Azure MCP Server: policy_assignment_list fails at management-group scope ("Only resource in a subscription is supported") - still reproducible in 3.0.0-beta.49 #3963

Title: Azure MCP Server: policy_assignment_list fails at management-group scope ("Only resource in a subscription is supported") — still reproducible in 3.0.0-beta.49

Summary

policy_assignment_list fails when the target scope is an Azure management group. Subscription-level enumeration works fine; management-group-level enumeration fails with:

Only resource in a subscription is supported

This is still reproducible in 3.0.0-beta.49, despite a related support case being closed/archived as if resolved.

Root cause

Azure.Mcp.Tools.Policy.Services.PolicyService.ListPolicyAssignmentsAsync resolves any non-empty scope via:

armClient.GetGenericResource(new ResourceIdentifier(scope)).GetAsync()

then calls .GetPolicyAssignments() on the result.

A management-group scope (/providers/Microsoft.Management/managementGroups/{id}) is not a generic ARM resource reachable through that GET surface — it's owned by Microsoft.Management, not subscription/resource-group scoped — so the generic-resource GET throws before policy assignments can even be listed.

Repro steps

1. Call policy_assignment_list with scope = a subscription ID → succeeds.
2. Call policy_assignment_list with scope = a management group ID (/providers/Microsoft.Management/managementGroups/{mgId}) → fails with "Only resource in a subscription is supported."
3. Confirmed on both 2.0.5 and 3.0.0-beta.49.
4. subscription_list and group_list (management group list) both work correctly — only policy-assignment enumeration at MG scope is affected.
5. Native Azure Policy REST API / Azure Resource Graph (PolicyResources table) correctly enumerate policy assignments at management-group scope — confirming this is an Azure MCP Server defect, not an ARM/Policy service limitation.

Expected behavior

policy_assignment_list should enumerate policy assignments at management-group scope, matching native Azure Policy REST API behavior.

Suggested fix

Bypass the generic-resource GET for management-group scopes. Use the scope-based extension method armClient.GetPolicyAssignments(new ResourceIdentifier(scope)) (from Azure.ResourceManager.Resources), or route management-group scopes through the typed ManagementGroupResource.GetPolicyAssignments() path, rather than funneling every scope through GetGenericResource.

Impact

Blocking a customer's Foundry-based Azure Policy governance agent — specifically the management-group portion of policy discovery, inheritance analysis, policy rationalization, and compliance workflows. Customer requests:

1. GitHub issue / tracking ID for the defect (this issue)
2. Planned fix version
3. Estimated timeline / release window
4. Whether a preview build containing the fix can be provided for validation
5. Any supported interim workaround within Azure MCP itself

Interim workaround (customer-facing, until fixed)

• Subscription-level policy_assignment_list is unaffected and works today.
• For management-group-level enumeration, use Azure Resource Graph (PolicyResources table, scoped to the management group) or the raw Azure Policy REST API directly.

Environment

• Azure MCP Server versions tested: 2.0.5, 3.0.0-beta.49
• Related support case: TrackingID#2608260040008728 (archived/closed prematurely — defect persists)