Microsoft Azure azureactivedirectory

Name: azureactivedirectory API
Brand: Azure Active Directory diagnostic settings
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory Servicesoauth26 Endpoints

Install Jentic One Beta

Connect the azureactivedirectory to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the azureactivedirectory, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with azureactivedirectory API.

List diagnostic settings on the Azure AD tenant resource

Retrieve a specific diagnostic setting by name

Create or update a diagnostic setting routing AAD logs to Log Analytics

GET STARTED

Start building with azureactivedirectory API

Explore with Jentic

View OpenAPI Document

For Agents

Configure where Azure AD sign-in and audit logs are routed by managing diagnostic settings on the aadiam tenant resource.

Use for: I need to send Azure AD sign-in logs to Log Analytics, Stream Azure AD audit logs to an Event Hub, List diagnostic settings on the AAD tenant, Get the named diagnostic setting on microsoft.aadiam

Not supported: Does not manage users, groups, applications, or conditional access - use for tenant-level Azure AD diagnostic settings only.

Use Cases

Patterns agents use azureactivedirectory API for, with concrete tasks.

★ Stream Azure AD logs to Log Analytics

Configure a diagnostic setting that pushes Azure AD AuditLogs and SignInLogs into a Log Analytics workspace for KQL-based investigation. The PUT /providers/microsoft.aadiam/diagnosticSettings/{name} call attaches the workspaceId and selects log categories. The canonical configuration for Sentinel-based AAD monitoring.

PUT /providers/microsoft.aadiam/diagnosticSettings/aad-to-sentinel with workspaceId and logs[].category in (AuditLogs, SignInLogs) enabled, then verify the GET returns enabled=true

Long-term log archival to storage

Send Azure AD logs to a storage account for long-term retention beyond the default Azure AD log window. The same diagnosticSettings PUT accepts a storageAccountId and per-category retention days. Used by compliance teams who need year-scale retention of identity events.

PUT a diagnosticSetting named aad-archive with storageAccountId and per-category retentionPolicy.days set to 365

Event-driven SIEM integration

Stream Azure AD logs into an Event Hub so a non-Microsoft SIEM can subscribe and consume identity events in near real time. The diagnosticSettings PUT supports eventHubAuthorizationRuleId and eventHubName. This is the standard handoff point for Splunk, QRadar, and similar tools.

PUT diagnosticSetting with eventHubAuthorizationRuleId and confirm AuditLogs and SignInLogs categories are enabled

Agent-driven AAD log routing

Allow an AI agent to wire up an Azure AD log sink during environment bring-up without an operator hand-coding the long microsoft.aadiam resource path. Through Jentic the agent searches by intent, loads the diagnostic setting schema, and executes the PUT. Removes a class of typos when constructing the diagnostic settings request body.

Search Jentic for 'configure azure ad diagnostic setting', load the workspaceId and logs[] schema, and execute the PUT against microsoft.aadiam

Key Endpoints

6 endpoints — jentic publishes the only available openapi specification for azure active directory diagnostic settings, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/providers/microsoft.aadiam/diagnosticSettings

List diagnostic settings on the tenant

GET

/providers/microsoft.aadiam/diagnosticSettings/{name}

Get a specific diagnostic setting

PUT

/providers/microsoft.aadiam/diagnosticSettings/{name}

Create or update a diagnostic setting

DELETE

/providers/microsoft.aadiam/diagnosticSettings/{name}

Delete a diagnostic setting

GET

/providers/microsoft.aadiam/diagnosticSettingsCategories

List available log categories

GET

/providers/microsoft.aadiam/operations

List operations on microsoft.aadiam

GET

/providers/microsoft.aadiam/diagnosticSettings

List diagnostic settings on the tenant

GET

/providers/microsoft.aadiam/diagnosticSettings/{name}

Get a specific diagnostic setting

PUT

/providers/microsoft.aadiam/diagnosticSettings/{name}

Create or update a diagnostic setting

DELETE

/providers/microsoft.aadiam/diagnosticSettings/{name}

Delete a diagnostic setting

GET

/providers/microsoft.aadiam/diagnosticSettingsCategories

List available log categories

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'configure azure ad diagnostic setting to log analytics' or 'stream sign-in logs to an event hub', and Jentic returns the matching microsoft.aadiam diagnosticSettings operation with its full request body schema so the agent wires the sink without hand-coding the resource path.

Time to first call

FAQs

Specific to using azureactivedirectory API through Jentic.

Why is there no official OpenAPI spec for the Azure Active Directory diagnostic settings API?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call the Azure Active Directory diagnostic settings API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does this API use?

The API uses Azure AD OAuth 2.0 with the implicit flow, scoped to user_impersonation against management.azure.com. The caller needs a role with Microsoft.aadiam/diagnosticSettings/write on the tenant. Through Jentic, the bearer token is held in your Jentic One instance and exchanged for a scoped access token at execution time.

Can I send Azure AD logs to multiple destinations at once?

Yes. A single diagnostic setting can specify any combination of workspaceId, storageAccountId, and eventHubAuthorizationRuleId. To send to multiple workspaces, create separate named settings via PUT /diagnosticSettings/{name}.

What are the rate limits for this API?

Azure Resource Manager applies tenant-level throttling - typically 12,000 reads and 1,200 writes per hour per subscription. Diagnostic setting writes are synchronous and return 200 with the resulting resource.

How do I configure AAD log routing through Jentic?

Run pip install jentic, then search for 'configure azure ad diagnostic setting'. Jentic returns the PUT /providers/microsoft.aadiam/diagnosticSettings/{name} operation, loads the workspaceId and logs schema, and executes the call.

Does this API manage users, groups, or sign-in policies?

No. This API only manages tenant-level diagnostic settings under microsoft.aadiam. User and group management lives in Microsoft Graph; sign-in policies are managed via Conditional Access APIs.

Can I limit what my agent is allowed to do with the Azure Active Directory diagnostic settings API?

Yes. Because Jentic One is self-hosted, your own rules decide which of the microsoft.aadiam operations the agent may call and which credential it uses, so you can grant it list, get, and create-or-update on diagnosticSettings while withholding the DELETE that removes a log sink. Since the setting name sits in the URL path at /providers/microsoft.aadiam/diagnosticSettings/{name}, a rule can also pin the agent to one named diagnostic setting rather than every setting on the tenant. The Azure AD credential is injected at execution time by your instance and never enters the agent's prompt or context.

Microsoft Azure azureactivedirectory

Connect the azureactivedirectory to your agent

Capabilities

Start building with azureactivedirectory API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs