Connectors · MSP & PSA
Azure Networking MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Azure Networking and the rest of your systems. It gives your agent 833 Azure Networking actions (463 reads, 202 writes and 168 that wait for a confirmation) and holds the Azure Networking credential itself, so the agent never does. It paces Azure Networking's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "azure_networking.subscriptions.list", intent: "check which Azure Networking account is connected"}# List the subscriptions the credential can see · read · 1 upstream call- 833actionsin one signed file
- 463readlook, never change
- 202writecreate and update
- 168wait for a yesdestructive, confirmed first
Set up
Connect Azure Networking in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Azure Networking.
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
client_idEntra application (client) id of a service principal with an Azure RBAC role on the subscriptionclient_secretEntra client secrettenant_idYour Azure Networking tenant id
account { op: "connections.requirements", service: "azure_networking" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "azure_networking.subscriptions.list" }# list the subscriptions the credential can see · read · 1 upstream callcheck { action: "azure_networking.public_ip_addresses.update_tags", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Azure Networking at a glance
- Sign-in
- OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
- You provide
client_idclient_secret- Setup fields
tenant_id- Limits we pace to
- 200 calls a minute, per connection
- API covered
- Azure Networking (virtual networks, subnets, NSGs, public IPs, load balancers, gateways, firewalls) API Azure Resource Manager Microsoft.Network 2026-03-01
management.azure.com - Built from
- Azure Networking's documentation, read 23 October 2026GitHublearn.microsoft.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 376 of 463 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 3, so ask can line Azure Networking up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Azure Networking.
833 actions in 173 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 463readlook, never change
- 202writecreate and update
- 168destructivewait for a confirmation
Virtual network gateways
3417 read · 7 write · 10 destructive
Gets all virtual network gateways by resource group · Gets all the connections in a virtual network gateway · Gets the specified virtual network gateway by resource group · Generates VPN profile for P2S client of the virtual network gateway in the specified resource group
Network watchers
2417 read · 5 write · 2 destructive
Lists all connection analyzers in the specified network watcher · Gets all network watchers by resource group · Gets all network watchers by subscription · Gets the specified connection analyzer by name
Application gateways
1712 read · 3 write · 2 destructive
Lists all application gateways in a resource group · Gets all the application gateways in a subscription · Lists all available request headers · Lists all available response headers
Express route cross connections
168 read · 4 write · 4 destructive
Retrieves all the ExpressRouteCrossConnections in a subscription · Retrieves all the ExpressRouteCrossConnections in a resource group · Gets details about the specified ExpressRouteCrossConnection · Gets migration health information for an express route circuit cross connection
Express route circuits
1510 read · 3 write · 2 destructive
Gets all the express route circuits in a resource group · Gets all the express route circuits in a subscription · Gets information about the specified express route circuit · Gets all stats from an express route circuit in a resource group
Network virtual appliances
134 read · 3 write · 6 destructive
Gets all Network Virtual Appliances in a subscription · Lists all Network Virtual Appliances in a resource group · Gets the specified Network Virtual Appliance · Retrieves the boot diagnostic logs for a VM instance belonging to the specified Network Virtual Appliance
Private link services
139 read · 2 write · 2 destructive
Gets all private link services in a resource group · Returns all of the private link service ids that can be linked to a Private Endpoint with auto approved in this subscription in this region · Returns all of the private link service ids that can be linked to a Private Endpoint with auto approved in this subscription in this region · Gets all private link service in a subscription
Bastion hosts
125 read · 3 write · 4 destructive
Lists all Bastion Hosts in a subscription · Lists all Bastion Hosts in a resource group · Gets the specified Bastion Host · Returns the list of currently active sessions on the Bastion
112 more areas · 689 actions
- Express route gateways 12
- Public ip addresses 12
- Virtual network gateway connections 12
- Virtual networks 12
- Express route lags 11
- Network interfaces 11
- P2S VPN gateways 11
- Service gateways 10
- Azure firewalls 9
- Load balancers 9
- Virtual hubs 9
- VPN gateways 9
- Network managers 8
- Virtual wans 8
- Express route ports 7
- Interconnect groups 7
- Ipam pools 7
- VPN link connections 7
- VPN server configurations 7
- Application security groups 6
- Authentication policies 6
- Connection monitors 6
- Custom ip prefixes 6
- Ddos custom policies 6
- Ddos protection plans 6
- Firewall policies 6
- First party service tags 6
- Ip allocations 6
- Ip groups 6
- Nat gateways 6
- Network profiles 6
- Network security groups 6
- Network security perimeters 6
- Packet captures 6
- Public ip prefixes 6
- Route filters 6
- Route tables 6
- Security partner providers 6
- Service endpoint policies 6
- Subnets 6
- Virtual network appliances 6
- Virtual network taps 6
- VPN connections 6
- VPN sites 6
- DSCP configuration 5
- Express route circuit authorizations 5
- Express route lag authorizations 5
- Express route port authorizations 5
- Flow logs 5
- Local network gateways 5
- Network security perimeter access rules 5
- Network security perimeter associations 5
- Private endpoints 5
- Verifier workspaces 5
- Virtual routers 5
- Web application firewall policies 5
- Address prefix sets 4
- Admin rule collections 4
- Admin rules 4
- Application gateway private endpoint connections 4
- Commits 4
- Configuration policy groups 4
- Connection policies 4
- Connectivity configurations 4
- Express route circuit connections 4
- Express route circuit peerings 4
- Express route connections 4
- Express route cross connection peerings 4
- Firewall policy idps signatures overrides 4
- Firewall policy kube selector groups 4
- Firewall policy rule collection groups 4
- Hub route tables 4
- Hub virtual network connections 4
- Inbound nat rules 4
- Load balancer backend address pools 4
- Management group network manager connections 4
- Nat rules 4
- Network groups 4
- Network interface tap configurations 4
- Network manager routing configurations 4
- Network security perimeter links 4
- Network security perimeter logging configurations 4
- Network security perimeter profiles 4
- Network virtual appliance connections 4
- Private DNS zone groups 4
- Reachability analysis intents 4
- Reachability analysis runs 4
- Route filter rules 4
- Route maps 4
- Routes 4
- Routing intent 4
- Routing rule collections 4
- Routing rules 4
- Scope connections 4
- Security admin configurations 4
- Security rules 4
- Security user configurations 4
- Security user rule collections 4
- Security user rules 4
- Service endpoint policy definitions 4
- Static cidrs 4
- Static members 4
- Subscription network manager connections 4
- Virtual appliance sites 4
- Virtual hub ip configuration 4
- Virtual hub route table V2S 4
- Virtual network appliance capabilities 4
- Virtual network gateway nat rules 4
- Virtual network peerings 4
- Virtual router peerings 4
- Firewall policy drafts 3
- 54 smaller areas 82
Top actions
The Azure Networking API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 26 of Azure Networking's 31 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
azure_networking.virtual_networks.list_allGets all virtual networks in a subscription | Gets all virtual networks in a subscription. | read | infra.network.list6 connectors |
azure_networking.resource_groups.listList the resource groups in a subscription | List the resource groups in a subscription. | read | infra.resource_group.list19 connectors |
azure_networking.subscriptions.list_locationsList the Azure regions available to a subscription | List the Azure regions available to a subscription. | read | infra.region.list16 connectors |
azure_networking.network_security_groups.list_allGets all network security groups in a subscription | Gets all network security groups in a subscription. | read | infra.security_group.list2 connectors |
azure_networking.public_ip_addresses.list_allGets all the public IP addresses in a subscription | Gets all the public IP addresses in a subscription. | read | infra.ip_address.list9 connectors |
azure_networking.virtual_network_gateway_connections.listThe List VirtualNetworkGatewayConnections operation retrieves all the virtual network gateways connections created | The List VirtualNetworkGatewayConnections operation retrieves all the virtual network gateways connections created. | read | infra.vpn_connection.list5 connectors |
azure_networking.subnets.listGets all subnets in a virtual network | Gets all subnets in a virtual network. | read | infra.subnet.list4 connectors |
azure_networking.public_ip_addresses.getGets the specified public IP address in a specified resource group | Gets the specified public IP address in a specified resource group. | read | infra.ip_address.get7 connectors |
azure_networking.public_ip_addresses.update_tagsUpdates public IP address tags | Updates public IP address tags. | write | infra.ip_address.update6 connectors |
azure_networking.virtual_networks.update_tagsUpdates a virtual network tags | Updates a virtual network tags. | write | infra.network.update5 connectors |
azure_networking.virtual_networks.deleteDeletes the specified virtual network | Deletes the specified virtual network. | destructive | infra.network.delete6 connectors |
azure_networking.network_security_groups.update_tagsUpdates a network security group tags | Updates a network security group tags. | write | infra.security_group.update3 connectors |
Try it
Prompts to paste into Claude.
Each one names the Azure Networking actions it will call, so you know what it reads and what it changes before you send it.
- Readread
List the subscriptions the credential can see in Azure Networking and tell me what stands out.
calls
azure_networking.subscriptions.list - Writewrite
Updates public IP address tags in Azure Networking. Show me exactly what you will send before you save it.
calls
azure_networking.public_ip_addresses.update_tags
Governance for Azure Networking
Destructive actions wait for a yes.
168 Azure Networking actions are destructive. The first 10:
- Deletes the specified virtual network
azure_networking.virtual_networks.delete - Deletes the specified public IP address
azure_networking.public_ip_addresses.delete - Deletes the specified subnet
azure_networking.subnets.delete - Deletes the specified virtual network Gateway connection
azure_networking.virtual_network_gateway_connections.delete - Deletes the specified load balancer
azure_networking.load_balancers.delete - Deletes the specified network security group
azure_networking.network_security_groups.delete - Post a Network Manager Commit
azure_networking.network_manager_commits.post - Runs a packet capture on AzureFirewall
azure_networking.azure_firewalls.packet_capture - Runs a packet capture operation on AzureFirewall
azure_networking.azure_firewalls.packet_capture_operation - Resets the primary of the vpn gateway in the specified resource group
azure_networking.vpn_gateways.reset
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Deletes the specified virtual network?
intent: the user asked me to deletes the specified virtual network
account { op: "keys.create", name: "azure-networking-agent", allowed_actions: ["azure_networking.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "azure_networking.virtual_networks.delete", approver: "[email protected]" }, { match: "azure_networking.public_ip_addresses.delete", approver: "[email protected]" }, { match: "azure_networking.subnets.delete", approver: "[email protected]" } ]}Cost
What Azure Networking costs on actionlake.
Every Azure Networking action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Azure Networking refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 833 Azure Networking actions
- 214actions pageeach page of a long list is one call
- 376reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Azure Networking action.
833 actions by area: the id your agent calls, what it does, and its effect.
Virtual network gateways34
azure_networking.virtual_network_gateways.generate_vpn_profileGenerates VPN profile for P2S client of the virtual network gateway in the specified resource groupwriteazure_networking.virtual_network_gateways.getGets the specified virtual network gateway by resource groupread- and 32 more in this area
Network watchers24
azure_networking.network_watchers.connection_analyzers_getGets the specified connection analyzer by namereadazure_networking.network_watchers.connection_analyzers_listLists all connection analyzers in the specified network watcherread- and 22 more in this area
Application gateways17
azure_networking.application_gateways.listLists all application gateways in a resource groupreadazure_networking.application_gateways.list_allGets all the application gateways in a subscriptionread- and 15 more in this area
Express route cross connections16
azure_networking.express_route_cross_connections.getGets details about the specified ExpressRouteCrossConnectionreadazure_networking.express_route_cross_connections.get_circuit_migration_infoGets migration health information for an express route circuit cross connectionread- and 14 more in this area
Express route circuits15
azure_networking.express_route_circuits.getGets information about the specified express route circuitreadazure_networking.express_route_circuits.get_peering_statsGets all stats from an express route circuit in a resource groupread- and 13 more in this area
Network virtual appliances13
azure_networking.network_virtual_appliances.getGets the specified Network Virtual Appliancereadazure_networking.network_virtual_appliances.get_boot_diagnostic_logsRetrieves the boot diagnostic logs for a VM instance belonging to the specified Network Virtual Applianceread- and 11 more in this area
Private link services13
azure_networking.private_link_services.listGets all private link services in a resource groupreadazure_networking.private_link_services.list_auto_approved_private_link_servicesReturns all of the private link service ids that can be linked to a Private Endpoint with auto approved in this subscription in this regionread- and 11 more in this area
Bastion hosts12
azure_networking.bastion_hosts.disconnect_active_sessionsReturns the list of currently active sessions on the Bastiondestructiveazure_networking.bastion_hosts.getGets the specified Bastion Hostread- and 10 more in this area
Express route gateways12
azure_networking.express_route_gateways.getFetches the details of an ExpressRoute gateway in a resource groupreadazure_networking.express_route_gateways.get_failover_all_tests_detailsRetrieves the details of all the failover tests performed on the ExpressRoute gateway for different peering locationsread- and 10 more in this area
Public ip addresses12
azure_networking.public_ip_addresses.deleteDeletes the specified public IP addressdestructiveazure_networking.public_ip_addresses.getGets the specified public IP address in a specified resource groupread- and 10 more in this area
Virtual network gateway connections12
azure_networking.virtual_network_gateway_connections.deleteDeletes the specified virtual network Gateway connectiondestructiveazure_networking.virtual_network_gateway_connections.getGets the specified virtual network gateway connection by resource groupread- and 10 more in this area
Virtual networks12
azure_networking.virtual_networks.deleteDeletes the specified virtual networkdestructiveazure_networking.virtual_networks.getGets the specified virtual network by resource groupread- and 10 more in this area
Express route lags11
azure_networking.express_route_lags.links_listRetrieve the ExpressRouteLagLink sub-resources of the specified ExpressRouteLag resourcereadazure_networking.express_route_lags.listList all the ExpressRouteLag resources in the specified subscriptionread- and 9 more in this area
Network interfaces11
azure_networking.network_interfaces.listGets all network interfaces in a resource groupreadazure_networking.network_interfaces.list_allGets all network interfaces in a subscriptionread- and 9 more in this area
P2S VPN gateways11
azure_networking.p2s_vpn_gateways.generate_vpn_profileGenerates VPN profile for P2S client of the P2SVpnGateway in the specified resource groupwriteazure_networking.p2s_vpn_gateways.getRetrieves the details of a virtual wan p2s vpn gatewayread- and 9 more in this area
Service gateways10
azure_networking.service_gateways.get_address_locationsGet address locations in service gatewayreadazure_networking.service_gateways.get_servicesGet Services in service gatewayread- and 8 more in this area
Azure firewalls9
azure_networking.azure_firewalls.getGets the specified Azure Firewallreadazure_networking.azure_firewalls.listLists all Azure Firewalls in a resource groupread- and 7 more in this area
Load balancers9
azure_networking.load_balancers.deleteDeletes the specified load balancerdestructiveazure_networking.load_balancers.getGets the specified load balancerread- and 7 more in this area
Virtual hubs9
azure_networking.virtual_hubs.getRetrieves the details of a VirtualHubreadazure_networking.virtual_hubs.get_effective_virtual_hub_routesGets the effective routes configured for the Virtual Hub resource or the specified resource read- and 7 more in this area
VPN gateways9
azure_networking.vpn_gateways.getRetrieves the details of a virtual wan vpn gatewayreadazure_networking.vpn_gateways.listLists all the VpnGateways in a subscriptionread- and 7 more in this area
Network managers8
azure_networking.network_managers.getGets the specified Network Managerreadazure_networking.network_managers.listList network managers in a resource groupread- and 6 more in this area
Virtual wans8
azure_networking.virtual_wans.getRetrieves the details of a VirtualWANreadazure_networking.virtual_wans.listLists all the VirtualWANs in a subscriptionread- and 6 more in this area
Express route ports7
azure_networking.express_route_ports.generate_loaGenerate a letter of authorization for the requested ExpressRoutePort resourcewriteazure_networking.express_route_ports.getRetrieves the requested ExpressRoutePort resourceread- and 5 more in this area
Interconnect groups7
azure_networking.interconnect_groups.getGets information about the specified interconnect groupreadazure_networking.interconnect_groups.get_node_availabilityGets node availability for all subgroups in the specified interconnect groupread- and 5 more in this area
Ipam pools7
azure_networking.ipam_pools.getGets the specific Pool resourcereadazure_networking.ipam_pools.get_pool_usageGet the Pool Usageread- and 5 more in this area
VPN link connections7
azure_networking.vpn_link_connections.get_all_shared_keysLists all shared keys of VpnLink connection specifiedreadazure_networking.vpn_link_connections.get_default_shared_keyGets the shared key of VpnLink connection specifiedread- and 5 more in this area
VPN server configurations7
azure_networking.vpn_server_configurations.getRetrieves the details of a VpnServerConfigurationreadazure_networking.vpn_server_configurations.listLists all the VpnServerConfigurations in a subscriptionread- and 5 more in this area
Application security groups6
azure_networking.application_security_groups.getGets information about the specified application security groupreadazure_networking.application_security_groups.listGets all the application security groups in a resource groupread- and 4 more in this area
Authentication policies6
azure_networking.authentication_policies.getRetrieve the authentication policy with specified name within a resource groupreadazure_networking.authentication_policies.listLists all of the authentication policies within a resource groupread- and 4 more in this area
Connection monitors6
azure_networking.connection_monitors.getGets a connection monitor by namereadazure_networking.connection_monitors.listLists all connection monitors for the specified Network Watcherread- and 4 more in this area
Custom ip prefixes 6Ddos custom policies 6Ddos protection plans 6Firewall policies 6First party service tags 6Ip allocations 6Ip groups 6Nat gateways 6Network profiles 6Network security groups 6Network security perimeters 6Packet captures 6Public ip prefixes 6Route filters 6Route tables 6Security partner providers 6Service endpoint policies 6Subnets 6Virtual network appliances 6Virtual network taps 6VPN connections 6VPN sites 6DSCP configuration 5Express route circuit authorizations 5Express route lag authorizations 5Express route port authorizations 5Flow logs 5Local network gateways 5Network security perimeter access rules 5Network security perimeter associations 5Private endpoints 5Verifier workspaces 5Virtual routers 5Web application firewall policies 5Address prefix sets 4Admin rule collections 4Admin rules 4Application gateway private endpoint connections 4Commits 4Configuration policy groups 4Connection policies 4Connectivity configurations 4Express route circuit connections 4Express route circuit peerings 4Express route connections 4Express route cross connection peerings 4Firewall policy idps signatures overrides 4Firewall policy kube selector groups 4Firewall policy rule collection groups 4Hub route tables 4Hub virtual network connections 4Inbound nat rules 4Load balancer backend address pools 4Management group network manager connections 4Nat rules 4Network groups 4Network interface tap configurations 4Network manager routing configurations 4Network security perimeter links 4Network security perimeter logging configurations 4Network security perimeter profiles 4Network virtual appliance connections 4Private DNS zone groups 4Reachability analysis intents 4Reachability analysis runs 4Route filter rules 4Route maps 4Routes 4Routing intent 4Routing rule collections 4Routing rules 4Scope connections 4Security admin configurations 4Security rules 4Security user configurations 4Security user rule collections 4Security user rules 4Service endpoint policy definitions 4Static cidrs 4Static members 4Subscription network manager connections 4Virtual appliance sites 4Virtual hub ip configuration 4Virtual hub route table V2S 4Virtual network appliance capabilities 4Virtual network gateway nat rules 4Virtual network peerings 4Virtual router peerings 4Firewall policy drafts 354 smaller areas 82
This index shows a sample of each area. All 833 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.
Questions
The Azure Networking MCP server, answered.
Is there an Azure Networking MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 833 Azure Networking actions across virtual network gateways, network watchers, application gateways and express route cross connections, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Azure Networking.
What do I need to connect Azure Networking?
Entra application (client) id of a service principal with an Azure RBAC role on the subscription and Entra client secret. Plus your tenant id. The free call account { op: "connections.requirements", service: "azure_networking" } lists exactly what to paste.
Can an AI agent delete or change things in Azure Networking?
Only if its key allows it, and only with an explicit confirmation. 168 Azure Networking actions are destructive, including deletes the specified virtual network, deletes the specified public IP address and deletes the specified subnet. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Azure Networking API limit?
actionlake paces every call to the limits in the Azure Networking service file: 200 calls a minute per connection. Repeated reads are answered from cache (376 Azure Networking actions can be), which never reaches Azure Networking.
What does an Azure Networking action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (214 Azure Networking actions page). Cache hits, searches, dry runs and calls Azure Networking refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Azure Networking API does it cover?
The Azure Networking (virtual networks, subnets, NSGs, public IPs, load balancers, gateways, firewalls) API Azure Resource Manager Microsoft.Network 2026-03-01 at management.azure.com. It is built from Azure Networking's documentation as read on 23 October 2026. 833 actions in 173 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Azure Networking data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Azure Networking credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Azure Networking today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.