Azure MCP Server 3.0 ships. Read the database warning first

Microsoft released Azure MCP Server 3.0 on October 12, and if you are piping Azure operations through agents, this is the upgrade that changes what an agent can touch. It is the third major release of the open-source MCP server for Azure tools, built on roughly 50 beta iterations, and it brings more of the everyday Azure control plane into agent workflows: backups, resilience drills, SRE incidents, Terraform exports, cost optimization, monitoring, Cosmos DB, IoT Hub. The surface got much bigger.

Start with the sharp edges, because they are the most important paragraph in the release notes. The MySQL and PostgreSQL query tools are destructive, non-idempotent, and non-read-only. SQL-verb filtering has been removed, and in consolidated mode these tools moved under a query-execution command. Translation: an agent holding these tools can write to your databases, and the old safety net that filtered SQL verbs is gone. Microsoft says to use least-privilege database permissions, and the signed-in identity's permissions determine what is allowed. That is correct and it is also the part people skip. Before this server touches production data, the database identity it uses should not have write rights it does not need.

The safer direction is the one Microsoft demonstrates first: start read-only. The release ships a read-only mode (npx -y @azure/mcp@3.0.0 server start --read-only), and the announcement's own example prompt begins with "List the Azure Advisor recommendations for my subscription and explain one cost recommendation. Don't apply changes." Microsoft's line is worth quoting back to anyone wiring this up: "a natural-language prompt isn't a substitute for access controls." The new security defaults point the same way: new storage accounts disable Shared Key authentication, new Event Hubs namespaces disable local authentication, new Recovery Services vaults disable public networking, new NFS shares get RootSquash and encryption in transit. These defaults do not reconfigure anything you already have on upgrade, so existing resources keep their current posture.

A few upgrade gotchas from the release notes themselves. Tool discovery changed, so remove obsolete parameters from saved calls and scripts. Response parsing changed (Advisor recommendations now use ARM-style properties; log queries use results wrappers). Namespaces moved from Azure.Mcp.Core. to Microsoft.Mcp.Core., which will break logging filters you hardcoded. The server speaks the stateless MCP protocol revision 2026-07-28, and custom HTTP clients must send Mcp-Method and Mcp-Name headers on every POST. And there is one breaking rename to grep for: resilience_ tool prefixes became resiliency_.

The pitch underneath is sensible: clearer tool descriptions, opt-in structured output, consistent error codes (missing resources are now 404s, not 500s), and a CLI --learn flag that lets you explore commands without executing them. A reported 39 percent startup gain is scoped to targeted CLI invocations only, not the server as a whole; Microsoft says so itself, which is good labeling to quote.

The operator move: test 3.0 in a dev subscription with read-only mode and a scoped identity, recheck your parsers against the new response shapes, and audit every saved prompt that touches database tools before upgrading anything shared. More tools means more capability for agents, and more capability is exactly when the permissions deserve a second look.

What remains unknown: how many of the 50 beta iterations changed tool behavior in ways not in the release notes, and whether the new tool surface introduces agent-prompt-injection paths through tool descriptions (the descriptions got "clearer," which cuts both ways). No test installation was performed for this briefing.

Related: the MCP 2026-07-28 spec guide covers the stateless protocol this server implements, llms.txt and the prompt-injection wave is the context-injection threat that bigger tool surfaces invite, and Microsoft's Copilot Autopilot usage billing tracks the other half of agent economics on Microsoft's platform.