Microsoft Azure SubscriptionsManagementClient

What authentication does the SubscriptionsManagementClient use?

All endpoints require Azure Active Directory OAuth 2.0 against the Azure Stack admin tenant, declared as the azure_auth security scheme with the user_impersonation scope. Through Jentic, the admin access token is held in the vault and injected at call time so the agent never sees the raw bearer token.

Can I attach a plan to a tenant subscription on Azure Stack?

Yes. PUT /subscriptions/{subscriptionId}/providers/Microsoft.Subscriptions.Admin/subscriptions/{targetSubscriptionId}/acquiredPlans/{planAcquisitionId} attaches a plan to the target tenant subscription. The body references the plan resource id and any associated SKU.

What are the rate limits for the SubscriptionsManagementClient?

Calls go through the Azure Stack admin endpoint, which inherits the Azure Resource Manager throttling pattern (writes typically capped per subscription per hour). Throttled responses return HTTP 429 with a Retry-After header; the spec does not encode these limits, so handle them in client code.

How do I list acquired plans through Jentic?

Run pip install jentic, search Jentic for 'list acquired plans on an azure stack subscription', load the AcquiredPlans_List operation, and execute it with subscriptionId, targetSubscriptionId, and the api-version 2015-11-01. Jentic handles the Azure Stack admin token exchange.

Does this API work against public Azure?

No. The base URL is https://adminmanagement.local.azurestack.external/, which is the on-premises Azure Stack admin endpoint. For public Azure subscription provisioning, use SubscriptionDefinitionsClient and SubscriptionClient.

Can I limit what my agent is allowed to do with the Azure Stack Subscriptions Management API?

Yes. Because you run Jentic One yourself, your own rules decide which acquired-plans operations and credentials the agent may use. The target subscription and plan acquisition id are URL path parameters, so a rule can pin the agent to acquired plans on a single target subscription and grant only the read calls, list acquired plans and get a plan by id, while withholding the PUT that attaches a plan and the DELETE that removes one. Nothing destructive is callable unless you explicitly add it to the agent's allowed operations.