Microsoft Azure PrivateDnsManagementClient

What authentication does the Azure Private DNS Management API use?

The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory under the azure_auth scheme with the user_impersonation scope. Through Jentic, the AAD client secret is held in the encrypted vault and a short-lived access token is supplied at execute time so the secret never appears in the agent's context.

Can I link a Private DNS zone to multiple virtual networks?

Yes. Each VNET link is its own resource at PUT .../privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName}, so you can attach the same zone to many virtual networks and choose per-link whether auto-registration of VM A records is enabled.

What are the rate limits for the Private DNS Management API?

Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. VNET link operations are long-running and should be polled with backoff.

How do I add an A record through Jentic?

Search Jentic for 'create azure private dns A record', load the schema for PUT .../privateDnsZones/{privateZoneName}/A/{relativeRecordSetName}, then execute with subscriptionId, resourceGroupName, the zone name, the relative record name, and the ARecords array. The pip install jentic Python SDK uses the async search, load, execute pattern.

Is the Private DNS Management API free?

There is no per-call charge for the management API itself; you pay for the Private DNS zones (per zone per month) and DNS queries served by the zone. Reads against the management plane are not separately metered.

Can I limit what my agent is allowed to do with the Microsoft Azure Private DNS Management API?

Yes. Because the subscription, resource group, zone name, record type, and record name all travel in the URL path, a rule in your self-hosted Jentic One instance can pin the agent to a single Private DNS zone and only the operations you approve, such as creating A records and listing record sets. You choose which operations it may call, so destructive ones like deleting a zone or removing a virtual network link are excluded unless you add them. Your own rules decide which operations and credentials the agent is allowed to use, and the scoped Azure AD bearer token is injected only at execution time.