[ONBOARD] Add read-only AKS maintenance configuration list/get support #3957

Service / Tool Name

Azure Kubernetes Service (AKS): maintenance configuration reads within the existing aks namespace.

Contacts

Requester: sho-harmonicinc Microsoft service/tool owner: not identified; please route to the Azure MCP and AKS teams.

Intended Agent Scenarios

We use Azure MCP Server to let an agent inspect Azure infrastructure through a hosted MCP endpoint. We need to audit which of the AKS clusters across multiple subscriptions have preferred maintenance windows configured, and report their schedules. This is a customer feature request for Microsoft’s consideration, rather than a proposal to own or implement the tool. Could the Azure MCP/AKS maintainers confirm whether this scenario is in scope and whether Microsoft would consider implementing it?

Current Environment

• Azure Function App with a custom handler running @azure/mcp.
• Deployed version: 3.0.0-beta.41.
• Authentication to Azure uses the Function App's managed identity.
• The identity has Reader and Monitoring Reader at subscription scope.
• The server runs in read-only mode.

Capability Gap

The available AKS tools expose cluster and node-pool reads, but not maintenance configuration list/get operations. Maintenance configurations are separate child resources, so cluster metadata alone does not answer this question.

The published beta.49 and 3.0.0 GA AKS command registrations also contain only cluster and node-pool reads. This is based on source inspection, not deployment testing of those versions.

The proxied ARM Resource Graph query tool does not provide arbitrary ARM GET requests. We have not observed an authorization denial for the maintenance API; the agent currently has no exposed operation to attempt that read.

Requested Behavior

Provide read-only operations to list a cluster's maintenance configurations and retrieve one by name, covering:

• default
• aksManagedAutoUpgradeSchedule
• aksManagedNodeOSUpgradeSchedule

Return the configured recurrence, start time, UTC offset, duration, and exclusion periods where applicable. Handle pagination and distinguish “no configuration exists” from failed or incomplete checks.

These reads require Microsoft.ContainerService/managedClusters/maintenanceConfigurations/read, which is already covered by Reader. No write operations or Kubernetes credentials are requested.

Questions for Maintainers

1. Is this scenario in scope for future Azure MCP support?
2. Would dedicated AKS tools or generic read-only ARM GET/list support be the preferred approach?
3. Is there an existing tracking item, planned release, or contribution path?

References

• AKS maintenance configuration list API
• Published 3.0.0 AKS command registration

Timeline

TBD. We are initially requesting confirmation of whether Microsoft intends to support this scenario and guidance on the preferred implementation path. No fixed delivery deadline.