canonical: https://jentic.com/apis/azure.com/authorizationmanagementclient # Microsoft Azure AuthorizationManagementClient AuthorizationManagementClient is the Azure Resource Manager API for role-based access control (RBAC). It governs role definitions, role assignments, provider operations metadata, permissions enumeration, and emergency access elevation across subscriptions, resource groups, and individual resources. Use this client to grant, revoke, and audit access to Azure resources programmatically - the foundational identity layer for any Azure automation. ## For AI agents Manage Azure RBAC role assignments and role definitions, enumerate permissions, and elevate access - the identity control plane for Azure resources, callable by an AI agent. ## Scope Does not authenticate users, manage Azure AD identities, or enforce policy compliance - use for RBAC role assignment and definition management on Azure resources only. ## Capabilities - Create, list, and delete role assignments at subscription, resource group, or resource scope - Manage custom role definitions including allowed actions, notActions, and assignable scopes - Enumerate the effective permissions a principal has at a given scope - List provider operations metadata to discover the action strings used in role definitions - Elevate global administrator access for break-glass scenarios - Look up role assignments by ID, scope, or principal ## Use cases ### Programmatic Access Provisioning Platform engineering teams running automation pipelines need to grant service principals or managed identities access to specific Azure scopes as part of resource provisioning. The role assignments endpoint creates the assignment in a single PUT, taking the principal ID, role definition ID, and scope. Assignments propagate quickly enough to be used in the same pipeline run. Example prompt: PUT a roleAssignments/{roleAssignmentId} resource with the target principalId, roleDefinitionId, and scope to grant access, then verify by GETting the assignment back. ### Custom Role Authoring Security teams building least-privilege custom roles need to know which provider operations exist before defining the role's actions and notActions. The providerOperations endpoint returns the full list per provider, which is then used to compose a role definition. The custom role is created via PUT on roleDefinitions/{roleDefinitionId} with a fresh GUID. Example prompt: GET providerOperations/{resourceProviderNamespace} for each in-scope provider, build the role definition's actions and notActions arrays, and PUT a new roleDefinitions resource with the composed permissions. ### Access Audit and Cleanup Compliance audits require a snapshot of who has what access where. Listing role assignments at the subscription scope (and recursing into nested resources) produces the access map. Combined with directory lookups, this drives quarterly access reviews and the targeted removal of stale assignments via DELETE on the role assignment resource. Example prompt: List role assignments at the subscription scope, filter to principals not in the active directory, and DELETE each stale assignment by its assignment ID. ### Effective Permission Check Before letting an agent call a write operation on a resource, an orchestrator can call the permissions endpoint to confirm the calling principal has the necessary actions. This prevents partial failures mid-pipeline and surfaces missing permissions early so they can be granted before retrying. Example prompt: GET /resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions, check the returned actions list for the required action string, and proceed only if it is present. ### Agent-Driven RBAC Operations via Jentic An AI ops agent provisioning Azure resources for a new project can use Jentic to grant the project's managed identity Contributor on a fresh resource group without holding the tenant admin token. Jentic returns the schema for role assignment creation and the agent supplies principal, role, and scope, with credentials staying in the vault. Example prompt: Search Jentic for 'create an Azure role assignment', execute the PUT with principalId, roleDefinitionId, and scope, and verify the resulting assignment exists. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments | List role assignments at the subscription scope | | GET | /providers/Microsoft.Authorization/providerOperations | List all provider operations metadata | | GET | /providers/Microsoft.Authorization/providerOperations/{resourceProviderNamespace} | List operations for a specific resource provider | | GET | /subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions | Get effective permissions on a resource group | | POST | /providers/Microsoft.Authorization/elevateAccess | Elevate to User Access Administrator for tenant root scope | ## Key resources - **Role assignments** — Create, list, and delete RBAC role assignments at any scope - **Role definitions** — Manage built-in and custom role definitions - **Permissions** — Enumerate effective permissions for a principal at a scope - **Provider operations metadata** — List the action strings exposed by each Azure resource provider - **Elevate access** — Grant tenant-level User Access Administrator for break-glass scenarios ## Why Jentic - **Setup:** Wiring the AuthorizationManagementClient by hand means registering an Azure AD app, driving the OAuth 2.0 token exchange against login.microsoftonline.com for the management.azure.com resource, and building the Azure Resource Manager plumbing that retries on throttling and waits out RBAC propagation. Through Jentic you install once, import AuthorizationManagementClient from the API Directory, store the Azure AD credential once, and your agent calls it. - **Permission scoping:** This client puts the subscription, resource group, and resource name in the URL path (for example /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments), so a rule can pin your agent to a specific scope. You choose the operations it may call, so destructive ones like deleting a role assignment or the tenant-wide elevateAccess call are not included unless you add them. - **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'grant Reader to a service principal' or 'list Azure role assignments', and Jentic returns the matching role assignment operation with its principalId, roleDefinitionId, and scope schema so the agent calls the right endpoint without looking up role GUIDs by hand. ## Related APIs - **Policy Client** — Define and assign Azure Policy rules that govern resource configuration - **Policy States Client** — Read policy compliance state across resources - **Key Vault Management Client** — Manage Key Vaults whose access is controlled via these RBAC assignments ## FAQ ### What authentication does the AuthorizationManagementClient use? Azure Active Directory OAuth 2.0 bearer tokens scoped to https://management.azure.com/. The calling principal must hold a role with Microsoft.Authorization/roleAssignments/write to manage assignments. Jentic securely stores the AAD token and supplies a scoped session at call time. ### Can I create custom roles with this API? Yes. PUT to /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} with a body containing roleName, description, actions, notActions, and assignableScopes. Custom role IDs are GUIDs you generate; the role is then assignable just like built-in roles. ### What are the rate limits for the AuthorizationManagementClient? Calls go through Azure Resource Manager and are subject to ARM throttling - typically 12,000 reads and 1,200 writes per hour per subscription. RBAC writes have additional propagation latency; allow up to a few minutes for assignments to take effect across all regions. ### How do I list role assignments through Jentic? Search Jentic for 'list Azure role assignments'. Jentic returns the schema for GET /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments; execute it with your subscription ID. The response is a paged list of assignments including principalId, roleDefinitionId, and scope. ### Is the AuthorizationManagementClient free? RBAC management calls do not have a per-request charge; access control is a foundational Azure capability included with the platform. Calls still count toward ARM throttling budgets, so design read-heavy automations with caching. ### What does the elevateAccess endpoint do? POST to /providers/Microsoft.Authorization/elevateAccess grants the calling principal the User Access Administrator role at the tenant root scope, which is required to manage RBAC across all subscriptions including those the principal is not assigned to. This is a break-glass capability for global admins; the assignment must be removed manually after use. ### Can I limit what my agent is allowed to do with the AuthorizationManagementClient? Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials your agent may use. This API puts the subscription, resource group, and resource name in the URL path, such as /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments, so a rule can pin the agent to a specific scope. You also choose which operations it can call, so destructive ones like deleting a role assignment or the tenant-wide elevateAccess call stay out of reach unless you add them.