Skip to content
actionlake
Start free

Connectors · MSP & PSA

Azure RBAC (Authorization) MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Azure RBAC (Authorization) and the rest of your systems. It gives your agent 140 Azure RBAC (Authorization) actions (87 reads, 23 writes and 30 that wait for a confirmation) and holds the Azure RBAC (Authorization) credential itself, so the agent never does. It paces Azure RBAC (Authorization)'s limits and records every call.

Connect Azure RBAC (Authorization) freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "azure_rbac.access_review_schedule_definitions.list_assigned_for_my_approval",  intent: "check which Azure RBAC (Authorization) account is connected"}# Get access review instances assigned for my approval · read · 1 upstream call
  • 140actionsin one signed file
  • 87readlook, never change
  • 23writecreate and update
  • 30wait for a yesdestructive, confirmed first

Set up

Connect Azure RBAC (Authorization) in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect Azure RBAC (Authorization).

    OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.

    • client_idEntra application (client) id of a service principal with an Azure RBAC role (Reader to audit, User Access…
    • client_secretEntra client secret
    • tenant_idYour Azure RBAC (Authorization) tenant id
    account { op: "connections.requirements", service: "azure_rbac" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "azure_rbac.access_review_schedule_definitions.list_assigned_for_my_approval" }# get access review instances assigned for my approval · read · 1 upstream callcheck { action: "azure_rbac.role_definitions.delete", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Azure RBAC (Authorization) at a glance

Sign-in
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
You provide
client_idclient_secret
Setup fields
tenant_id
Limits we pace to
200 calls a minute, per connection
API covered
Azure RBAC (role assignments, role definitions, deny assignments, PIM, access reviews, locks) API Azure Resource Manager Microsoft.Authorization: authorization-RoleAssignmentsCalls.json (2022-04-01), authorization-RoleDefinitionsCalls.json (2022-04-01), authorization-DenyAssignmentCalls.json (2022-04-01), authorization-ProviderOperationsCalls.json (2022-04-01), EligibleChildResources.json (2020-10-01), RoleAssignmentSchedule.json (2020-10-01), RoleAssignmentScheduleInstance.json (2020-10-01), RoleAssignmentScheduleRequest.json (2020-10-01), RoleEligibilitySchedule.json (2020-10-01), RoleEligibilityScheduleInstance.json (2020-10-01), RoleEligibilityScheduleRequest.json (2020-10-01), RoleManagementPolicy.json (2020-10-01), RoleManagementPolicyAssignment.json (2020-10-01), ClassicAdmin.json (2015-07-01), authorization-AccessReviewCalls.json (2021-12-01-preview), RoleManagementAlerts.json (2022-08-01-preview), locks.json (2020-05-01)management.azure.com
Built from
Azure RBAC (Authorization)'s documentation, read 23 October 2026GitHublearn.microsoft.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
83 of 87 reads, for up to 5 minutes; a write clears what it affects
Shared entities
2, so ask can line Azure RBAC (Authorization) up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Azure RBAC (Authorization).

140 actions in 33 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 87readlook, never change
  • 23writecreate and update
  • 30destructivewait for a confirmation

  1. Access review instances

    18

    6 read · 6 write · 6 destructive

    Get access review instances · Get access review instances assigned for my approval · Get access review instances · Get access review instances

  2. Locks

    16

    8 read · 4 write · 4 destructive

    Gets all the management locks for a scope · Gets all the management locks for a resource group · Gets all the management locks for a resource or any level below resource · Gets all the management locks for a subscription

  3. Access review schedule definitions

    11

    5 read · 2 write · 4 destructive

    Get access review schedule definitions · Get single access review definition · Delete access review schedule definition · Get access review instances assigned for my approval

  4. Role assignments

    10

    6 read · 0 write · 4 destructive

    List all role assignments that apply to a scope · Get a role assignment by scope and name · List all role assignments that apply to a resource · List all role assignments that apply to a resource group

  5. Access review history definitions

    8

    4 read · 2 write · 2 destructive

    Lists the accessReviewHistoryDefinitions available from this provider, definition instances are only available for 30 days after creation · Lists the accessReviewHistoryDefinitions available from this provider, definition instances are only available for 30 days after creation · Get access review history definition by definition Id · Get access review history definition by definition Id

  6. Deny assignments

    6

    6 read · 0 write · 0 destructive

    Gets all deny assignments for the subscription · Gets deny assignments for a resource · Gets deny assignments for a resource group · Gets deny assignments for a scope

  7. Alerts

    5

    2 read · 3 write · 0 destructive

    Gets alerts for a resource scope · Get the specified alert · Refresh an alert · Refresh all alerts for a resource scope

  8. Role assignment schedule requests

    5

    3 read · 0 write · 2 destructive

    Gets role assignment schedule requests for a scope · Get the specified role assignment schedule request · Validates a new role assignment schedule request · Creates a role assignment schedule request

25 more areas · 61 actions
  • Role definitions 5
  • Role eligibility schedule requests 5
  • Access review default settings 4
  • Access review history definition instances 4
  • Role management policies 4
  • Role management policy assignments 4
  • Access review contacted reviewers 3
  • Access review my decisions 3
  • Alert configurations 3
  • Alert incidents 3
  • Access review decisions 2
  • Alert definitions 2
  • Permissions 2
  • Provider operations 2
  • Role assignment schedule instances 2
  • Role assignment schedules 2
  • Role eligibility schedule instances 2
  • Role eligibility schedules 2
  • Alert operations 1
  • Classic administrators 1
  • Eligible child resources 1
  • Global administrator 1
  • Operations 1
  • Resource groups 1
  • Subscriptions 1

Top actions

The Azure RBAC (Authorization) API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 11 of Azure RBAC (Authorization)'s 12 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
azure_rbac.role_definitions.listGet all role definitions that are applicable at scope and aboveGet all role definitions that are applicable at scope and above.readidentity.role.list184 connectors
azure_rbac.role_assignments.list_for_scopeList all role assignments that apply to a scopeList all role assignments that apply to a scope.readidentity.role_assignment.list41 connectors
azure_rbac.role_definitions.getGet role definition by name (GUID)Get role definition by name (GUID).readidentity.role.get127 connectors
azure_rbac.role_assignments.getGet a role assignment by scope and nameGet a role assignment by scope and name.readidentity.role_assignment.get18 connectors
azure_rbac.role_definitions.deleteDeletes a role definitionDeletes a role definition.destructiveidentity.role.delete106 connectors
azure_rbac.permissions.list_for_resource_groupGets all permissions the caller has for a resource groupGets all permissions the caller has for a resource group.readidentity.permission.list33 connectors
azure_rbac.access_review_schedule_definitions.listGet access review schedule definitionsGet access review schedule definitions.readidentity.access_review.list5 connectors
azure_rbac.resource_groups.listList the resource groups in a subscriptionList the resource groups in a subscription.readinfra.resource_group.list19 connectors
azure_rbac.access_review_schedule_definitions.get_by_idGet single access review definitionGet single access review definition.readidentity.access_review.get5 connectors
azure_rbac.role_definitions.create_or_updateCreates or updates a role definitionCreates or updates a role definition.writeidentity.role.upsert2 connectors
azure_rbac.access_review_schedule_definitions.create_or_update_by_idCreate or Update access review schedule definitionCreate or Update access review schedule definition.writethis connector
azure_rbac.access_review_history_definitions.createCreate a scheduled or one-time Access Review History DefinitionCreate a scheduled or one-time Access Review History Definition.writethis connector

Try it

Prompts to paste into Claude.

Each one names the Azure RBAC (Authorization) actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Get access review instances assigned for my approval in Azure RBAC (Authorization) and tell me what stands out.

    callsazure_rbac.access_review_schedule_definitions.list_assigned_for_my_approval

  2. Writewrite

    Creates or updates a role definition in Azure RBAC (Authorization). Show me exactly what you will send before you save it.

    callsazure_rbac.role_definitions.create_or_update

Governance for Azure RBAC (Authorization)

Destructive actions wait for a yes.

30 Azure RBAC (Authorization) actions are destructive. These are all of them:

  • Deletes a role definitionazure_rbac.role_definitions.delete
  • Delete access review schedule definitionazure_rbac.access_review_schedule_definitions.delete_by_id
  • Delete a management lock by scopeazure_rbac.locks.delete_by_scope
  • Create or update a role assignment by scope and nameazure_rbac.role_assignments.create
  • Delete a role assignment by scope and nameazure_rbac.role_assignments.delete
  • Remediate an alert incidentazure_rbac.alert_incidents.remediate
  • Create or update a role assignment by IDazure_rbac.role_assignments.create_by_id
  • Delete a role assignment by IDazure_rbac.role_assignments.delete_by_id
  • Deletes the management lock of a resource or any level below the resourceazure_rbac.locks.delete_at_resource_level
  • Delete a role management policyazure_rbac.role_management_policies.delete
  • Deletes the management lock at the subscription levelazure_rbac.locks.delete_at_subscription_level
  • Elevates access for a Global Administratorazure_rbac.global_administrator.elevate_access
  • Deletes a management lock at the resource group levelazure_rbac.locks.delete_at_resource_group_level
  • An action to apply all decisions for an access review instanceazure_rbac.access_review_instances.apply_decisions
  • An action to reset all decisions for an access review instanceazure_rbac.access_review_instances.reset_decisions
  • Creates a role assignment schedule requestazure_rbac.role_assignment_schedule_requests.create
  • Creates a role eligibility schedule requestazure_rbac.role_eligibility_schedule_requests.create
  • Create a role management policy assignmentazure_rbac.role_management_policy_assignments.create
  • Delete a role management policy assignmentazure_rbac.role_management_policy_assignments.delete
  • Delete an access review history definitionazure_rbac.access_review_history_definitions.delete_by_id
  • An action to apply all decisions for an access review instanceazure_rbac.access_review_instances.apply_decisions_at_scope
  • An action to reset all decisions for an access review instanceazure_rbac.access_review_instances.reset_decisions_at_scope
  • Delete an access review history definitionazure_rbac.access_review_history_definitions.delete_by_id_at_scope
  • Delete access review schedule definitionazure_rbac.access_review_schedule_definitions.delete_by_id_at_scope
  • An action to stop an access review instanceazure_rbac.access_review_instances.stop
  • An action to stop an access review instanceazure_rbac.access_review_instances.stop_at_scope
  • Stop access review definitionazure_rbac.access_review_schedule_definitions.stop
  • Cancels a pending role assignment schedule requestazure_rbac.role_assignment_schedule_requests.cancel
  • Cancels a pending role eligibility schedule requestazure_rbac.role_eligibility_schedule_requests.cancel
  • Stop access review definitionazure_rbac.access_review_schedule_definitions.stop_at_scope

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

doazure_rbac.role_definitions.deleteconfirm_policy: human

Deletes a role definition?

intent: the user asked me to deletes a role definition

run suspended · waiting for a named person · key azure-rbac-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "azure-rbac-agent",  allowed_actions: ["azure_rbac.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "azure_rbac.role_definitions.delete", approver: "[email protected]" },    { match: "azure_rbac.access_review_schedule_definitions.delete_by_id", approver: "[email protected]" },    { match: "azure_rbac.locks.delete_by_scope", approver: "[email protected]" }  ]}
Illustrative. Scoped to Azure RBAC (Authorization) only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Azure RBAC (Authorization) costs on actionlake.

Every Azure RBAC (Authorization) action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Azure RBAC (Authorization) refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 140 Azure RBAC (Authorization) actions
  • 49actions pageeach page of a long list is one call
  • 83reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Azure RBAC (Authorization) action.

140 actions by area: the id your agent calls, what it does, and its effect.

Access review instances18
  • azure_rbac.access_review_instances.accept_recommendationsAn action to accept recommendations for decision in an access review instancewrite
  • azure_rbac.access_review_instances.apply_decisionsAn action to apply all decisions for an access review instancedestructive
  • azure_rbac.access_review_instances.apply_decisions_at_scopeAn action to apply all decisions for an access review instancedestructive
  • azure_rbac.access_review_instances.createUpdate access review instancewrite
  • azure_rbac.access_review_instances.create_at_scopeUpdate access review instancewrite
  • azure_rbac.access_review_instances.get_by_idGet access review instancesread
  • azure_rbac.access_review_instances.get_by_id_assigned_for_my_approvalGet single access review instance assigned for my approvalread
  • azure_rbac.access_review_instances.get_by_id_at_scopeGet access review instancesread
  • azure_rbac.access_review_instances.listGet access review instancesread
  • azure_rbac.access_review_instances.list_assigned_for_my_approvalGet access review instances assigned for my approvalread
  • azure_rbac.access_review_instances.list_at_scopeGet access review instancesread
  • azure_rbac.access_review_instances.record_all_decisions_at_scopeAn action to approve/deny all decisions for a review with certain filterswrite
  • azure_rbac.access_review_instances.reset_decisionsAn action to reset all decisions for an access review instancedestructive
  • azure_rbac.access_review_instances.reset_decisions_at_scopeAn action to reset all decisions for an access review instancedestructive
  • azure_rbac.access_review_instances.send_remindersAn action to send reminders for an access review instancewrite
  • azure_rbac.access_review_instances.send_reminders_at_scopeAn action to send reminders for an access review instancewrite
  • azure_rbac.access_review_instances.stopAn action to stop an access review instancedestructive
  • azure_rbac.access_review_instances.stop_at_scopeAn action to stop an access review instancedestructive
Locks16
  • azure_rbac.locks.create_or_update_at_resource_group_levelCreates or updates a management lock at the resource group levelwrite
  • azure_rbac.locks.create_or_update_at_resource_levelCreates or updates a management lock at the resource level or any level below the resourcewrite
  • azure_rbac.locks.create_or_update_at_subscription_levelCreates or updates a management lock at the subscription levelwrite
  • azure_rbac.locks.create_or_update_by_scopeCreate or update a management lock by scopewrite
  • azure_rbac.locks.delete_at_resource_group_levelDeletes a management lock at the resource group leveldestructive
  • azure_rbac.locks.delete_at_resource_levelDeletes the management lock of a resource or any level below the resourcedestructive
  • azure_rbac.locks.delete_at_subscription_levelDeletes the management lock at the subscription leveldestructive
  • azure_rbac.locks.delete_by_scopeDelete a management lock by scopedestructive
  • azure_rbac.locks.get_at_resource_group_levelGets a management lock at the resource group levelread
  • azure_rbac.locks.get_at_resource_levelGet the management lock of a resource or any level below resourceread
  • azure_rbac.locks.get_at_subscription_levelGets a management lock at the subscription levelread
  • azure_rbac.locks.get_by_scopeGet a management lock by scoperead
  • azure_rbac.locks.listGets all the management locks for a scoperead
  • azure_rbac.locks.list_at_resource_group_levelGets all the management locks for a resource groupread
  • azure_rbac.locks.list_at_resource_levelGets all the management locks for a resource or any level below resourceread
  • azure_rbac.locks.list_at_subscription_levelGets all the management locks for a subscriptionread
Access review schedule definitions11
  • azure_rbac.access_review_schedule_definitions.create_or_update_by_idCreate or Update access review schedule definitionwrite
  • azure_rbac.access_review_schedule_definitions.create_or_update_by_id_at_scopeCreate or Update access review schedule definitionwrite
  • azure_rbac.access_review_schedule_definitions.delete_by_idDelete access review schedule definitiondestructive
  • azure_rbac.access_review_schedule_definitions.delete_by_id_at_scopeDelete access review schedule definitiondestructive
  • azure_rbac.access_review_schedule_definitions.get_by_idGet single access review definitionread
  • azure_rbac.access_review_schedule_definitions.get_by_id_at_scopeGet single access review definitionread
  • azure_rbac.access_review_schedule_definitions.listGet access review schedule definitionsread
  • azure_rbac.access_review_schedule_definitions.list_assigned_for_my_approvalGet access review instances assigned for my approvalread
  • azure_rbac.access_review_schedule_definitions.list_at_scopeGet access review schedule definitionsread
  • azure_rbac.access_review_schedule_definitions.stopStop access review definitiondestructive
  • azure_rbac.access_review_schedule_definitions.stop_at_scopeStop access review definitiondestructive
Role assignments10
  • azure_rbac.role_assignments.createCreate or update a role assignment by scope and namedestructive
  • azure_rbac.role_assignments.create_by_idCreate or update a role assignment by IDdestructive
  • azure_rbac.role_assignments.deleteDelete a role assignment by scope and namedestructive
  • azure_rbac.role_assignments.delete_by_idDelete a role assignment by IDdestructive
  • azure_rbac.role_assignments.getGet a role assignment by scope and nameread
  • azure_rbac.role_assignments.get_by_idGet a role assignment by IDread
  • azure_rbac.role_assignments.list_for_resourceList all role assignments that apply to a resourceread
  • azure_rbac.role_assignments.list_for_resource_groupList all role assignments that apply to a resource groupread
  • azure_rbac.role_assignments.list_for_scopeList all role assignments that apply to a scoperead
  • azure_rbac.role_assignments.list_for_subscriptionList all role assignments that apply to a subscriptionread
Access review history definitions8
  • azure_rbac.access_review_history_definitions.createCreate a scheduled or one-time Access Review History Definitionwrite
  • azure_rbac.access_review_history_definitions.create_at_scopeCreate a scheduled or one-time Access Review History Definitionwrite
  • azure_rbac.access_review_history_definitions.delete_by_idDelete an access review history definitiondestructive
  • azure_rbac.access_review_history_definitions.delete_by_id_at_scopeDelete an access review history definitiondestructive
  • azure_rbac.access_review_history_definitions.get_by_idGet access review history definition by definition Idread
  • azure_rbac.access_review_history_definitions.get_by_id_at_scopeGet access review history definition by definition Idread
  • azure_rbac.access_review_history_definitions.listLists the accessReviewHistoryDefinitions available from this provider, definition instances are only available for 30 days after creationread
  • azure_rbac.access_review_history_definitions.list_at_scopeLists the accessReviewHistoryDefinitions available from this provider, definition instances are only available for 30 days after creationread
Deny assignments6
  • azure_rbac.deny_assignments.getGet the specified deny assignmentread
  • azure_rbac.deny_assignments.get_by_idGets a deny assignment by IDread
  • azure_rbac.deny_assignments.listGets all deny assignments for the subscriptionread
  • azure_rbac.deny_assignments.list_for_resourceGets deny assignments for a resourceread
  • azure_rbac.deny_assignments.list_for_resource_groupGets deny assignments for a resource groupread
  • azure_rbac.deny_assignments.list_for_scopeGets deny assignments for a scoperead
Alerts5
  • azure_rbac.alerts.getGet the specified alertread
  • azure_rbac.alerts.list_for_scopeGets alerts for a resource scoperead
  • azure_rbac.alerts.refreshRefresh an alertwrite
  • azure_rbac.alerts.refresh_allRefresh all alerts for a resource scopewrite
  • azure_rbac.alerts.updateUpdate an alertwrite
Role assignment schedule requests5
  • azure_rbac.role_assignment_schedule_requests.cancelCancels a pending role assignment schedule requestdestructive
  • azure_rbac.role_assignment_schedule_requests.createCreates a role assignment schedule requestdestructive
  • azure_rbac.role_assignment_schedule_requests.getGet the specified role assignment schedule requestread
  • azure_rbac.role_assignment_schedule_requests.list_for_scopeGets role assignment schedule requests for a scoperead
  • azure_rbac.role_assignment_schedule_requests.validateValidates a new role assignment schedule requestread
Role definitions5
  • azure_rbac.role_definitions.create_or_updateCreates or updates a role definitionwrite
  • azure_rbac.role_definitions.deleteDeletes a role definitiondestructive
  • azure_rbac.role_definitions.getGet role definition by name (GUID)read
  • azure_rbac.role_definitions.get_by_idGets a role definition by IDread
  • azure_rbac.role_definitions.listGet all role definitions that are applicable at scope and aboveread
Role eligibility schedule requests5
  • azure_rbac.role_eligibility_schedule_requests.cancelCancels a pending role eligibility schedule requestdestructive
  • azure_rbac.role_eligibility_schedule_requests.createCreates a role eligibility schedule requestdestructive
  • azure_rbac.role_eligibility_schedule_requests.getGet the specified role eligibility schedule requestread
  • azure_rbac.role_eligibility_schedule_requests.list_for_scopeGets role eligibility schedule requests for a scoperead
  • azure_rbac.role_eligibility_schedule_requests.validateValidates a new role eligibility schedule requestread
Access review default settings4
  • azure_rbac.access_review_default_settings.getGet access review default settings for the subscriptionread
  • azure_rbac.access_review_default_settings.get_at_scopeGet access review default settings for the subscriptionread
  • azure_rbac.access_review_default_settings.putGet access review default settings for the subscriptionwrite
  • azure_rbac.access_review_default_settings.put_at_scopeGet access review default settings for the subscriptionwrite
Access review history definition instances4
  • azure_rbac.access_review_history_definition_instances.generate_download_uriGenerates a uri which can be used to retrieve review history dataread
  • azure_rbac.access_review_history_definition_instances.generate_download_uri_at_scopeGenerates a uri which can be used to retrieve review history dataread
  • azure_rbac.access_review_history_definition_instances.listGet access review history definition instances by definition Idread
  • azure_rbac.access_review_history_definition_instances.list_at_scopeGet access review history definition instances by definition Idread
Role management policies4
  • azure_rbac.role_management_policies.deleteDelete a role management policydestructive
  • azure_rbac.role_management_policies.getGet the specified role management policy for a resource scoperead
  • azure_rbac.role_management_policies.list_for_scopeGets role management policies for a resource scoperead
  • azure_rbac.role_management_policies.updateUpdate a role management policywrite
Role management policy assignments4
  • azure_rbac.role_management_policy_assignments.createCreate a role management policy assignmentdestructive
  • azure_rbac.role_management_policy_assignments.deleteDelete a role management policy assignmentdestructive
  • azure_rbac.role_management_policy_assignments.getGet the specified role management policy assignment for a resource scoperead
  • azure_rbac.role_management_policy_assignments.list_for_scopeGets role management assignment policies for a resource scoperead
Access review contacted reviewers3
  • azure_rbac.access_review_contacted_reviewers.listGet access review instance contacted reviewersread
  • azure_rbac.access_review_contacted_reviewers.list_at_scopeGet access review instance contacted reviewersread
  • azure_rbac.access_review_contacted_reviewers.list_tenant_levelGet access review instance contacted reviewersread
Access review my decisions3
  • azure_rbac.access_review_my_decisions.get_by_idGet my single access review instance decisionread
  • azure_rbac.access_review_my_decisions.listGet my access review instance decisionsread
  • azure_rbac.access_review_my_decisions.patchRecord a decisionwrite
Alert configurations3
  • azure_rbac.alert_configurations.getGet the specified alert configurationread
  • azure_rbac.alert_configurations.list_for_scopeGets alert configurations for a resource scoperead
  • azure_rbac.alert_configurations.updateUpdate an alert configurationwrite
Alert incidents3
  • azure_rbac.alert_incidents.getGet the specified alert incidentread
  • azure_rbac.alert_incidents.list_for_scopeGets alert incidents for a resource scoperead
  • azure_rbac.alert_incidents.remediateRemediate an alert incidentdestructive
Access review decisions2
  • azure_rbac.access_review_decisions.listGet access review instance decisionsread
  • azure_rbac.access_review_decisions.list_at_scopeGet access review instance decisionsread
Alert definitions2
  • azure_rbac.alert_definitions.getGet the specified alert definitionread
  • azure_rbac.alert_definitions.list_for_scopeGets alert definitions for a resource scoperead
Permissions2
  • azure_rbac.permissions.list_for_resourceGets all permissions the caller has for a resourceread
  • azure_rbac.permissions.list_for_resource_groupGets all permissions the caller has for a resource groupread
Provider operations2
  • azure_rbac.provider_operations.getGets provider operations metadata for the specified resource providerread
  • azure_rbac.provider_operations.listGets provider operations metadata for all resource providersread
Role assignment schedule instances2
  • azure_rbac.role_assignment_schedule_instances.getGets the specified role assignment schedule instanceread
  • azure_rbac.role_assignment_schedule_instances.list_for_scopeGets role assignment schedule instances of a role assignment scheduleread
Role assignment schedules2
  • azure_rbac.role_assignment_schedules.getGet the specified role assignment schedule for a resource scoperead
  • azure_rbac.role_assignment_schedules.list_for_scopeGets role assignment schedules for a resource scoperead
Role eligibility schedule instances2
  • azure_rbac.role_eligibility_schedule_instances.getGets the specified role eligibility schedule instanceread
  • azure_rbac.role_eligibility_schedule_instances.list_for_scopeGets role eligibility schedule instances of a role eligibility scheduleread
Role eligibility schedules2
  • azure_rbac.role_eligibility_schedules.getGet the specified role eligibility schedule for a resource scoperead
  • azure_rbac.role_eligibility_schedules.list_for_scopeGets role eligibility schedules for a resource scoperead
Alert operations1
  • azure_rbac.alert_operations.getGet the specified alert operationread
Classic administrators1
  • azure_rbac.classic_administrators.listGets service administrator, account administrator, and co-administrators for the subscriptionread
Eligible child resources1
  • azure_rbac.eligible_child_resources.listGet the child resources of a resource on which user has eligible accessread
Global administrator1
  • azure_rbac.global_administrator.elevate_accessElevates access for a Global Administratordestructive
Operations1
  • azure_rbac.operations.listLists all of the available Microsoft.Authorization REST API operationsread
Resource groups1
  • azure_rbac.resource_groups.listList the resource groups in a subscriptionread
Subscriptions1
  • azure_rbac.subscriptions.listList the subscriptions the credential can seeread

Questions

The Azure RBAC (Authorization) MCP server, answered.

Is there an Azure RBAC (Authorization) MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 140 Azure RBAC (Authorization) actions across access review instances, locks, access review schedule definitions and role assignments, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Azure RBAC (Authorization).

What do I need to connect Azure RBAC (Authorization)?

Entra application (client) id of a service principal with an Azure RBAC role (Reader to audit, User Access… and Entra client secret. Plus your tenant id. The free call account { op: "connections.requirements", service: "azure_rbac" } lists exactly what to paste.

Can an AI agent delete or change things in Azure RBAC (Authorization)?

Only if its key allows it, and only with an explicit confirmation. 30 Azure RBAC (Authorization) actions are destructive, including deletes a role definition, delete access review schedule definition and delete a management lock by scope. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Azure RBAC (Authorization) API limit?

actionlake paces every call to the limits in the Azure RBAC (Authorization) service file: 200 calls a minute per connection. Repeated reads are answered from cache (83 Azure RBAC (Authorization) actions can be), which never reaches Azure RBAC (Authorization).

What does an Azure RBAC (Authorization) action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (49 Azure RBAC (Authorization) actions page). Cache hits, searches, dry runs and calls Azure RBAC (Authorization) refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Azure RBAC (Authorization) API does it cover?

The Azure RBAC (role assignments, role definitions, deny assignments, PIM, access reviews, locks) API Azure Resource Manager Microsoft.Authorization: authorization-RoleAssignmentsCalls.json (2022-04-01), authorization-RoleDefinitionsCalls.json (2022-04-01), authorization-DenyAssignmentCalls.json (2022-04-01), authorization-ProviderOperationsCalls.json (2022-04-01), EligibleChildResources.json (2020-10-01), RoleAssignmentSchedule.json (2020-10-01), RoleAssignmentScheduleInstance.json (2020-10-01), RoleAssignmentScheduleRequest.json (2020-10-01), RoleEligibilitySchedule.json (2020-10-01), RoleEligibilityScheduleInstance.json (2020-10-01), RoleEligibilityScheduleRequest.json (2020-10-01), RoleManagementPolicy.json (2020-10-01), RoleManagementPolicyAssignment.json (2020-10-01), ClassicAdmin.json (2015-07-01), authorization-AccessReviewCalls.json (2021-12-01-preview), RoleManagementAlerts.json (2022-08-01-preview), locks.json (2020-05-01) at management.azure.com. It is built from Azure RBAC (Authorization)'s documentation as read on 23 October 2026. 140 actions in 33 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Azure RBAC (Authorization) data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Azure RBAC (Authorization) credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like Azure RBAC (Authorization)

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by Azure RBAC (Authorization); the name is the vendor's own. Counts are from the Azure RBAC (Authorization) service file, version 1.0.0.

Give your agent Azure RBAC (Authorization) today.

Connect Azure RBAC (Authorization) freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.