Microsoft Azure azureactivedirectory
Browse all Azure APIsAgent-ready OpenAPI document · curated by JenticIdentity AuthDirectory Servicesoauth26 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Configure where Azure AD sign-in and audit logs are routed by managing diagnostic settings on the aadiam tenant resource.
Use for: I need to send Azure AD sign-in logs to Log Analytics, Stream Azure AD audit logs to an Event Hub, List diagnostic settings on the AAD tenant, Get the named diagnostic setting on microsoft.aadiam
Not supported: Does not manage users, groups, applications, or conditional access - use for tenant-level Azure AD diagnostic settings only.
Jentic publishes the only available OpenAPI specification for Azure Active Directory diagnostic settings, keeping it validated and agent-ready. The API manages diagnostic settings on the microsoft.aadiam tenant resource, letting agents list and configure where Azure AD audit and sign-in logs are sent - Log Analytics workspace, storage account, or Event Hub. It exposes the diagnosticSettings, diagnosticSettingsCategories, and operations resources under the microsoft.aadiam provider on Azure Resource Manager.
Install Jentic One Beta
Connect the azureactivedirectory to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the azureactivedirectory, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazureactivedirectory" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazureactivedirectory" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with azureactivedirectory API.
List diagnostic settings on the Azure AD tenant resource
Retrieve a specific diagnostic setting by name
Create or update a diagnostic setting routing AAD logs to Log Analytics
Send Azure AD audit and sign-in logs to a storage account
Stream AAD logs to an Event Hub via diagnostic settings
List the categories of logs available for diagnostic export
Use Cases
Patterns agents use azureactivedirectory API for, with concrete tasks.
★ Stream Azure AD logs to Log Analytics
Configure a diagnostic setting that pushes Azure AD AuditLogs and SignInLogs into a Log Analytics workspace for KQL-based investigation. The PUT /providers/microsoft.aadiam/diagnosticSettings/{name} call attaches the workspaceId and selects log categories. The canonical configuration for Sentinel-based AAD monitoring.
PUT /providers/microsoft.aadiam/diagnosticSettings/aad-to-sentinel with workspaceId and logs[].category in (AuditLogs, SignInLogs) enabled, then verify the GET returns enabled=true
Long-term log archival to storage
Send Azure AD logs to a storage account for long-term retention beyond the default Azure AD log window. The same diagnosticSettings PUT accepts a storageAccountId and per-category retention days. Used by compliance teams who need year-scale retention of identity events.
PUT a diagnosticSetting named aad-archive with storageAccountId and per-category retentionPolicy.days set to 365
Event-driven SIEM integration
Stream Azure AD logs into an Event Hub so a non-Microsoft SIEM can subscribe and consume identity events in near real time. The diagnosticSettings PUT supports eventHubAuthorizationRuleId and eventHubName. This is the standard handoff point for Splunk, QRadar, and similar tools.
PUT diagnosticSetting with eventHubAuthorizationRuleId and confirm AuditLogs and SignInLogs categories are enabled
Agent-driven AAD log routing
Allow an AI agent to wire up an Azure AD log sink during environment bring-up without an operator hand-coding the long microsoft.aadiam resource path. Through Jentic the agent searches by intent, loads the diagnostic setting schema, and executes the PUT. Removes a class of typos when constructing the diagnostic settings request body.
Search Jentic for 'configure azure ad diagnostic setting', load the workspaceId and logs[] schema, and execute the PUT against microsoft.aadiam
Key Endpoints
6 endpoints — jentic publishes the only available openapi specification for azure active directory diagnostic settings, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/providers/microsoft.aadiam/diagnosticSettings
List diagnostic settings on the tenant
GET
/providers/microsoft.aadiam/diagnosticSettings/{name}
Get a specific diagnostic setting
PUT
/providers/microsoft.aadiam/diagnosticSettings/{name}
Create or update a diagnostic setting
DELETE
/providers/microsoft.aadiam/diagnosticSettings/{name}
Delete a diagnostic setting
GET
/providers/microsoft.aadiam/diagnosticSettingsCategories
List available log categories
GET
/providers/microsoft.aadiam/operations
List operations on microsoft.aadiam
GET
/providers/microsoft.aadiam/diagnosticSettings
List diagnostic settings on the tenant
GET
/providers/microsoft.aadiam/diagnosticSettings/{name}
Get a specific diagnostic setting
PUT
/providers/microsoft.aadiam/diagnosticSettings/{name}
Create or update a diagnostic setting
DELETE
/providers/microsoft.aadiam/diagnosticSettings/{name}
Delete a diagnostic setting
GET
/providers/microsoft.aadiam/diagnosticSettingsCategories
List available log categories
GET
/providers/microsoft.aadiam/operations
List operations on microsoft.aadiam
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Azure AD diagnostic settings API by hand means registering an Azure AD app for OAuth2 bearer auth against management.azure.com, granting the microsoft.aadiam write role, and hand-building the diagnostic setting body with workspace, storage, or Event Hub sinks. Through Jentic you install once, import Azure Active Directory diagnostic settings from the API Directory, store the Azure AD credential once, and your agent calls it.
Permission scoping
The setting name sits in the URL path (/providers/microsoft.aadiam/diagnosticSettings/{name}), so a rule can pin your agent to a named diagnostic setting. You choose the operations it may call, so the DELETE that removes a log sink is not included unless you add it, leaving an agent that can only list, read, and create or update settings.
Credential isolation
Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'configure azure ad diagnostic setting to log analytics' or 'stream sign-in logs to an event hub', and Jentic returns the matching microsoft.aadiam diagnosticSettings operation with its full request body schema so the agent wires the sink without hand-coding the resource path.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using azureactivedirectory API through Jentic.
Why is there no official OpenAPI spec for the Azure Active Directory diagnostic settings API?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call the Azure Active Directory diagnostic settings API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.
What authentication does this API use?
The API uses Azure AD OAuth 2.0 with the implicit flow, scoped to user_impersonation against management.azure.com. The caller needs a role with Microsoft.aadiam/diagnosticSettings/write on the tenant. Through Jentic, the bearer token is held in your Jentic One instance and exchanged for a scoped access token at execution time.
Can I send Azure AD logs to multiple destinations at once?
Yes. A single diagnostic setting can specify any combination of workspaceId, storageAccountId, and eventHubAuthorizationRuleId. To send to multiple workspaces, create separate named settings via PUT /diagnosticSettings/{name}.
What are the rate limits for this API?
Azure Resource Manager applies tenant-level throttling - typically 12,000 reads and 1,200 writes per hour per subscription. Diagnostic setting writes are synchronous and return 200 with the resulting resource.
How do I configure AAD log routing through Jentic?
Run pip install jentic, then search for 'configure azure ad diagnostic setting'. Jentic returns the PUT /providers/microsoft.aadiam/diagnosticSettings/{name} operation, loads the workspaceId and logs schema, and executes the call.
Does this API manage users, groups, or sign-in policies?
No. This API only manages tenant-level diagnostic settings under microsoft.aadiam. User and group management lives in Microsoft Graph; sign-in policies are managed via Conditional Access APIs.
Can I limit what my agent is allowed to do with the Azure Active Directory diagnostic settings API?
Yes. Because Jentic One is self-hosted, your own rules decide which of the microsoft.aadiam operations the agent may call and which credential it uses, so you can grant it list, get, and create-or-update on diagnosticSettings while withholding the DELETE that removes a log sink. Since the setting name sits in the URL path at /providers/microsoft.aadiam/diagnosticSettings/{name}, a rule can also pin the agent to one named diagnostic setting rather than every setting on the tenant. The Azure AD credential is injected at execution time by your instance and never enters the agent's prompt or context.
GET STARTED