Other Changes

AOT- Added a verb to the namespace name for bestpractices [#109]

• Added instructions about consumption plan for azure functions deployment best practices [#218]

0.5.11 (2025-09-02)

Other Changes

• Fixed VSIX signing [#91]
• Included native packages in build artifacts and pack/release scripts. [#51]

0.5.10 (2025-08-28)

Bugs fixed

• Fixed a bug with telemetry collection related to AppConfig tools. [#44]

0.5.9 (2025-08-26)

Other Changes

Dependency Updates

• Updated the following dependencies to improve .NET Ahead-of-Time (AOT) compilation support:
  • Microsoft.Azure.Cosmos 3.51.0 → Microsoft.Azure.Cosmos.Aot 0.1.1-preview.1. [#37]

0.5.8 (2025-08-21)

Features Added

• Added support for listing knowledge indexes in Microsoft Foundry projects via the command azmcp_foundry_knowledge_index_list. [#1004]
• Added support for getting details of an Azure Function App via the command azmcp_functionapp_get. [#970]
• Added the following Azure Managed Lustre commands: [#1003]
  • azmcp_azuremanagedlustre_filesystem_list: List available Azure Managed Lustre filesystems.
  • azmcp_azuremanagedlustre_filesystem_required-subnet-size: Returns the number of IP addresses required for a specific SKU and size of Azure Managed Lustre filesystem.
• Added support for designing Azure Cloud Architecture through guided questions via the command azmcp_cloudarchitect_design. [#890]
• Added support for the following Azure MySQL operations: [#855]
  • azmcp_mysql_database_list - List all databases in a MySQL server.
  • azmcp_mysql_database_query - Executes a SELECT query on a MySQL Database. The query must start with SELECT and cannot contain any destructive SQL operations for security reasons.
  • azmcp_mysql_table_list - List all tables in a MySQL database.
  • azmcp_mysql_table_schema_get - Get the schema of a specific table in a MySQL database.
  • azmcp_mysql_server_config_get - Retrieve the configuration of a MySQL server.
  • azmcp_mysql_server_list - List all MySQL servers in a subscription & resource group.
  • azmcp_mysql_server_param_get - Retrieve a specific parameter of a MySQL server.
  • azmcp_mysql_server_param_set - Set a specific parameter of a MySQL server to a specific value.
• Added telemetry for tracking service area when calling tools. [#1024]

Breaking Changes

• Renamed the following Storage tool option names: [#1015]
  • azmcp_storage_account_create: account-name → account.
  • azmcp_storage_blob_batch_set-tier: blob-names → blobs.

Bugs Fixed

• Fixed SQL service test assertions to use case-insensitive string comparisons for resource type validation. [#938]
• Fixed HttpClient service test assertions to properly validate NoProxy collection handling instead of expecting a single string value. [#938]

Other Changes

• Introduced the BaseAzureResourceService class to allow performing Azure Resource read operations using Azure Resource Graph queries. [#938]
• Refactored SQL service implementation to use Azure Resource Graph queries instead of direct ARM API calls. [#938]
  • Removed dependency on Azure.ResourceManager.Sql package by migrating to Azure Resource Graph queries, reducing package size and improving startup performance.
• Enhanced BaseAzureService with EscapeKqlString method for safe KQL query construction across all Azure services. [#938]
  • Fixed KQL string escaping in Workbooks service queries.
• Standardized Azure Storage command descriptions, option names, and parameter names for consistency across all storage commands. Updated JSON serialization context to remove unused model types and improve organization. [#1015]
• Updated to .NET 10 SDK to prepare for .NET tool packing. [#1023]
• Enhanced bestpractices and azureterraformbestpractices tool descriptions to better work with the vscode copilot tool grouping feature. [#1029]
• The Azure MCP Server can now be packaged as a .NET SDK Tool for easier use by users with the .NET 10 SDK installed. [#422]

Dependency Updates

• Updated the following dependencies to improve .NET Ahead-of-Time (AOT) compilation support: [#1031]
  • Azure.ResourceManager.ResourceHealth: 1.0.0 → 1.1.0-beta.5

0.5.7 (2025-08-19)

Features Added

• Added support for the following Azure Deploy and Azure Quota operations: [#626]
  • azmcp_deploy_app_logs_get - Get logs from Azure applications deployed using azd.
  • azmcp_deploy_iac_rules_get - Get Infrastructure as Code rules.
  • azmcp_deploy_pipeline_guidance-get - Get guidance for creating CI/CD pipelines to provision Azure resources and deploy applications.
  • azmcp_deploy_plan_get - Generate deployment plans to construct infrastructure and deploy applications on Azure.
  • azmcp_deploy_architecture_diagram-generate - Generate Azure service architecture diagrams based on application topology.
  • azmcp_quota_region_availability-list - List available Azure regions for specific resource types.
  • azmcp_quota_usage_check - Check Azure resource usage and quota information for specific resource types and regions.
• Added support for listing Azure Function Apps via the command azmcp-functionapp-list. [#863]
• Added support for importing existing certificates into Azure Key Vault via the command azmcp-keyvault-certificate-import. [#968]
• Added support for uploading a local file to an Azure Storage blob via the command azmcp-storage-blob-upload. [#960]
• Added support for the following Azure Service Health operations: [#998]
  • azmcp-resourcehealth-availability-status-get - Get the availability status for a specific resource.
  • azmcp-resourcehealth-availability-status-list - List availability statuses for all resources in a subscription or resource group.
• Added support for listing repositories in Azure Container Registries via the command azmcp-acr-registry-repository-list. [#983]

Other Changes

• Improved guidance for LLM interactions with Azure MCP server by adding rules around bestpractices tool calling to server instructions. [#1007]

Dependency Updates

• Updated the following dependencies to improve .NET Ahead-of-Time (AOT) compilation support: [#893]
  • Azure.Bicep.Types: 0.5.110 → 0.6.1
  • Azure.Bicep.Types.Az: 0.2.771 → 0.2.792
• Added the following dependencies to support Azure Managed Lustre
  • Azure.ResourceManager.StorageCache: 1.3.1

0.5.6 (2025-08-14)

Features Added

• Added support for listing Azure Function Apps via the command azmcp-functionapp-list. [#863]
• Added support for getting details about an Azure Storage Account via the command azmcp-storage-account-details. [#934]

Other Changes

• Refactored resource group option (--resource-group) handling and validation for all commands to a centralized location. [#961]

Dependency Updates

• Updated the following dependencies to improve .NET Ahead-of-Time (AOT) compilation support: [#967] [#969]
  • Azure.Monitor.Query: 1.6.0 → 1.7.1
  • Azure.Monitor.Ingestion: 1.1.2 → 1.2.0
  • Azure.Search.Documents: 11.7.0-beta.4 → 11.7.0-beta.6
  • Azure.ResourceManager.ContainerRegistry: 1.3.0 → 1.3.1
  • Azure.ResourceManager.DesktopVirtualization: 1.3.1 → 1.3.2
  • Azure.ResourceManager.PostgreSql: 1.3.0 → 1.3.1

0.5.5 (2025-08-12)

Features Added

• Added support for listing ACR (Azure Container Registry) registries in a subscription via the command azmcp-acr-registry-list. [#915]
• Added the following Azure Storage commands:
  • azmcp-storage-account-create: Create a new Azure Storage account. [#927]
  • azmcp-storage-queue-message-send: Send a message to an Azure Storage queue. [#794]
  • azmcp-storage-blob-details: Get details about an Azure Storage blob. [#930]
  • azmcp-storage-blob-container-create: Create a new Azure Storage blob container. [#937]

Breaking Changes

• The azmcp-storage-account-list command now returns account metadata objects instead of plain strings. Each item includes: name, location, kind, skuName, skuTier, hnsEnabled, allowBlobPublicAccess, enableHttpsTrafficOnly. Update scripts to read the name property. The underlying IStorageService.GetStorageAccounts() signature changed from Task<List<string>> to Task<List<StorageAccountInfo>>. [#904]

Bugs Fixed

• Fixed best practices tool invocation failure when passing "all" action with "general" or "azurefunctions" resources. [#757]
• Updated metadata for CREATE and SET tools to destructive = true. [#773]

Other Changes

• Consolidate "AzSubscriptionGuid" telemetry logic into McpRuntime. [#935]

0.5.4 (2025-08-07)

Bugs Fixed

• Fixed subscription parameter handling across all Azure MCP service methods to consistently use subscription instead of subscriptionId, enabling proper support for both subscription IDs and subscription names. [#877]
• Fixed ToolExecuted telemetry activity being created twice. [#741]

Other Changes

• Improved Azure MCP display name in VS Code from 'azure-mcp-server-ext' to 'Azure MCP' for better user experience in the Configure Tools interface. [#871, #876]
• Updated the following CommandGroup descriptions to improve their tool usage by Agents:
  • Azure AI Search [#874]
  • Storage [#879]

0.5.3 (2025-08-05)

Features Added

• Added support for providing the --content-type and --tags properties to the azmcp-appconfig-kv-set command. [#459]
• Added filter-path and recursive capabilities to azmcp-storage-datalake-file-system-list-paths. [#770]
• Added support for listing files and directories in Azure File Shares via the azmcp-storage-share-file-list command. This command recursively lists all items in a specified file share directory with metadata including size, last modified date, and content type. [#793]
• Added support for Azure Virtual Desktop with new commands: [#653]
  • azmcp-virtualdesktop-hostpool-list - List all host pools in a subscription
  • azmcp-virtualdesktop-sessionhost-list - List all session hosts in a host pool
  • azmcp-virtualdesktop-sessionhost-usersession-list - List all user sessions on a specific session host
• Added support for creating and publishing DevDeviceId in telemetry. [#810]

Breaking Changes

• Parameter Name Changes: Removed unnecessary "-name" suffixes from command parameters across 25+ parameters in 12+ Azure service areas to improve consistency and usability. Users will need to update their command-line usage and scripts. [#853]
  • AppConfig: --account-name → --account
  • Search: --service-name → --service, --index-name → --index
  • Cosmos: --account-name → --account, --database-name → --database, --container-name → --container
  • Kusto: --cluster-name → --cluster, --database-name → --database, --table-name → --table
  • AKS: --cluster-name → --cluster
  • Postgres: --user-name → --user
  • ServiceBus: --queue-name → --queue, --topic-name → --topic
  • Storage: --account-name → --account, --container-name → --container, --table-name → --table, --file-system-name → --file-system, --tier-name → --tier
  • Monitor: --table-name → --table, --model → --health-model, --resource-name → --resource
  • Foundry: --deployment-name → --deployment, --publisher-name → --publisher, --license-name → --license, --sku-name → --sku, --azure-ai-services-name → --azure-ai-services

Bugs Fixed

• Fixed an issue where the azmcp-storage-blob-batch-set-tier command did not correctly handle the --tier parameter when setting the access tier for multiple blobs. [#808]

Other Changes

• Implemented centralized HttpClient service with proxy support for better resource management and enterprise compatibility. [#857]
• Added caching for Cosmos DB databases and containers. [#813]
• Refactored PostgreSQL commands to follow ObjectVerb naming pattern, fix command hierarchy, and ensure all commands end with verbs. This improves consistency and discoverability across all postgres commands. [#865] [#866]

Dependency Updates

• Updated the following dependencies to improve .NET Ahead-of-Time (AOT) compilation support. AOT will enable shipping Azure MCP Server as self-contained native executable.
  • Azure.Core: 1.46.2 → 1.47.1
  • Azure.ResourceManager: 1.13.1 → 1.13.2
  • Azure.ResourceManager.ApplicationInsights: 1.0.1 → 1.1.0-beta.1
  • Azure.ResourceManager.AppConfiguration: 1.4.0 → 1.4.1
  • Azure.ResourceManager.Authorization: 1.1.4 → 1.1.5
  • Azure.ResourceManager.ContainerService: 1.2.3 → 1.2.5
  • Azure.ResourceManager.Kusto: 1.6.0 → 1.6.1
  • Azure.ResourceManager.CognitiveServices: 1.4.0 → 1.5.1
  • Azure.ResourceManager.Redis: 1.5.0 → 1.5.1
  • Azure.ResourceManager.RedisEnterprise: 1.1.0 → 1.2.1
  • Azure.ResourceManager.LoadTesting: 1.1.1 → 1.1.2
  • Azure.ResourceManager.Sql: 1.3.0 → 1.4.0-beta.3
  • Azure.ResourceManager.Datadog: 1.0.0-beta.5 → 1.0.0-beta.6
  • Azure.ResourceManager.CosmosDB: 1.3.2 → 1.4.0-beta.13
  • Azure.ResourceManager.OperationalInsights: 1.3.0 → 1.3.1
  • Azure.ResourceManager.Search: 1.2.3 → 1.3.0
  • Azure.ResourceManager.Storage: 1.4.2 → 1.4.4
  • Azure.ResourceManager.Grafana: 1.1.1 → 1.2.0-beta.2
  • Azure.ResourceManager.ResourceGraph: 1.1.0-beta.3 → 1.1.0-beta.4

0.5.2 (2025-07-31)

Features Added

• Added support for batch setting access tier for multiple Azure Storage blobs via the azmcp-storage-blob-batch-set-tier command. This command efficiently changes the storage tier (Hot, Cool, Archive, etc) for multiple blobs simultaneously in a single operation. [#735]
• Added descriptions to all Azure MCP command groups to improve discoverability and usability when running the server with --mode single or --mode namespace. [#791]

Breaking Changes

• Removed --partner-tenant-id option from azmcp-marketplace-product-get command. [#656]

0.5.1 (2025-07-29)

Features Added

• Added support for listing SQL databases via the command: azmcp-sql-db-list. [#746]
• Added support for reading AZURE_SUBSCRIPTION_ID from the environment variables if a subscription is not provided. [#533]

Breaking Changes

• Removed the following Key Vault operations: [#768]
  • azmcp-keyvault-secret-get
  • azmcp-keyvault-key-get

Other Changes

• Improved the MAC address search logic for telemetry by making it more robust in finding a valid network interface. [#759]
• Major repository structure change:
  • Service areas moved from /src/areas/{Area} and /tests/areas/{Area} into /areas/{area}/src and /areas/{area}/tests
  • Common code moved into /core/src and /core/tests

0.5.0 (2025-07-24)

Features Added

• Added a new VS Code extension (VSIX installer) for the VS Code Marketplace. [#661]
• Added --mode all startup option to expose all Azure MCP tools individually. [#689]
• Added more tools for Azure Key Vault: [#517]
  • azmcp-keyvault-certificate-list - List certificates in a key vault
  • azmcp-keyvault-certificate-get - Get details of a specific certificate
  • azmcp-keyvault-certificate-create - Create a new certificate
  • azmcp-keyvault-secret-list - List secrets in a key vault
  • azmcp-keyvault-secret-create - Create a new secret
• Added support for Azure Workbooks management operations: [#629]
  • azmcp-workbooks-list - List workbooks in a resource group with optional filtering
  • azmcp-workbooks-show - Get detailed information about a specific workbook
  • azmcp-workbooks-create - Create new workbooks with custom visualizations and content
  • azmcp-workbooks-update - Update existing workbook configurations and metadata
  • azmcp-workbooks-delete - Delete workbooks when no longer needed
• Added support for creating a directory in Azure Storage DataLake via the azmcp-storage-datalake-directory-create command. [#647]
• Added support for getting the details of an Azure Kubernetes Service (AKS) cluster via the azmcp-aks-cluster-get command. [#700]

Breaking Changes

• Changed the default startup mode to list tools at the namespace level instead of at an individual level, reducing total tool count from around 128 tools to 25. Use --mode all to restore the previous behavior of exposing all tools individually. [#689]
• Consolidated Azure best practices commands into the command azmcp-bestpractices-get with --resource and --action parameters: [#677]
  • Removed azmcp-bestpractices-general-get, azmcp-bestpractices-azurefunctions-get-code-generation and azmcp-bestpractices-azurefunctions-get-deployment
  • Use --resource general --action code-generation for general Azure code generation best practices
  • Use --resource general --action deployment for general Azure deployment best practices
  • Use --resource azurefunctions --action code-generation instead of the old azurefunctions code-generation command
  • Use --resource azurefunctions --action deployment instead of the old azurefunctions deployment command
  • Use --resource static-web-app --action all to get Static Web Apps development and deployment best practices

Bugs Fixed

• Fixes tool discovery race condition causing "tool not found" errors in MCP clients that use different processes to start and use the server, like LangGraph. [#556]

0.4.1 (2025-07-17)

Features Added

• Added support for the following Azure Load Testing operations: [#315]
  • azmcp-loadtesting-testresource-list - List Azure Load testing resources.
  • azmcp-loadtesting-testresource-create - Create a new Azure Load testing resource.
  • azmcp-loadtesting-test-get - Get details of a specific load test configuration.
  • azmcp-loadtesting-test-create - Create a new load test configuration.
  • azmcp-loadtesting-testrun-get - Get details of a specific load test run.
  • azmcp-loadtesting-testrun-list - List all load test runs for a specific test.
  • azmcp-loadtesting-testrun-create - Create a new load test run.
  • azmcp-loadtesting-testrun-delete - Delete a specific load test run.
• Added support for scanning Azure resources for compliance recommendations using the Azure Quick Review CLI via the command: azmcp-extension-azqr. [#510]
• Added support for listing paths in Data Lake file systems via the command: azmcp-storage-datalake-file-system-list-paths. [#608]
• Added support for listing SQL elastic pools via the command: azmcp-sql-elastic-pool-list. [#606]
• Added support for listing SQL server firewall rules via the command: azmcp-sql-firewall-rule-list. [#610]
• Added new commands for obtaining Azure Functions best practices via the following commands: [#630]
  • azmcp-bestpractices-azurefunctions-get-code-generation - Get code generation best practices for Azure Functions.
  • azmcp-bestpractices-azurefunctions-get-deployment - Get deployment best practices for Azure Functions.
• Added support for get details about a product in the Azure Marketplace via the command: azmcp-marketplace-product-get. [#442]

Breaking Changes

• Renamed the command azmcp-bestpractices-get to azmcp-bestpractices-general-get. [#630]

Bugs Fixed

• Fixed an issue with Azure CLI executable path resolution on Windows. [#611]
• Fixed a tool discovery timing issue when calling tools on fresh server instances. [#604]
• Fixed issue where unrecognizable json would be sent to MCP clients in STDIO mode at startup. [#644]

Other Changes

• Changed engines.node in package.json to require Node.js version >=20.0.0. [#628]

0.4.0 (2025-07-15)

Features Added

• Added support for listing Azure Kubernetes Service (AKS) clusters via the command azmcp-aks-cluster-list. [#560]
• Made the following Ahead of Time (AOT) compilation improvements saving 6.96 MB in size total:
  • Switched to the trimmer-friendly CreateSlimBuilder API from CreateBuilder, saving 0.63 MB in size for the native executable. [#564]
  • Switched to the trimmer-friendly npgsql API, saving 2.69 MB in size for the native executable. [#592]
  • Enabled IlcFoldIdenticalMethodBodies to fold identical method bodies, saving 3.64 MB in size for the native executable. [#598]
• Added support for using the hyphen/dash ("-") character in command names. [#531]
• Added support for authenticating with the Azure account used to log into VS Code. Authentication now prioritizes the VS Code broker credential when in the context of VS Code. [#452]

Breaking Changes

• Removed SSE (Server-Sent Events) transport support. Now, only stdio transport is supported as SSE is no longer part of the MCP specification. [#593]
• Renamed azmcp-sql-server-entraadmin-list to azmcp-sql-server-entra-admin-list for better readability. [#602]

Bugs Fixed

• Added a post-install script to ensure platform-specific versions like @azure/mcp-${platform}-${arch} can be resolved. Otherwise, fail install to prevent npx caching of @azure/mcp. [#597]
• Improved install reliability and error handling when missing platform packages on Ubuntu. [#394]

Other Changes

• Updated engines.node in package.json to require Node.js version >=22.0.0.

Dependency Updates

• Updated the ModelContextProtocol.AspNetCore version from 0.3.0-preview.1 to 0.3.0-preview.2. [#519]

0.3.2 (2025-07-10)

Features Added

• Added support for listing Azure Managed Grafana details via the command: azmcp-grafana-list. [#532]
• Added agent best practices for Azure Terraform commands. [#420]

Bugs Fixed

• Fixed issue where trace logs could be collected as telemetry. [#540]
• Fixed an issue that prevented the Azure MCP from finding the Azure CLI if it was installed on a path other than the default global one. [#351]

0.3.1 (2025-07-08)

Features Added

• Added support for the following SQL operations:
  • azmcp-sql-db-show - Show details of a SQL Database [#516]
  • azmcp-sql-server-entra-admin-list - List Microsoft Entra ID administrators for a SQL server [#529]
• Updates Azure MCP tool loading configurations at launch time. [#513]

Breaking Changes

• Deprecated the --service flag. Use --namespace and --mode options to specify the service and mode the server will run in. [#513]

0.3.0 (2025-07-03)

Features Added

• Added support for Microsoft Foundry [#274]. The following tools are now available:
  • azmcp-foundry-models-list
  • azmcp-foundry-models-deploy
  • azmcp-foundry-models-deployments-list
• Added support for telemetry [#386]. Telemetry is enabled by default but can be disabled by setting AZURE_MCP_COLLECT_TELEMETRY to false.

Bugs Fixed

• Fixed a bug where CallToolResult was always successful. [#511]

0.2.6 (2025-07-01)

Other Changes

• Updated the descriptions of the following tools to improve their usage by Agents: [#492]
  • azmcp-datadog-monitoredresources-list
  • azmcp-kusto-cluster-list
  • azmcp-kusto-database-list
  • azmcp-kusto-sample
  • azmcp-kusto-table-list
  • azmcp-kusto-table-schema

0.2.5 (2025-06-26)

Bugs Fixed

• Fixed issue where tool listing incorrectly returned resources instead of text. #465
• Fixed invalid modification to HttpClient in KustoClient. #433

0.2.4 (2025-06-24)

Features Added

• Added new command for resource-centric logs query in Azure Monitor with command path azmcp-monitor-resource-logs-query - https://github.com/Azure/azure-mcp/pull/413
• Added support for starting the server with a subset of services using the --service flag - https://github.com/Azure/azure-mcp/pull/424
• Improved index schema handling in Azure AI Search (index descriptions, facetable fields, etc.) - https://github.com/Azure/azure-mcp/pull/440
• Added new commands for querying metrics with Azure Monitor with command paths azmcp-monitor-metrics-query and azmcp-monitor-metrics-definitions. - https://github.com/Azure/azure-mcp/pull/428

Breaking Changes

• Changed the command for workspace-based logs query in Azure Monitor from azmcp-monitor-log-query to azmcp-monitor-workspace-logs-query

Bugs Fixed

• Fixed handling of non-retrievable fields in Azure AI Search. #416

Other Changes

• Repository structure changed to organize all of an Azure service's code into a single "area" folder. (426)
• Upgraded Azure.Messaging.ServiceBus to 7.20.1 and Azure.Core to 1.46.2. (441)
• Updated to ModelContextProtocol 0.3.0-preview1, which brings support for the 06-18-2025 MCP specification. (431)

0.2.3 (2025-06-19)

Features Added

• Adds support to launch MCP server in readonly mode - https://github.com/Azure/azure-mcp/pull/410

Bugs Fixed

• MCP tools now expose annotations to clients https://github.com/Azure/azure-mcp/pull/388

0.2.2 (2025-06-17)

Features Added

• Support for Azure ISV Services https://github.com/Azure/azure-mcp/pull/199/
• Support for Azure RBAC https://github.com/Azure/azure-mcp/pull/266
• Support for Key Vault Secrets https://github.com/Azure/azure-mcp/pull/173

0.2.1 (2025-06-12)

Bugs Fixed

• Fixed the issue where queries containing double quotes failed to execute. https://github.com/Azure/azure-mcp/pull/338
• Enables dynamic proxy mode within single "azure" tool. https://github.com/Azure/azure-mcp/pull/325

0.2.0 (2025-06-09)

Features Added

• Support for launching smaller service level MCP servers. https://github.com/Azure/azure-mcp/pull/324

Bugs Fixed

• Fixed failure starting Docker image. https://github.com/Azure/azure-mcp/pull/301

0.1.2 (2025-06-03)

Bugs Fixed

• Monitor Query Logs Failing. Fixed with https://github.com/Azure/azure-mcp/pull/280

0.1.1 (2025-05-30)

Bugs Fixed

• Fixed return value of tools/list to use JSON object names. https://github.com/Azure/azure-mcp/pull/275

Other Changes

• Update .NET SDK version to 9.0.300 https://github.com/Azure/azure-mcp/pull/278

0.1.0 (2025-05-28)

Breaking Changes

• azmcp tool list "args" changes to "options"

Other Changes

• Removed "Arguments" from code base in favor of "Options" to align with System. CommandLine semantics. https://github.com/Azure/azure-mcp/pull/232

0.0.21 (2025-05-22)

Features Added

• Support for Azure Redis Caches and Clusters https://github.com/Azure/azure-mcp/pull/198
• Support for Azure Monitor Health Models https://github.com/Azure/azure-mcp/pull/208

Bugs Fixed

• Updates the usage patterns of Azure Developer CLI (azd) when invoked from MCP. https://github.com/Azure/azure-mcp/pull/203
• Fixes server binding issue when using SSE transport in Docker by replacing ListenLocalhost with ListenAnyIP, allowing external access via port mapping. https://github.com/Azure/azure-mcp/pull/233

Other Changes

• Updated to the latest ModelContextProtocol library. https://github.com/Azure/azure-mcp/pull/220

0.0.20 (2025-05-17)

Bugs Fixed

• Improve the formatting in the ParseJsonOutput method and refactor it to utilize a ParseError record. https://github.com/Azure/azure-mcp/pull/218
• Added dummy argument for best practices tool, so the schema is properly generated for Python Open API use cases. https://github.com/Azure/azure-mcp/pull/219

0.0.19 (2025-05-15)

Bugs Fixed

• Fixes Service Bus host name parameter description. https://github.com/Azure/azure-mcp/pull/209/

0.0.18 (2025-05-14)

Bugs Fixed

• Include option to exclude managed keys. https://github.com/Azure/azure-mcp/pull/202

0.0.17 (2025-05-13)

Bugs Fixed

• Added an opt-in timeout for browser-based authentication to handle cases where the process waits indefinitely if the user closes the browser. https://github.com/Azure/azure-mcp/pull/189

0.0.16 (2025-05-13)

Bugs Fixed

• Fixed being able to pass args containing spaces through an npx call to the cli

Other Changes

• Updated to the latest ModelContextProtocol library. https://github.com/Azure/azure-mcp/pull/161

0.0.15 (2025-05-09)

Features Added

• Support for getting properties and runtime information for Azure Service Bus queues, topics, and subscriptions. https://github.com/Azure/azure-mcp/pull/150/
• Support for peeking at Azure Service Bus messages from queues or subscriptions. https://github.com/Azure/azure-mcp/pull/144
• Adds Best Practices tool that provides guidance to LLMs for effective code generation. https://github.com/Azure/azure-mcp/pull/153 https://github.com/Azure/azure-mcp/pull/156

Other Changes

• Disabled Parallel testing in the ADO pipeline for Live Tests https://github.com/Azure/azure-mcp/pull/151

0.0.14 (2025-05-07)

Features Added

• Support for Azure Key Vault keys https://github.com/Azure/azure-mcp/pull/119
• Support for Azure Data Explorer https://github.com/Azure/azure-mcp/pull/21

0.0.13 (2025-05-06)

Features Added

• Support for Azure PostgreSQL. https://github.com/Azure/azure-mcp/pull/81

0.0.12 (2025-05-05)

Features Added

• Azure Search Tools https://github.com/Azure/azure-mcp/pull/83

Other Changes

• Arguments no longer echoed in response: https://github.com/Azure/azure-mcp/pull/79
• Editorconfig and gitattributes updated: https://github.com/Azure/azure-mcp/pull/91

0.0.11 (2025-04-29)

Features Added

Breaking Changes

Bugs Fixed

• Bug fixes to existing MCP commands
• See https://github.com/Azure/azure-mcp/releases/tag/0.0.11

Other Changes

0.0.10 (2025-04-17)

Features Added

• Support for Azure Cosmos DB (NoSQL databases).
• Support for Azure Storage.
• Support for Azure Monitor (Log Analytics).
• Support for Azure App Configuration.
• Support for Azure Resource Groups.
• Support for Azure CLI.
• Support for Azure Developer CLI (azd).

Breaking Changes

Bugs Fixed

• See https://github.com/Azure/azure-mcp/releases/tag/0.0.10

Other Changes

• See blog post for details https://devblogs.microsoft.com/azure-sdk/introducing-the-azure-mcp-server/