canonical: https://jentic.com/apis/azure.com/azure-managedserviceidentityclient # Microsoft Azure ManagedServiceIdentityClient Jentic publishes the only available OpenAPI specification for ManagedServiceIdentityClient, keeping it validated and agent-ready. ManagedServiceIdentityClient is the Azure Resource Manager surface for the Microsoft.ManagedIdentity provider - user-assigned managed identities. It provisions identity resources that other Azure resources (VMs, App Services, Functions) reference to obtain AAD tokens without storing client secrets, and exposes the operations catalog for the provider. ## For AI agents Provision and manage Azure user-assigned managed identities through Azure Resource Manager. Use for identity resource lifecycle, not for assigning RBAC roles or granting access to specific resources. ## Scope Does not assign RBAC roles, manage system-assigned identities, or issue tokens directly - use only for Microsoft.ManagedIdentity user-assigned identity resource lifecycle. ## Capabilities - Provision user-assigned managed identities in a resource group - List user-assigned managed identities across a subscription or resource group - Update tags or properties on an existing managed identity via PATCH - Delete user-assigned managed identities that are no longer in use - Inspect the operations catalog exposed by the Microsoft.ManagedIdentity resource provider ## Use cases ### Provision Identities for Workload Authentication Platform teams give applications a stable identity by provisioning user-assigned managed identities once and attaching them to compute resources (VMs, App Services, AKS clusters). The PUT on /userAssignedIdentities/{resourceName} returns the principalId and clientId - the values downstream resources use to obtain AAD tokens. Identities can be reused across resources, simplifying secret-free authentication patterns. Example prompt: PUT a user-assigned managed identity 'app-prod-identity' in resource group 'app-prod' at westeurope, then return the principalId and clientId from the response so downstream RBAC role assignments can reference it. ### Identity Inventory and Cleanup Security teams audit which user-assigned managed identities exist, when they were created, and whether they are still attached to any resource. UserAssignedIdentities_ListBySubscription returns the full set; combined with Resource Graph queries for identity assignment, this surfaces orphan identities safe to delete. Removing unused identities reduces the AAD service principal sprawl. Example prompt: List UserAssignedIdentities in the subscription, return name, principalId, and resource group for each, and flag identities not referenced by any resource for follow-up deletion. ### Managed Identity Tag Governance Compliance teams enforce tagging on managed identities to attribute usage and cost allocation. UserAssignedIdentities_Update (PATCH on the identity) lets an automation set or update tags such as costCenter, owner, or environment without altering the identity's principal or client IDs. Updates are atomic and do not require token refresh on dependent resources. Example prompt: PATCH each user-assigned managed identity in resource group 'prod-app' to set tags costCenter=CC-1234 and owner=platform-team. ### AI Agent Identity Provisioning Platform agents that automate landing zone setup use Jentic to discover the managed identity creation operation. Searching for 'create azure user assigned managed identity' returns the schema; the agent loads it and executes against management.azure.com using a token retrieved from your Jentic One instance, so identity provisioning runs as part of larger landing zone automations without bundling the ManagedServiceIdentity SDK. Example prompt: Use Jentic to search 'create azure user assigned managed identity', load the UserAssignedIdentities_CreateOrUpdate schema, and PUT the identity in the requested resource group, returning principalId for use in subsequent RBAC role assignment. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName} | Create or update a user-assigned managed identity | | GET | /subscriptions/{subscriptionId}/providers/Microsoft.ManagedIdentity/userAssignedIdentities | List user-assigned identities in a subscription | | GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities | List user-assigned identities in a resource group | | DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName} | Delete a user-assigned managed identity | | PATCH | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName} | Update an identity's tags or properties | | GET | /providers/Microsoft.ManagedIdentity/operations | List Microsoft.ManagedIdentity provider operations | ## Key resources - **UserAssignedIdentities** — User-assigned managed identity lifecycle: create, list, get, update, delete. - **Operations** — Operations catalog for the Microsoft.ManagedIdentity resource provider. ## Why Jentic - **Setup:** Wiring the Microsoft.ManagedIdentity API by hand means registering an Azure AD app, negotiating OAuth 2.0 tokens for management.azure.com, and threading subscription and resource-group scope through every user-assigned-identity call. Through Jentic you install once, import ManagedServiceIdentityClient from the API Directory, store the Azure AD credential once, and your agent calls it. - **Permission scoping:** This API puts the user-assigned identity in the URL path (/userAssignedIdentities/{resourceName}), so a rule can pin your agent to reading identities: it can list user-assigned identities across a subscription or resource group. You choose the operations it may call, so creating, updating, or deleting an identity is not included unless you add it. - **Credential handling:** Your Azure AD credential for the ManagedIdentity control plane is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'list user-assigned managed identities' or 'read a managed identity', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **KeyVaultClient** — Grant a managed identity access to keys, secrets, and certificates in a Key Vault. - **PolicyClient** — Enforce that resources must use a user-assigned managed identity rather than embedded credentials. - **ManagedLabsClient** — Grant managed identities access to Lab Services automation runbooks. ## FAQ ### Why is there no official OpenAPI spec for ManagedServiceIdentityClient? Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call ManagedServiceIdentityClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the ManagedServiceIdentityClient use? AAD OAuth 2.0 bearer tokens scoped to https://management.azure.com/. With Jentic, AAD client credentials live in the encrypted vault and a short-lived bearer token is injected into the Authorization header at call time. ### Does this API assign RBAC roles to the managed identity? No. RBAC role assignments are made through the Microsoft.Authorization provider (roleAssignments). This client only creates, updates, and deletes the identity resource itself; once you have its principalId, you assign roles separately. ### What are the rate limits for the ManagedServiceIdentityClient? Standard Azure Resource Manager throttling - typically 12,000 reads and 1,200 writes per hour per subscription per region. Identity create operations on /userAssignedIdentities/{resourceName} are normally synchronous and return the principalId and clientId in the response body. ### How do I create a managed identity through Jentic? Run pip install jentic, then search Jentic for 'create azure user assigned managed identity'. Jentic returns the UserAssignedIdentities_CreateOrUpdate schema; load it, supply the resource group, identity name, and location, and PUT to /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}. ### Can I create system-assigned identities with this API? No. System-assigned identities are toggled on the parent resource (for example, on a VM via Microsoft.Compute) and cannot exist independently. This client is only for user-assigned identities, which are independent ARM resources. ### Can I limit what my agent is allowed to do with the Microsoft Azure Managed Identity API? Yes. Because you self-host Jentic One, your own rules decide which operations and credentials the agent may use, and the identity name sits in the URL path, so you can pin the agent to read-only work such as listing user-assigned managed identities across a subscription or resource group. You choose the operations it may call, so creating, updating, or deleting an identity is excluded unless you explicitly add it. The Azure AD credential is stored by your own instance and injected only for the calls you permit.