Microsoft Azure package v1.1.0

A Microsoft Entra access token for a dedicated least-privilege app registration, held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Bearer', one separating space, then the token — 'Bearer <token>'. customer_vault is the only generally-supported production custody model here — identity_federation and customer_broker are refused at startup and inline is lab-only. The reviewed token process is the OAuth 2.0 client credentials grant against the v2.0 endpoint: an external deployment process holds the app registration's client id and client secret, POSTs grant_type=client_credentials with scope=https://management.azure.com/.default to https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token, receives an access token (Microsoft documents expires_in, approximately one hour), and writes the complete header value under this reference; there are no refresh tokens in this flow, so renewal is the external process repeating the grant — the executor injects the stored value verbatim and performs no token lifecycle itself.

Revocation is removing the client secret from the app registration or disabling the app: that stops future token issuance (a repeated grant fails closed), but the client credentials flow has no refresh tokens and no documented per-token revocation — an already-minted token remains valid until its expiry (approximately one hour), so treat the token lifetime as the exposure window. A certificate client assertion is the documented stronger alternative to a shared secret and is the deployment's review.

Least privilege: RBAC Reader on the subscription covers the three ARM inventory reads; for the Cost Management query, Microsoft's cost-scope documentation shows subscription Reader already grants read-only access to Cost Analysis, Forecast and the Query API, so plain Reader can suffice — the purpose-built Cost Management Reader role is the tighter alternative, and Enterprise Agreement subscriptions additionally require the 'AO view charges' billing setting to be enabled.

Grant nothing broader.

Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

Every endpoint here is on the shared Azure management host management.azure.com, which stays real — it is the documented authority for ARM, not a tenant placeholder. SUBSCRIPTION_ID is a path placeholder the deployment binds to a concrete subscription before enabling; the paths are otherwise the documented ARM shapes with pinned api-version query values, and the review binds those versions — Microsoft documents api-version as required on every one of these operations.

The credential targets login.microsoftonline.com for token minting, which is also a real shared host, but token minting is the external process's call, not a capability: the executor injects the minted value and never calls the token endpoint itself, so no capability allowlists it.

Approval classification: all four capabilities sit at R0, the read floor. The Cost Management query is a POST by HTTP shape but a read by effect — the request body is a query definition (type, timeframe, dataset with aggregation, grouping and filter) and the response is rows of cost data; nothing is created or changed at the provider. It is registered as read with the POST shape stated plainly in the description, the same honesty the GCP pack applies to getIamPolicy.

Cost data is financial at the read floor — a lower bound: an R0 financial read can still be a serious confidentiality risk. The read moves no money, so no cost ceiling is declared on the AAES action; per-request API behaviour at the provider is the deployment's review.

Documented exclusions for the Resource Manager reads: this pack does not register resource group or resource create/update/delete, deployments (Microsoft.Resources/deployments), role assignments or any Microsoft.Authorization write, Microsoft.Billing operations, Cost Management exports (which write query results to storage), or tenant- and management-group-scope variants of the registered lists — subscription scope only, except azure.subscriptions.list, which is the tenant-level subscriptions collection (GET /subscriptions) by design. Every list read here describes the collection read only — single-resource reads and resource-group-scoped resource listing are not registered by this pack.

Azure OpenAI and Foundry administration (added in 1.1.0): seven capabilities on the same ARM host manage one Microsoft.CognitiveServices account through the Azure AI Services account-management API, api-version 2024-10-01: deployments (list, create or update, delete), content filters, which ARM calls raiPolicies (list, create or update, delete), and access-key rotation (regenerateKey). SUBSCRIPTION_ID, RESOURCE_GROUP, ACCOUNT_NAME, DEPLOYMENT_NAME and RAI_POLICY_NAME are path placeholders to bind before enabling. The two list reads use this pack's read-only token. The writes name a separate reference, secret-ref-azure-cognitiveservices-admin-token, minted by the same client-credentials process for a second app registration that holds write rights on that one account only; the Reader registration above never gets them.

Tiers sit at the floor of the declared actions. Creating or updating a deployment declares pay because provisioned SKUs bill hourly per deployed PTU until the deployment is deleted. Key rotation declares delete and share: the old key is destroyed and the response carries both current keys. Changing a content filter is R2 by the action floor, and policy should raise it for production. Every other operation in the account-management API is excluded: the rest of the Accounts group (including listKeys, create, update and delete), Deleted Accounts, Commitment Plans and Tiers, Defender for AI Settings, Encryption Scopes, Models, Model Capacities and their calculation, Network Security Perimeter Configurations, Private Endpoint Connections and Private Link Resources, Rai Blocklists and their items, Rai Content Filters, Resource Skus, Usages, and the availability checks. Single-deployment and single-filter reads are not registered. Azure Reservations purchases and the Foundry data-plane and inference endpoints are outside this API and are not registered.