Microsoft Azure ManagedServicesClient

Name: ManagedServicesClient API
Brand: ManagedServicesClient
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputeoauth29 Endpoints

Install Jentic One Beta

Connect the ManagedServicesClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the ManagedServicesClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with ManagedServicesClient API.

Create or update a registration definition that grants a managing tenant scoped access to a customer subscription

Assign a registration definition to a customer scope so a service provider can operate on their behalf

List all registration assignments attached to a given Azure scope to audit active delegations

GET STARTED

Start building with ManagedServicesClient API

Explore with Jentic

View OpenAPI Document

For Agents

Manage Azure Lighthouse cross-tenant delegations: create registration definitions, assign them to customer scopes, and revoke access. Useful for MSPs and platform teams onboarding tenants programmatically.

Use for: I need to onboard a new customer tenant to Azure Lighthouse, List all registration assignments under a customer subscription, Get the registration definition that grants my tenant access to a subscription, Revoke a delegated access assignment for a customer scope

Not supported: Does not handle Azure RBAC role assignments inside a single tenant, Azure Policy enforcement, or marketplace billing - use for cross-tenant Azure Lighthouse delegated access management only.

Use Cases

Patterns agents use ManagedServicesClient API for, with concrete tasks.

★ Onboard MSP customer tenants

Managed service providers use the ManagedServices API to programmatically onboard new customer subscriptions to Azure Lighthouse. The API creates a registration definition describing which managing tenant principals get which roles on the customer scope, then attaches a registration assignment so the access becomes active. This replaces the manual marketplace offer flow for repeatable onboarding pipelines.

Create a registration definition granting Reader and Contributor roles to managing tenant principal IDs, then PUT a registration assignment scoped to the customer subscription and confirm provisioningState is Succeeded.

Audit cross-tenant delegations

Security and compliance teams query the registration assignments and definitions endpoints to inventory every cross-tenant access path into a subscription. The List endpoints return all delegations under a given scope so reviewers can verify the managing tenant ID, role definition IDs, and principal authorizations for each active assignment.

Call GET /{scope}/providers/Microsoft.ManagedServices/registrationAssignments with $expand=registrationDefinition and produce a CSV of managing tenant IDs and granted role definitions.

Offboard a managed customer

When an MSP engagement ends, the API revokes delegated access by deleting the registration assignment. The assignment delete is asynchronous and the API returns a 202 with a status URL the agent polls until removal completes. The underlying registration definition can also be deleted once no assignments reference it.

Delete a registration assignment by ID at a customer subscription scope, poll the asynchronous operation until completion, then delete the orphaned registration definition.

Agent-driven Lighthouse provisioning

Through Jentic, an AI agent can search for 'onboard customer tenant to Azure Lighthouse', load the input schema for RegistrationAssignments_CreateOrUpdate, and execute the call with the customer subscription, registration definition ID, and principal authorizations. The agent never sees the Azure access token directly, and Jentic returns structured results the agent can branch on.

Use Jentic search for 'create azure lighthouse registration', load the operation, supply scope and registration definition body, and execute through the Jentic SDK.

Key Endpoints

9 endpoints — jentic publishes the only available openapi specification for managedservicesclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

PUT

/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}

Create or update a registration definition

PUT

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}

Assign a registration definition to a scope

GET

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments

List registration assignments under a scope

GET

/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}

Get a registration definition by ID

DELETE

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}

Revoke a registration assignment

DELETE

/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}

Delete a registration definition

PUT

/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}

Create or update a registration definition

PUT

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}

Assign a registration definition to a scope

GET

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments

List registration assignments under a scope

GET

/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}

Get a registration definition by ID

DELETE

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}

Revoke a registration assignment

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Azure AD client credentials and tenant IDs are stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token scoped to management.azure.com at execution time. The raw secret never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create an azure lighthouse registration assignment' or 'list active cross-tenant delegations', and Jentic returns the matching RegistrationAssignments or RegistrationDefinitions operation with its input schema so the agent calls the right path without reading the Azure REST docs.

Time to first call

FAQs

Specific to using ManagedServicesClient API through Jentic.

Why is there no official OpenAPI spec for ManagedServicesClient?

Microsoft Azure does not publish a standalone OpenAPI specification for the ManagedServices resource provider. Jentic generates and maintains this spec so that AI agents and developers can call ManagedServicesClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the ManagedServices API use?

The API uses Azure Active Directory OAuth 2.0 via the azure_auth flow, with the user_impersonation scope against https://management.azure.com/. Through Jentic, your Azure AD client credentials are stored encrypted in your Jentic One instance and exchanged for a scoped access token at execution time, so the raw secret never enters the agent context.

Can I onboard a customer tenant to Azure Lighthouse with this API?

Yes. Create a registration definition with PUT /{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId} listing the managing tenant ID and the principal-to-role authorizations, then attach it to a customer subscription with PUT /{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}. Both calls are scoped to the customer subscription or resource group.

What are the rate limits for the Azure ManagedServices API?

Azure Resource Manager applies a default subscription-level write throttle of around 1,200 writes per hour and 12,000 reads per hour, surfaced through x-ms-ratelimit-remaining-* response headers. Agents should read those headers and back off when remaining quota approaches zero.

How do I list active delegations for a subscription through Jentic?

Search Jentic for 'list azure lighthouse registration assignments', load the RegistrationAssignments_List operation, and execute with scope set to /subscriptions/{subscriptionId}. Pass $expand=registrationDefinition to include the role authorization payload in the same response.

Is the Azure ManagedServices API free?

The control-plane calls themselves are not billed; you only pay for the underlying Azure resources the managing tenant subsequently operates on. Standard Azure egress and operational charges apply to those workloads.

Does this API support resource group scoped delegations?

Yes. The {scope} path parameter accepts both /subscriptions/{subscriptionId} and /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}, so registration definitions and assignments can be created at either granularity to limit blast radius.

Can I limit what my agent is allowed to do with the Azure ManagedServices API?

Yes. Because you self-host Jentic One, your own rules decide which ManagedServices operations and which stored Azure AD credentials the agent may use. Since the customer scope and the registration definition or assignment ID travel in the URL path, you can pin the agent to a named customer subscription or resource group and its registrations. You also choose the operations it can call, so deleting a registration assignment stays off limits unless you explicitly grant it.

Microsoft Azure ManagedServicesClient

Connect the ManagedServicesClient to your agent

Capabilities

Start building with ManagedServicesClient API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs