AzPolicyMCP

What is AzPolicyMCP?

AzPolicyMCP is a Model Context Protocol server that empowers Large Language Models (LLMs) to generate, validate, and deploy Azure custom policies. It provides a standardized interface for LLM applications to interact with Azure Policy definitions and assignments, ensuring correctness and compliance.

How to use AzPolicyMCP?

Configure Azure authentication via environment variables (TENANT_ID, CLIENT_ID, CLIENT_SECRET) and run the server. The LLM client invokes MCP tools such as get_builtin_policies, get_policies_in_category, get_policy_content, deploy_policy_assignment, query_policy_compliance, delete_policy_assignment, and create_policy_definition to manage the full policy lifecycle.

Key features of AzPolicyMCP

• Fetches built-in Azure policy categories from GitHub
• Retrieves individual policy definitions by category
• Validates policy JSON structure against official schema (disabled)
• Deploys policy assignments via Azure REST API
• Queries and reports policy compliance states
• Creates and manages policies and assignments end-to-end

Use cases of AzPolicyMCP

• Generate custom Azure policies for any resource type
• Validate generated policies against official Azure schema
• Deploy validated policies directly into an Azure subscription
• Monitor compliance status of deployed policy assignments
• Clean up policy assignments through deletion

FAQ from AzPolicyMCP

What is the purpose of AzPolicyMCP?

It enables LLMs to assist users in generating, validating, and deploying accurate Azure custom policies, preventing incorrect policy JSON.

What Azure authentication is required?

The server requires environment variables TENANT_ID, CLIENT_ID, and CLIENT_SECRET for Azure AD authentication via the MSAL library.

Which tools are implemented?

Implemented tools: get_builtin_policies, get_policies_in_category, get_policy_content, deploy_policy_assignment, query_policy_compliance, delete_policy_assignment, and create_policy_definition.

Is the policy validation tool working?

verify_policy_structure is temporarily disabled due to issues with the schema validation library. It is intended to validate JSON against the official Azure Policy schema.

Where does the data live?

Built-in policy data is fetched from the Azure/azure-policy GitHub repository. Deployment and compliance data live in the target Azure subscription.