AuthorizationManagementClient

Name: AuthorizationManagementClient API
Brand: AuthorizationManagementClient
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthorizationoauth219 EndpointsREST

For Agents

Manage Azure RBAC role assignments and role definitions, enumerate permissions, and elevate access — the identity control plane for Azure resources, callable by an AI agent.

Connect the AuthorizationManagementClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AuthorizationManagementClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with AuthorizationManagementClient API.

Create, list, and delete role assignments at subscription, resource group, or resource scope

Manage custom role definitions including allowed actions, notActions, and assignable scopes

Enumerate the effective permissions a principal has at a given scope

List provider operations metadata to discover the action strings used in role definitions

GET STARTED

Start building with AuthorizationManagementClient API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for AuthorizationManagementClient, keeping it validated and agent-ready.

AuthorizationManagementClient is the Azure Resource Manager API for role-based access control (RBAC). It governs role definitions, role assignments, provider operations metadata, permissions enumeration, and emergency access elevation across subscriptions, resource groups, and individual resources. Use this client to grant, revoke, and audit access to Azure resources programmatically — the foundational identity layer for any Azure automation.

Use Cases

Patterns agents use AuthorizationManagementClient API for, with concrete tasks.

★ Programmatic Access Provisioning

Platform engineering teams running automation pipelines need to grant service principals or managed identities access to specific Azure scopes as part of resource provisioning. The role assignments endpoint creates the assignment in a single PUT, taking the principal ID, role definition ID, and scope. Assignments propagate quickly enough to be used in the same pipeline run.

PUT a roleAssignments/{roleAssignmentId} resource with the target principalId, roleDefinitionId, and scope to grant access, then verify by GETting the assignment back.

Custom Role Authoring

Security teams building least-privilege custom roles need to know which provider operations exist before defining the role's actions and notActions. The providerOperations endpoint returns the full list per provider, which is then used to compose a role definition. The custom role is created via PUT on roleDefinitions/{roleDefinitionId} with a fresh GUID.

GET providerOperations/{resourceProviderNamespace} for each in-scope provider, build the role definition's actions and notActions arrays, and PUT a new roleDefinitions resource with the composed permissions.

Access Audit and Cleanup

Compliance audits require a snapshot of who has what access where. Listing role assignments at the subscription scope (and recursing into nested resources) produces the access map. Combined with directory lookups, this drives quarterly access reviews and the targeted removal of stale assignments via DELETE on the role assignment resource.

List role assignments at the subscription scope, filter to principals not in the active directory, and DELETE each stale assignment by its assignment ID.

Effective Permission Check

Before letting an agent call a write operation on a resource, an orchestrator can call the permissions endpoint to confirm the calling principal has the necessary actions. This prevents partial failures mid-pipeline and surfaces missing permissions early so they can be granted before retrying.

GET /resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions, check the returned actions list for the required action string, and proceed only if it is present.

Agent-Driven RBAC Operations via Jentic

An AI ops agent provisioning Azure resources for a new project can use Jentic to grant the project's managed identity Contributor on a fresh resource group without holding the tenant admin token. Jentic returns the schema for role assignment creation and the agent supplies principal, role, and scope, with credentials staying in the vault.

Search Jentic for 'create an Azure role assignment', execute the PUT with principalId, roleDefinitionId, and scope, and verify the resulting assignment exists.

Key Endpoints

19 endpoints — authorizationmanagementclient is the azure resource manager api for role-based access control (rbac).

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments

List role assignments at the subscription scope

GET

/providers/Microsoft.Authorization/providerOperations

List all provider operations metadata

GET

/providers/Microsoft.Authorization/providerOperations/{resourceProviderNamespace}

List operations for a specific resource provider

GET

/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions

Get effective permissions on a resource group

POST

/providers/Microsoft.Authorization/elevateAccess

Elevate to User Access Administrator for tenant root scope

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments

List role assignments at the subscription scope

GET

/providers/Microsoft.Authorization/providerOperations

List all provider operations metadata

GET

/providers/Microsoft.Authorization/providerOperations/{resourceProviderNamespace}

List operations for a specific resource provider

GET

/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions

Get effective permissions on a resource group

POST

/providers/Microsoft.Authorization/elevateAccess

Elevate to User Access Administrator for tenant root scope

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

AAD bearer tokens with RBAC management permissions are vaulted in Jentic. Agents receive a scoped session at call time; the underlying client secret stays in the MAXsystem vault and the agent never sees it.

Intent-based discovery

Agents search by intent ('grant Reader to a service principal') and Jentic returns the role assignment operation with its principalId, roleDefinitionId, and scope schema, removing the need to look up role GUIDs by hand.

Time to first call

Direct integration: 1-2 days for AAD setup, ARM client wiring, and role definition discovery. Through Jentic: under 30 minutes — search, load, execute the role assignment PUT.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Policy Client

Define and assign Azure Policy rules that govern resource configuration

Use Policy Client when the agent needs to enforce configuration rules; use Authorization for who can act on resources.

Complementary

Policy States Client

Read policy compliance state across resources

Pair when the agent needs to evaluate compliance posture alongside RBAC posture.

Complementary

Key Vault Management Client

Manage Key Vaults whose access is controlled via these RBAC assignments

Use Key Vault Management for vault provisioning; use Authorization to grant data-plane and management-plane access.

FAQs

Specific to using AuthorizationManagementClient API through Jentic.

What authentication does the AuthorizationManagementClient use?

Azure Active Directory OAuth 2.0 bearer tokens scoped to https://management.azure.com/. The calling principal must hold a role with Microsoft.Authorization/roleAssignments/write to manage assignments. Jentic vaults the AAD token and supplies a scoped session at call time.

Can I create custom roles with this API?

Yes. PUT to /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} with a body containing roleName, description, actions, notActions, and assignableScopes. Custom role IDs are GUIDs you generate; the role is then assignable just like built-in roles.

What are the rate limits for the AuthorizationManagementClient?

Calls go through Azure Resource Manager and are subject to ARM throttling — typically 12,000 reads and 1,200 writes per hour per subscription. RBAC writes have additional propagation latency; allow up to a few minutes for assignments to take effect across all regions.

How do I list role assignments through Jentic?

Search Jentic for 'list Azure role assignments'. Jentic returns the schema for GET /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments; execute it with your subscription ID. The response is a paged list of assignments including principalId, roleDefinitionId, and scope.

Is the AuthorizationManagementClient free?

RBAC management calls do not have a per-request charge; access control is a foundational Azure capability included with the platform. Calls still count toward ARM throttling budgets, so design read-heavy automations with caching.

What does the elevateAccess endpoint do?

POST to /providers/Microsoft.Authorization/elevateAccess grants the calling principal the User Access Administrator role at the tenant root scope, which is required to manage RBAC across all subscriptions including those the principal is not assigned to. This is a break-glass capability for global admins; the assignment must be removed manually after use.