Connect Azure MCP Server to Conduit

This walkthrough connects the Azure MCP Server (Azure cloud tooling, in Conduit’s network category) to Conduit. It authenticates as a Microsoft Entra service principal — you supply the Entra tenant’s Directory ID plus the service principal’s Application ID and client secret, and Conduit’s Azure MCP Server uses them to obtain Azure management tokens.

Menu labels can change

The Entra steps below reflect the Azure-portal flow at time of writing; menu labels can shift between releases. If a label differs, see Microsoft’s guide to creating a service principal and the Azure MCP Server overview.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• Permission in your Microsoft Entra tenant to create an app registration (service principal) and to assign it Azure roles on the subscriptions you want the AI to see.

Step 1 — Create a service principal in Microsoft Entra

1. Follow Microsoft’s guide to register an application and create a client secret.
2. Collect three values:
   • The Directory (tenant) ID of the Entra tenant.
   • The Application (client) ID of the app registration.
   • The client secret value (shown once, at creation).
3. Grant the service principal an Azure role (for example Reader) on the subscriptions or resource groups you want the AI to work with — Azure tools can only see what the principal has been given access to.

Caution

Copy the client secret value now and store it somewhere safe — the portal shows it only at creation. Don’t paste it into chat, email, or a shared document; the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the secret, delete it in Entra and create a new one; the exposed secret becomes useless immediately.

Step 2 — Connect Azure MCP Server in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Azure MCP Server in the catalog (under Network) and click Connect. Expected: a credential form with three fields.
3. Fill the fields:
   • Azure Tenant ID (required) — the Directory (tenant) ID of the Entra tenant.
   • Service Principal Client ID (required) — the Application (client) ID of the service principal.
   • Service Principal Client Secret (required) — the client secret value for the service principal.
4. Click Connect. Expected: Conduit validates immediately by requesting an Azure management token from Microsoft Entra with the service principal, then shows a green Connected status. A bad tenant ID, client ID, or secret is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this Azure connection. (For per-technician service principals, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Azure tool, such as listing subscriptions or resource groups. You should get real data back, and the call appears in your audit log with the correct user, vendor (azure-mcp), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Tenant ID, Client ID, and Client Secret are all required.”	One of the three fields was left empty. All three values are mandatory.
Connect fails with “Azure service principal rejected. Check the tenant ID, client ID, and secret.”	Entra refused the sign-in — a wrong or expired secret, a client ID that doesn’t exist in that tenant, or a tenant ID typo. Re-copy all three values from the app registration and reconnect.
Connect fails with “Microsoft Entra is unavailable (HTTP …). Try again shortly.”	A transient Entra-side outage. Wait a moment and retry.
Connect fails with “Could not reach Microsoft Entra: …”	Conduit couldn’t reach the Entra token endpoint at all (network error or timeout). Retry; if it persists, check Azure’s service status.
Connected, but tool calls return no subscriptions or resources	Validation only proves the service principal can sign in. If it has no Azure RBAC role assignments, it can’t see anything — grant it a role (for example Reader) on the subscriptions you want visible.
Tool calls return 403 “no credentials for vendor”	Azure MCP Server isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a credential.
Need to rotate the secret	Create a new client secret on the app registration in Entra, then update the credential at /org/catalog. Delete the old secret once the new one is connected.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.