Azure

The Azure plugin provides access to the following resources from Microsoft Azure:

Knowledge Graph nodes

VM Instances
VM Scale Sets and Instances
SQL Databases
PostgreSQL Databases
MySQL Databases
Cosmos DB Accounts
Load Balancers
Application Gateways
Storage Accounts
Managed Disks
Virtual Networks and Subnets
Network Security Groups
Network Interfaces
Public IP Addresses
AKS Clusters

Metrics

VM Instances:

Percentage CPU
Network In/Out
Disk Read/Write Bytes
Disk Read/Write Operations/Sec
Available Memory Bytes
CPU Credits Remaining/Consumed

VM Scale Sets:

Percentage CPU
Network In/Out Total
Disk Read/Write Bytes
Disk Read/Write Operations/Sec
CPU Credits Remaining/Consumed

SQL Databases:

CPU Percent
Physical Data Read Percent
Log Write Percent
DTU Consumption Percent
Storage Percent
Connection Successful/Failed
Blocked by Firewall
Deadlocks
Workers/Sessions Percent

PostgreSQL Databases:

CPU Percent
Memory Percent
IO Consumption Percent
Storage Percent/Used/Limit
Active Connections
Connections Failed
Network Bytes Ingress/Egress
Max Lag Across Replicas
Backup Storage Used

MySQL Databases:

CPU Percent
Memory Percent
IO Consumption Percent
Storage Percent/Used/Limit
Active Connections
Connections Failed
Seconds Behind Master (replicas)
Network Bytes Ingress/Egress
Backup Storage Used

Cosmos DB Accounts:

Total Request Units
Total Requests
Autoscale Max Throughput
Provisioned Throughput
Available Storage
Data/Index Usage
Document Count/Quota
Replication Latency
Service Availability

Load Balancers:

VIP/DIP Availability
Byte Count
Packet Count
SYN Count
SNAT Connection Count
Allocated/Used SNAT Ports

Application Gateways:

Throughput
Healthy/Unhealthy Host Count
Response Status (2xx/3xx/4xx/5xx)
Backend Response Status
Backend Connect/Request/Response Time
Current Connections
Failed Requests
Total Requests
Current Capacity Units

Storage Accounts:

Used Capacity
Transactions
Ingress/Egress
Success Server/E2E Latency
Availability
Blob Capacity/Count
File Capacity/Count/Share Count

AKS Clusters:

Node CPU Usage Percentage
Node Memory Working Set Percentage
Node Disk Usage Percentage
Node Network In/Out Bytes
Kube Pod Status Ready/Phase
Cluster Autoscaler Metrics
Unneeded Nodes Count
Unschedulable Pods Count

MCP Tools

get_realtime_vm_status: Get real-time status information for an Azure VM instance
get_sql_database_status: Get status information for an Azure SQL database

Prerequisites

You should have Azure credentials configured through one of the following methods:

Azure CLI: Use az login to authenticate with the Azure CLI
Service Principal: Set environment variables AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID
Managed Identity: If running on Azure infrastructure (VMs, App Service, etc.)
Visual Studio Code: If you have the Azure Account extension installed and authenticated
Azure PowerShell: If you have authenticated using Azure PowerShell

The plugin follows the standard Azure credential provider chain.

Required Permissions

The Azure plugin requires read-only access to various Azure resources. Below is the recommended Azure RBAC (Role-Based Access Control) configuration.

Option 1: Use Built-in Reader Role (Recommended for Getting Started)

The simplest approach is to assign the built-in Reader role at the subscription level:

# Get your subscription ID
SUBSCRIPTION_ID=$(az account show --query id -o tsv)

# Assign Reader role to your service principal or managed identity
az role assignment create \
  --assignee <your-service-principal-id-or-user> \
  --role "Reader" \
  --scope "/subscriptions/$SUBSCRIPTION_ID"

This provides read access to all resources in the subscription, which is sufficient for the plugin to build the knowledge graph and retrieve metrics.

Option 2: Custom Role with Minimal Permissions (Recommended for Production)

For production environments, create a custom role with only the permissions needed by Unpage:

{
  "Name": "Unpage Reader",
  "Description": "Minimal read-only permissions for Unpage infrastructure knowledge graph",
  "Actions": [
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/instanceView/read",
    "Microsoft.Compute/virtualMachineScaleSets/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read",
    "Microsoft.Compute/disks/read",
    "Microsoft.Sql/servers/read",
    "Microsoft.Sql/servers/databases/read",
    "Microsoft.DBforPostgreSQL/servers/read",
    "Microsoft.DBforPostgreSQL/servers/databases/read",
    "Microsoft.DBforMySQL/servers/read",
    "Microsoft.DBforMySQL/servers/databases/read",
    "Microsoft.DocumentDB/databaseAccounts/read",
    "Microsoft.Network/loadBalancers/read",
    "Microsoft.Network/applicationGateways/read",
    "Microsoft.Network/virtualNetworks/read",
    "Microsoft.Network/virtualNetworks/subnets/read",
    "Microsoft.Network/networkSecurityGroups/read",
    "Microsoft.Network/networkInterfaces/read",
    "Microsoft.Network/publicIPAddresses/read",
    "Microsoft.Storage/storageAccounts/read",
    "Microsoft.ContainerService/managedClusters/read",
    "Microsoft.Insights/metrics/read",
    "Microsoft.Resources/subscriptions/resourceGroups/read"
  ],
  "NotActions": [],
  "AssignableScopes": [
    "/subscriptions/<your-subscription-id>"
  ]
}

To create and assign this custom role:

# Save the JSON above to a file named unpage-reader-role.json
# Update <your-subscription-id> with your actual subscription ID

# Create the custom role
az role definition create --role-definition unpage-reader-role.json

# Assign the custom role
az role assignment create \
  --assignee <your-service-principal-id-or-user> \
  --role "Unpage Reader" \
  --scope "/subscriptions/$SUBSCRIPTION_ID"

Permissions Breakdown

The custom role includes permissions for:

Compute: Read access to VMs, VM Scale Sets, and managed disks
Databases: Read access to SQL, PostgreSQL, MySQL, and Cosmos DB resources
Networking: Read access to load balancers, application gateways, virtual networks, subnets, NSGs, network interfaces, and public IPs
Storage: Read access to storage accounts
AKS: Read access to managed Kubernetes clusters
Monitoring: Read access to Azure Monitor metrics for all resources
Resource Groups: List and read resource groups in the subscription

These permissions are read-only and follow the principle of least privilege.

Configuration

Configure the Azure plugin by running uv run unpage configure or by editing the ~/.unpage/profiles/<profile_name>/config.yaml file:

plugins:
  # ...
  azure:
    enabled: true
    # Optional: specify subscription details
    settings:
      subscriptions:
        default:
          subscription_id: "your-subscription-id"
          tenant_id: "your-tenant-id"  # Optional

If no subscription is specified, the plugin will use the default subscription from your Azure credentials.

Tools

The Azure plugin provides the following tools to Agents and MCP Clients:

get_realtime_vm_status

Get real-time status information for an Azure VM instance directly from Azure API.Arguments

string

required

The Azure VM name.

string

required

The Azure resource group name containing the VM.

Returns dict | string: A dictionary containing VM status information or an error message if the VM couldn’t be found.Example response:

{
  "name": "my-vm",
  "power_state": "VM running",
  "provisioning_state": "Succeeded",
  "statuses": [
    {
      "code": "PowerState/running",
      "display_status": "VM running",
      "time": "2024-01-15T10:30:00Z"
    }
  ]
}

get_sql_database_status

Get status information for an Azure SQL database.Arguments

string

required

The Azure SQL database name.

string

required

The Azure SQL server name hosting the database.

string

required

The Azure resource group name containing the SQL server.

Returns dict | string: A dictionary containing database status and configuration details or an error message if the database couldn’t be found.Example response:

{
  "name": "my-database",
  "status": "Online",
  "edition": "Standard",
  "service_objective": "S1",
  "max_size_bytes": 268435456000,
  "collation": "SQL_Latin1_General_CP1_CI_AS",
  "creation_date": "2024-01-10T08:00:00Z"
}

About Unpage

Core Concepts

Example Agents

Plugins

How-To Guides

Command Reference

Prerequisites

Required Permissions

Option 1: Use Built-in Reader Role (Recommended for Getting Started)

Option 2: Custom Role with Minimal Permissions (Recommended for Production)

Permissions Breakdown

Configuration

Tools

get_realtime_vm_status

get_sql_database_status

​Prerequisites

​Required Permissions

​Option 1: Use Built-in Reader Role (Recommended for Getting Started)

​Option 2: Custom Role with Minimal Permissions (Recommended for Production)

​Permissions Breakdown

​Configuration

​Tools

get_realtime_vm_status

get_sql_database_status

Prerequisites

Required Permissions

Option 1: Use Built-in Reader Role (Recommended for Getting Started)

Option 2: Custom Role with Minimal Permissions (Recommended for Production)

Permissions Breakdown

Configuration

Tools