Skip to content

[FEATURE] Update MCP tools which create resources to disable local authentication when possible #3217

Description

Describe the bug

  • Currently MCP tools are mute on whether or not they disable local authentication. By policy, several services (eventhubs, storage, cosmosdb, etc) have local authentication disabled which means that those MCP tools cannot be used on those subscriptions.

The proposal is to disable local authentication by default on these tools to align the tools to Microsoft's overall guidance w.r.t. local authentication.

This is a breaking change to those tools, but it may allow those tools to work in more scenarios and helps to guide customers to a non-connectionstring/sas token world.

Copilot analysis of the area:

Confirmed affected (resource type has a documented local-auth-disable property):

  1. Storage — StorageService.cs (via CreateOrUpdateGenericResourceAsync — this is why my earlier .CreateOrUpdateAsync( grep missed it; Storage doesn't call the typed SDK method directly)
  2. Sql — SqlService.cs:701 (SQL Server — Azure AD-only auth)
  3. Redis — RedisService.cs:139 (Azure Cache for Redis — disableAccessKeyAuthentication )
  4. EventHubs — EventHubsService.cs:243 (Namespace — DisableLocalAuth ), confirming your correction

Ruled out on inspection (create/update ARM resources, but no local-auth ARM surface on that resource type): Compute (VM/VMSS/Disk/NIC/VNet/NSG), AppService (site config sub-resource), FileShares (share/snapshot — inherit from parent storage account, not separately toggled), Monitor (Web Tests), AzureBackup (Recovery Services/Backup Vaults, Policies), Workbooks, StorageSync (service/sync group/endpoints), ManagedLustre (filesystem/jobs), AzureMigrate (migration project).

Worth a second look, not fully confirmed: MySql ( GetMySqlFlexibleServerConfigurations().CreateOrUpdateAsync — MySQL Flexible Server has an authConfig.passwordAuth toggle, but this call updates generic server parameters, not authConfig specifically) and LoadTesting ( GetLoadTestingResources().CreateOrUpdateAsync — unsure if this resource type exposes a local-auth property).

Revised total: 4 confirmed tools/resources affected — Storage, Sql, Redis, EventHubs Namespace — with MySql and LoadTesting flagged for follow-up verification.

Copilot analysis of the impacted test bicep files:

Test bicep files: 45 total

Disable local auth (10 files) — via disableLocalAuth: true or allowSharedKeyAccess: false :
AppConfig, EventHubs, FoundryExtensions, AppService, Cosmos, Speech, Search, ServiceBus, Monitor, Storage

Do not disable local auth (35 files) — no disableLocalAuth / allowSharedKeyAccess: false found:
Core (2), Acr, Aks, Authorization, AzureBackup, AzureIsv, AzureMigrate, Communication, Compute, ConfidentialLedger, Deploy, EventGrid, FileShares, FunctionApp, Grafana, IoTHub, KeyVault, Kusto, LoadTesting, ManagedLustre, Marketplace, Postgres, Pricing, Quota, Redis, ResilienceManagement, ResourceHealth, ServiceFabric, SignalR, Sql, SreAgent, StorageSync, VirtualDesktop, Workbooks

Note: AzureBackup and FunctionApp explicitly set allowSharedKeyAccess: true (local auth intentionally enabled, likely required by the scenario), so those may need to stay as-is rather than be "fixed."

Files needing updates: Of the 35, only a subset deploy resource types that actually support a local-auth-disable property (Storage-like accounts, Cosmos-like DBs, EventHub/ServiceBus-like namespaces, Cognitive Services, App Config, Key Vault via enableRbacAuthorization , SQL via AAD-only auth, Redis, Kusto, SignalR, IoTHub, etc.). Resource groups, ACR RBAC-only tools (Authorization, Compute, Deploy, Quota, Pricing, Marketplace, ResourceHealth, ServiceFabric, VirtualDesktop, AzureMigrate, AzureIsv, SreAgent, ResilienceManagement) largely don't provision an auth-bearing data-plane resource, so a full determination of "must update" requires a resource-by-resource review rather than a blanket 35. I'd recommend a follow-up pass per-file if you want an exact number — happy to do that if useful.

Connection strings in MCP tools

Yes — three tools build/use raw connection strings for their own data-plane operations (not just codegen for user apps):

• Postgres ( DbProvider.cs , PostgresResource.cs ) — builds a connection string (with Entra ID token support) to connect to Postgres.
• MySql ( MySqlService.cs ) — builds connection strings via MySqlConnectionStringBuilder , supports Entra ID token as password.
• AppService ( DatabaseAddCommand.cs ) — accepts/generates a ConnectionString option to wire a database into an App Service.

Additionally, Monitor's instrumentation generators emit Application Insights connection strings into user code templates (not used internally by MCP for auth).

Expected behavior

MCP tools should be able to be used on subscriptions like the Azure SDK Playground Subscription or Microsoft Dev Subscriptions

Actual behavior

MCP tools cannot be used on those subscriptions.

Reproduction Steps

Log into your dev subscription. Attempt to create an eventhubs namespace using the eventhubs_eventhub_namespace_update tool.

Environment

No response

Metadata

Metadata

Labels

enhancementNew feature or requestneeds-triageWorkflow: This is a new issue that needs to be triaged to the appropriate team.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions