Deploying the OfficeAgent.NET MCP Server to Azure

#dotnet #ai #mcp #sharepoint

OfficeAgent.NET ships an MCP server that gives AI agents tools to edit real Word documents through typed, validated change plans. You can start it locally with a few commands:

dotnet tool install --global OfficeAgent.Mcp
officeagent-mcp --stdio

This is perfect if you want to use it with locally running agents such as Claude Code or Codex. But local is not always enough. Hosting becomes necessary in these cases:

Hosted agents. Copilot Studio and Microsoft 365 Copilot can only consume MCP over streamable HTTP at a public HTTPS endpoint.
Unattended automation. A document workflow that runs on schedule or on events needs the server running somewhere that isn't a laptop.
Shared server for a team. Instead of every user holding SharePoint credentials in a local config, one hosted instance holds them once, and clients get a URL.

This article shows how to deploy that endpoint to Azure Container Apps, connect it to your SharePoint document storage, and secure it with built-in authentication (Easy Auth).

What you need before you start

Before you start the deployment you need to prepare the following:

1. The container image. This article uses a prebuilt image available on the GitHub Container Registry:

ghcr.io/ilia-sokolov/officeagent-mcp:latest

Feel free to use it. If your policy requires your own registry, build the image from the Dockerfile in the repository, push it to your registry, and replace the reference - the steps are the same.

2. Your tenant id. In the
Entra admin center, it's on the Overview page.

3. An app registration for SharePoint access. OfficeAgent works through
providers: you define which document storage the agents may reach. It ships a filesystem provider and a SharePoint provider; for a hosted server,
SharePoint is the best option. The server needs its own identity to reach the documents:

In the Entra admin center, open App registrations and create a new registration. Name it (e.g. officeagent-sharepoint), keep the defaults, and register it. Copy the Application (client) ID.
On the app's Certificates & secrets page, create a new client secret. Copy its Value right away - it is shown only once.
Under API permissions, add a permission: pick Microsoft Graph, then Application permissions. Add Sites.Selected (least privilege - the app reaches only sites you explicitly grant) or Sites.ReadWrite.All (simpler, but every site in the tenant). Then grant admin consent.
If you chose Sites.Selected, grant the app Write access to the specific site or sites, for example with PnP PowerShell:

Grant-PnPAzureADAppSitePermission `
    -AppId "<app-client-id>" `
    -DisplayName "<app-name>" `
    -Site "<site-url>" `
    -Permissions Write

Deploy MCP in Azure portal

Create the app:

In the Azure portal, create a new Container App resource. Pick a resource group, name the app (e.g. officeagent-mcp), and let it create a new Container Apps environment.
On the Container tab: uncheck Use quickstart image. Name the container (e.g. officeagent-mcp), set Image source to Docker Hub or other registries, Image type to Public, set Registry login server to ghcr.io, and set Image and tag to ilia-sokolov/officeagent-mcp:latest.
The Environment variables grid is at the bottom of the same tab. Add the six variables from the table below.

These values configure the server's SharePoint connection:

Variable	Value
`OfficeAgent__SharePointConnections__0__ConnectionId`	`documents`
`OfficeAgent__SharePointConnections__0__AuthMode`	`appOnly`
`OfficeAgent__SharePointConnections__0__TenantId`	your tenant id
`OfficeAgent__SharePointConnections__0__ClientId`	the SharePoint app's client id
`OfficeAgent__SharePointConnections__0__ClientSecret`	the SharePoint app's client secret
`OfficeAgent__SharePointConnections__0__RegistrationIndexPath`	`/tmp/officeagent-index.json`

In this article we set up appOnly: the server acts as one application
identity for every caller. The provider also supports an on-behalf-of
flow, where the server acts as the signed-in user and SharePoint permissions
apply per user. See the
deployment guide
if you need that.

On the Ingress tab: enable ingress, accept traffic from anywhere, target port 8080.
Create the app. To verify, open https://<app-url>/healthz, where <app-url> is the URL of the created container app. It should return {"status":"ok",...}.

The endpoint is available now, but anyone can call it. Let's fix that by
enabling authentication.

Turn on Easy Auth:

In the created Container App, open the Authentication page (you'll find it under Security) and click Add identity provider. Pick Microsoft.
Let the form create the app registration for you. Leave App registration type on Create new app registration, give it a name (e.g. officeagent-easyauth). Under Additional checks, set Client application requirement to Allow requests from any application. The wizard creates the registration, the secret, and the wiring in one step.
Set Restrict access to Require authentication and Unauthenticated requests to HTTP 401 Unauthorized - this is an API, not a website; a login redirect would only confuse MCP clients.
Save. https://<app-url>/healthz now returns 401. The client must send an Entra bearer token for the Easy Auth app. You can check this using the following script:

TOKEN=$(az account get-access-token --resource api://<easyauth-client-id> --query accessToken -o tsv)
curl -H "Authorization: Bearer $TOKEN" https://<app-url>/healthz