@azure/mcp

Security Hardening Guide: Azure MCP Connector

Least-privilege permissions

• Grant only required Azure permissions – Configure the MCP server's Azure identity (service principal) with the minimum roles needed for its specific tasks. For example, if it only reads storage files, grant "Storage Blob Reader" instead of full storage access.
• Use scope restrictions – Limit access to specific resource groups or subscriptions rather than allowing access across all Azure resources.
• Avoid "Owner" or "Contributor" roles – These admin-level permissions give the connector dangerous broad powers; use specific, narrow roles instead.
• Rotate credentials regularly – Change Azure authentication tokens and keys every 90 days to reduce risk if compromised.

Network isolation

• Run the MCP server in a private network – Deploy it within an Azure Virtual Network or private environment, not on the public internet where attackers can reach it directly.
• Use managed identity instead of stored credentials – Enable Azure Managed Identity so the server authenticates without storing secrets in code or configuration files.
• Restrict outbound connections – Configure firewalls to limit what external services the MCP server can connect to, blocking unexpected data exfiltration attempts.
• Encrypt all communication – Ensure all data flowing between the agent and Azure uses encryption (TLS/HTTPS) to prevent interception.

Monitoring

• Log all Azure operations – Enable Azure Activity Logs and audit trails to record every action the MCP connector performs (who accessed what, when, and what changed).
• Set alerts for suspicious activity – Configure alerts for mass deletions, unexpected credential access, or operations outside normal patterns.
• Review agent outputs regularly – Check what the connector returns to users; look for accidentally exposed credentials, secrets, or sensitive data.
• Monitor npm package updates – Track updates to the "@azure/mcp" package and verify security advisories before upgrading; use lock files to prevent automatic version changes.

Red flags to watch for

• Credentials appearing in chat or logs – If you see Azure passwords, tokens, or connection strings in agent responses or visible logs, immediately rotate those credentials and investigate the leak source.
• Unexpected Azure resource changes – Watch for deleted resources, new user accounts, or permission changes you didn't authorize; this signals a potential attack.
• Large data downloads or exports – Monitor for unusual data transfers from databases or storage; attackers often exfiltrate large volumes of sensitive information.
• Prompts requesting Azure operations – Be cautious if users ask the agent to "delete all backups" or "grant admin access"; verify such requests are legitimate before allowing the MCP server to execute them.