ManagedServicesClient

Name: ManagedServicesClient API
Brand: ManagedServicesClient
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputeoauth29 EndpointsREST

For Agents

Manage Azure Lighthouse cross-tenant delegations: create registration definitions, assign them to customer scopes, and revoke access. Useful for MSPs and platform teams onboarding tenants programmatically.

Connect the ManagedServicesClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the ManagedServicesClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with ManagedServicesClient API.

Create or update a registration definition that grants a managing tenant scoped access to a customer subscription

Assign a registration definition to a customer scope so a service provider can operate on their behalf

List all registration assignments attached to a given Azure scope to audit active delegations

Retrieve a single registration definition by ID to inspect granted role assignments and authorizations

GET STARTED

Start building with ManagedServicesClient API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for ManagedServicesClient, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for ManagedServicesClient, keeping it validated and agent-ready. The Azure ManagedServices API powers Azure Lighthouse, letting service providers manage customer Azure resources from their own tenant through delegated resource management. Use it to register a managed service offer in a customer scope, list and inspect registration definitions and assignments, and remove access when an engagement ends. The API operates over Azure Resource Manager scopes (subscriptions or resource groups) and is authenticated through Azure Active Directory OAuth 2.0.

Use Cases

Patterns agents use ManagedServicesClient API for, with concrete tasks.

★ Onboard MSP customer tenants

Managed service providers use the ManagedServices API to programmatically onboard new customer subscriptions to Azure Lighthouse. The API creates a registration definition describing which managing tenant principals get which roles on the customer scope, then attaches a registration assignment so the access becomes active. This replaces the manual marketplace offer flow for repeatable onboarding pipelines.

Create a registration definition granting Reader and Contributor roles to managing tenant principal IDs, then PUT a registration assignment scoped to the customer subscription and confirm provisioningState is Succeeded.

Audit cross-tenant delegations

Security and compliance teams query the registration assignments and definitions endpoints to inventory every cross-tenant access path into a subscription. The List endpoints return all delegations under a given scope so reviewers can verify the managing tenant ID, role definition IDs, and principal authorizations for each active assignment.

Call GET /{scope}/providers/Microsoft.ManagedServices/registrationAssignments with $expand=registrationDefinition and produce a CSV of managing tenant IDs and granted role definitions.

Offboard a managed customer

When an MSP engagement ends, the API revokes delegated access by deleting the registration assignment. The assignment delete is asynchronous and the API returns a 202 with a status URL the agent polls until removal completes. The underlying registration definition can also be deleted once no assignments reference it.

Delete a registration assignment by ID at a customer subscription scope, poll the asynchronous operation until completion, then delete the orphaned registration definition.

Agent-driven Lighthouse provisioning

Through Jentic, an AI agent can search for 'onboard customer tenant to Azure Lighthouse', load the input schema for RegistrationAssignments_CreateOrUpdate, and execute the call with the customer subscription, registration definition ID, and principal authorizations. The agent never sees the Azure access token directly, and Jentic returns structured results the agent can branch on.

Use Jentic search for 'create azure lighthouse registration', load the operation, supply scope and registration definition body, and execute through the Jentic SDK.

Key Endpoints

9 endpoints — jentic publishes the only available openapi specification for managedservicesclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

PUT

/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}

Create or update a registration definition

PUT

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}

Assign a registration definition to a scope

GET

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments

List registration assignments under a scope

GET

/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}

Get a registration definition by ID

DELETE

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}

Revoke a registration assignment

DELETE

/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}

Delete a registration definition

PUT

/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}

Create or update a registration definition

PUT

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}

Assign a registration definition to a scope

GET

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments

List registration assignments under a scope

GET

/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}

Get a registration definition by ID

DELETE

/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}

Revoke a registration assignment

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD client credentials and tenant IDs are stored encrypted in the Jentic vault. At execution time Jentic mints a short-lived bearer token scoped to https://management.azure.com/ and injects it into the request, so the agent never handles client secrets.

Intent-based discovery

Agents search Jentic with intents like 'create azure lighthouse delegation' and Jentic returns the matching ManagedServices operation with its input schema, so the agent can call the right path without browsing Azure REST docs.

Time to first call

Direct integration: 2-4 days to wire up MSAL, ARM scope conventions, async polling, and rate-limit headers. Through Jentic: under an hour — search, load, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Authorization Management Client

Azure RBAC role definitions and role assignments — pairs with ManagedServices for in-tenant access control.

Choose Authorization for same-tenant role assignments; use ManagedServices when access must cross from a managing tenant into a customer tenant.

Complementary

Subscription Client

List and inspect Azure subscriptions, often the scope target for ManagedServices registration assignments.

Use the Subscription client first to enumerate candidate customer subscription IDs before creating registration assignments against them.

Alternative

Policy Client

Enforce governance via Azure Policy assignments rather than delegated tenant access.

Pick Policy when the goal is to constrain customer resources by rules; pick ManagedServices when an external tenant's principals need to operate the resources.

Complementary

Customer Lockbox

Approve or deny Microsoft engineer access requests, complementing tenant-to-tenant delegations.

Combine with ManagedServices when building a full cross-tenant access governance workflow.

FAQs

Specific to using ManagedServicesClient API through Jentic.

Why is there no official OpenAPI spec for ManagedServicesClient?

Microsoft Azure does not publish a standalone OpenAPI specification for the ManagedServices resource provider. Jentic generates and maintains this spec so that AI agents and developers can call ManagedServicesClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the ManagedServices API use?

The API uses Azure Active Directory OAuth 2.0 via the azure_auth flow, with the user_impersonation scope against https://management.azure.com/. Through Jentic, your Azure AD client credentials are stored encrypted in the Jentic vault and exchanged for a scoped access token at execution time, so the raw secret never enters the agent context.

Can I onboard a customer tenant to Azure Lighthouse with this API?

Yes. Create a registration definition with PUT /{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId} listing the managing tenant ID and the principal-to-role authorizations, then attach it to a customer subscription with PUT /{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}. Both calls are scoped to the customer subscription or resource group.

What are the rate limits for the Azure ManagedServices API?

Azure Resource Manager applies a default subscription-level write throttle of around 1,200 writes per hour and 12,000 reads per hour, surfaced through x-ms-ratelimit-remaining-* response headers. Agents should read those headers and back off when remaining quota approaches zero.

How do I list active delegations for a subscription through Jentic?

Search Jentic for 'list azure lighthouse registration assignments', load the RegistrationAssignments_List operation, and execute with scope set to /subscriptions/{subscriptionId}. Pass $expand=registrationDefinition to include the role authorization payload in the same response.

Is the Azure ManagedServices API free?

The control-plane calls themselves are not billed; you only pay for the underlying Azure resources the managing tenant subsequently operates on. Standard Azure egress and operational charges apply to those workloads.

Does this API support resource group scoped delegations?

Yes. The {scope} path parameter accepts both /subscriptions/{subscriptionId} and /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}, so registration definitions and assignments can be created at either granularity to limit blast radius.