Microsoft Azure ManagedServiceIdentityClient

Name: ManagedServiceIdentityClient API
Brand: ManagedServiceIdentityClient
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory Servicesoauth27 Endpoints

Install Jentic One Beta

Connect the ManagedServiceIdentityClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the ManagedServiceIdentityClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with ManagedServiceIdentityClient API.

Provision user-assigned managed identities in a resource group

List user-assigned managed identities across a subscription or resource group

Update tags or properties on an existing managed identity via PATCH

GET STARTED

Start building with ManagedServiceIdentityClient API

Explore with Jentic

View OpenAPI Document

For Agents

Provision and manage Azure user-assigned managed identities through Azure Resource Manager. Use for identity resource lifecycle, not for assigning RBAC roles or granting access to specific resources.

Use for: Create a user-assigned managed identity 'app-identity' in resource group 'prod-app', List all user-assigned managed identities in my subscription, Find managed identities assigned to a specific resource group, Update tags on the 'pipeline-identity' managed identity

Not supported: Does not assign RBAC roles, manage system-assigned identities, or issue tokens directly - use only for Microsoft.ManagedIdentity user-assigned identity resource lifecycle.

Use Cases

Patterns agents use ManagedServiceIdentityClient API for, with concrete tasks.

★ Provision Identities for Workload Authentication

Platform teams give applications a stable identity by provisioning user-assigned managed identities once and attaching them to compute resources (VMs, App Services, AKS clusters). The PUT on /userAssignedIdentities/{resourceName} returns the principalId and clientId - the values downstream resources use to obtain AAD tokens. Identities can be reused across resources, simplifying secret-free authentication patterns.

PUT a user-assigned managed identity 'app-prod-identity' in resource group 'app-prod' at westeurope, then return the principalId and clientId from the response so downstream RBAC role assignments can reference it.

Identity Inventory and Cleanup

Security teams audit which user-assigned managed identities exist, when they were created, and whether they are still attached to any resource. UserAssignedIdentities_ListBySubscription returns the full set; combined with Resource Graph queries for identity assignment, this surfaces orphan identities safe to delete. Removing unused identities reduces the AAD service principal sprawl.

List UserAssignedIdentities in the subscription, return name, principalId, and resource group for each, and flag identities not referenced by any resource for follow-up deletion.

Managed Identity Tag Governance

Compliance teams enforce tagging on managed identities to attribute usage and cost allocation. UserAssignedIdentities_Update (PATCH on the identity) lets an automation set or update tags such as costCenter, owner, or environment without altering the identity's principal or client IDs. Updates are atomic and do not require token refresh on dependent resources.

PATCH each user-assigned managed identity in resource group 'prod-app' to set tags costCenter=CC-1234 and owner=platform-team.

AI Agent Identity Provisioning

Platform agents that automate landing zone setup use Jentic to discover the managed identity creation operation. Searching for 'create azure user assigned managed identity' returns the schema; the agent loads it and executes against management.azure.com using a token retrieved from your Jentic One instance, so identity provisioning runs as part of larger landing zone automations without bundling the ManagedServiceIdentity SDK.

Use Jentic to search 'create azure user assigned managed identity', load the UserAssignedIdentities_CreateOrUpdate schema, and PUT the identity in the requested resource group, returning principalId for use in subsequent RBAC role assignment.

Key Endpoints

7 endpoints — jentic publishes the only available openapi specification for managedserviceidentityclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}

Create or update a user-assigned managed identity

GET

/subscriptions/{subscriptionId}/providers/Microsoft.ManagedIdentity/userAssignedIdentities

List user-assigned identities in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities

List user-assigned identities in a resource group

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}

Delete a user-assigned managed identity

PATCH

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}

Update an identity's tags or properties

GET

/providers/Microsoft.ManagedIdentity/operations

List Microsoft.ManagedIdentity provider operations

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}

Create or update a user-assigned managed identity

GET

/subscriptions/{subscriptionId}/providers/Microsoft.ManagedIdentity/userAssignedIdentities

List user-assigned identities in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities

List user-assigned identities in a resource group

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}

Delete a user-assigned managed identity

PATCH

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Azure AD credential for the ManagedIdentity control plane is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'list user-assigned managed identities' or 'read a managed identity', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

Time to first call

FAQs

Specific to using ManagedServiceIdentityClient API through Jentic.

Why is there no official OpenAPI spec for ManagedServiceIdentityClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call ManagedServiceIdentityClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the ManagedServiceIdentityClient use?

AAD OAuth 2.0 bearer tokens scoped to https://management.azure.com/. With Jentic, AAD client credentials live in the encrypted vault and a short-lived bearer token is injected into the Authorization header at call time.

Does this API assign RBAC roles to the managed identity?

No. RBAC role assignments are made through the Microsoft.Authorization provider (roleAssignments). This client only creates, updates, and deletes the identity resource itself; once you have its principalId, you assign roles separately.

What are the rate limits for the ManagedServiceIdentityClient?

Standard Azure Resource Manager throttling - typically 12,000 reads and 1,200 writes per hour per subscription per region. Identity create operations on /userAssignedIdentities/{resourceName} are normally synchronous and return the principalId and clientId in the response body.

How do I create a managed identity through Jentic?

Run pip install jentic, then search Jentic for 'create azure user assigned managed identity'. Jentic returns the UserAssignedIdentities_CreateOrUpdate schema; load it, supply the resource group, identity name, and location, and PUT to /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}.

Can I create system-assigned identities with this API?

No. System-assigned identities are toggled on the parent resource (for example, on a VM via Microsoft.Compute) and cannot exist independently. This client is only for user-assigned identities, which are independent ARM resources.

Can I limit what my agent is allowed to do with the Microsoft Azure Managed Identity API?

Yes. Because you self-host Jentic One, your own rules decide which operations and credentials the agent may use, and the identity name sits in the URL path, so you can pin the agent to read-only work such as listing user-assigned managed identities across a subscription or resource group. You choose the operations it may call, so creating, updating, or deleting an identity is excluded unless you explicitly add it. The Azure AD credential is stored by your own instance and injected only for the calls you permit.

Microsoft Azure ManagedServiceIdentityClient

Connect the ManagedServiceIdentityClient to your agent

Capabilities

Start building with ManagedServiceIdentityClient API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs