1---2name: azure-network-ops3description: Azure cloud networking -- VNets, NSGs, ExpressRoute, VPN Gateways, Azure Firewalls, Load Balancers, Application Gateways, Route Tables, Network Watcher, Private Endpoints, DNS zones. Use when auditing Azure VNets, troubleshooting hybrid connectivity (ExpressRoute/VPN), checking NSG rules, inspecting firewall policies, or analyzing load balancer health.4license: Apache-2.05---6
7# Azure Network Operations
8
9## MCP Server
10
11- **Command**: `python mcp-servers/azure-network-mcp/azure_network_mcp_server.py` (stdio transport)
12- **Requires**: `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_SUBSCRIPTION_ID`
13- **Read-only**: All operations are List/Get -- no create/modify/delete
14- **Auth**: DefaultAzureCredential (service principal or Azure CLI fallback)
15
16## Available Tools (19)
17
18### Subscription (1)
19
20| Tool | What It Does |
21|------|-------------|
22| `azure_list_subscriptions` | List all accessible Azure subscriptions |
23
24### VNet Topology (3)
25
26| Tool | What It Does |
27|------|-------------|
28| `azure_list_vnets` | List all VNets with address space, subnet/peering count |
29| `azure_get_vnet_details` | Full VNet details: subnets (NSG, route table, delegations), peerings, DNS |
30| `azure_get_vnet_peerings` | VNet peering status with traffic forwarding settings |
31
32### NSG Security (3)
33
34| Tool | What It Does |
35|------|-------------|
36| `azure_list_nsgs` | List all NSGs with association info and orphan detection |
37| `azure_get_nsg_rules` | All rules (custom + default) sorted by priority |
38| `azure_get_effective_security_rules` | Effective aggregated rules for a NIC |
39
40### Compliance (1)
41
42| Tool | What It Does |
43|------|-------------|
44| `azure_audit_nsg_compliance` | CIS Azure Foundations Benchmark audit (rules 6.1-6.4) |
45
46### ExpressRoute (2)
47
48| Tool | What It Does |
49|------|-------------|
50| `azure_get_expressroute_status` | Circuit status, peering config, provisioning state |
51| `azure_get_expressroute_routes` | Learned route table for a peering |
52
53### VPN Gateway (1)
54
55| Tool | What It Does |
56|------|-------------|
57| `azure_get_vpn_gateway_status` | Gateway config, connections, BGP settings |
58
59### Firewall (2)
60
61| Tool | What It Does |
62|------|-------------|
63| `azure_list_firewalls` | List Azure Firewalls with SKU and policy association |
64| `azure_get_firewall_policy` | Policy details: rule collections, threat intel, IDPS |
65
66### Load Balancer (2)
67
68| Tool | What It Does |
69|------|-------------|
70| `azure_list_load_balancers` | List LBs with frontend/backend/probe summary |
71| `azure_get_lb_backend_health` | Backend pool health per member |
72
73### Application Gateway / Front Door (1)
74
75| Tool | What It Does |
76|------|-------------|
77| `azure_get_app_gateway_health` | App GW config, WAF, backend health; Front Door routing |
78
79### Supporting Services (3)
80
81| Tool | What It Does |
82|------|-------------|
83| `azure_get_route_tables` | Route tables, UDRs, effective routes for a NIC |
84| `azure_get_network_watcher_status` | Network Watcher availability, connection monitors, flow logs |
85| `azure_get_private_endpoints` | Private Endpoints with DNS zone associations |
86| `azure_get_dns_zones` | DNS zones (public/private) and record sets |
87
88## Workflow: VNet Topology Audit
89
90When asked "show me our Azure network" or "audit Azure VNets":
91
921. `azure_list_subscriptions` -- discover available subscriptions
932. `azure_list_vnets` -- get all VNets in the target subscription
943. For each VNet: `azure_get_vnet_details` -- subnets, peerings, DNS, NSGs
954. `azure_get_vnet_peerings` -- check peering state (Connected/Disconnected)
965. Report: VNet count, subnet utilization, peering health, orphaned NSGs
97
98## Workflow: Hybrid Connectivity Check
99
100When asked "check ExpressRoute status" or "is the VPN tunnel up":
101
1021. `azure_get_expressroute_status` -- circuit provisioning, peering state
1032. `azure_get_expressroute_routes` -- verify learned routes from on-prem
1043. `azure_get_vpn_gateway_status` -- VPN connection status, BGP peers
1054. Report: circuit health, learned route count, tunnel status, bytes transferred
106
107## Workflow: Security Posture Assessment
108
109When asked "audit NSG rules" or "check security posture":
110
1111. `azure_audit_nsg_compliance` -- run CIS benchmark against all NSGs
1122. `azure_list_nsgs` -- identify orphaned NSGs
1133. For flagged NSGs: `azure_get_nsg_rules` -- review offending rules
1144. `azure_get_effective_security_rules` -- verify effective rules on critical NICs
1155. Report: findings by severity, remediation steps, orphan count
116
117## Important Rules
118
119- **Read-only**: Never attempt to create, modify, or delete Azure resources
120- **Subscription-scoped**: Always specify or use default subscription_id
121- **GAIT logging**: All tool calls are audit-logged with timestamp, operation, and result
122- **Multi-subscription**: Pass subscription_id to query across subscriptions
123- **Rate limits**: Azure ARM allows ~1200 reads/5min per tenant; server auto-retries on 429
124
125## Environment Variables
126
127| Variable | Required | Description |
128|----------|----------|-------------|
129| `AZURE_TENANT_ID` | Yes | Azure AD tenant ID |
130| `AZURE_CLIENT_ID` | Yes | Service principal client ID |
131| `AZURE_CLIENT_SECRET` | Yes | Service principal secret |
132| `AZURE_SUBSCRIPTION_ID` | Yes | Default subscription |
gabrielmoreira