Microsoft Azure AuthorizationManagementClient

Name: AuthorizationManagementClient API
Brand: AuthorizationManagementClient
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthorizationoauth219 Endpoints

Install Jentic One Beta

Connect the AuthorizationManagementClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AuthorizationManagementClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with AuthorizationManagementClient API.

Create, list, and delete role assignments at subscription, resource group, or resource scope

Manage custom role definitions including allowed actions, notActions, and assignable scopes

Enumerate the effective permissions a principal has at a given scope

GET STARTED

Start building with AuthorizationManagementClient API

Explore with Jentic

View OpenAPI Document

For Agents

Manage Azure RBAC role assignments and role definitions, enumerate permissions, and elevate access - the identity control plane for Azure resources, callable by an AI agent.

Use for: I need to grant a service principal Reader on a resource group, List all role assignments on my subscription, Create a custom role that only allows starting and stopping VMs, Find the permissions a user has at a specific resource scope

Not supported: Does not authenticate users, manage Azure AD identities, or enforce policy compliance - use for RBAC role assignment and definition management on Azure resources only.

Use Cases

Patterns agents use AuthorizationManagementClient API for, with concrete tasks.

★ Programmatic Access Provisioning

Platform engineering teams running automation pipelines need to grant service principals or managed identities access to specific Azure scopes as part of resource provisioning. The role assignments endpoint creates the assignment in a single PUT, taking the principal ID, role definition ID, and scope. Assignments propagate quickly enough to be used in the same pipeline run.

PUT a roleAssignments/{roleAssignmentId} resource with the target principalId, roleDefinitionId, and scope to grant access, then verify by GETting the assignment back.

Custom Role Authoring

Security teams building least-privilege custom roles need to know which provider operations exist before defining the role's actions and notActions. The providerOperations endpoint returns the full list per provider, which is then used to compose a role definition. The custom role is created via PUT on roleDefinitions/{roleDefinitionId} with a fresh GUID.

GET providerOperations/{resourceProviderNamespace} for each in-scope provider, build the role definition's actions and notActions arrays, and PUT a new roleDefinitions resource with the composed permissions.

Access Audit and Cleanup

Compliance audits require a snapshot of who has what access where. Listing role assignments at the subscription scope (and recursing into nested resources) produces the access map. Combined with directory lookups, this drives quarterly access reviews and the targeted removal of stale assignments via DELETE on the role assignment resource.

List role assignments at the subscription scope, filter to principals not in the active directory, and DELETE each stale assignment by its assignment ID.

Effective Permission Check

Before letting an agent call a write operation on a resource, an orchestrator can call the permissions endpoint to confirm the calling principal has the necessary actions. This prevents partial failures mid-pipeline and surfaces missing permissions early so they can be granted before retrying.

GET /resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions, check the returned actions list for the required action string, and proceed only if it is present.

Agent-Driven RBAC Operations via Jentic

An AI ops agent provisioning Azure resources for a new project can use Jentic to grant the project's managed identity Contributor on a fresh resource group without holding the tenant admin token. Jentic returns the schema for role assignment creation and the agent supplies principal, role, and scope, with credentials staying in the vault.

Search Jentic for 'create an Azure role assignment', execute the PUT with principalId, roleDefinitionId, and scope, and verify the resulting assignment exists.

Key Endpoints

19 endpoints — authorizationmanagementclient is the azure resource manager api for role-based access control (rbac).

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments

List role assignments at the subscription scope

GET

/providers/Microsoft.Authorization/providerOperations

List all provider operations metadata

GET

/providers/Microsoft.Authorization/providerOperations/{resourceProviderNamespace}

List operations for a specific resource provider

GET

/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions

Get effective permissions on a resource group

POST

/providers/Microsoft.Authorization/elevateAccess

Elevate to User Access Administrator for tenant root scope

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments

List role assignments at the subscription scope

GET

/providers/Microsoft.Authorization/providerOperations

List all provider operations metadata

GET

/providers/Microsoft.Authorization/providerOperations/{resourceProviderNamespace}

List operations for a specific resource provider

GET

/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions

Get effective permissions on a resource group

POST

/providers/Microsoft.Authorization/elevateAccess

Elevate to User Access Administrator for tenant root scope

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'grant Reader to a service principal' or 'list Azure role assignments', and Jentic returns the matching role assignment operation with its principalId, roleDefinitionId, and scope schema so the agent calls the right endpoint without looking up role GUIDs by hand.

Time to first call

FAQs

Specific to using AuthorizationManagementClient API through Jentic.

What authentication does the AuthorizationManagementClient use?

Azure Active Directory OAuth 2.0 bearer tokens scoped to https://management.azure.com/. The calling principal must hold a role with Microsoft.Authorization/roleAssignments/write to manage assignments. Jentic securely stores the AAD token and supplies a scoped session at call time.

Can I create custom roles with this API?

Yes. PUT to /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} with a body containing roleName, description, actions, notActions, and assignableScopes. Custom role IDs are GUIDs you generate; the role is then assignable just like built-in roles.

What are the rate limits for the AuthorizationManagementClient?

Calls go through Azure Resource Manager and are subject to ARM throttling - typically 12,000 reads and 1,200 writes per hour per subscription. RBAC writes have additional propagation latency; allow up to a few minutes for assignments to take effect across all regions.

How do I list role assignments through Jentic?

Search Jentic for 'list Azure role assignments'. Jentic returns the schema for GET /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments; execute it with your subscription ID. The response is a paged list of assignments including principalId, roleDefinitionId, and scope.

Is the AuthorizationManagementClient free?

RBAC management calls do not have a per-request charge; access control is a foundational Azure capability included with the platform. Calls still count toward ARM throttling budgets, so design read-heavy automations with caching.

What does the elevateAccess endpoint do?

POST to /providers/Microsoft.Authorization/elevateAccess grants the calling principal the User Access Administrator role at the tenant root scope, which is required to manage RBAC across all subscriptions including those the principal is not assigned to. This is a break-glass capability for global admins; the assignment must be removed manually after use.

Can I limit what my agent is allowed to do with the AuthorizationManagementClient?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials your agent may use. This API puts the subscription, resource group, and resource name in the URL path, such as /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments, so a rule can pin the agent to a specific scope. You also choose which operations it can call, so destructive ones like deleting a role assignment or the tenant-wide elevateAccess call stay out of reach unless you add them.