Connectors · MSP & PSA

Azure Resource Manager MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Azure Resource Manager and the rest of your systems. It gives your agent 101 Azure Resource Manager actions (66 reads, 18 writes and 17 that wait for a confirmation) and holds the Azure Resource Manager credential itself, so the agent never does. It paces Azure Resource Manager's limits and records every call.

Connect Azure Resource Manager free See pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp

the first call

do {  action: "azure_resource_manager.tenants.list",  intent: "check which Azure Resource Manager account is connected"}# Gets the tenants for your account · read · 1 upstream call

101actionsin one signed file
66readlook, never change
18writecreate and update
17wait for a yesdestructive, confirmed first

Set up

Connect Azure Resource Manager in three steps.

01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp
02
Connect Azure Resource Manager.
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
- client_idEntra application (client) id of a service principal with Reader (or Contributor) on the subscriptions
- client_secretEntra client secret
- tenant_idYour Azure Resource Manager tenant id
```
account { op: "connections.requirements", service: "azure_resource_manager" }
# free: exactly what to paste, and what is found for you
```

Make the first call. Check before a write.

Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

do    { action: "azure_resource_manager.tenants.list" }# gets the tenants for your account · read · 1 upstream callcheck { action: "azure_resource_manager.deployments.delete", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Azure Resource Manager at a glance

Sign-in: OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
You provide: client_idclient_secret
Setup fields: tenant_id
Limits we pace to: 200 calls a minute, per connection
API covered: Azure Resource Manager (subscriptions, resource groups, resources, tags, providers, deployments) API Azure Resource Manager Microsoft.Resources: resources.json (2025-04-01), deployments.json (2025-04-01), subscriptions.json (2022-12-01)management.azure.com
Built from: Azure Resource Manager's documentation, read 22 October 2026OpenAPI spec (GitHub)OpenAPI spec (GitHub)OpenAPI spec (GitHub)
Service file: Version 1.0.0, signed (Ed25519)
Cached reads: 39 of 66 reads, for up to 5 minutes; a write clears what it affects
Shared entities: 2, so ask can line Azure Resource Manager up with your other systems
Data: Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Azure Resource Manager.

101 actions in 11 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

66readlook, never change
18writecreate and update
17destructivewait for a confirmation

Deployments
45
30 read · 5 write · 10 destructive
Get all the deployments for a resource group · Gets a deployment · Deletes a deployment from the deployment history · Deploys resources to a resource group
Resources
14
7 read · 5 write · 2 destructive
Get all the resources in a subscription · Get all the resources for a resource group · Checks whether a resource exists · Checks by ID whether a resource exists
Deployment operations
10
10 read · 0 write · 0 destructive
Gets all deployments operations for a deployment · Gets all deployments operations for a deployment · Gets all deployments operations for a deployment · Gets all deployments operations for a deployment
Tags
9
2 read · 4 write · 3 destructive
Gets a summary of tag usage under the subscription · Gets the entire set of tags on a resource or subscription · Selectively updates the set of tags on a resource or subscription · Deletes a predefined tag name
Providers
8
5 read · 2 write · 1 destructive
Gets all resource providers for a subscription · Gets all resource providers for the tenant · Get the provider permissions · Gets the specified resource provider
Resource groups
7
4 read · 2 write · 1 destructive
Gets all the resource groups for a subscription · Gets a resource group · Updates a resource group · Deletes a resource group
Subscriptions
4
4 read · 0 write · 0 destructive
Gets all available geo-locations · Gets all subscriptions for a tenant · Gets details about a specified subscription · Compares a subscriptions logical zone mapping
Operations
1
1 read · 0 write · 0 destructive
List the operations for the provider

3 more areas · 3 actions

Provider resource types 1
Resource names 1
Tenants 1

Top actions

The Azure Resource Manager API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 17 of Azure Resource Manager's 17 action names are shared with at least one other connector, so an agent learns them once.

Action	What it does	Effect	Same name in
`azure_resource_manager.deployments.list_by_resource_group`Get all the deployments for a resource group	Get all the deployments for a resource group.	read	`infra.deployment.list`8 connectors
`azure_resource_manager.deployments.get`Gets a deployment	Gets a deployment.	read	`infra.deployment.get`8 connectors
`azure_resource_manager.resource_groups.list`Gets all the resource groups for a subscription	Gets all the resource groups for a subscription.	read	`infra.resource_group.list`19 connectors
`azure_resource_manager.subscriptions.list_locations`Gets all available geo-locations	Gets all available geo-locations.	read	`infra.region.list`16 connectors
`azure_resource_manager.tenants.list`Gets the tenants for your account	Gets the tenants for your account.	read	`platform.tenant.list`70 connectors
`azure_resource_manager.subscriptions.list`Gets all subscriptions for a tenant	Gets all subscriptions for a tenant.	read	`infra.account.list`3 connectors
`azure_resource_manager.deployments.delete`Deletes a deployment from the deployment history	Deletes a deployment from the deployment history.	destructive	`infra.deployment.delete`7 connectors
`azure_resource_manager.tags.list`Gets a summary of tag usage under the subscription	Gets a summary of tag usage under the subscription.	read	`infra.resource_tag.list`2 connectors
`azure_resource_manager.resource_groups.get`Gets a resource group	Gets a resource group.	read	`infra.resource_group.get`4 connectors
`azure_resource_manager.deployments.create_or_update`Deploys resources to a resource group	Deploys resources to a resource group.	write	`infra.deployment.upsert`2 connectors
`azure_resource_manager.resource_groups.update`Updates a resource group	Updates a resource group.	write	`infra.resource_group.update`4 connectors
`azure_resource_manager.tags.update_at_scope`Selectively updates the set of tags on a resource or subscription	Selectively updates the set of tags on a resource or subscription.	write	`infra.resource_tag.update`2 connectors

Try it

Prompts to paste into Claude.

Each one names the Azure Resource Manager actions it will call, so you know what it reads and what it changes before you send it.

Readread
Gets the tenants for your account in Azure Resource Manager and tell me what stands out.
callsazure_resource_manager.tenants.list
Writewrite
Deploys resources to a resource group in Azure Resource Manager. Show me exactly what you will send before you save it.
callsazure_resource_manager.deployments.create_or_update

Governance for Azure Resource Manager

Destructive actions wait for a yes.

17 Azure Resource Manager actions are destructive. These are all of them:

Deletes a deployment from the deployment historyazure_resource_manager.deployments.delete
Deletes a resource groupazure_resource_manager.resource_groups.delete
Deletes a predefined tag nameazure_resource_manager.tags.delete
Deletes a resourceazure_resource_manager.resources.delete
Deletes a predefined tag value for a predefined tag nameazure_resource_manager.tags.delete_value
Unregisters a subscription from a resource providerazure_resource_manager.providers.unregister
Deletes the entire set of tags on a resource or subscriptionazure_resource_manager.tags.delete_at_scope
Deletes a resource by IDazure_resource_manager.resources.delete_by_id
Deletes a deployment from the deployment historyazure_resource_manager.deployments.delete_at_scope
Deletes a deployment from the deployment historyazure_resource_manager.deployments.delete_at_tenant_scope
Deletes a deployment from the deployment historyazure_resource_manager.deployments.delete_at_subscription_scope
Deletes a deployment from the deployment historyazure_resource_manager.deployments.delete_at_management_group_scope
Cancels a currently running template deploymentazure_resource_manager.deployments.cancel
Cancels a currently running template deploymentazure_resource_manager.deployments.cancel_at_scope
Cancels a currently running template deploymentazure_resource_manager.deployments.cancel_at_tenant_scope
Cancels a currently running template deploymentazure_resource_manager.deployments.cancel_at_subscription_scope
Cancels a currently running template deploymentazure_resource_manager.deployments.cancel_at_management_group_scope

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

doazure_resource_manager.deployments.deleteconfirm_policy: human

Deletes a deployment from the deployment history?

intent: the user asked me to deletes a deployment from the deployment history

run suspended · waiting for a named person · key azure-resource-manager-agent cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

account {  op: "keys.create", name: "azure-resource-manager-agent",  allowed_actions: ["azure_resource_manager.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "azure_resource_manager.deployments.delete", approver: "[email protected]" },    { match: "azure_resource_manager.resource_groups.delete", approver: "[email protected]" },    { match: "azure_resource_manager.tags.delete", approver: "[email protected]" }  ]}

Illustrative. Scoped to Azure Resource Manager only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Azure Resource Manager costs on actionlake.

Every Azure Resource Manager action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Azure Resource Manager refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

1upstream call per actionall 101 Azure Resource Manager actions
20actions pageeach page of a long list is one call
39reads can be cacheda cache hit costs nothing
100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Azure Resource Manager action.

101 actions by area: the id your agent calls, what it does, and its effect.

Deployments45

azure_resource_manager.deployments.calculate_template_hashCalculate the hash of the given templateread
azure_resource_manager.deployments.cancelCancels a currently running template deploymentdestructive
azure_resource_manager.deployments.cancel_at_management_group_scopeCancels a currently running template deploymentdestructive
azure_resource_manager.deployments.cancel_at_scopeCancels a currently running template deploymentdestructive
azure_resource_manager.deployments.cancel_at_subscription_scopeCancels a currently running template deploymentdestructive
azure_resource_manager.deployments.cancel_at_tenant_scopeCancels a currently running template deploymentdestructive
azure_resource_manager.deployments.check_existenceChecks whether the deployment existsread
azure_resource_manager.deployments.check_existence_at_management_group_scopeChecks whether the deployment existsread
azure_resource_manager.deployments.check_existence_at_scopeChecks whether the deployment existsread
azure_resource_manager.deployments.check_existence_at_subscription_scopeChecks whether the deployment existsread
azure_resource_manager.deployments.check_existence_at_tenant_scopeChecks whether the deployment existsread
azure_resource_manager.deployments.create_or_updateDeploys resources to a resource groupwrite
azure_resource_manager.deployments.create_or_update_at_management_group_scopeDeploys resources at management group scopewrite
azure_resource_manager.deployments.create_or_update_at_scopeDeploys resources at a given scopewrite
azure_resource_manager.deployments.create_or_update_at_subscription_scopeDeploys resources at subscription scopewrite
azure_resource_manager.deployments.create_or_update_at_tenant_scopeDeploys resources at tenant scopewrite
azure_resource_manager.deployments.deleteDeletes a deployment from the deployment historydestructive
azure_resource_manager.deployments.delete_at_management_group_scopeDeletes a deployment from the deployment historydestructive
azure_resource_manager.deployments.delete_at_scopeDeletes a deployment from the deployment historydestructive
azure_resource_manager.deployments.delete_at_subscription_scopeDeletes a deployment from the deployment historydestructive
azure_resource_manager.deployments.delete_at_tenant_scopeDeletes a deployment from the deployment historydestructive
azure_resource_manager.deployments.export_templateExports the template used for specified deploymentread
azure_resource_manager.deployments.export_template_at_management_group_scopeExports the template used for specified deploymentread
azure_resource_manager.deployments.export_template_at_scopeExports the template used for specified deploymentread
azure_resource_manager.deployments.export_template_at_subscription_scopeExports the template used for specified deploymentread
azure_resource_manager.deployments.export_template_at_tenant_scopeExports the template used for specified deploymentread
azure_resource_manager.deployments.getGets a deploymentread
azure_resource_manager.deployments.get_at_management_group_scopeGets a deploymentread
azure_resource_manager.deployments.get_at_scopeGets a deploymentread
azure_resource_manager.deployments.get_at_subscription_scopeGets a deploymentread
azure_resource_manager.deployments.get_at_tenant_scopeGets a deploymentread
azure_resource_manager.deployments.list_at_management_group_scopeGet all the deployments for a management groupread
azure_resource_manager.deployments.list_at_scopeGet all the deployments at the given scoperead
azure_resource_manager.deployments.list_at_subscription_scopeGet all the deployments for a subscriptionread
azure_resource_manager.deployments.list_at_tenant_scopeGet all the deployments at the tenant scoperead
azure_resource_manager.deployments.list_by_resource_groupGet all the deployments for a resource groupread
azure_resource_manager.deployments.validateValidates whether the specified template is syntactically correct and will be accepted by Azure Resource Managerread
azure_resource_manager.deployments.validate_at_management_group_scopeValidates whether the specified template is syntactically correct and will be accepted by Azure Resource Managerread
azure_resource_manager.deployments.validate_at_scopeValidates whether the specified template is syntactically correct and will be accepted by Azure Resource Managerread
azure_resource_manager.deployments.validate_at_subscription_scopeValidates whether the specified template is syntactically correct and will be accepted by Azure Resource Managerread
azure_resource_manager.deployments.validate_at_tenant_scopeValidates whether the specified template is syntactically correct and will be accepted by Azure Resource Managerread
azure_resource_manager.deployments.what_ifReturns changes that will be made by the deployment if executed at the scope of the resource groupread
azure_resource_manager.deployments.what_if_at_management_group_scopeReturns changes that will be made by the deployment if executed at the scope of the management groupread
azure_resource_manager.deployments.what_if_at_subscription_scopeReturns changes that will be made by the deployment if executed at the scope of the subscriptionread
azure_resource_manager.deployments.what_if_at_tenant_scopeReturns changes that will be made by the deployment if executed at the scope of the tenant groupread

Resources14

azure_resource_manager.resources.check_existenceChecks whether a resource existsread
azure_resource_manager.resources.check_existence_by_idChecks by ID whether a resource existsread
azure_resource_manager.resources.create_or_updateCreates a resourcewrite
azure_resource_manager.resources.create_or_update_by_idCreate a resource by IDwrite
azure_resource_manager.resources.deleteDeletes a resourcedestructive
azure_resource_manager.resources.delete_by_idDeletes a resource by IDdestructive
azure_resource_manager.resources.getGets a resourceread
azure_resource_manager.resources.get_by_idGets a resource by IDread
azure_resource_manager.resources.listGet all the resources in a subscriptionread
azure_resource_manager.resources.list_by_resource_groupGet all the resources for a resource groupread
azure_resource_manager.resources.move_resourcesMoves resources from one resource group to another resource groupwrite
azure_resource_manager.resources.updateUpdates a resourcewrite
azure_resource_manager.resources.update_by_idUpdate a resource by IDwrite
azure_resource_manager.resources.validate_move_resourcesValidates whether resources can be moved from one resource group to another resource groupread

Deployment operations10

azure_resource_manager.deployment_operations.getGets a deployments operationread
azure_resource_manager.deployment_operations.get_at_management_group_scopeGets a deployments operationread
azure_resource_manager.deployment_operations.get_at_scopeGets a deployments operationread
azure_resource_manager.deployment_operations.get_at_subscription_scopeGets a deployments operationread
azure_resource_manager.deployment_operations.get_at_tenant_scopeGets a deployments operationread
azure_resource_manager.deployment_operations.listGets all deployments operations for a deploymentread
azure_resource_manager.deployment_operations.list_at_management_group_scopeGets all deployments operations for a deploymentread
azure_resource_manager.deployment_operations.list_at_scopeGets all deployments operations for a deploymentread
azure_resource_manager.deployment_operations.list_at_subscription_scopeGets all deployments operations for a deploymentread
azure_resource_manager.deployment_operations.list_at_tenant_scopeGets all deployments operations for a deploymentread

Tags9

azure_resource_manager.tags.create_or_updateCreates a predefined tag namewrite
azure_resource_manager.tags.create_or_update_at_scopeCreates or updates the entire set of tags on a resource or subscriptionwrite
azure_resource_manager.tags.create_or_update_valueCreates a predefined value for a predefined tag namewrite
azure_resource_manager.tags.deleteDeletes a predefined tag namedestructive
azure_resource_manager.tags.delete_at_scopeDeletes the entire set of tags on a resource or subscriptiondestructive
azure_resource_manager.tags.delete_valueDeletes a predefined tag value for a predefined tag namedestructive
azure_resource_manager.tags.get_at_scopeGets the entire set of tags on a resource or subscriptionread
azure_resource_manager.tags.listGets a summary of tag usage under the subscriptionread
azure_resource_manager.tags.update_at_scopeSelectively updates the set of tags on a resource or subscriptionwrite

Providers8

azure_resource_manager.providers.getGets the specified resource providerread
azure_resource_manager.providers.get_at_tenant_scopeGets the specified resource provider at the tenant levelread
azure_resource_manager.providers.listGets all resource providers for a subscriptionread
azure_resource_manager.providers.list_at_tenant_scopeGets all resource providers for the tenantread
azure_resource_manager.providers.provider_permissionsGet the provider permissionsread
azure_resource_manager.providers.registerRegisters a subscription with a resource providerwrite
azure_resource_manager.providers.register_at_management_group_scopeRegisters a management group with a resource providerwrite
azure_resource_manager.providers.unregisterUnregisters a subscription from a resource providerdestructive

Resource groups7

azure_resource_manager.resource_groups.check_existenceChecks whether a resource group existsread
azure_resource_manager.resource_groups.create_or_updateCreates or updates a resource groupwrite
azure_resource_manager.resource_groups.deleteDeletes a resource groupdestructive
azure_resource_manager.resource_groups.export_templateCaptures the specified resource group as a templateread
azure_resource_manager.resource_groups.getGets a resource groupread
azure_resource_manager.resource_groups.listGets all the resource groups for a subscriptionread
azure_resource_manager.resource_groups.updateUpdates a resource groupwrite

Subscriptions4

azure_resource_manager.subscriptions.check_zone_peersCompares a subscriptions logical zone mappingread
azure_resource_manager.subscriptions.getGets details about a specified subscriptionread
azure_resource_manager.subscriptions.listGets all subscriptions for a tenantread
azure_resource_manager.subscriptions.list_locationsGets all available geo-locationsread

Operations1

azure_resource_manager.operations.listList the operations for the providerread

Provider resource types1

azure_resource_manager.provider_resource_types.listList the resource types for a specified resource providerread

Resource names1

azure_resource_manager.resource_names.checkChecks resource name validityread

Tenants1

azure_resource_manager.tenants.listGets the tenants for your accountread

Questions

The Azure Resource Manager MCP server, answered.

Is there an Azure Resource Manager MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 101 Azure Resource Manager actions across deployments, resources, deployment operations and tags, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Azure Resource Manager.

What do I need to connect Azure Resource Manager?

Entra application (client) id of a service principal with Reader (or Contributor) on the subscriptions and Entra client secret. Plus your tenant id. The free call account { op: "connections.requirements", service: "azure_resource_manager" } lists exactly what to paste.

Can an AI agent delete or change things in Azure Resource Manager?

Only if its key allows it, and only with an explicit confirmation. 17 Azure Resource Manager actions are destructive, including deletes a deployment from the deployment history, deletes a resource group and deletes a predefined tag name. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Azure Resource Manager API limit?

actionlake paces every call to the limits in the Azure Resource Manager service file: 200 calls a minute per connection. Repeated reads are answered from cache (39 Azure Resource Manager actions can be), which never reaches Azure Resource Manager.

What does an Azure Resource Manager action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (20 Azure Resource Manager actions page). Cache hits, searches, dry runs and calls Azure Resource Manager refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Azure Resource Manager API does it cover?

The Azure Resource Manager (subscriptions, resource groups, resources, tags, providers, deployments) API Azure Resource Manager Microsoft.Resources: resources.json (2025-04-01), deployments.json (2025-04-01), subscriptions.json (2022-12-01) at management.azure.com. It is built from Azure Resource Manager's documentation as read on 22 October 2026. 101 actions in 11 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Azure Resource Manager data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Azure Resource Manager credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

Give your agent Azure Resource Manager today.

Connect Azure Resource Manager free See pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

Azure Resource Manager MCP server for AI agents.

Connect Azure Resource Manager in three steps.

Add actionlake to Claude.

Connect Azure Resource Manager.

Make the first call. Check before a write.

What an AI agent can do in Azure Resource Manager.

Deployments

Resources

Deployment operations

Tags

Providers

Resource groups

Subscriptions

Operations