Microsoft Azure ManagedServicesClient
Browse all Azure APIsAgent-ready OpenAPI document · curated by JenticCloud InfrastructureComputeoauth29 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Manage Azure Lighthouse cross-tenant delegations: create registration definitions, assign them to customer scopes, and revoke access. Useful for MSPs and platform teams onboarding tenants programmatically.
Use for: I need to onboard a new customer tenant to Azure Lighthouse, List all registration assignments under a customer subscription, Get the registration definition that grants my tenant access to a subscription, Revoke a delegated access assignment for a customer scope
Not supported: Does not handle Azure RBAC role assignments inside a single tenant, Azure Policy enforcement, or marketplace billing - use for cross-tenant Azure Lighthouse delegated access management only.
Jentic publishes the only available OpenAPI specification for ManagedServicesClient, keeping it validated and agent-ready. The Azure ManagedServices API powers Azure Lighthouse, letting service providers manage customer Azure resources from their own tenant through delegated resource management. Use it to register a managed service offer in a customer scope, list and inspect registration definitions and assignments, and remove access when an engagement ends. The API operates over Azure Resource Manager scopes (subscriptions or resource groups) and is authenticated through Azure Active Directory OAuth 2.0.
Install Jentic One Beta
Connect the ManagedServicesClient to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the ManagedServicesClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazure-managedservicesclient" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazure-managedservicesclient" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with ManagedServicesClient API.
Create or update a registration definition that grants a managing tenant scoped access to a customer subscription
Assign a registration definition to a customer scope so a service provider can operate on their behalf
List all registration assignments attached to a given Azure scope to audit active delegations
Retrieve a single registration definition by ID to inspect granted role assignments and authorizations
Delete a registration assignment to revoke a managing tenant's delegated access to customer resources
Enumerate available Microsoft.ManagedServices resource provider operations for permission tooling
Use Cases
Patterns agents use ManagedServicesClient API for, with concrete tasks.
★ Onboard MSP customer tenants
Managed service providers use the ManagedServices API to programmatically onboard new customer subscriptions to Azure Lighthouse. The API creates a registration definition describing which managing tenant principals get which roles on the customer scope, then attaches a registration assignment so the access becomes active. This replaces the manual marketplace offer flow for repeatable onboarding pipelines.
Create a registration definition granting Reader and Contributor roles to managing tenant principal IDs, then PUT a registration assignment scoped to the customer subscription and confirm provisioningState is Succeeded.
Audit cross-tenant delegations
Security and compliance teams query the registration assignments and definitions endpoints to inventory every cross-tenant access path into a subscription. The List endpoints return all delegations under a given scope so reviewers can verify the managing tenant ID, role definition IDs, and principal authorizations for each active assignment.
Call GET /{scope}/providers/Microsoft.ManagedServices/registrationAssignments with $expand=registrationDefinition and produce a CSV of managing tenant IDs and granted role definitions.
Offboard a managed customer
When an MSP engagement ends, the API revokes delegated access by deleting the registration assignment. The assignment delete is asynchronous and the API returns a 202 with a status URL the agent polls until removal completes. The underlying registration definition can also be deleted once no assignments reference it.
Delete a registration assignment by ID at a customer subscription scope, poll the asynchronous operation until completion, then delete the orphaned registration definition.
Agent-driven Lighthouse provisioning
Through Jentic, an AI agent can search for 'onboard customer tenant to Azure Lighthouse', load the input schema for RegistrationAssignments_CreateOrUpdate, and execute the call with the customer subscription, registration definition ID, and principal authorizations. The agent never sees the Azure access token directly, and Jentic returns structured results the agent can branch on.
Use Jentic search for 'create azure lighthouse registration', load the operation, supply scope and registration definition body, and execute through the Jentic SDK.
Key Endpoints
9 endpoints — jentic publishes the only available openapi specification for managedservicesclient, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
PUT
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Create or update a registration definition
PUT
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}
Assign a registration definition to a scope
GET
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments
List registration assignments under a scope
GET
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Get a registration definition by ID
DELETE
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}
Revoke a registration assignment
DELETE
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Delete a registration definition
PUT
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Create or update a registration definition
PUT
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}
Assign a registration definition to a scope
GET
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments
List registration assignments under a scope
GET
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Get a registration definition by ID
DELETE
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}
Revoke a registration assignment
DELETE
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Delete a registration definition
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring Azure Lighthouse by hand means setting up MSAL and an Azure AD service principal, minting bearer tokens against management.azure.com, learning the ARM scope path conventions, and polling the async status URL that assignment deletes return. Through Jentic you install once, import ManagedServices from the API Directory, store the service principal credentials once, and your agent calls it.
Permission scoping
The scope and definition or assignment id travel in the URL path (/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}), so a rule can pin your agent to a named customer scope and its registrations. You choose the operations it may call, so revoking a registration assignment is not included unless you add it.
Credential isolation
Your Azure AD client credentials and tenant IDs are stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token scoped to management.azure.com at execution time. The raw secret never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'create an azure lighthouse registration assignment' or 'list active cross-tenant delegations', and Jentic returns the matching RegistrationAssignments or RegistrationDefinitions operation with its input schema so the agent calls the right path without reading the Azure REST docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using ManagedServicesClient API through Jentic.
Why is there no official OpenAPI spec for ManagedServicesClient?
Microsoft Azure does not publish a standalone OpenAPI specification for the ManagedServices resource provider. Jentic generates and maintains this spec so that AI agents and developers can call ManagedServicesClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.
What authentication does the ManagedServices API use?
The API uses Azure Active Directory OAuth 2.0 via the azure_auth flow, with the user_impersonation scope against https://management.azure.com/. Through Jentic, your Azure AD client credentials are stored encrypted in your Jentic One instance and exchanged for a scoped access token at execution time, so the raw secret never enters the agent context.
Can I onboard a customer tenant to Azure Lighthouse with this API?
Yes. Create a registration definition with PUT /{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId} listing the managing tenant ID and the principal-to-role authorizations, then attach it to a customer subscription with PUT /{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}. Both calls are scoped to the customer subscription or resource group.
What are the rate limits for the Azure ManagedServices API?
Azure Resource Manager applies a default subscription-level write throttle of around 1,200 writes per hour and 12,000 reads per hour, surfaced through x-ms-ratelimit-remaining-* response headers. Agents should read those headers and back off when remaining quota approaches zero.
How do I list active delegations for a subscription through Jentic?
Search Jentic for 'list azure lighthouse registration assignments', load the RegistrationAssignments_List operation, and execute with scope set to /subscriptions/{subscriptionId}. Pass $expand=registrationDefinition to include the role authorization payload in the same response.
Is the Azure ManagedServices API free?
The control-plane calls themselves are not billed; you only pay for the underlying Azure resources the managing tenant subsequently operates on. Standard Azure egress and operational charges apply to those workloads.
Does this API support resource group scoped delegations?
Yes. The {scope} path parameter accepts both /subscriptions/{subscriptionId} and /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}, so registration definitions and assignments can be created at either granularity to limit blast radius.
Can I limit what my agent is allowed to do with the Azure ManagedServices API?
Yes. Because you self-host Jentic One, your own rules decide which ManagedServices operations and which stored Azure AD credentials the agent may use. Since the customer scope and the registration definition or assignment ID travel in the URL path, you can pin the agent to a named customer subscription or resource group and its registrations. You also choose the operations it can call, so deleting a registration assignment stays off limits unless you explicitly grant it.
GET STARTED