canonical: https://jentic.com/apis/azure.com/azure-managedservicesclient # Microsoft Azure ManagedServicesClient Jentic publishes the only available OpenAPI specification for ManagedServicesClient, keeping it validated and agent-ready. The Azure ManagedServices API powers Azure Lighthouse, letting service providers manage customer Azure resources from their own tenant through delegated resource management. Use it to register a managed service offer in a customer scope, list and inspect registration definitions and assignments, and remove access when an engagement ends. The API operates over Azure Resource Manager scopes (subscriptions or resource groups) and is authenticated through Azure Active Directory OAuth 2.0. ## For AI agents Manage Azure Lighthouse cross-tenant delegations: create registration definitions, assign them to customer scopes, and revoke access. Useful for MSPs and platform teams onboarding tenants programmatically. ## Scope Does not handle Azure RBAC role assignments inside a single tenant, Azure Policy enforcement, or marketplace billing - use for cross-tenant Azure Lighthouse delegated access management only. ## Capabilities - Create or update a registration definition that grants a managing tenant scoped access to a customer subscription - Assign a registration definition to a customer scope so a service provider can operate on their behalf - List all registration assignments attached to a given Azure scope to audit active delegations - Retrieve a single registration definition by ID to inspect granted role assignments and authorizations - Delete a registration assignment to revoke a managing tenant's delegated access to customer resources - Enumerate available Microsoft.ManagedServices resource provider operations for permission tooling ## Use cases ### Onboard MSP customer tenants Managed service providers use the ManagedServices API to programmatically onboard new customer subscriptions to Azure Lighthouse. The API creates a registration definition describing which managing tenant principals get which roles on the customer scope, then attaches a registration assignment so the access becomes active. This replaces the manual marketplace offer flow for repeatable onboarding pipelines. Example prompt: Create a registration definition granting Reader and Contributor roles to managing tenant principal IDs, then PUT a registration assignment scoped to the customer subscription and confirm provisioningState is Succeeded. ### Audit cross-tenant delegations Security and compliance teams query the registration assignments and definitions endpoints to inventory every cross-tenant access path into a subscription. The List endpoints return all delegations under a given scope so reviewers can verify the managing tenant ID, role definition IDs, and principal authorizations for each active assignment. Example prompt: Call GET /{scope}/providers/Microsoft.ManagedServices/registrationAssignments with $expand=registrationDefinition and produce a CSV of managing tenant IDs and granted role definitions. ### Offboard a managed customer When an MSP engagement ends, the API revokes delegated access by deleting the registration assignment. The assignment delete is asynchronous and the API returns a 202 with a status URL the agent polls until removal completes. The underlying registration definition can also be deleted once no assignments reference it. Example prompt: Delete a registration assignment by ID at a customer subscription scope, poll the asynchronous operation until completion, then delete the orphaned registration definition. ### Agent-driven Lighthouse provisioning Through Jentic, an AI agent can search for 'onboard customer tenant to Azure Lighthouse', load the input schema for RegistrationAssignments_CreateOrUpdate, and execute the call with the customer subscription, registration definition ID, and principal authorizations. The agent never sees the Azure access token directly, and Jentic returns structured results the agent can branch on. Example prompt: Use Jentic search for 'create azure lighthouse registration', load the operation, supply scope and registration definition body, and execute through the Jentic SDK. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | PUT | /{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId} | Create or update a registration definition | | PUT | /{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId} | Assign a registration definition to a scope | | GET | /{scope}/providers/Microsoft.ManagedServices/registrationAssignments | List registration assignments under a scope | | GET | /{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId} | Get a registration definition by ID | | DELETE | /{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId} | Revoke a registration assignment | | DELETE | /{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId} | Delete a registration definition | ## Key resources - **RegistrationDefinitions** — Define the role authorizations a managing tenant gets on a customer scope; supports list, get, create or update, and delete. - **RegistrationAssignments** — Bind a registration definition to a specific customer scope; supports list, get, create or update, and delete with async provisioning. - **Operations** — Enumerate the Microsoft.ManagedServices resource provider operations available for RBAC tooling. ## Why Jentic - **Setup:** Wiring Azure Lighthouse by hand means setting up MSAL and an Azure AD service principal, minting bearer tokens against management.azure.com, learning the ARM scope path conventions, and polling the async status URL that assignment deletes return. Through Jentic you install once, import ManagedServices from the API Directory, store the service principal credentials once, and your agent calls it. - **Permission scoping:** The scope and definition or assignment id travel in the URL path (/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}), so a rule can pin your agent to a named customer scope and its registrations. You choose the operations it may call, so revoking a registration assignment is not included unless you add it. - **Credential handling:** Your Azure AD client credentials and tenant IDs are stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token scoped to management.azure.com at execution time. The raw secret never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'create an azure lighthouse registration assignment' or 'list active cross-tenant delegations', and Jentic returns the matching RegistrationAssignments or RegistrationDefinitions operation with its input schema so the agent calls the right path without reading the Azure REST docs. ## Related APIs - **Authorization Management Client** — Azure RBAC role definitions and role assignments - pairs with ManagedServices for in-tenant access control. - **Subscription Client** — List and inspect Azure subscriptions, often the scope target for ManagedServices registration assignments. - **Policy Client** — Enforce governance via Azure Policy assignments rather than delegated tenant access. - **Customer Lockbox** — Approve or deny Microsoft engineer access requests, complementing tenant-to-tenant delegations. ## FAQ ### Why is there no official OpenAPI spec for ManagedServicesClient? Microsoft Azure does not publish a standalone OpenAPI specification for the ManagedServices resource provider. Jentic generates and maintains this spec so that AI agents and developers can call ManagedServicesClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the ManagedServices API use? The API uses Azure Active Directory OAuth 2.0 via the azure_auth flow, with the user_impersonation scope against https://management.azure.com/. Through Jentic, your Azure AD client credentials are stored encrypted in your Jentic One instance and exchanged for a scoped access token at execution time, so the raw secret never enters the agent context. ### Can I onboard a customer tenant to Azure Lighthouse with this API? Yes. Create a registration definition with PUT /{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId} listing the managing tenant ID and the principal-to-role authorizations, then attach it to a customer subscription with PUT /{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}. Both calls are scoped to the customer subscription or resource group. ### What are the rate limits for the Azure ManagedServices API? Azure Resource Manager applies a default subscription-level write throttle of around 1,200 writes per hour and 12,000 reads per hour, surfaced through x-ms-ratelimit-remaining-* response headers. Agents should read those headers and back off when remaining quota approaches zero. ### How do I list active delegations for a subscription through Jentic? Search Jentic for 'list azure lighthouse registration assignments', load the RegistrationAssignments_List operation, and execute with scope set to /subscriptions/{subscriptionId}. Pass $expand=registrationDefinition to include the role authorization payload in the same response. ### Is the Azure ManagedServices API free? The control-plane calls themselves are not billed; you only pay for the underlying Azure resources the managing tenant subsequently operates on. Standard Azure egress and operational charges apply to those workloads. ### Does this API support resource group scoped delegations? Yes. The {scope} path parameter accepts both /subscriptions/{subscriptionId} and /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}, so registration definitions and assignments can be created at either granularity to limit blast radius. ### Can I limit what my agent is allowed to do with the Azure ManagedServices API? Yes. Because you self-host Jentic One, your own rules decide which ManagedServices operations and which stored Azure AD credentials the agent may use. Since the customer scope and the registration definition or assignment ID travel in the URL path, you can pin the agent to a named customer subscription or resource group and its registrations. You also choose the operations it can call, so deleting a registration assignment stays off limits unless you explicitly grant it.