{ "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:27:53.457Z", "record_id": "VXI-EXT-TOOL-TRUST-AZURE-01-v1", "record_kind": "external_reference", "title": "Azure MCP: Caller identity and deployment boundaries", "system": "Azure MCP Server", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Can an agent assume a locally running cloud connector is isolated from production or has limited authority?", "near_questions": [ "Does a local cloud connector keep production credentials isolated?", "Which Azure identity does an MCP tool use?", "Do Azure RBAC permissions constrain MCP operations?", "Can a broadly privileged server act for a less privileged caller?", "What must protect a remote self-hosted Azure MCP endpoint?", "Does Microsoft permit production credentials in local Azure MCP?", "Can Azure MCP run deployment operations?", "Does a local MCP process prove local-only model processing?", "What should be checked before enabling updated cloud tools?", "How should an agent distinguish Azure tenant and subscription?", "What does a saved Azure access review preserve?", "Does this profile verify my gateway or role assignments?" ], "supported_claims": [ { "claim": "Microsoft documents Azure MCP access through Entra identities and Azure RBAC. A local process can still act with the developer's cloud permissions. Remote self-hosted deployments require protection of both the caller boundary and the server's execution identity. Microsoft explicitly excludes production data and credentials from its local-server guidance; this review does not verify a deployed gateway or role assignment.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "Microsoft documents Azure MCP access through Entra identities and Azure RBAC. A local process can still act with the developer's cloud permissions. Remote self-hosted deployments require protection of both the caller boundary and the server's execution identity. Microsoft explicitly excludes production data and credentials from its local-server guidance; this review does not verify a deployed gateway or role assignment.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-VERCEL-01-v1", "VXI-EXT-TOOL-TRUST-AWS-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "Azure MCP deployment and capabilities", "source_url": "https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/overview", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-AZURE-01-v1", "candidate_record_sha256": "6ec771cd88c3a59f2eeeab5034721e0e5f316a7d579d0f9a7984b1697481ff92", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Microsoft documents Azure MCP access through Entra identities and Azure RBAC. A local process can still act with the developer's cloud permissions. Remote self-hosted deployments require protection of both the caller boundary and the server's execution identity. Microsoft explicitly excludes production data and credentials from its local-server guidance; this review does not verify a deployed gateway or role assignment.", "required_buyer_context": "Microsoft-maintained Azure MCP Server, with local developer and remote self-hosted modes distinguished; excludes Foundry-specific MCP services. Tenant, subscription, role assignments, deployment mode, gateway enforcement and client recipients.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "Azure MCP Server", "variant": "Microsoft-maintained Azure MCP Server, with local developer and remote self-hosted modes distinguished; excludes Foundry-specific MCP services." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Microsoft publishes Azure MCP; the party running a local or self-hosted deployment operates that instance.", "source_ids": [ "azure-main", "azure-security" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Inspect Azure resources and support development, diagnostics and deployment operations.", "source_ids": [ "azure-main" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Resource listings and diagnostic/query data are documented capabilities.", "source_ids": [ "azure-main" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Deployment workflows and other permitted cloud operations can change resources.", "source_ids": [ "azure-main" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Entra ID via Azure Identity is documented; remote guidance requires token and caller validation.", "source_ids": [ "azure-security" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "RBAC applies; broad caller or server identities require explicit restriction and per-caller checks.", "source_ids": [ "azure-security" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "A local server still calls Azure and returns results to the client; local execution alone proves no data residency.", "source_ids": [ "azure-main", "azure-security" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Privileged developer sessions, a server lending its identity to callers, or unreviewed tool changes.", "source_ids": [ "azure-security" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Tenant, subscription, role assignments, deployment mode, gateway enforcement and client recipients.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Do not use the local developer path for production data; verify caller, server identity and target before a remote change.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "azure-main", "url": "https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/overview", "final_url": "https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/overview", "title": "Azure MCP deployment and capabilities", "checked_on": "2026-10-11", "sha256": "14858ee47782900629ac48b88a34e57e6f1c56a583af50095e0a50b1a91f012c", "bytes": 54913 }, { "source_id": "azure-security", "url": "https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/security", "final_url": "https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/security", "title": "Azure MCP identity and deployment security", "checked_on": "2026-10-11", "sha256": "f482b3b01c246d4250d9630e5bc49f562b4774a0eec57add3d8211cc2187b41f", "bytes": 59705 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Save the caller/server-identity and local-versus-remote boundaries behind a cloud-tool review.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Recheck execution identity, caller validation, roles and tool definitions when changing deployment mode." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#azure-mcp-identity-deployment-trust", "machine_readable_record": "/varexis-index/records/azure-mcp-identity-deployment-trust.json" }