PolicyClient

Name: PolicyClient API
Brand: Azure Policy
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityComplianceoauth213 EndpointsREST

For Agents

Author and assign Azure Policy definitions across subscription, resource group, and resource scopes through 13 ARM operations on Microsoft.Authorization.

Connect the PolicyClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the PolicyClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with PolicyClient API.

Create custom policy definitions with policyRule expressions and parameter schemas

Assign built-in or custom policy definitions at subscription scope

Assign policy definitions at resource group scope to scope governance to a workload

Assign policy definitions at individual resource scope for surgical exemptions

GET STARTED

Start building with PolicyClient API

Explore with Jentic

View OpenAPI Document

Use for: I need to create a custom policy definition that enforces a 'cost-center' tag, Assign the 'Allowed locations' built-in policy to our production subscription, List all policy assignments in a resource group, Remove a policy assignment that is blocking a deployment

Not supported: Does not evaluate compliance, query non-compliant resources, or manage RBAC role assignments — use for authoring policy definitions and creating policy assignments only.

Jentic publishes the only available OpenAPI document for PolicyClient, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for PolicyClient, keeping it validated and agent-ready. The Azure Policy management API exposes 13 operations under Microsoft.Authorization for managing policy definitions and policy assignments. Use it to author custom policy definitions, assign built-in or custom policies at subscription, resource group, or individual resource scope, and remove assignments when a control is no longer required. This is the foundational governance plane that enforces tagging, naming, location, and SKU rules across an Azure estate.

Use Cases

Patterns agents use PolicyClient API for, with concrete tasks.

★ Subscription Governance Baseline

Apply a baseline of Azure Policy assignments to every new subscription as part of a landing zone. Assignments typically include allowed regions, required tags, allowed VM SKUs, and disk encryption enforcement. The 13 endpoints in this API let an automation create custom definitions, assign them at subscription scope, and verify the assignments resolve correctly. The whole baseline applies in a few seconds and is enforced from the next ARM call onward.

Create the policy assignments for 'Allowed locations' (westeurope, northeurope), 'Required tag cost-center', and 'Allowed VM SKUs' at subscription scope

Custom Tag Enforcement

Author a custom policy definition that denies any resource creation missing a required tag (for example 'cost-center' or 'environment'). The policyRule expression checks for tag presence and returns deny when the tag is missing. Once assigned at the appropriate scope, every subsequent ARM PUT lacking the tag is rejected at the management plane before the resource is provisioned, eliminating drift instead of fixing it after the fact.

Create a custom policy definition 'require-cost-center-tag' with a deny effect when tags['cost-center'] is missing, and assign it at the production resource group

Targeted Policy Exception

Grant a temporary exception by assigning a policy with a different parameter value, or by removing a policy assignment at a narrower scope. The API supports assignment at subscription, resource group, parent resource path, or individual resource scope, so the exception can be as narrow as a single resource. Removal of the exception is a single DELETE, restoring the inherited policy from the parent scope.

Assign a relaxed location policy at resource '/subscriptions/{id}/resourceGroups/legacy-app/providers/Microsoft.Web/sites/legacy' to permit eastus, then remove the assignment after migration

AI Agent Governance Operator

An AI agent supporting a cloud governance team can author and assign policies through Jentic. The agent searches by intent ('assign an azure policy'), Jentic returns the PolicyAssignments_Create operation with its schema, and the agent executes the call with managed Azure credentials. Definition authoring and assignment removal follow the same intent-driven flow.

Search Jentic for 'assign an Azure policy', load the PolicyAssignments_Create schema, and execute it with the supplied policy definition ID and target scope

Key Endpoints

13 endpoints — jentic publishes the only available openapi specification for policyclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions

List all policy definitions in a subscription

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions/{policyDefinitionName}

Get a policy definition by name

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyassignments

List all policy assignments in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/policyAssignments

List policy assignments for a resource group

GET

/{policyAssignmentId}

Get a policy assignment by its full assignment ID

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions

List all policy definitions in a subscription

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions/{policyDefinitionName}

Get a policy definition by name

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyassignments

List all policy assignments in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/policyAssignments

List policy assignments for a resource group

GET

/{policyAssignmentId}

Get a policy assignment by its full assignment ID

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure service principal credentials are encrypted in the Jentic vault. Agents receive scoped ARM bearer tokens at execution time and never see the underlying client secret.

Intent-based discovery

Agents search by intent ('assign an azure policy' or 'create a policy definition') and Jentic returns the matching operation, avoiding the need to learn the 13 endpoints under Microsoft.Authorization.

Time to first call

Direct ARM integration: half a day for AAD app registration, MSAL token handling, and policy rule modelling. Through Jentic: under 30 minutes.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Azure Policy States

Query current compliance state for the policies assigned through this API.

Use Policy States to find non-compliant resources after assigning policies here.

Complementary

Azure Policy Events

Query historical evaluation events to track when a resource became non-compliant.

Use Policy Events to investigate compliance drift over time after assignments are in place.

Complementary

Azure Authorization Management

Manage RBAC role assignments alongside policy assignments.

Use Authorization Management for who can do what; use Policy for what must be true.

Complementary

Azure Policy Metadata

Look up regulatory and metadata information for policy definitions.

Use Policy Metadata to map definitions to regulatory standards (CIS, ISO, etc.).

FAQs

Specific to using PolicyClient API through Jentic.

Why is there no official OpenAPI spec for PolicyClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call PolicyClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Azure Policy API use?

It uses Azure Active Directory OAuth 2.0 against https://management.azure.com/ with the user_impersonation scope. The caller needs the Resource Policy Contributor role or equivalent permissions on Microsoft.Authorization/policyAssignments and policyDefinitions. Jentic stores service principal credentials encrypted and issues short-lived bearer tokens at execution time.

Can I assign a policy to a single resource through this API?

Yes. PUT to /{scope}/providers/Microsoft.Authorization/policyassignments/{policyAssignmentName} where {scope} is the full resource ID. Use this for narrow exemptions where a workload needs different rules from its containing resource group.

What are the rate limits for the Azure Policy API?

Azure Resource Manager applies subscription-level throttling at roughly 1,200 reads and 1,200 writes per hour. Policy definition and assignment operations are synchronous and typically complete in well under a second.

How do I assign a built-in Azure Policy through Jentic?

Run pip install jentic and search for 'assign an azure policy'. Jentic returns the PolicyAssignments_Create operation; load its schema and execute it with the target scope and the policy definition ID (built-in IDs follow /providers/Microsoft.Authorization/policyDefinitions/{name}).

Does this API evaluate policy compliance?

No. PolicyClient manages definitions and assignments. Compliance evaluation lives in PolicyStatesClient and PolicyEventsClient under Microsoft.PolicyInsights, which expose query endpoints over current state and historical evaluation events.