feat (iac): [networking] add MCP subnet - #106
Open
ferantivero wants to merge 6 commits into
Open
Conversation
Prepare the workload virtual network for privately hosted MCP servers: - reserve a dedicated /24 subnet - delegate the subnet to Microsoft.App/environments - expose the subnet name and resource ID Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Apply deny-by-default controls for a future Container Apps environment: - allow required platform, DNS, load-balancer, and intra-subnet traffic - allow access to workload private endpoints - attach the NSG to the reserved MCP subnet Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Enable the private MCP request path within the workload virtual network: - allow Foundry Agent outbound HTTPS to the MCP subnet - allow matching inbound HTTPS on the MCP subnet Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Control private MCP server outbound traffic through Azure Firewall: - associate the MCP subnet with the egress route table - allow required Container Apps platform dependencies - wire the MCP subnet into the firewall module Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Clarify how agents reach public and private MCP servers: - describe firewall-controlled public MCP egress - identify the reserved private MCP subnet - note that the Container Apps environment is not deployed Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Document the Container Apps load-balancer probe rule lifecycle: - retain the required dynamic allocation range initially - narrow the NSG rule after Azure assigns the immutable ports Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds networking foundations for future private MCP servers hosted in Azure Container Apps.
Changes:
- Reserves and secures a delegated MCP subnet.
- Adds agent connectivity and firewall-controlled MCP egress.
- Documents private and public MCP traffic flows.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
README.md |
Documents MCP networking behavior. |
infra-as-code/bicep/network.bicep |
Adds the subnet, NSG rules, and outputs. |
infra-as-code/bicep/main.bicep |
Passes the MCP subnet to the firewall module. |
infra-as-code/bicep/azure-firewall.bicep |
Adds Container Apps and MCP egress policies. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ckittel
requested changes
Jul 27, 2026
ckittel
left a comment
ckittel
left a comment
Member
There was a problem hiding this comment.
Am I missing it? Where does this subnet get configured as being the MCP subnet in our foundry deployment?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WHY
Foundry Agent Service supports private MCP server endpoints when the standard agent setup uses private networking and a dedicated subnet. The RI now provide the networking required for a future internal ACA environment that host MCP servers
WHAT
/24MCP subnetTEST
e2e passed