ManagedServiceIdentityClient

Name: ManagedServiceIdentityClient API
Brand: ManagedServiceIdentityClient
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory Servicesoauth27 EndpointsREST

For Agents

Provision and manage Azure user-assigned managed identities through Azure Resource Manager. Use for identity resource lifecycle, not for assigning RBAC roles or granting access to specific resources.

Connect the ManagedServiceIdentityClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the ManagedServiceIdentityClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with ManagedServiceIdentityClient API.

Provision user-assigned managed identities in a resource group

List user-assigned managed identities across a subscription or resource group

Update tags or properties on an existing managed identity via PATCH

Delete user-assigned managed identities that are no longer in use

GET STARTED

Start building with ManagedServiceIdentityClient API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for ManagedServiceIdentityClient, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for ManagedServiceIdentityClient, keeping it validated and agent-ready. ManagedServiceIdentityClient is the Azure Resource Manager surface for the Microsoft.ManagedIdentity provider — user-assigned managed identities. It provisions identity resources that other Azure resources (VMs, App Services, Functions) reference to obtain AAD tokens without storing client secrets, and exposes the operations catalog for the provider.

Use Cases

Patterns agents use ManagedServiceIdentityClient API for, with concrete tasks.

★ Provision Identities for Workload Authentication

Platform teams give applications a stable identity by provisioning user-assigned managed identities once and attaching them to compute resources (VMs, App Services, AKS clusters). The PUT on /userAssignedIdentities/{resourceName} returns the principalId and clientId — the values downstream resources use to obtain AAD tokens. Identities can be reused across resources, simplifying secret-free authentication patterns.

PUT a user-assigned managed identity 'app-prod-identity' in resource group 'app-prod' at westeurope, then return the principalId and clientId from the response so downstream RBAC role assignments can reference it.

Identity Inventory and Cleanup

Security teams audit which user-assigned managed identities exist, when they were created, and whether they are still attached to any resource. UserAssignedIdentities_ListBySubscription returns the full set; combined with Resource Graph queries for identity assignment, this surfaces orphan identities safe to delete. Removing unused identities reduces the AAD service principal sprawl.

List UserAssignedIdentities in the subscription, return name, principalId, and resource group for each, and flag identities not referenced by any resource for follow-up deletion.

Managed Identity Tag Governance

Compliance teams enforce tagging on managed identities to attribute usage and cost allocation. UserAssignedIdentities_Update (PATCH on the identity) lets an automation set or update tags such as costCenter, owner, or environment without altering the identity's principal or client IDs. Updates are atomic and do not require token refresh on dependent resources.

PATCH each user-assigned managed identity in resource group 'prod-app' to set tags costCenter=CC-1234 and owner=platform-team.

AI Agent Identity Provisioning

Platform agents that automate landing zone setup use Jentic to discover the managed identity creation operation. Searching for 'create azure user assigned managed identity' returns the schema; the agent loads it and executes against management.azure.com using a token retrieved from the Jentic vault, so identity provisioning runs as part of larger landing zone automations without bundling the ManagedServiceIdentity SDK.

Use Jentic to search 'create azure user assigned managed identity', load the UserAssignedIdentities_CreateOrUpdate schema, and PUT the identity in the requested resource group, returning principalId for use in subsequent RBAC role assignment.

Key Endpoints

7 endpoints — jentic publishes the only available openapi specification for managedserviceidentityclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}

Create or update a user-assigned managed identity

GET

/subscriptions/{subscriptionId}/providers/Microsoft.ManagedIdentity/userAssignedIdentities

List user-assigned identities in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities

List user-assigned identities in a resource group

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}

Delete a user-assigned managed identity

PATCH

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}

Update an identity's tags or properties

GET

/providers/Microsoft.ManagedIdentity/operations

List Microsoft.ManagedIdentity provider operations

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}

Create or update a user-assigned managed identity

GET

/subscriptions/{subscriptionId}/providers/Microsoft.ManagedIdentity/userAssignedIdentities

List user-assigned identities in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities

List user-assigned identities in a resource group

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}

Delete a user-assigned managed identity

PATCH

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

AAD client credentials are stored encrypted in the Jentic vault. Agents receive only short-lived bearer tokens scoped to https://management.azure.com/ at call time. The principalId and clientId returned from identity creation are surfaced through the agent's structured response, never logged in plaintext.

Intent-based discovery

Agents search by intent (for example, 'create azure user assigned managed identity') and Jentic returns the UserAssignedIdentities_CreateOrUpdate operation with its parameter schema, so the agent calls the correct endpoint without consulting Microsoft Docs.

Time to first call

Direct ARM integration: under 1 day for AAD setup and identity creation flow. Through Jentic: under 30 minutes — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

KeyVaultClient

Grant a managed identity access to keys, secrets, and certificates in a Key Vault.

Use after creating an identity to give it data-plane access to a Key Vault.

Complementary

PolicyClient

Enforce that resources must use a user-assigned managed identity rather than embedded credentials.

Use when wrapping managed identity adoption into Azure Policy compliance.

Complementary

ManagedLabsClient

Grant managed identities access to Lab Services automation runbooks.

Use when classroom automation needs an identity to manage labs without static credentials.

FAQs

Specific to using ManagedServiceIdentityClient API through Jentic.

Why is there no official OpenAPI spec for ManagedServiceIdentityClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call ManagedServiceIdentityClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the ManagedServiceIdentityClient use?

AAD OAuth 2.0 bearer tokens scoped to https://management.azure.com/. With Jentic, AAD client credentials live in the encrypted vault and a short-lived bearer token is injected into the Authorization header at call time.

Does this API assign RBAC roles to the managed identity?

No. RBAC role assignments are made through the Microsoft.Authorization provider (roleAssignments). This client only creates, updates, and deletes the identity resource itself; once you have its principalId, you assign roles separately.

What are the rate limits for the ManagedServiceIdentityClient?

Standard Azure Resource Manager throttling — typically 12,000 reads and 1,200 writes per hour per subscription per region. Identity create operations on /userAssignedIdentities/{resourceName} are normally synchronous and return the principalId and clientId in the response body.

How do I create a managed identity through Jentic?

Run pip install jentic, then search Jentic for 'create azure user assigned managed identity'. Jentic returns the UserAssignedIdentities_CreateOrUpdate schema; load it, supply the resource group, identity name, and location, and PUT to /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}.

Can I create system-assigned identities with this API?

No. System-assigned identities are toggled on the parent resource (for example, on a VM via Microsoft.Compute) and cannot exist independently. This client is only for user-assigned identities, which are independent ARM resources.