County IT allows Copilot to use an MCP server against production SQL for read assistance but must prevent schema changes through that channel. What policy should they apply?

Denying MCP write tools so Copilot cannot mutate production schema or data through MCP is the policy county IT should apply when Copilot uses an MCP server against production SQL for read assistance. Read-oriented tools can help analysts understand schemas and draft queries; write, delete, and DDL tools turn an AI assistant into an unsupervised change channel on live municipal databases. Explicitly denying write tools enforces that production MCP remains an inspection aid, not a deployment path.

Enabling every MCP write and DDL tool for faster Copilot experimentation in production fails by concept—speed does not justify uncontrolled schema change on live systems. Storing production sa credentials in the MCP tool configuration grants maximum privilege to the AI channel and embeds a secret where prompts and logs may expose it. Allowing unrestricted MCP deletes on ledger tables to simplify cleanup demos risks irreversible integrity and compliance damage.

Exam caveat: Prefer staging MCP with broader tools and production MCP with read-only tools. If write is ever required, gate it behind separate identities, change tickets, and non-Copilot deployment pipelines. DP-800 security-for-AI-tooling questions emphasize least privilege on tool surfaces, not only on SQL logins.

Operational check: Configure the production MCP server’s tool allow-list to include metadata/read query helpers only; omit insert/update/delete/DDL. Attempt a write tool call via Copilot and confirm denial. Ensure MCP uses a low-privilege Entra identity without sa/db_owner. Audit MCP invocations, prohibit sa in tool configs, and keep a staging MCP environment for experimentation with writes.