> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rootly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Resource Manager (MCP)

> Connect Rootly AI to Microsoft's hosted Azure Resource Manager MCP endpoint for read-only resource inventory and deployment status.

## Overview

The **Azure Resource Manager (MCP)** connector lets Rootly AI inventory Azure resources and inspect Azure Resource Manager deployment status. Rootly connects to Microsoft's maintained endpoint at `https://mcp.management.azure.com` and uses delegated Microsoft Entra OAuth, so you don't deploy or operate an MCP server.

<Info>
  Azure has two Rootly AI connectors. Use this MCP connector for resource inventory and ARM deployment status. Use [Azure Monitor](/ai/connectors/azure-monitor) for logs, metrics, alert instances, activity and resource changes, Resource Health, and diagnostic settings. You can connect both.
</Info>

This connector is also separate from the existing Azure alert source, which sends Azure alerts into Rootly for routing and paging. See [Alert Sources](/alerts/alert-sources).

## Before You Start

You'll need:

* A Microsoft Entra account that can authorize Rootly and read the Azure subscriptions and resources responders need to investigate.
* Azure RBAC assignments for that account at the smallest appropriate subscription, resource-group, or resource scope.
* Permission to manage AI connectors in Rootly.

Rootly AI inherits the authorizing user's Azure access. Connecting the MCP endpoint does not grant additional Azure permissions. If that user is deprovisioned or loses Azure RBAC, Rootly AI immediately loses the same visibility; reconnect with an appropriate account when ownership or access changes.

## Connect Azure Resource Manager (MCP)

<Steps>
  <Step title="Open the Azure Resource Manager (MCP) card">
    In Rootly, go to **AI & Agents → Connectors** and click **Connect** on the **Azure Resource Manager (MCP)** card.
  </Step>

  <Step title="Authorize with Microsoft Entra">
    Sign in with the Microsoft Entra account Rootly AI should use and approve the requested access. Rootly uses Microsoft's fixed hosted MCP endpoint; there is no endpoint URL, tenant secret, or MCP server to configure.
  </Step>

  <Step title="Confirm the connection">
    After authorization and Rootly's catalog probe succeed, the connector card shows **Connected**. Ask a resource question whose answer you can verify in Azure before relying on the connector during an incident.
  </Step>
</Steps>

## What Rootly AI Can Read

Rootly exposes four reviewed MCP tools:

| Tool                    | Purpose                                                                         |
| ----------------------- | ------------------------------------------------------------------------------- |
| `generate_query`        | Generate a candidate Azure Resource Graph query from a natural-language request |
| `validate_query`        | Check a generated query before execution                                        |
| `execute_query`         | Run the reviewed query against resources visible through Azure RBAC             |
| `get_deployment_status` | Read the status of a known ARM deployment using exact identifiers               |

The hosted MCP catalog also advertises write-capable Azure tools. Rootly filters those tools out; this connector exposes only the four operations above.

<Warning>
  Treat `generate_query` as a draft, not proof that a query answers the intended question. Rootly AI validates and semantically reviews generated Resource Graph queries before execution. An empty result is inconclusive and can also mean the authorizing user lacks access to the relevant scope.
</Warning>

## Choosing Between the Azure AI Connectors

| Question                                                                                                      | Use                                           |
| ------------------------------------------------------------------------------------------------------------- | --------------------------------------------- |
| *"Which Azure resources match this service, tag, type, or configuration?"*                                    | Azure Resource Manager (MCP)                  |
| *"What is the exact status of this ARM deployment?"*                                                          | Azure Resource Manager (MCP)                  |
| *"What do the logs and metrics show around the incident?"*                                                    | [Azure Monitor](/ai/connectors/azure-monitor) |
| *"What alert, activity-log event, resource change, health event, or diagnostic setting explains the impact?"* | [Azure Monitor](/ai/connectors/azure-monitor) |

Connect both when responders need resource discovery and deep operational evidence in the same investigation.

## Security and Data Handling

* Microsoft hosts and maintains the MCP endpoint; Rootly does not require a customer-hosted service.
* Microsoft Entra OAuth identifies the authorizing user, and Azure RBAC remains authoritative.
* Rootly fixes the endpoint to `https://mcp.management.azure.com`; users cannot substitute another host for this provider.
* Rootly applies a read-only tool allowlist even if the upstream catalog exposes mutation tools.
* Requests use a bounded 60-second timeout.

Query results can appear in Rootly AI traces used for quality monitoring. See [Data Privacy for Rootly AI](/ai/data-privacy-for-rootly-ai) for retention and model-training controls.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Microsoft authorization fails" icon="key">
    Confirm that you're signing in to the intended Microsoft Entra tenant and that your organization permits the Rootly enterprise application. An Entra administrator may need to approve the application or consent policy first.
  </Accordion>

  <Accordion title="The connection succeeds but resources are missing" icon="magnifying-glass">
    Check the Azure RBAC assignments of the account that authorized Rootly. The connector can only query subscriptions and resources that account can read. Empty Resource Graph results are not proof that a resource doesn't exist.
  </Accordion>

  <Accordion title="A generated query validates but answers the wrong question" icon="triangle-exclamation">
    Query validation checks syntax and Azure acceptance, not whether the query captures the intended semantics. Make the resource types, subscriptions, tags, and desired fields explicit, then ask Rootly AI to review the query before execution.
  </Accordion>

  <Accordion title="Deployment status is unavailable" icon="rocket">
    Provide the exact ARM deployment identifiers and confirm the authorizing account can read that deployment scope. Use the native [Azure Monitor connector](/ai/connectors/azure-monitor) when you need deployment operations correlated with logs, activity, or resource changes.
  </Accordion>
</AccordionGroup>

## Related Pages

<CardGroup cols={3}>
  <Card title="Azure Monitor" icon="chart-line" href="/ai/connectors/azure-monitor">
    Query Azure operational evidence through Rootly's native read-only connector.
  </Card>

  <Card title="Alert Sources" icon="bell" href="/alerts/alert-sources">
    Send Azure alerts into Rootly for routing and paging.
  </Card>

  <Card title="Connectors Overview" icon="sparkles" href="/ai/connectors/overview">
    Compare all Rootly AI connectors and setup flows.
  </Card>
</CardGroup>