Microsoft Azure Azure App Configuration Management Client

What authentication does the Azure App Configuration Management Client use?

The API uses Azure Active Directory OAuth 2.0 bearer tokens (the azure_auth scheme) on management.azure.com. Through Jentic, the AAD app secret is held in your Jentic One instance and exchanged for a short-lived bearer token at execution time, so agents never see the raw secret.

Can I rotate App Configuration access keys with this API?

Yes. POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores/{configStoreName}/RegenerateKey rotates the primary or secondary key in place. Pair it with ListKeys to retrieve the new value for downstream consumers.

How do I read a specific feature flag value through the management plane?

Call POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores/{configStoreName}/listKeyValue with the key and label. This is useful for ad-hoc inspection during incidents without standing up the data plane SDK.

What are the rate limits for this API?

Azure Resource Manager applies subscription-level throttling. Key regeneration and listKeyValue calls are subject to tighter limits because they touch secret material. Honour HTTP 429 Retry-After values and avoid scripting tight loops over RegenerateKey.

How do I provision an App Configuration store and retrieve its connection string through Jentic?

Run pip install jentic, then search Jentic with 'create Azure App Configuration store'. Jentic returns the PUT configurationStores endpoint and the ListKeys endpoint with their schemas. Execute create, then ListKeys to obtain the connection string; the OAuth token is resolved from the vault automatically.

Can I limit what my agent is allowed to do with the Azure App Configuration Management API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and every configuration store is addressed by path parameters, so you can pin the agent to a single subscription, resource group, and named store. You choose which operations it may call, so read-only work like listing and getting stores or reading a key-value can be allowed while destructive operations such as DeleteConfigurationStore or RegenerateKey stay out of reach unless you add them. The Azure AD service principal credential is held by your instance and exchanged for a short-lived bearer token at execution time, so the agent never sees the raw secret.