canonical: https://jentic.com/apis/azure.com/ad-hybrid-health-service # Microsoft Azure Azure AD Hybrid Health Service Jentic publishes the only available OpenAPI specification for Azure AD Hybrid Health Service, keeping it validated and agent-ready. This API powers Azure Active Directory Connect Health, surfacing telemetry from on-premises ADFS, Active Directory Domain Services (AD DS), and AAD Connect Sync agents to the Azure portal. It exposes services, service members, alerts, dimensions, configuration, and report-driven endpoints used to monitor synchronisation health, replication, sign-in latency, and password sync status. ## For AI agents Read sync, replication, and sign-in health telemetry from AAD Connect Health and list, acknowledge, or investigate hybrid identity alerts. ## Scope Does not provision ADFS, configure AAD Connect Sync rules, or modify on-prem AD objects - use only to read Connect Health telemetry, alerts, and service member status. ## Capabilities - List ADFS, AD DS, and AAD Connect Sync services registered with Connect Health - Retrieve open and historical alerts for a hybrid identity service - Inspect service members (agents) and their last reported health state - Query AD replication summary and replication detail dimensions - Read sync object level errors and password sync status for AAD Connect - Premium-check whether a Connect Health service is on a paid SKU ## Use cases ### Hybrid Identity Outage Triage When users cannot sign in via ADFS or password hash sync stalls, an operator needs the open alerts and the agent that raised them within seconds. The `/addsservices/{serviceName}/alerts` and `/adfsservices/{serviceName}/alerts` paths return current alerts with severity and root cause hints, while service member endpoints reveal which on-prem agent is unhealthy. Example prompt: List all active alerts for ADFS service 'contoso-adfs' and report severity and source for each ### Replication and Sync Health Reporting Identity teams build dashboards over AD replication summary and replication details to catch divergence before it becomes an outage. The dimensions endpoints (`/addsservices/{serviceName}/dimensions/{dimension}`) and replication summary endpoints feed time-series data into reporting pipelines without scraping the Azure portal. Example prompt: Pull the replicationSummary dimension for AD DS service 'contoso-addsservice' for the last 24 hours and emit a CSV ### AAD Connect Agent Inventory Operations teams need to know how many AAD Connect Sync, ADFS, and AD DS agents are deployed and which have stopped reporting. The service member endpoints across all three service types return per-agent status, version, and last contact, supporting fleet-wide patching and decommission workflows. Example prompt: List all addsservicemembers for service 'contoso-addsservice' and flag any whose lastReboot is older than 30 days ### Agent-Driven Hybrid Identity Health Reviews An AI agent doing a weekly identity posture review can pull active alerts, replication health, and password sync status across every Connect Health service through Jentic. Intent search returns the right list and detail endpoints; the Azure OAuth token is held in the credential vault. The agent produces a written summary instead of a portal screenshot. Example prompt: Search Jentic for 'list AAD Connect Health alerts', execute it across every registered service, and summarise alerts by severity ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | `/providers/Microsoft.ADHybridHealthService/addsservices` | List AD DS services | | GET | `/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}` | Get an AD DS service | | GET | `/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/alerts` | List alerts for an AD DS service | | GET | `/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/addsservicemembers` | List AD DS service members | | GET | `/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/dimensions/{dimension}` | Get a metric dimension for AD DS | | GET | `/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/configuration` | List AD DS configurations | | GET | `/providers/Microsoft.ADHybridHealthService/addsservices/premiumCheck` | Check premium SKU status | ## Key resources - **ADDS Services** — AD DS Connect Health services, members, alerts, configuration, and dimensions - **ADFS Services** — ADFS Connect Health services, alerts, and members - **Sync Services** — AAD Connect Sync services, members, and dimensions - **Alerts** — Open and historical alerts across all hybrid identity services - **Service Members** — On-premises agents reporting telemetry to Connect Health - **Dimensions** — Time-series dimensions for replication, sync, and sign-in metrics ## Why Jentic - **Setup:** Wiring this Connect Health client by hand means registering an Azure AD app, acquiring and refreshing OAuth 2.0 bearer tokens for management.azure.com, and walking the long Microsoft.ADHybridHealthService path tree across ADFS, AD DS, and sync services yourself. Through Jentic you install once, import the Azure AD Hybrid Health Service API from the API Directory, store the Azure credential once, and your agent calls it. - **Permission scoping:** This client puts the service name in the URL path (`/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/...`), so a rule can pin your agent to reading alerts, members, and dimensions for one service. You choose the operations it may call, so it stays on the read-and-monitor endpoints and does not touch any that acknowledge or change state unless you add them. - **Credential handling:** Your Azure Active Directory credential is stored once, encrypted, by your own Jentic One instance, which exchanges it for short-lived scoped bearer tokens at execution time. The service principal secret never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'list AAD Connect Health alerts' or 'check Azure AD replication health', and Jentic returns the matching ADHybridHealthService operation with its input schema so the agent does not map the path tree by hand. ## Related APIs - **Azure Monitor Management Client** — Routes Connect Health alerts and metrics into Azure Monitor action groups and dashboards. - **Azure Application Insights Management Client** — Stores correlated telemetry from on-premises sync agents alongside cloud workload data. - **Azure Advisor Management Client** — Surfaces hybrid identity hardening recommendations alongside Connect Health signals. - **Microsoft Insights API** — Generic Azure Insights metrics surface; Connect Health is the identity-specific alternative. ## FAQ ### Why is there no official OpenAPI spec for Azure AD Hybrid Health Service? Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure AD Hybrid Health Service via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the Azure AD Hybrid Health Service use? The API uses Azure Active Directory OAuth 2.0 bearer tokens (the azure_auth scheme) on the management.azure.com endpoint. Through Jentic, the AAD app registration secret is held in your Jentic One instance and exchanged for a short-lived bearer token at execution time. ### Can I list active ADFS or AD DS alerts with this API? Yes. Use GET `/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/alerts` for AD DS and the corresponding adfsservices alerts endpoint for ADFS. Both return current alerts with severity, scope, and source agent. ### How do I find AAD Connect agents that have stopped reporting? Call GET `/providers/Microsoft.ADHybridHealthService/addsservices/{serviceName}/addsservicemembers` and filter on the last contact timestamp in the response. Combine with the service-level alerts endpoint to confirm the unreported agent is the cause. ### What are the rate limits for this API? Azure Resource Manager applies standard subscription throttling and Connect Health adds tighter limits on dimension queries to protect the telemetry pipeline. Honour HTTP 429 Retry-After values and prefer dimension queries over wide time ranges to per-minute polling. ### How do I check replication health across an AD DS forest through Jentic? Run pip install jentic, then search Jentic with 'check Azure AD replication health'. Jentic returns the AD DS dimensions endpoint with its input schema. Execute it for the replicationSummary dimension to receive forest-wide replication data, then load alerts to confirm there are no open issues. ### Can I limit what my agent is allowed to do with the Azure AD Hybrid Health Service API? Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent can use, so you can pin it to read-only Connect Health calls such as GET addsservices/{serviceName}/alerts, /addsservicemembers, and `/dimensions/{dimension}` for a single named service. Since the service name lives in the URL path, you can scope the agent to one ADFS, AD DS, or AAD Connect Sync service rather than the whole tenant. Any operation that acknowledges or changes state stays unavailable to the agent until you explicitly allow it.