Add Azure Backup MCP ToolSet - Drop1

.github/CODEOWNERS

@@ -94,6 +94,12 @@
 # ServiceLabel: %tools-Authorization
 # ServiceOwners:                       @vurhanau @xiangyan99
 
+# PRLabel: %tools-AzureBackup
+/tools/Azure.Mcp.Tools.AzureBackup/        @shrja @microsoft/azure-mcp
+
+# ServiceLabel: %tools-AzureBackup
+# ServiceOwners:                           @shrja
+
 # ServiceLabel: %tools-AzCLI
 # ServiceOwners:                       @JasonYeMSFT @microsoft/azure-mcp
 

Directory.Packages.props

@@ -37,6 +37,9 @@
     <PackageVersion Include="Azure.ResourceManager.MySql" Version="1.1.2" />
     <PackageVersion Include="Azure.ResourceManager.PostgreSql" Version="1.3.1" />
     <PackageVersion Include="Azure.ResourceManager.Redis" Version="1.5.1" />
+    <PackageVersion Include="Azure.ResourceManager.RecoveryServices" Version="1.1.1" />
+    <PackageVersion Include="Azure.ResourceManager.RecoveryServicesBackup" Version="1.3.0" />
+    <PackageVersion Include="Azure.ResourceManager.DataProtectionBackup" Version="1.7.0" />
     <PackageVersion Include="Azure.ResourceManager.Resources" Version="1.11.1" />
     <PackageVersion Include="Azure.ResourceManager.RedisEnterprise" Version="1.2.1" />
     <PackageVersion Include="Azure.ResourceManager.ResourceHealth" Version="1.1.0-beta.5" />

Microsoft.Mcp.slnx

@@ -126,6 +126,14 @@
     <Project Path="tools/Azure.Mcp.Tools.Authorization/tests/Azure.Mcp.Tools.Authorization.LiveTests/Azure.Mcp.Tools.Authorization.LiveTests.csproj" />
     <Project Path="tools/Azure.Mcp.Tools.Authorization/tests/Azure.Mcp.Tools.Authorization.UnitTests/Azure.Mcp.Tools.Authorization.UnitTests.csproj" />
   </Folder>
+  <Folder Name="/tools/Azure.Mcp.Tools.AzureBackup/" />
+  <Folder Name="/tools/Azure.Mcp.Tools.AzureBackup/src/">
+    <Project Path="tools/Azure.Mcp.Tools.AzureBackup/src/Azure.Mcp.Tools.AzureBackup.csproj" />
+  </Folder>
+  <Folder Name="/tools/Azure.Mcp.Tools.AzureBackup/tests/">
+    <Project Path="tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.LiveTests/Azure.Mcp.Tools.AzureBackup.LiveTests.csproj" />
+    <Project Path="tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.UnitTests/Azure.Mcp.Tools.AzureBackup.UnitTests.csproj" />
+  </Folder>
   <Folder Name="/tools/Azure.Mcp.Tools.AzureBestPractices/" />
   <Folder Name="/tools/Azure.Mcp.Tools.AzureBestPractices/src/">
     <Project Path="tools/Azure.Mcp.Tools.AzureBestPractices/src/Azure.Mcp.Tools.AzureBestPractices.csproj" />

servers/Azure.Mcp.Server/Azure.Mcp.Server.slnx

@@ -87,6 +87,14 @@
     <Project Path="../../tools/Azure.Mcp.Tools.Authorization/tests/Azure.Mcp.Tools.Authorization.LiveTests/Azure.Mcp.Tools.Authorization.LiveTests.csproj" />
     <Project Path="../../tools/Azure.Mcp.Tools.Authorization/tests/Azure.Mcp.Tools.Authorization.UnitTests/Azure.Mcp.Tools.Authorization.UnitTests.csproj" />
   </Folder>
+  <Folder Name="/tools/Azure.Mcp.Tools.AzureBackup/" />
+  <Folder Name="/tools/Azure.Mcp.Tools.AzureBackup/src/">
+    <Project Path="../../tools/Azure.Mcp.Tools.AzureBackup/src/Azure.Mcp.Tools.AzureBackup.csproj" />
+  </Folder>
+  <Folder Name="/tools/Azure.Mcp.Tools.AzureBackup/tests/">
+    <Project Path="../../tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.LiveTests/Azure.Mcp.Tools.AzureBackup.LiveTests.csproj" />
+    <Project Path="../../tools/Azure.Mcp.Tools.AzureBackup/tests/Azure.Mcp.Tools.AzureBackup.UnitTests/Azure.Mcp.Tools.AzureBackup.UnitTests.csproj" />
+  </Folder>
   <Folder Name="/tools/Azure.Mcp.Tools.AzureBestPractices/" />
   <Folder Name="/tools/Azure.Mcp.Tools.AzureBestPractices/src/">
     <Project Path="../../tools/Azure.Mcp.Tools.AzureBestPractices/src/Azure.Mcp.Tools.AzureBestPractices.csproj" />

servers/Azure.Mcp.Server/README.md

@@ -922,6 +922,18 @@ For full configuration options, see the [Sovereign Clouds documentation](https:/
 * "List the deployments for web app 'my-webapp' in 'my-resource-group'"
 * "Get the deployment 'deployment-id' for web app 'my-webapp' in 'my-resource-group'"
 
+### 🛡️ Azure Backup
+
+* "Create a Recovery Services vault named 'myvault' in resource group 'myRG' in eastus"
+* "Get details of backup vault 'myvault' in resource group 'myRG'"
+* "Create a backup policy for Azure VMs in vault 'myvault'"
+* "List protectable items in my backup vault"
+* "Check backup status for my Azure resource"
+* "Get recovery points for a protected item"
+* "Find unprotected resources in my subscription"
+* "Check soft delete and immutability settings on my vault"
+* "Enable cross-region restore on my vault"
+
 ### 🖥️ Azure CLI Generate
 
 * Generate Azure CLI commands based on user intent
@@ -1119,6 +1131,7 @@ The Azure MCP Server provides tools for interacting with **43+ Azure service are
 - 🎤 **Azure AI Services Speech** - Speech-to-text recognition and text-to-speech synthesis
 - ⚙️ **Azure App Configuration** - Configuration management
 - 🕸️ **Azure App Service** - Web app hosting
+- 🛡️ **Azure Backup** - Recovery Services vault management, backup policies, protection, jobs, recovery points, governance, and disaster recovery
 - 🛡️ **Azure Best Practices** - Secure, production-grade guidance
 - 🖥️ **Azure CLI Generate** - Generate Azure CLI commands from natural language
 - 📞 **Azure Communication Services** - SMS messaging and communication

servers/Azure.Mcp.Server/changelog-entries/shrja-add-azure-backup-toolset.yaml

@@ -0,0 +1,3 @@
+changes:
+  - section: "Features Added"
+    description: "Add Azure Backup toolset with 15 commands for vault management, backup policies, protection, jobs, recovery points, governance, and disaster recovery"

servers/Azure.Mcp.Server/docs/azmcp-commands.md

@@ -580,6 +580,180 @@ azmcp appservice database add --subscription "my-subscription" \
 -   `--connection-string`: Custom connection string (optional - auto-generated if not provided)
 -   `--tenant`: Azure tenant ID for authentication (optional)
 
+### Azure Backup Operations
+
+#### Vault
+
+```bash
+# Creates a new backup vault. Specify --vault-type as 'rsv' for a Recovery Services vault or 'dpp' for a Backup vault (Data Protection). Returns the created vault details.
+# ✅ Destructive | ❌ Idempotent | ❌ OpenWorld | ❌ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup vault create --subscription <subscription> \
+                               --resource-group <resource-group> \
+                               --vault <vault> \
+                               --location <location> \
+                               [--vault-type <vault-type>] \
+                               [--sku <sku>] \
+                               [--storage-type <storage-type>]
+
+# Retrieves backup vault information. When --vault and --resource-group are specified, returns detailed information about a single vault including type, location, SKU, and storage redundancy. When omitted, lists all backup vaults (RSV and Backup vaults) in the subscription, optionally filtered by --vault-type ('rsv' or 'dpp').
+# ❌ Destructive | ✅ Idempotent | ❌ OpenWorld | ✅ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup vault get --subscription <subscription> \
+                            [--resource-group <resource-group>] \
+                            [--vault <vault>] \
+                            [--vault-type <vault-type>]
+
+# Updates vault-level settings including storage redundancy, soft delete, immutability, and managed identity.
+# ✅ Destructive | ✅ Idempotent | ❌ OpenWorld | ❌ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup vault update --subscription <subscription> \
+                               --resource-group <resource-group> \
+                               --vault <vault> \
+                               [--vault-type <vault-type>] \
+                               [--redundancy <redundancy>] \
+                               [--soft-delete <soft-delete>] \
+                               [--soft-delete-retention-days <soft-delete-retention-days>] \
+                               [--immutability-state <immutability-state>] \
+                               [--identity-type <identity-type>] \
+                               [--tags <tags>]
+```
+
+#### Policy
+
+```bash
+# Creates a backup policy for a specified workload type with schedule and retention rules.
+# ✅ Destructive | ❌ Idempotent | ❌ OpenWorld | ❌ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup policy create --subscription <subscription> \
+                                --resource-group <resource-group> \
+                                --vault <vault> \
+                                --policy <policy> \
+                                [--vault-type <vault-type>] \
+                                [--workload-type <workload-type>] \
+                                [--schedule-frequency <schedule-frequency>] \
+                                [--schedule-time <schedule-time>] \
+                                [--daily-retention-days <daily-retention-days>] \
+                                [--weekly-retention-weeks <weekly-retention-weeks>] \
+                                [--monthly-retention-months <monthly-retention-months>] \
+                                [--yearly-retention-years <yearly-retention-years>]
+
+# Retrieves backup policy information. When --policy is specified, returns detailed information about a single policy including datasource types and protected items count. When omitted, lists all backup policies configured in the vault.
+# ❌ Destructive | ✅ Idempotent | ❌ OpenWorld | ✅ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup policy get --subscription <subscription> \
+                             --resource-group <resource-group> \
+                             --vault <vault> \
+                             [--vault-type <vault-type>] \
+                             [--policy <policy>]
+```
+
+#### Protected Item
+
+```bash
+# Retrieves protected item information. When --protected-item is specified, returns detailed information about a single backup instance including protection status, datasource details, policy assignment, and last backup time. When --protected-item is omitted, lists all protected items in the vault.
+# ❌ Destructive | ✅ Idempotent | ❌ OpenWorld | ✅ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup protecteditem get --subscription <subscription> \
+                                    --resource-group <resource-group> \
+                                    --vault <vault> \
+                                    [--vault-type <vault-type>] \
+                                    [--protected-item <protected-item>] \
+                                    [--container <container>]
+
+# Enables backup protection for a resource by creating a protected item or backup instance.
+# ✅ Destructive | ❌ Idempotent | ❌ OpenWorld | ❌ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup protecteditem protect --subscription <subscription> \
+                                        --resource-group <resource-group> \
+                                        --vault <vault> \
+                                        --datasource-id <datasource-id> \
+                                        --policy <policy> \
+                                        [--vault-type <vault-type>] \
+                                        [--container <container>] \
+                                        [--datasource-type <datasource-type>]
+```
+
+#### Protectable Item
+
+```bash
+# Lists protectable items (SQL databases, SAP HANA databases) discovered in the Recovery Services vault.
+# ❌ Destructive | ✅ Idempotent | ❌ OpenWorld | ✅ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup protectableitem list --subscription <subscription> \
+                                       --resource-group <resource-group> \
+                                       --vault <vault> \
+                                       [--vault-type <vault-type>] \
+                                       [--workload-type <workload-type>] \
+                                       [--container <container>]
+```
+
+#### Backup
+
+```bash
+# Checks whether a datasource is protected and returns vault and policy details.
+# ❌ Destructive | ✅ Idempotent | ❌ OpenWorld | ✅ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup backup status --subscription <subscription> \
+                                --datasource-id <datasource-id> \
+                                --location <location>
+```
+
+#### Job
+
+```bash
+# Retrieves backup job information. When --job is specified, returns detailed information about a single job. When omitted, lists all backup jobs in the vault.
+# ❌ Destructive | ✅ Idempotent | ❌ OpenWorld | ✅ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup job get --subscription <subscription> \
+                          --resource-group <resource-group> \
+                          --vault <vault> \
+                          [--vault-type <vault-type>] \
+                          [--job <job>]
+```
+
+#### Recovery Point
+
+```bash
+# Retrieves recovery point information for a protected item. When --recovery-point is specified, returns a single recovery point. When omitted, lists all available recovery points.
+# ❌ Destructive | ✅ Idempotent | ❌ OpenWorld | ✅ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup recoverypoint get --subscription <subscription> \
+                                    --resource-group <resource-group> \
+                                    --vault <vault> \
+                                    --protected-item <protected-item> \
+                                    [--vault-type <vault-type>] \
+                                    [--container <container>] \
+                                    [--recovery-point <recovery-point>]
+```
+
+#### Governance
+
+```bash
+# Scans the subscription to find Azure resources that are not currently protected by any backup policy.
+# ❌ Destructive | ✅ Idempotent | ❌ OpenWorld | ✅ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup governance find-unprotected --subscription <subscription> \
+                                              [--resource-type-filter <resource-type-filter>] \
+                                              [--resource-group-filter <resource-group-filter>] \
+                                              [--tag-filter <tag-filter>]
+
+# Configures the immutability state for a backup vault.
+# ✅ Destructive | ✅ Idempotent | ❌ OpenWorld | ❌ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup governance immutability --subscription <subscription> \
+                                          --resource-group <resource-group> \
+                                          --vault <vault> \
+                                          [--vault-type <vault-type>] \
+                                          [--immutability-state <immutability-state>]
+
+# Configures the soft delete settings for a backup vault.
+# ✅ Destructive | ✅ Idempotent | ❌ OpenWorld | ❌ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup governance soft-delete --subscription <subscription> \
+                                         --resource-group <resource-group> \
+                                         --vault <vault> \
+                                         [--vault-type <vault-type>] \
+                                         [--soft-delete <soft-delete>] \
+                                         [--soft-delete-retention-days <soft-delete-retention-days>]
+```
+
+#### DR
+
+```bash
+# Enables Cross-Region Restore on a GRS-enabled vault.
+# ✅ Destructive | ✅ Idempotent | ❌ OpenWorld | ❌ ReadOnly | ❌ Secret | ❌ LocalRequired
+azmcp azurebackup dr enablecrr --subscription <subscription> \
+                               --resource-group <resource-group> \
+                               --vault <vault> \
+                               [--vault-type <vault-type>]
+
 #### Web Apps
 
 ```bash

servers/Azure.Mcp.Server/docs/e2eTestPrompts.md

@@ -119,6 +119,41 @@ This file contains prompts used for end-to-end testing to ensure each tool is in
 | appservice_webapp_settings_update-appsettings | Set application setting <setting-name> with <setting-value> to web app <webapp> in <resource_group> |
 | appservice_webapp_settings_update-appsettings | Delete application setting <setting-name> from web app <webapp> in <resource_group> |
 
+## Azure Backup
+
+| Tool Name | Test Prompt |
+|:----------|:----------|
+| azurebackup_vault_create | Create a Recovery Services vault named <vault_name> in resource group <resource_group> in region <location> |
+| azurebackup_vault_create | Set up a new backup vault called <vault_name> in <location> under resource group <resource_group> |
+| azurebackup_vault_get | Get details of Recovery Services vault <vault_name> in resource group <resource_group> |
+| azurebackup_vault_get | Show me information about vault <vault_name> in resource group <resource_group> |
+| azurebackup_vault_update | Update vault <vault_name> in resource group <resource_group> to use GeoRedundant storage |
+| azurebackup_vault_update | Change the redundancy of vault <vault_name> in resource group <resource_group> to LocallyRedundant |
+| azurebackup_policy_create | Create a backup policy named <policy_name> for AzureIaasVM in vault <vault_name> in resource group <resource_group> |
+| azurebackup_policy_create | Set up a new backup policy called <policy_name> for AzureStorage workload in vault <vault_name> under resource group <resource_group> |
+| azurebackup_policy_get | Get backup policy <policy_name> from vault <vault_name> in resource group <resource_group> |
+| azurebackup_policy_get | Show me the details of backup policy <policy_name> in vault <vault_name> under resource group <resource_group> |
+| azurebackup_protecteditem_get | Get protected item details for <item_name> in vault <vault_name> and resource group <resource_group> |
+| azurebackup_protecteditem_get | Show backup status of protected item <item_name> in vault <vault_name> under resource group <resource_group> |
+| azurebackup_protecteditem_protect | Enable backup protection for <item_name> using policy <policy_name> in vault <vault_name> and resource group <resource_group> |
+| azurebackup_protecteditem_protect | Protect item <item_name> with backup policy <policy_name> in vault <vault_name> under resource group <resource_group> |
+| azurebackup_protectableitem_list | List protectable items in vault <vault_name> in resource group <resource_group> |
+| azurebackup_protectableitem_list | Show me all items that can be backed up in vault <vault_name> under resource group <resource_group> |
+| azurebackup_backup_status | Check backup status for resource <resource_id> |
+| azurebackup_backup_status | What is the backup status of <resource_id> in my subscription? |
+| azurebackup_job_get | Get backup job <job_id> from vault <vault_name> in resource group <resource_group> |
+| azurebackup_job_get | Show me the status of backup job <job_id> in vault <vault_name> under resource group <resource_group> |
+| azurebackup_recoverypoint_get | Get recovery points for protected item <item_name> in vault <vault_name> and resource group <resource_group> |
+| azurebackup_recoverypoint_get | List available recovery points for <item_name> in vault <vault_name> under resource group <resource_group> |
+| azurebackup_governance_find-unprotected | Find unprotected resources of type <datasource_type> in my subscription |
+| azurebackup_governance_find-unprotected | Show me Azure resources that are not backed up for datasource type <datasource_type> |
+| azurebackup_governance_immutability | Check immutability status of vault <vault_name> in resource group <resource_group> |
+| azurebackup_governance_immutability | Is immutability enabled on vault <vault_name> in resource group <resource_group>? |
+| azurebackup_governance_soft-delete | Check soft delete configuration for vault <vault_name> in resource group <resource_group> |
+| azurebackup_governance_soft-delete | Is soft delete enabled on vault <vault_name> in resource group <resource_group>? |
+| azurebackup_dr_enablecrr | Enable cross-region restore on vault <vault_name> in resource group <resource_group> |
+| azurebackup_dr_enablecrr | Turn on cross-region restore for vault <vault_name> under resource group <resource_group> |
+
 ## Azure Application Insights
 
 | Tool Name | Test Prompt |