Notatka
Dostęp do tej strony wymaga autoryzacji. Może spróbować zalogować się lub zmienić katalogi.
Dostęp do tej strony wymaga autoryzacji. Możesz spróbować zmienić katalogi.
The Azure IoT Operations Model Context Protocol (MCP) server exposes tools for Azure IoT Operations documentation, resources, and permitted operational tasks. MCP-compatible clients access these tools through MCP Gateway, which authenticates callers and applies authorization policies before forwarding requests to the server.
The Azure IoT Operations MCP capability contains two components:
| Component | Responsibility |
|---|---|
| MCP Gateway | Authenticates callers, evaluates per-connection authorization policies, and routes MCP tool calls to registered servers. |
| Azure IoT Operations MCP | Provides tools for Azure IoT Operations documentation, resources, and permitted operational tasks. |
The Azure IoT Operations operator deploys both components together. ARM manages the MCPServerConnection and MCPAuthorizationPolicy resources. The operator reconciles those resources into the configuration used by MCP Gateway.
Important
MCP in Azure IoT Operations is in preview. Use a nonproduction environment to evaluate the preview and the examples in this article. The examples use ARM API version 2026-11-01-preview and require an extension version with compatible MCP custom resource definitions (CRDs).
MCP is enabled by default for new Azure IoT Operations deployments that use an instance template with MCP support. The deployment includes MCP Gateway and Azure IoT Operations MCP, not the separate Kubernetes MCP server. You can disable MCP if you don't need it, or optionally install Kubernetes MCP and register it as another gateway connection. Clients must connect through MCP Gateway rather than directly to the backends.
Access MCP tools
In-cluster clients authenticate by using Kubernetes service account tokens. Authorization policies determine which tools each caller can use based on the roles assigned to its ServiceAccount. Use the default policy or configure your own policy to restrict tool access. For remote access, Azure API Management validates Microsoft Entra tokens and forwards requests through an Azure Relay Hybrid Connection to the in-cluster relay, which connects to MCP Gateway. You can bring your own MCP-compatible agent. An optional sample agent demonstrates using MCP tools with a Foundry Local model; you don't need to deploy it to use Azure IoT Operations MCP. Its model authentication is separate from MCP authentication and authorization.
Get started
- Verify the MCP deployment and its default connection.
- Configure MCP authorization to review client authentication and customize tool access.
- Connect to MCP by using your own MCP-compatible agent or, optionally, the sample agent.
- Expose MCP through Azure Relay if your client runs outside the cluster.