Azure AD Hybrid Health Service

Name: Azure AD Hybrid Health Service API
Brand: Azure AD Hybrid Health Service
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory Servicesoauth274 EndpointsREST

For Agents

Read sync, replication, and sign-in health telemetry from AAD Connect Health and list, acknowledge, or investigate hybrid identity alerts.

Connect the Azure AD Hybrid Health Service to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure AD Hybrid Health Service, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Azure AD Hybrid Health Service API.

List ADFS, AD DS, and AAD Connect Sync services registered with Connect Health

Retrieve open and historical alerts for a hybrid identity service

Inspect service members (agents) and their last reported health state

Query AD replication summary and replication detail dimensions

GET STARTED

Start building with Azure AD Hybrid Health Service API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Azure AD Hybrid Health Service, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Azure AD Hybrid Health Service, keeping it validated and agent-ready. This API powers Azure Active Directory Connect Health, surfacing telemetry from on-premises ADFS, Active Directory Domain Services (AD DS), and AAD Connect Sync agents to the Azure portal. It exposes services, service members, alerts, dimensions, configuration, and report-driven endpoints used to monitor synchronisation health, replication, sign-in latency, and password sync status.

Use Cases

Patterns agents use Azure AD Hybrid Health Service API for, with concrete tasks.

★ Hybrid Identity Outage Triage

When users cannot sign in via ADFS or password hash sync stalls, an operator needs the open alerts and the agent that raised them within seconds. The /addsservices/{serviceName}/alerts and /adfsservices/{serviceName}/alerts paths return current alerts with severity and root cause hints, while service member endpoints reveal which on-prem agent is unhealthy.

List all active alerts for ADFS service 'contoso-adfs' and report severity and source for each

Replication and Sync Health Reporting

Identity teams build dashboards over AD replication summary and replication details to catch divergence before it becomes an outage. The dimensions endpoints (/addsservices/{serviceName}/dimensions/{dimension}) and replication summary endpoints feed time-series data into reporting pipelines without scraping the Azure portal.

Pull the replicationSummary dimension for AD DS service 'contoso-addsservice' for the last 24 hours and emit a CSV

AAD Connect Agent Inventory

Operations teams need to know how many AAD Connect Sync, ADFS, and AD DS agents are deployed and which have stopped reporting. The service member endpoints across all three service types return per-agent status, version, and last contact, supporting fleet-wide patching and decommission workflows.

List all addsservicemembers for service 'contoso-addsservice' and flag any whose lastReboot is older than 30 days

Agent-Driven Hybrid Identity Health Reviews

An AI agent doing a weekly identity posture review can pull active alerts, replication health, and password sync status across every Connect Health service through Jentic. Intent search returns the right list and detail endpoints; the Azure OAuth token is held in the credential vault. The agent produces a written summary instead of a portal screenshot.

Search Jentic for 'list AAD Connect Health alerts', execute it across every registered service, and summarise alerts by severity

Key Endpoints

74 endpoints — jentic publishes the only available openapi specification for azure ad hybrid health service, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/providers/Microsoft.ADHybridHealthService/addsservices

List AD DS services

GET

/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}

Get an AD DS service

GET

/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/alerts

List alerts for an AD DS service

GET

/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/addsservicemembers

List AD DS service members

GET

/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/dimensions/{dimension}

Get a metric dimension for AD DS

GET

/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/configuration

List AD DS configurations

GET

/providers/Microsoft.ADHybridHealthService/addsservices/premiumCheck

Check premium SKU status

GET

/providers/Microsoft.ADHybridHealthService/addsservices

List AD DS services

GET

/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}

Get an AD DS service

GET

/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/alerts

List alerts for an AD DS service

GET

/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/addsservicemembers

List AD DS service members

GET

/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/dimensions/{dimension}

Get a metric dimension for AD DS

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure Active Directory OAuth 2.0 tokens are minted and rotated inside the Jentic vault (MAXsystem). Service principal client secrets stay encrypted; agents call Microsoft.ADHybridHealthService with a short-lived scoped token only.

Intent-based discovery

Agents search by intent (e.g., 'list AAD Connect Health alerts') and Jentic returns the matching ADHybridHealthService operation with its input schema, so the agent does not need to map the long Microsoft.ADHybridHealthService path tree by hand.

Time to first call

Direct ARM integration: 2-4 days for AAD app registration, token acquisition, throttling handling, and walking the multi-service path tree. Through Jentic: under 1 hour — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Azure Monitor Management Client

Routes Connect Health alerts and metrics into Azure Monitor action groups and dashboards.

Pair with Connect Health when alerts must trigger pages, runbooks, or dashboards beyond the Azure portal.

Complementary

Azure Application Insights Management Client

Stores correlated telemetry from on-premises sync agents alongside cloud workload data.

Use Application Insights when sync telemetry must correlate with web app or API traces.

Complementary

Azure Advisor Management Client

Surfaces hybrid identity hardening recommendations alongside Connect Health signals.

Use Advisor for proactive recommendations; use Connect Health for live operational alerts.

Alternative

Microsoft Insights API

Generic Azure Insights metrics surface; Connect Health is the identity-specific alternative.

Choose Connect Health for identity-specific alerts; choose Microsoft Insights when querying generic Azure metrics.

FAQs

Specific to using Azure AD Hybrid Health Service API through Jentic.

Why is there no official OpenAPI spec for Azure AD Hybrid Health Service?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure AD Hybrid Health Service via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Azure AD Hybrid Health Service use?

The API uses Azure Active Directory OAuth 2.0 bearer tokens (the azure_auth scheme) on the management.azure.com endpoint. Through Jentic, the AAD app registration secret is held in the MAXsystem vault and exchanged for a short-lived bearer token at execution time.

Can I list active ADFS or AD DS alerts with this API?

Yes. Use GET /providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/alerts for AD DS and the corresponding adfsservices alerts endpoint for ADFS. Both return current alerts with severity, scope, and source agent.

How do I find AAD Connect agents that have stopped reporting?

Call GET /providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/addsservicemembers and filter on the last contact timestamp in the response. Combine with the service-level alerts endpoint to confirm the unreported agent is the cause.

What are the rate limits for this API?

Azure Resource Manager applies standard subscription throttling and Connect Health adds tighter limits on dimension queries to protect the telemetry pipeline. Honour HTTP 429 Retry-After values and prefer dimension queries over wide time ranges to per-minute polling.

How do I check replication health across an AD DS forest through Jentic?

Run pip install jentic, then search Jentic with 'check Azure AD replication health'. Jentic returns the AD DS dimensions endpoint with its input schema. Execute it for the replicationSummary dimension to receive forest-wide replication data, then load alerts to confirm there are no open issues.