azureactivedirectory

Name: azureactivedirectory API
Brand: Azure Active Directory diagnostic settings
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory Servicesoauth26 EndpointsREST

For Agents

Configure where Azure AD sign-in and audit logs are routed by managing diagnostic settings on the aadiam tenant resource.

Connect the azureactivedirectory to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the azureactivedirectory, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with azureactivedirectory API.

List diagnostic settings on the Azure AD tenant resource

Retrieve a specific diagnostic setting by name

Create or update a diagnostic setting routing AAD logs to Log Analytics

Send Azure AD audit and sign-in logs to a storage account

GET STARTED

Start building with azureactivedirectory API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for azureactivedirectory, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Azure Active Directory diagnostic settings, keeping it validated and agent-ready. The API manages diagnostic settings on the microsoft.aadiam tenant resource, letting agents list and configure where Azure AD audit and sign-in logs are sent — Log Analytics workspace, storage account, or Event Hub. It exposes the diagnosticSettings, diagnosticSettingsCategories, and operations resources under the microsoft.aadiam provider on Azure Resource Manager.

Use Cases

Patterns agents use azureactivedirectory API for, with concrete tasks.

★ Stream Azure AD logs to Log Analytics

Configure a diagnostic setting that pushes Azure AD AuditLogs and SignInLogs into a Log Analytics workspace for KQL-based investigation. The PUT /providers/microsoft.aadiam/diagnosticSettings/{name} call attaches the workspaceId and selects log categories. The canonical configuration for Sentinel-based AAD monitoring.

PUT /providers/microsoft.aadiam/diagnosticSettings/aad-to-sentinel with workspaceId and logs[].category in (AuditLogs, SignInLogs) enabled, then verify the GET returns enabled=true

Long-term log archival to storage

Send Azure AD logs to a storage account for long-term retention beyond the default Azure AD log window. The same diagnosticSettings PUT accepts a storageAccountId and per-category retention days. Used by compliance teams who need year-scale retention of identity events.

PUT a diagnosticSetting named aad-archive with storageAccountId and per-category retentionPolicy.days set to 365

Event-driven SIEM integration

Stream Azure AD logs into an Event Hub so a non-Microsoft SIEM can subscribe and consume identity events in near real time. The diagnosticSettings PUT supports eventHubAuthorizationRuleId and eventHubName. This is the standard handoff point for Splunk, QRadar, and similar tools.

PUT diagnosticSetting with eventHubAuthorizationRuleId and confirm AuditLogs and SignInLogs categories are enabled

Agent-driven AAD log routing

Allow an AI agent to wire up an Azure AD log sink during environment bring-up without an operator hand-coding the long microsoft.aadiam resource path. Through Jentic the agent searches by intent, loads the diagnostic setting schema, and executes the PUT. Removes a class of typos when constructing the diagnostic settings request body.

Search Jentic for 'configure azure ad diagnostic setting', load the workspaceId and logs[] schema, and execute the PUT against microsoft.aadiam

Key Endpoints

6 endpoints — jentic publishes the only available openapi specification for azure active directory diagnostic settings, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/providers/microsoft.aadiam/diagnosticSettings

List diagnostic settings on the tenant

GET

/providers/microsoft.aadiam/diagnosticSettings/{name}

Get a specific diagnostic setting

PUT

/providers/microsoft.aadiam/diagnosticSettings/{name}

Create or update a diagnostic setting

DELETE

/providers/microsoft.aadiam/diagnosticSettings/{name}

Delete a diagnostic setting

GET

/providers/microsoft.aadiam/diagnosticSettingsCategories

List available log categories

GET

/providers/microsoft.aadiam/operations

List operations on microsoft.aadiam

GET

/providers/microsoft.aadiam/diagnosticSettings

List diagnostic settings on the tenant

GET

/providers/microsoft.aadiam/diagnosticSettings/{name}

Get a specific diagnostic setting

PUT

/providers/microsoft.aadiam/diagnosticSettings/{name}

Create or update a diagnostic setting

DELETE

/providers/microsoft.aadiam/diagnosticSettings/{name}

Delete a diagnostic setting

GET

/providers/microsoft.aadiam/diagnosticSettingsCategories

List available log categories

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD OAuth tokens are stored encrypted in the Jentic vault. Agents receive scoped bearer tokens at execution time — service principal client secrets never enter the agent's context.

Intent-based discovery

Agents search Jentic by intent (e.g., 'send azure ad logs to log analytics') and Jentic returns the matching microsoft.aadiam diagnosticSettings operation with its full request body schema.

Time to first call

Direct ARM integration: 1-2 days for AAD app registration, role assignment, and diagnostic setting plumbing. Through Jentic: under 1 hour — search, load, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Azure Log Analytics

Provisions the Log Analytics workspace this API routes AAD logs into

Use Log Analytics to create the workspace, then use this API to wire AAD logs into it

Complementary

Azure Monitor private link scopes

Restricts the network paths over which AAD logs flow into Azure Monitor

Pair when AAD log routing must traverse private link only

Complementary

Authorization management client

Manages the role assignments needed to write microsoft.aadiam diagnostic settings

Use authorization to grant the writer role before configuring diagnostic settings

FAQs

Specific to using azureactivedirectory API through Jentic.

Why is there no official OpenAPI spec for the Azure Active Directory diagnostic settings API?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call the Azure Active Directory diagnostic settings API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does this API use?

The API uses Azure AD OAuth 2.0 with the implicit flow, scoped to user_impersonation against management.azure.com. The caller needs a role with Microsoft.aadiam/diagnosticSettings/write on the tenant. Through Jentic, the bearer token is held in the Jentic vault and exchanged for a scoped access token at execution time.

Can I send Azure AD logs to multiple destinations at once?

Yes. A single diagnostic setting can specify any combination of workspaceId, storageAccountId, and eventHubAuthorizationRuleId. To send to multiple workspaces, create separate named settings via PUT /diagnosticSettings/{name}.

What are the rate limits for this API?

Azure Resource Manager applies tenant-level throttling — typically 12,000 reads and 1,200 writes per hour per subscription. Diagnostic setting writes are synchronous and return 200 with the resulting resource.

How do I configure AAD log routing through Jentic?

Run pip install jentic, then search for 'configure azure ad diagnostic setting'. Jentic returns the PUT /providers/microsoft.aadiam/diagnosticSettings/{name} operation, loads the workspaceId and logs schema, and executes the call.

Does this API manage users, groups, or sign-in policies?

No. This API only manages tenant-level diagnostic settings under microsoft.aadiam. User and group management lives in Microsoft Graph; sign-in policies are managed via Conditional Access APIs.