--- title: "Azure RBAC (Authorization) MCP server - actionlake" description: "Give Claude 140 Azure RBAC (Authorization) actions through one MCP server. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/azure-rbac-authorization updated: 2026-10-23 --- Connectors · MSP & PSA # Azure RBAC (Authorization) MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Azure RBAC (Authorization) and the rest of your systems. It gives your agent 140 Azure RBAC (Authorization) actions (87 reads, 23 writes and 30 that wait for a confirmation) and holds the Azure RBAC (Authorization) credential itself, so the agent never does. It paces Azure RBAC (Authorization)'s limits and records every call. [Connect Azure RBAC (Authorization) free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "azure_rbac.access_review_schedule_definitions.list_assigned_for_my_approval", intent: "check which Azure RBAC (Authorization) account is connected" } # Get access review instances assigned for my approval · read · 1 upstream call ``` - 140 actions in one signed file - 87 read look, never change - 23 write create and update - 30 wait for a yes destructive, confirmed first Set up ## Connect Azure RBAC (Authorization) in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Azure RBAC (Authorization). OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key. - `client_id` Entra application (client) id of a service principal with an Azure RBAC role (Reader to audit, User Access… - `client_secret` Entra client secret - `tenant_id` Your Azure RBAC (Authorization) tenant id ``` account { op: "connections.requirements", service: "azure_rbac" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "azure_rbac.access_review_schedule_definitions.list_assigned_for_my_approval" } # get access review instances assigned for my approval · read · 1 upstream call check { action: "azure_rbac.role_definitions.delete", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Azure RBAC (Authorization) at a glance **Sign-in** OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. **You provide** `client_id` `client_secret` **Setup fields** `tenant_id` **Limits we pace to** 200 calls a minute, per connection **API covered** Azure RBAC (role assignments, role definitions, deny assignments, PIM, access reviews, locks) API Azure Resource Manager Microsoft.Authorization: authorization-RoleAssignmentsCalls.json (2022-04-01), authorization-RoleDefinitionsCalls.json (2022-04-01), authorization-DenyAssignmentCalls.json (2022-04-01), authorization-ProviderOperationsCalls.json (2022-04-01), EligibleChildResources.json (2020-10-01), RoleAssignmentSchedule.json (2020-10-01), RoleAssignmentScheduleInstance.json (2020-10-01), RoleAssignmentScheduleRequest.json (2020-10-01), RoleEligibilitySchedule.json (2020-10-01), RoleEligibilityScheduleInstance.json (2020-10-01), RoleEligibilityScheduleRequest.json (2020-10-01), RoleManagementPolicy.json (2020-10-01), RoleManagementPolicyAssignment.json (2020-10-01), ClassicAdmin.json (2015-07-01), authorization-AccessReviewCalls.json (2021-12-01-preview), RoleManagementAlerts.json (2022-08-01-preview), locks.json (2020-05-01)`management.azure.com` **Built from** Azure RBAC (Authorization)'s documentation, read 23 October 2026[GitHub](https://github.com/Azure/azure-rest-api-specs/tree/main/specification/authorization/resource-manager/Microsoft.Authorization/Authorization/) [learn.microsoft.com](https://learn.microsoft.com/en-us/rest/api/authorization/) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 83 of 87 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 2, so ask can line Azure RBAC (Authorization) up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Azure RBAC (Authorization). 140 actions in 33 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **87** read look, never change - **23** write create and update - **30** destructive wait for a confirmation 1. ### Access review instances 18 6 read · 6 write · 6 destructive Get access review instances · Get access review instances assigned for my approval · Get access review instances · Get access review instances 2. ### Locks 16 8 read · 4 write · 4 destructive Gets all the management locks for a scope · Gets all the management locks for a resource group · Gets all the management locks for a resource or any level below resource · Gets all the management locks for a subscription 3. ### Access review schedule definitions 11 5 read · 2 write · 4 destructive Get access review schedule definitions · Get single access review definition · Delete access review schedule definition · Get access review instances assigned for my approval 4. ### Role assignments 10 6 read · 0 write · 4 destructive List all role assignments that apply to a scope · Get a role assignment by scope and name · List all role assignments that apply to a resource · List all role assignments that apply to a resource group 5. ### Access review history definitions 8 4 read · 2 write · 2 destructive Lists the accessReviewHistoryDefinitions available from this provider, definition instances are only available for 30 days after creation · Lists the accessReviewHistoryDefinitions available from this provider, definition instances are only available for 30 days after creation · Get access review history definition by definition Id · Get access review history definition by definition Id 6. ### Deny assignments 6 6 read · 0 write · 0 destructive Gets all deny assignments for the subscription · Gets deny assignments for a resource · Gets deny assignments for a resource group · Gets deny assignments for a scope 7. ### Alerts 5 2 read · 3 write · 0 destructive Gets alerts for a resource scope · Get the specified alert · Refresh an alert · Refresh all alerts for a resource scope 8. ### Role assignment schedule requests 5 3 read · 0 write · 2 destructive Gets role assignment schedule requests for a scope · Get the specified role assignment schedule request · Validates a new role assignment schedule request · Creates a role assignment schedule request **25 more areas · 61 actions** - Role definitions **5** - Role eligibility schedule requests **5** - Access review default settings **4** - Access review history definition instances **4** - Role management policies **4** - Role management policy assignments **4** - Access review contacted reviewers **3** - Access review my decisions **3** - Alert configurations **3** - Alert incidents **3** - Access review decisions **2** - Alert definitions **2** - Permissions **2** - Provider operations **2** - Role assignment schedule instances **2** - Role assignment schedules **2** - Role eligibility schedule instances **2** - Role eligibility schedules **2** - Alert operations **1** - Classic administrators **1** - Eligible child resources **1** - Global administrator **1** - Operations **1** - Resource groups **1** - Subscriptions **1** Top actions ## The Azure RBAC (Authorization) API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 11 of Azure RBAC (Authorization)'s 12 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `azure_rbac.role_definitions.list` Get all role definitions that are applicable at scope and above | Get all role definitions that are applicable at scope and above. | read | `identity.role.list` 184 connectors | | `azure_rbac.role_assignments.list_for_scope` List all role assignments that apply to a scope | List all role assignments that apply to a scope. | read | `identity.role_assignment.list` 41 connectors | | `azure_rbac.role_definitions.get` Get role definition by name (GUID) | Get role definition by name (GUID). | read | `identity.role.get` 127 connectors | | `azure_rbac.role_assignments.get` Get a role assignment by scope and name | Get a role assignment by scope and name. | read | `identity.role_assignment.get` 18 connectors | | `azure_rbac.role_definitions.delete` Deletes a role definition | Deletes a role definition. | destructive | `identity.role.delete` 106 connectors | | `azure_rbac.permissions.list_for_resource_group` Gets all permissions the caller has for a resource group | Gets all permissions the caller has for a resource group. | read | `identity.permission.list` 33 connectors | | `azure_rbac.access_review_schedule_definitions.list` Get access review schedule definitions | Get access review schedule definitions. | read | `identity.access_review.list` 5 connectors | | `azure_rbac.resource_groups.list` List the resource groups in a subscription | List the resource groups in a subscription. | read | `infra.resource_group.list` 19 connectors | | `azure_rbac.access_review_schedule_definitions.get_by_id` Get single access review definition | Get single access review definition. | read | `identity.access_review.get` 5 connectors | | `azure_rbac.role_definitions.create_or_update` Creates or updates a role definition | Creates or updates a role definition. | write | `identity.role.upsert` 2 connectors | | `azure_rbac.access_review_schedule_definitions.create_or_update_by_id` Create or Update access review schedule definition | Create or Update access review schedule definition. | write | this connector | | `azure_rbac.access_review_history_definitions.create` Create a scheduled or one-time Access Review History Definition | Create a scheduled or one-time Access Review History Definition. | write | this connector | Try it ## Prompts to paste into Claude. Each one names the Azure RBAC (Authorization) actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Get access review instances assigned for my approval in Azure RBAC (Authorization) and tell me what stands out. calls `azure_rbac.access_review_schedule_definitions.list_assigned_for_my_approval` 2. Write write Creates or updates a role definition in Azure RBAC (Authorization). Show me exactly what you will send before you save it. calls `azure_rbac.role_definitions.create_or_update` Governance for Azure RBAC (Authorization) ## Destructive actions wait for a yes. 30 Azure RBAC (Authorization) actions are destructive. These are all of them: - Deletes a role definition `azure_rbac.role_definitions.delete` - Delete access review schedule definition `azure_rbac.access_review_schedule_definitions.delete_by_id` - Delete a management lock by scope `azure_rbac.locks.delete_by_scope` - Create or update a role assignment by scope and name `azure_rbac.role_assignments.create` - Delete a role assignment by scope and name `azure_rbac.role_assignments.delete` - Remediate an alert incident `azure_rbac.alert_incidents.remediate` - Create or update a role assignment by ID `azure_rbac.role_assignments.create_by_id` - Delete a role assignment by ID `azure_rbac.role_assignments.delete_by_id` - Deletes the management lock of a resource or any level below the resource `azure_rbac.locks.delete_at_resource_level` - Delete a role management policy `azure_rbac.role_management_policies.delete` - Deletes the management lock at the subscription level `azure_rbac.locks.delete_at_subscription_level` - Elevates access for a Global Administrator `azure_rbac.global_administrator.elevate_access` - Deletes a management lock at the resource group level `azure_rbac.locks.delete_at_resource_group_level` - An action to apply all decisions for an access review instance `azure_rbac.access_review_instances.apply_decisions` - An action to reset all decisions for an access review instance `azure_rbac.access_review_instances.reset_decisions` - Creates a role assignment schedule request `azure_rbac.role_assignment_schedule_requests.create` - Creates a role eligibility schedule request `azure_rbac.role_eligibility_schedule_requests.create` - Create a role management policy assignment `azure_rbac.role_management_policy_assignments.create` - Delete a role management policy assignment `azure_rbac.role_management_policy_assignments.delete` - Delete an access review history definition `azure_rbac.access_review_history_definitions.delete_by_id` - An action to apply all decisions for an access review instance `azure_rbac.access_review_instances.apply_decisions_at_scope` - An action to reset all decisions for an access review instance `azure_rbac.access_review_instances.reset_decisions_at_scope` - Delete an access review history definition `azure_rbac.access_review_history_definitions.delete_by_id_at_scope` - Delete access review schedule definition `azure_rbac.access_review_schedule_definitions.delete_by_id_at_scope` - An action to stop an access review instance `azure_rbac.access_review_instances.stop` - An action to stop an access review instance `azure_rbac.access_review_instances.stop_at_scope` - Stop access review definition `azure_rbac.access_review_schedule_definitions.stop` - Cancels a pending role assignment schedule request `azure_rbac.role_assignment_schedule_requests.cancel` - Cancels a pending role eligibility schedule request `azure_rbac.role_eligibility_schedule_requests.cancel` - Stop access review definition `azure_rbac.access_review_schedule_definitions.stop_at_scope` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do azure_rbac.role_definitions.delete confirm_policy: **human** Deletes a role definition? **intent:** the user asked me to deletes a role definition run suspended · waiting for a named person · key _azure-rbac-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "azure-rbac-agent", allowed_actions: ["azure_rbac.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "azure_rbac.role_definitions.delete", approver: "lead@example.com" }, { match: "azure_rbac.access_review_schedule_definitions.delete_by_id", approver: "lead@example.com" }, { match: "azure_rbac.locks.delete_by_scope", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Azure RBAC (Authorization) only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Azure RBAC (Authorization) costs on actionlake. Every Azure RBAC (Authorization) action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Azure RBAC (Authorization) refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 140 Azure RBAC (Authorization) actions - 49 actions page each page of a long list is one call - 83 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Azure RBAC (Authorization) action. 140 actions by area: the id your agent calls, what it does, and its effect. **Access review instances 18** - `azure_rbac.access_review_instances.accept_recommendations` An action to accept recommendations for decision in an access review instance write - `azure_rbac.access_review_instances.apply_decisions` An action to apply all decisions for an access review instance destructive - `azure_rbac.access_review_instances.apply_decisions_at_scope` An action to apply all decisions for an access review instance destructive - `azure_rbac.access_review_instances.create` Update access review instance write - `azure_rbac.access_review_instances.create_at_scope` Update access review instance write - `azure_rbac.access_review_instances.get_by_id` Get access review instances read - `azure_rbac.access_review_instances.get_by_id_assigned_for_my_approval` Get single access review instance assigned for my approval read - `azure_rbac.access_review_instances.get_by_id_at_scope` Get access review instances read - `azure_rbac.access_review_instances.list` Get access review instances read - `azure_rbac.access_review_instances.list_assigned_for_my_approval` Get access review instances assigned for my approval read - `azure_rbac.access_review_instances.list_at_scope` Get access review instances read - `azure_rbac.access_review_instances.record_all_decisions_at_scope` An action to approve/deny all decisions for a review with certain filters write - `azure_rbac.access_review_instances.reset_decisions` An action to reset all decisions for an access review instance destructive - `azure_rbac.access_review_instances.reset_decisions_at_scope` An action to reset all decisions for an access review instance destructive - `azure_rbac.access_review_instances.send_reminders` An action to send reminders for an access review instance write - `azure_rbac.access_review_instances.send_reminders_at_scope` An action to send reminders for an access review instance write - `azure_rbac.access_review_instances.stop` An action to stop an access review instance destructive - `azure_rbac.access_review_instances.stop_at_scope` An action to stop an access review instance destructive **Locks 16** - `azure_rbac.locks.create_or_update_at_resource_group_level` Creates or updates a management lock at the resource group level write - `azure_rbac.locks.create_or_update_at_resource_level` Creates or updates a management lock at the resource level or any level below the resource write - `azure_rbac.locks.create_or_update_at_subscription_level` Creates or updates a management lock at the subscription level write - `azure_rbac.locks.create_or_update_by_scope` Create or update a management lock by scope write - `azure_rbac.locks.delete_at_resource_group_level` Deletes a management lock at the resource group level destructive - `azure_rbac.locks.delete_at_resource_level` Deletes the management lock of a resource or any level below the resource destructive - `azure_rbac.locks.delete_at_subscription_level` Deletes the management lock at the subscription level destructive - `azure_rbac.locks.delete_by_scope` Delete a management lock by scope destructive - `azure_rbac.locks.get_at_resource_group_level` Gets a management lock at the resource group level read - `azure_rbac.locks.get_at_resource_level` Get the management lock of a resource or any level below resource read - `azure_rbac.locks.get_at_subscription_level` Gets a management lock at the subscription level read - `azure_rbac.locks.get_by_scope` Get a management lock by scope read - `azure_rbac.locks.list` Gets all the management locks for a scope read - `azure_rbac.locks.list_at_resource_group_level` Gets all the management locks for a resource group read - `azure_rbac.locks.list_at_resource_level` Gets all the management locks for a resource or any level below resource read - `azure_rbac.locks.list_at_subscription_level` Gets all the management locks for a subscription read **Access review schedule definitions 11** - `azure_rbac.access_review_schedule_definitions.create_or_update_by_id` Create or Update access review schedule definition write - `azure_rbac.access_review_schedule_definitions.create_or_update_by_id_at_scope` Create or Update access review schedule definition write - `azure_rbac.access_review_schedule_definitions.delete_by_id` Delete access review schedule definition destructive - `azure_rbac.access_review_schedule_definitions.delete_by_id_at_scope` Delete access review schedule definition destructive - `azure_rbac.access_review_schedule_definitions.get_by_id` Get single access review definition read - `azure_rbac.access_review_schedule_definitions.get_by_id_at_scope` Get single access review definition read - `azure_rbac.access_review_schedule_definitions.list` Get access review schedule definitions read - `azure_rbac.access_review_schedule_definitions.list_assigned_for_my_approval` Get access review instances assigned for my approval read - `azure_rbac.access_review_schedule_definitions.list_at_scope` Get access review schedule definitions read - `azure_rbac.access_review_schedule_definitions.stop` Stop access review definition destructive - `azure_rbac.access_review_schedule_definitions.stop_at_scope` Stop access review definition destructive **Role assignments 10** - `azure_rbac.role_assignments.create` Create or update a role assignment by scope and name destructive - `azure_rbac.role_assignments.create_by_id` Create or update a role assignment by ID destructive - `azure_rbac.role_assignments.delete` Delete a role assignment by scope and name destructive - `azure_rbac.role_assignments.delete_by_id` Delete a role assignment by ID destructive - `azure_rbac.role_assignments.get` Get a role assignment by scope and name read - `azure_rbac.role_assignments.get_by_id` Get a role assignment by ID read - `azure_rbac.role_assignments.list_for_resource` List all role assignments that apply to a resource read - `azure_rbac.role_assignments.list_for_resource_group` List all role assignments that apply to a resource group read - `azure_rbac.role_assignments.list_for_scope` List all role assignments that apply to a scope read - `azure_rbac.role_assignments.list_for_subscription` List all role assignments that apply to a subscription read **Access review history definitions 8** - `azure_rbac.access_review_history_definitions.create` Create a scheduled or one-time Access Review History Definition write - `azure_rbac.access_review_history_definitions.create_at_scope` Create a scheduled or one-time Access Review History Definition write - `azure_rbac.access_review_history_definitions.delete_by_id` Delete an access review history definition destructive - `azure_rbac.access_review_history_definitions.delete_by_id_at_scope` Delete an access review history definition destructive - `azure_rbac.access_review_history_definitions.get_by_id` Get access review history definition by definition Id read - `azure_rbac.access_review_history_definitions.get_by_id_at_scope` Get access review history definition by definition Id read - `azure_rbac.access_review_history_definitions.list` Lists the accessReviewHistoryDefinitions available from this provider, definition instances are only available for 30 days after creation read - `azure_rbac.access_review_history_definitions.list_at_scope` Lists the accessReviewHistoryDefinitions available from this provider, definition instances are only available for 30 days after creation read **Deny assignments 6** - `azure_rbac.deny_assignments.get` Get the specified deny assignment read - `azure_rbac.deny_assignments.get_by_id` Gets a deny assignment by ID read - `azure_rbac.deny_assignments.list` Gets all deny assignments for the subscription read - `azure_rbac.deny_assignments.list_for_resource` Gets deny assignments for a resource read - `azure_rbac.deny_assignments.list_for_resource_group` Gets deny assignments for a resource group read - `azure_rbac.deny_assignments.list_for_scope` Gets deny assignments for a scope read **Alerts 5** - `azure_rbac.alerts.get` Get the specified alert read - `azure_rbac.alerts.list_for_scope` Gets alerts for a resource scope read - `azure_rbac.alerts.refresh` Refresh an alert write - `azure_rbac.alerts.refresh_all` Refresh all alerts for a resource scope write - `azure_rbac.alerts.update` Update an alert write **Role assignment schedule requests 5** - `azure_rbac.role_assignment_schedule_requests.cancel` Cancels a pending role assignment schedule request destructive - `azure_rbac.role_assignment_schedule_requests.create` Creates a role assignment schedule request destructive - `azure_rbac.role_assignment_schedule_requests.get` Get the specified role assignment schedule request read - `azure_rbac.role_assignment_schedule_requests.list_for_scope` Gets role assignment schedule requests for a scope read - `azure_rbac.role_assignment_schedule_requests.validate` Validates a new role assignment schedule request read **Role definitions 5** - `azure_rbac.role_definitions.create_or_update` Creates or updates a role definition write - `azure_rbac.role_definitions.delete` Deletes a role definition destructive - `azure_rbac.role_definitions.get` Get role definition by name (GUID) read - `azure_rbac.role_definitions.get_by_id` Gets a role definition by ID read - `azure_rbac.role_definitions.list` Get all role definitions that are applicable at scope and above read **Role eligibility schedule requests 5** - `azure_rbac.role_eligibility_schedule_requests.cancel` Cancels a pending role eligibility schedule request destructive - `azure_rbac.role_eligibility_schedule_requests.create` Creates a role eligibility schedule request destructive - `azure_rbac.role_eligibility_schedule_requests.get` Get the specified role eligibility schedule request read - `azure_rbac.role_eligibility_schedule_requests.list_for_scope` Gets role eligibility schedule requests for a scope read - `azure_rbac.role_eligibility_schedule_requests.validate` Validates a new role eligibility schedule request read **Access review default settings 4** - `azure_rbac.access_review_default_settings.get` Get access review default settings for the subscription read - `azure_rbac.access_review_default_settings.get_at_scope` Get access review default settings for the subscription read - `azure_rbac.access_review_default_settings.put` Get access review default settings for the subscription write - `azure_rbac.access_review_default_settings.put_at_scope` Get access review default settings for the subscription write **Access review history definition instances 4** - `azure_rbac.access_review_history_definition_instances.generate_download_uri` Generates a uri which can be used to retrieve review history data read - `azure_rbac.access_review_history_definition_instances.generate_download_uri_at_scope` Generates a uri which can be used to retrieve review history data read - `azure_rbac.access_review_history_definition_instances.list` Get access review history definition instances by definition Id read - `azure_rbac.access_review_history_definition_instances.list_at_scope` Get access review history definition instances by definition Id read **Role management policies 4** - `azure_rbac.role_management_policies.delete` Delete a role management policy destructive - `azure_rbac.role_management_policies.get` Get the specified role management policy for a resource scope read - `azure_rbac.role_management_policies.list_for_scope` Gets role management policies for a resource scope read - `azure_rbac.role_management_policies.update` Update a role management policy write **Role management policy assignments 4** - `azure_rbac.role_management_policy_assignments.create` Create a role management policy assignment destructive - `azure_rbac.role_management_policy_assignments.delete` Delete a role management policy assignment destructive - `azure_rbac.role_management_policy_assignments.get` Get the specified role management policy assignment for a resource scope read - `azure_rbac.role_management_policy_assignments.list_for_scope` Gets role management assignment policies for a resource scope read **Access review contacted reviewers 3** - `azure_rbac.access_review_contacted_reviewers.list` Get access review instance contacted reviewers read - `azure_rbac.access_review_contacted_reviewers.list_at_scope` Get access review instance contacted reviewers read - `azure_rbac.access_review_contacted_reviewers.list_tenant_level` Get access review instance contacted reviewers read **Access review my decisions 3** - `azure_rbac.access_review_my_decisions.get_by_id` Get my single access review instance decision read - `azure_rbac.access_review_my_decisions.list` Get my access review instance decisions read - `azure_rbac.access_review_my_decisions.patch` Record a decision write **Alert configurations 3** - `azure_rbac.alert_configurations.get` Get the specified alert configuration read - `azure_rbac.alert_configurations.list_for_scope` Gets alert configurations for a resource scope read - `azure_rbac.alert_configurations.update` Update an alert configuration write **Alert incidents 3** - `azure_rbac.alert_incidents.get` Get the specified alert incident read - `azure_rbac.alert_incidents.list_for_scope` Gets alert incidents for a resource scope read - `azure_rbac.alert_incidents.remediate` Remediate an alert incident destructive **Access review decisions 2** - `azure_rbac.access_review_decisions.list` Get access review instance decisions read - `azure_rbac.access_review_decisions.list_at_scope` Get access review instance decisions read **Alert definitions 2** - `azure_rbac.alert_definitions.get` Get the specified alert definition read - `azure_rbac.alert_definitions.list_for_scope` Gets alert definitions for a resource scope read **Permissions 2** - `azure_rbac.permissions.list_for_resource` Gets all permissions the caller has for a resource read - `azure_rbac.permissions.list_for_resource_group` Gets all permissions the caller has for a resource group read **Provider operations 2** - `azure_rbac.provider_operations.get` Gets provider operations metadata for the specified resource provider read - `azure_rbac.provider_operations.list` Gets provider operations metadata for all resource providers read **Role assignment schedule instances 2** - `azure_rbac.role_assignment_schedule_instances.get` Gets the specified role assignment schedule instance read - `azure_rbac.role_assignment_schedule_instances.list_for_scope` Gets role assignment schedule instances of a role assignment schedule read **Role assignment schedules 2** - `azure_rbac.role_assignment_schedules.get` Get the specified role assignment schedule for a resource scope read - `azure_rbac.role_assignment_schedules.list_for_scope` Gets role assignment schedules for a resource scope read **Role eligibility schedule instances 2** - `azure_rbac.role_eligibility_schedule_instances.get` Gets the specified role eligibility schedule instance read - `azure_rbac.role_eligibility_schedule_instances.list_for_scope` Gets role eligibility schedule instances of a role eligibility schedule read **Role eligibility schedules 2** - `azure_rbac.role_eligibility_schedules.get` Get the specified role eligibility schedule for a resource scope read - `azure_rbac.role_eligibility_schedules.list_for_scope` Gets role eligibility schedules for a resource scope read **Alert operations 1** - `azure_rbac.alert_operations.get` Get the specified alert operation read **Classic administrators 1** - `azure_rbac.classic_administrators.list` Gets service administrator, account administrator, and co-administrators for the subscription read **Eligible child resources 1** - `azure_rbac.eligible_child_resources.list` Get the child resources of a resource on which user has eligible access read **Global administrator 1** - `azure_rbac.global_administrator.elevate_access` Elevates access for a Global Administrator destructive **Operations 1** - `azure_rbac.operations.list` Lists all of the available Microsoft.Authorization REST API operations read **Resource groups 1** - `azure_rbac.resource_groups.list` List the resource groups in a subscription read **Subscriptions 1** - `azure_rbac.subscriptions.list` List the subscriptions the credential can see read Questions ## The Azure RBAC (Authorization) MCP server, answered. **Is there an Azure RBAC (Authorization) MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 140 Azure RBAC (Authorization) actions across access review instances, locks, access review schedule definitions and role assignments, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Azure RBAC (Authorization). **What do I need to connect Azure RBAC (Authorization)?** Entra application (client) id of a service principal with an Azure RBAC role (Reader to audit, User Access… and Entra client secret. Plus your tenant id. The free call account { op: "connections.requirements", service: "azure_rbac" } lists exactly what to paste. **Can an AI agent delete or change things in Azure RBAC (Authorization)?** Only if its key allows it, and only with an explicit confirmation. 30 Azure RBAC (Authorization) actions are destructive, including deletes a role definition, delete access review schedule definition and delete a management lock by scope. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Azure RBAC (Authorization) API limit?** actionlake paces every call to the limits in the Azure RBAC (Authorization) service file: 200 calls a minute per connection. Repeated reads are answered from cache (83 Azure RBAC (Authorization) actions can be), which never reaches Azure RBAC (Authorization). **What does an Azure RBAC (Authorization) action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (49 Azure RBAC (Authorization) actions page). Cache hits, searches, dry runs and calls Azure RBAC (Authorization) refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Azure RBAC (Authorization) API does it cover?** The Azure RBAC (role assignments, role definitions, deny assignments, PIM, access reviews, locks) API Azure Resource Manager Microsoft.Authorization: authorization-RoleAssignmentsCalls.json (2022-04-01), authorization-RoleDefinitionsCalls.json (2022-04-01), authorization-DenyAssignmentCalls.json (2022-04-01), authorization-ProviderOperationsCalls.json (2022-04-01), EligibleChildResources.json (2020-10-01), RoleAssignmentSchedule.json (2020-10-01), RoleAssignmentScheduleInstance.json (2020-10-01), RoleAssignmentScheduleRequest.json (2020-10-01), RoleEligibilitySchedule.json (2020-10-01), RoleEligibilityScheduleInstance.json (2020-10-01), RoleEligibilityScheduleRequest.json (2020-10-01), RoleManagementPolicy.json (2020-10-01), RoleManagementPolicyAssignment.json (2020-10-01), ClassicAdmin.json (2015-07-01), authorization-AccessReviewCalls.json (2021-12-01-preview), RoleManagementAlerts.json (2022-08-01-preview), locks.json (2020-05-01) at management.azure.com. It is built from Azure RBAC (Authorization)'s documentation as read on 23 October 2026. 140 actions in 33 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Azure RBAC (Authorization) data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Azure RBAC (Authorization) credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Azure RBAC (Authorization) Shares the most action names with - [SUSE Rancher Manager 5](https://actionlake.com/connectors/suse-rancher-manager) - [Action1 3](https://actionlake.com/connectors/action1) - [TP-Link Omada Open API 3](https://actionlake.com/connectors/tp-link-omada-open-api) - [Commvault Cloud 3](https://actionlake.com/connectors/commvault-cloud) - [Microsoft Power Platform API 2](https://actionlake.com/connectors/microsoft-power-platform-api) - [Cato Networks SASE 2](https://actionlake.com/connectors/cato-networks-sase) Joins with, on shared entities - [Boomi Enterprise Platform 2](https://actionlake.com/connectors/boomi-enterprise-platform) - [Microsoft 365 Users 1](https://actionlake.com/connectors/microsoft-365-users) - [Genesys Cloud CX 1](https://actionlake.com/connectors/genesys-cloud-cx) - [Harness Platform 1](https://actionlake.com/connectors/harness-platform) - [Rubrik Security Cloud 1](https://actionlake.com/connectors/rubrik-security-cloud) - [Cloudflare 1](https://actionlake.com/connectors/cloudflare) Browse - [All MSP & PSA connectors](https://actionlake.com/connectors/category/msp-and-psa) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Azure RBAC (Authorization); the name is the vendor's own. Counts are from the Azure RBAC (Authorization) service file, version 1.0.0. ## Give your agent Azure RBAC (Authorization) today. [Connect Azure RBAC (Authorization) free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/azure-rbac-authorization More: https://actionlake.com/llms.txt