Microsoft says Azure MCP Server 3.0 became generally stable on October 12, 2026. The open-source implementation of the Model Context Protocol enables compatible AI agents and developer environments to discover and call Azure tools, building on the self-hosted remote support introduced in version 2.0. The release follows 50 beta iterations and contributions from the community, and is intended for custom agents, GitHub Copilot integrations, and shared developer platforms.

New operational toolsets provide context for backup and recovery work. Azure Backup tools can inspect vaults, policies, protectable and protected items, jobs, and recovery points, and manage features such as soft delete, immutability, Resource Guards, customer-managed keys, and cross-region restore. Resilience Management covers recovery plans, readiness checks, failover validation, and drill lifecycles, while Azure SRE Agent provides tools for investigations, incidents, connectors, safety hooks, remediation plans, and a 55-command set covering related agent workflows. Private endpoint support for backup applies to Recovery Services vaults, not Data Protection vaults, and SRE Agent tools require the Microsoft.App/SREAgentPreview resource provider.

The release also targets infrastructure changes and optimization. Azure Terraform tools can retrieve AzureRM and AzAPI documentation, explore Azure Verified Modules, export resources with aztfexport, and validate configurations with conftest. Azure Advisor adds recommendation and lifecycle information plus remediation guidance, while the Optimization toolset ranks cost recommendations, estimates annual savings, compares VM and VM Scale Set options, and provides utilization projections. Advisor’s apply tool prepares infrastructure-as-code changes rather than applying changes directly to live resources.

Additional capabilities cover Azure Monitor, Cosmos DB, IoT, infrastructure insights, and compute services. Monitor can query metrics and perform bounded searches over Basic and Auxiliary log tables; Cosmos DB tools support schema inference, item retrieval, full-text search, and vector search. IoT tools inspect device identities, twins, statistics, and Azure IoT Operations instances, while other tools manage VM power state, validate VM creation inputs, change App Service state, and expand Azure Managed Lustre filesystems.

Version 3.0 revises client integration with refreshed ModelContextProtocol packages, clearer tool descriptions, richer System.Text.Json input schemas, and errors for unknown parameters. The CLI’s --learn flag describes commands without executing operations, and structured responses are opt-in through structured-output-mode settings; otherwise responses remain content-only. The release also adds operationPlane metadata, Azure Pipelines workload identity federation through AzurePipelinesCredential, a --disable-proxy-tools option, clearer authentication and RBAC errors, improved logging behavior, and more precise 404 and 400 responses. Reported startup improvement of about 39% applies only to targeted CLI command invocations, not overall server startup or throughput.

Security defaults apply when new resources are created through the server. Storage accounts disable Shared Key authentication, Event Hubs namespaces disable local authentication, Recovery Services vaults disable public networking, and new NFS file shares use RootSquash and encryption in transit; HTTPS, TLS 1.2, and disabled anonymous blob access remain defaults. Upgrading does not reconfigure existing resources, and omitted options preserve existing file-share and Event Hubs settings. Expanded endpoint validation and filtered telemetry are also included, while Azure Communication Services email and SMS send tools are excluded in read-only mode.

Microsoft recommends reviewing the complete 3.x changelog before upgrading from 2.0 or a preview. Changes can affect saved calls, renamed resiliency tools, response formats, configuration namespaces, database operations and permissions, VM image and sizing requirements, and custom HTTP clients using the stateless MCP protocol dated 2026-07-28. A documented read-only trial uses Node.js LTS, Azure CLI, an Azure subscription, a compatible MCP client, and @azure/mcp@3.0.0 in VS Code; Microsoft advises using limited permissions and a development subscription before enabling write tools.