[Karan Singh (karansinghneu)]

What does this PR do?

Adds .arg.core.windows.net to the domain suffixes that KustoClient accepts, so the Kusto tools can query Azure
Resource Graph (ARG) Kusto endpoints such as
https://<name>.arg.core.windows.net/providers/Microsoft.ResourceGraph/connector/kusto/<connector>. Today the tools
reject these URIs before sending a request.

• The new entry has an inline comment that links to Kusto tools reject Azure Resource Graph Kusto endpoints (*.arg.core.windows.net) #4028, which explains why ARG needs its own suffix.
• Nothing else needs to change. KustoClient keeps the URI's path when it appends /v1/rest/query or
  /v1/rest/mgmt, and GetKustoScope() returns https://kusto.kusto.windows.net/.default, the audience in ARG's auth
  metadata.
• The existing SSRF checks still apply: HTTPS only, and the name before the suffix must be valid hostname segments.
  The Kusto SDKs' well-known endpoints already include this suffix.

Tests added to KustoClientTests:

• Accepts *.arg.core.windows.net URIs, with and without the connector path.
• Rejects the bare suffix (https://arg.core.windows.net) and a look-alike host (*.arg.core.windows.net.example.com).
• For a path-based ARG URI, sends the query to <uri>/v1/rest/query and requests the Kusto scope.

Without the new suffix the three acceptance tests fail; with it, all 69 KustoClientTests pass. dotnet format --verify-no-changes and cspell pass on the changed files.

GitHub issue number?

Fixes #4028

Pre-merge Checklist

• Required for All PRs
  • Read contribution guidelines
  • PR title clearly describes the change
  • Commit history is clean with descriptive messages (cleanup guide)
  • Added comprehensive tests for new/modified functionality
  • Created a changelog entry if the change falls among the following: new feature, bug fix, UI/UX update, breaking change, or updated dependencies. Follow the changelog entry guide
• For MCP tool changes: not applicable. No tool, option, or description changes.
  • One tool per PR: This PR adds or modifies only one MCP tool for faster review cycles
  • Updated servers/Azure.Mcp.Server/README.md and/or servers/Fabric.Mcp.Server/README.md documentation
  • Validate README.md changes running the script ./eng/scripts/Process-PackageReadMe.ps1. See Package README
  • For new or modified tool descriptions (excluding Fabric MCP tools), ran ToolDescriptionEvaluator and obtained a score of 0.4 or more and a top 3 ranking for all related test prompts
  • For tools with new names, including new tools or renamed tools, update consolidated-tools.json
  • For renamed tools, follow the Tool Rename Checklist and tag the PR with the breaking-change label
  • For new tools associated with Azure services or publicly available tools/APIs/products, add URL to documentation in the PR description
• Extra steps for Azure MCP Server tool changes: not applicable.
  • Updated command list in servers/Azure.Mcp.Server/docs/azmcp-commands.md
  • Ran ./eng/scripts/Update-AzCommandsMetadata.ps1 to update tool metadata in azmcp-commands.md (required for CI)
  • Updated test prompts in servers/Azure.Mcp.Server/docs/e2eTestPrompts.md

Invoking Livetests

Copilot submitted PRs are not trustworthy by default. Users with write access to the repo need to validate the contents of this PR before leaving a comment with the text /azp run mcp - pullrequest - live. This will trigger the necessary livetest workflows to complete required validation.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

Thank you for your contribution Karan Singh (@karansinghneu)! We will review the pull request and get back to you soon.

[Copilot]

🟢 Approval recommended

The narrowly scoped allow-list addition has focused regression coverage and no identified blocking issues.

No open issues 🎉

What changed in this PR

This PR enables the existing Kusto tools to accept Azure Resource Graph endpoints under *.arg.core.windows.net, addressing #4028 without changing request construction or authentication.

Changes:

• Adds the ARG domain suffix to Kusto URI validation while preserving existing security checks.
• Adds regression tests for valid endpoints, rejected look-alike hosts, connector-path preservation, and token scope.
• Records the fix in the Azure MCP Server changelog.

File	Description
tools/​Azure.Mcp.Tools.Kusto/​tests/​Azure.Mcp.Tools.Kusto.Tests/​KustoClientTests.cs	Tests ARG validation, request paths, and authentication scope.
tools/​Azure.Mcp.Tools.Kusto/​src/​Services/​KustoClient.cs	Allows the public-cloud ARG endpoint suffix.
servers/​Azure.Mcp.Server/​changelog-entries/​karanrsingh-kusto-arg-endpoints.yaml	Documents the endpoint acceptance fix.

_{Review effort: Balanced}

[Steven Vukelich (vukelich)]

one small comment