Can AI agents automate Microsoft Azure?

Microsoft Azure resource management is automatable today through Azure Resource Manager. This record is the Azure cloud control plane, not Azure DevOps, not Microsoft Entra ID as a standalone directory product, and not Microsoft 365. ARM is the management layer for create, update, and delete of Azure resources. Microsoft states that capabilities available in the Azure portal are also available through REST, the Azure CLI, PowerShell, and client SDKs. Control-plane calls go to https://management.azure.com with an api-version query parameter and a Bearer token from Microsoft Entra ID. Documented grants are authorization code for interactive clients and client credentials for unattended service principals. Managed identities are a documented way for Azure-hosted callers and the Azure CLI to obtain those tokens without storing a secret. Official client libraries cover .NET, Java, Node.js, Python, Go, C++, and Rust. The Azure CLI is a cross-platform official tool with JSON output, interactive login, service-principal login, and managed-identity login; Microsoft now requires MFA for Entra user identities on the CLI, so unattended scripts should use a workload identity. Event Grid can push Azure service and resource-group or subscription system events to HTTPS webhooks. Microsoft documents a first-party Azure MCP Server, packaged as Azure.Mcp, @azure/mcp, and msmcp-azure, with a broad service tool catalog. In supported hosts the tools start disabled and Microsoft lists a GitHub Copilot subscription plus Azure RBAC as prerequisites. The local server is intended for developer use. Connector catalogs were not opened. Computer-use viability is unassessed. API scores 8 and is the best path because it is the durable ARM contract. CLI also scores 8 as a maintained wrapper over that contract. MCP scores 7: official and useful, with host and identity gates.

Best path today: api · Overall automatability: 8/10