Microsoft released a stable version of Azure MCP Server 3.0 on Oct. 12, Azure SDK product manager Sandeep Sen said in a blog post on Oct. 14. The release adds tools that let AI agents review backups, plan recoveries and work with Microsoft’s operations agent in Azure.
Azure MCP Server is Microsoft’s open-source implementation of the Model Context Protocol, a standard way for AI agents to find and call outside tools. It gives agents and coding tools a consistent way to reach Azure services. Version 3.0 brings together 50 beta releases and hundreds of contributions, Sen wrote.
What agents can do now
New toolsets cover Azure Backup, Azure Resilience Management and Azure SRE Agent, Microsoft’s agent for site reliability work. The SRE Agent toolset alone has 55 commands covering investigations, incidents, safety hooks and remediation plans, according to the post.
Sen suggests a backup review as a starting point. An agent can examine a vault’s policies and protected items, then look at jobs and recovery points, to help someone judge whether a workload is protected.
The resilience tools include failover and reprotect actions. The post advises users to “plan and review those operations before invoking them.”
New Terraform tools help bring existing resources into infrastructure as code, which means managing cloud setups through configuration files. Azure Advisor tools rank cost recommendations by estimated annual savings. Microsoft notes that Advisor’s apply tool returns rules for preparing a code change “rather than applying changes to live resources.”
Safer defaults
When an agent creates new resources through the server, 3.0 applies stricter settings by default, the post says. New storage accounts turn off Shared Key authentication. New Event Hubs namespaces turn off local authentication, and new Recovery Services vaults turn off public network access.
These defaults don’t change existing resources when users upgrade, Sen wrote.
The release also changes how tools present themselves to models. It has clearer tool descriptions for language models choosing which tool to call, more accurate input schemas and errors for unknown parameters. A new –learn flag lets developers explore commands without running any Azure operations.
Microsoft flags one area for care. The MySQL and PostgreSQL query tools are “destructive, non-idempotent, and non-read-only,” and filtering by SQL command has been removed, so the post tells users to rely on least-privilege database permissions.
Upgrading takes some work. Teams moving from 2.0 or a 3.0 preview should check the full changelog and test their clients first, the post says, since some parameters were removed and some response formats changed. The server now uses the stateless MCP protocol version dated July 28, 2026, while clients on the November 2025 version keep backward compatibility.
Azure MCP Server works in Visual Studio Code, Visual Studio, IntelliJ, Eclipse and Cursor, along with Claude and Google Antigravity, according to Microsoft. It also runs with GitHub Copilot CLI and as a self-hosted server a team can share. The code is on GitHub.
Source: Azure SDK Blog, Microsoft Azure SDK team, “Azure MCP Server 3.0 stable release: More tools. More possibilities”
Additional sources: Azure MCP Server (GitHub), Microsoft, “microsoft/mcp”
