Connect Claude to Microsoft Azure

List every subscription this service principal can see, with each one's id, display name and state. Call it first when you do not know which subscription to act on, and to find out whether the connection reaches anything at all - an empty list means the app registration exists but has been given no RBAC role on any subscription. The subscriptionId returned here is what every other operation's subscription_id argument takes.

List the resource groups in one subscription, with each group's name, location and tags. Resource groups are how Azure work is usually organised, so this is the natural second call after list_subscriptions and the way to find the resource_group name that the virtual machine operations need. Use list_resources instead when the question is about a kind of resource rather than about where things are grouped.

List resources across a whole subscription, of any type, with each one's full ARM id, name, type, location and tags. This is the general inventory call and the one to reach for when the question is "what is running here" or "where is the thing called X" - narrow it with `filter`, which is the only practical way to keep the answer small in a busy subscription. The `id` it returns is the fully qualified resource id that get_resource takes. For virtual machines specifically, list_virtual_machines returns their configuration rather than this generic envelope.

Fetch one resource of any type by its fully qualified ARM id, returning the provider's own properties for it rather than the generic summary a listing gives. Ids come from list_resources and look like /subscriptions/{guid}/resourceGroups/prod-rg/providers/Microsoft.Web/sites/my-app. IMPORTANT: api_version here belongs to the resource's own provider, not to ARM - Microsoft.Web, Microsoft.Compute and Microsoft.Storage each version independently, and a version the provider does not recognise is rejected outright. Read the `type` from list_resources, then pass the api-version documented for that type.

List every virtual machine in a subscription with its size, image, OS disk, network interfaces and provisioning state. This returns the machine's configuration, which is what it was built as - it does not say whether the machine is running right now. For that, call get_vm_instance_view with the resource group and name from here. The `id` of each machine is also a valid get_resource id.

Report one virtual machine's run-time state: power state (running, stopped, deallocated), provisioning state, agent and extension health, boot diagnostics and disk status. This is the operation that answers "is it up" - list_virtual_machines describes how a machine is configured and says nothing about whether it is currently running. Call it before and after start_vm, restart_vm or deallocate_vm, since all three return as soon as Azure accepts the request rather than when the machine has finished changing state. Resource group and machine name come from list_virtual_machines.

List the storage accounts in a subscription with their kind, SKU, replication, endpoints and network access settings. Useful for finding where blob data lives and for auditing exposure - allowBlobPublicAccess, minimumTlsVersion and publicNetworkAccess all come back here. Access keys are deliberately not returned by this endpoint and this connector exposes no operation that returns them.

Read the subscription's activity log - the control-plane audit trail of who changed what and whether it worked. This is the operation to reach for after an unexplained change: it names the caller, the operation, the resource and the outcome. `filter` is REQUIRED and Azure accepts only a handful of exact shapes, always starting with a time range: "eventTimestamp ge '2026-08-20T00:00:00Z' and eventTimestamp le '2026-08-21T00:00:00Z'", optionally followed by exactly one of `and resourceGroupName eq '…'`, `and resourceUri eq '…'`, `and resourceProvider eq '…'` or `and correlationId eq '…'`. No other syntax is accepted, and a malformed filter is rejected rather than ignored. The log holds 90 days.

List the App Service web apps and function apps in a subscription, with each one's state, default hostname, hosting plan, runtime stack and HTTPS settings. Use it to find which app serves a hostname, or to check whether an app is stopped. Deployment, restarts and configuration changes are not exposed here - this connector reads App Service and does not operate it.