canonical: https://jentic.com/apis/azure.com/azureactivedirectory

# Microsoft Azure azureactivedirectory

Jentic publishes the only available OpenAPI specification for Azure Active Directory diagnostic settings, keeping it validated and agent-ready. The API manages diagnostic settings on the microsoft.aadiam tenant resource, letting agents list and configure where Azure AD audit and sign-in logs are sent - Log Analytics workspace, storage account, or Event Hub. It exposes the diagnosticSettings, diagnosticSettingsCategories, and operations resources under the microsoft.aadiam provider on Azure Resource Manager.

## For AI agents

Configure where Azure AD sign-in and audit logs are routed by managing diagnostic settings on the aadiam tenant resource.

## Scope

Does not manage users, groups, applications, or conditional access - use for tenant-level Azure AD diagnostic settings only.

## Capabilities

- List diagnostic settings on the Azure AD tenant resource
- Retrieve a specific diagnostic setting by name
- Create or update a diagnostic setting routing AAD logs to Log Analytics
- Send Azure AD audit and sign-in logs to a storage account
- Stream AAD logs to an Event Hub via diagnostic settings
- List the categories of logs available for diagnostic export

## Use cases

### Stream Azure AD logs to Log Analytics

Configure a diagnostic setting that pushes Azure AD AuditLogs and SignInLogs into a Log Analytics workspace for KQL-based investigation. The PUT /providers/microsoft.aadiam/diagnosticSettings/{name} call attaches the workspaceId and selects log categories. The canonical configuration for Sentinel-based AAD monitoring.

Example prompt: PUT /providers/microsoft.aadiam/diagnosticSettings/aad-to-sentinel with workspaceId and logs[].category in (AuditLogs, SignInLogs) enabled, then verify the GET returns enabled=true

### Long-term log archival to storage

Send Azure AD logs to a storage account for long-term retention beyond the default Azure AD log window. The same diagnosticSettings PUT accepts a storageAccountId and per-category retention days. Used by compliance teams who need year-scale retention of identity events.

Example prompt: PUT a diagnosticSetting named aad-archive with storageAccountId and per-category retentionPolicy.days set to 365

### Event-driven SIEM integration

Stream Azure AD logs into an Event Hub so a non-Microsoft SIEM can subscribe and consume identity events in near real time. The diagnosticSettings PUT supports eventHubAuthorizationRuleId and eventHubName. This is the standard handoff point for Splunk, QRadar, and similar tools.

Example prompt: PUT diagnosticSetting with eventHubAuthorizationRuleId and confirm AuditLogs and SignInLogs categories are enabled

### Agent-driven AAD log routing

Allow an AI agent to wire up an Azure AD log sink during environment bring-up without an operator hand-coding the long microsoft.aadiam resource path. Through Jentic the agent searches by intent, loads the diagnostic setting schema, and executes the PUT. Removes a class of typos when constructing the diagnostic settings request body.

Example prompt: Search Jentic for 'configure azure ad diagnostic setting', load the workspaceId and logs[] schema, and execute the PUT against microsoft.aadiam

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /providers/microsoft.aadiam/diagnosticSettings | List diagnostic settings on the tenant |
| GET | /providers/microsoft.aadiam/diagnosticSettings/{name} | Get a specific diagnostic setting |
| PUT | /providers/microsoft.aadiam/diagnosticSettings/{name} | Create or update a diagnostic setting |
| DELETE | /providers/microsoft.aadiam/diagnosticSettings/{name} | Delete a diagnostic setting |
| GET | /providers/microsoft.aadiam/diagnosticSettingsCategories | List available log categories |
| GET | /providers/microsoft.aadiam/operations | List operations on microsoft.aadiam |

## Key resources

- **diagnosticSettings** — Read, create, update, or delete a tenant-level AAD diagnostic setting
- **diagnosticSettingsCategories** — List the categories of logs available for diagnostic export
- **operations** — List operations supported by the microsoft.aadiam provider

## Why Jentic

- **Setup:** Wiring the Azure AD diagnostic settings API by hand means registering an Azure AD app for OAuth2 bearer auth against management.azure.com, granting the microsoft.aadiam write role, and hand-building the diagnostic setting body with workspace, storage, or Event Hub sinks. Through Jentic you install once, import Azure Active Directory diagnostic settings from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** The setting name sits in the URL path (/providers/microsoft.aadiam/diagnosticSettings/{name}), so a rule can pin your agent to a named diagnostic setting. You choose the operations it may call, so the DELETE that removes a log sink is not included unless you add it, leaving an agent that can only list, read, and create or update settings.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'configure azure ad diagnostic setting to log analytics' or 'stream sign-in logs to an event hub', and Jentic returns the matching microsoft.aadiam diagnosticSettings operation with its full request body schema so the agent wires the sink without hand-coding the resource path.

## Related APIs

- **Azure Log Analytics** — Provisions the Log Analytics workspace this API routes AAD logs into
- **Azure Monitor private link scopes** — Restricts the network paths over which AAD logs flow into Azure Monitor
- **Authorization management client** — Manages the role assignments needed to write microsoft.aadiam diagnostic settings

## FAQ

### Why is there no official OpenAPI spec for the Azure Active Directory diagnostic settings API?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call the Azure Active Directory diagnostic settings API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does this API use?

The API uses Azure AD OAuth 2.0 with the implicit flow, scoped to user_impersonation against management.azure.com. The caller needs a role with Microsoft.aadiam/diagnosticSettings/write on the tenant. Through Jentic, the bearer token is held in your Jentic One instance and exchanged for a scoped access token at execution time.

### Can I send Azure AD logs to multiple destinations at once?

Yes. A single diagnostic setting can specify any combination of workspaceId, storageAccountId, and eventHubAuthorizationRuleId. To send to multiple workspaces, create separate named settings via PUT /diagnosticSettings/{name}.

### What are the rate limits for this API?

Azure Resource Manager applies tenant-level throttling - typically 12,000 reads and 1,200 writes per hour per subscription. Diagnostic setting writes are synchronous and return 200 with the resulting resource.

### How do I configure AAD log routing through Jentic?

Run pip install jentic, then search for 'configure azure ad diagnostic setting'. Jentic returns the PUT /providers/microsoft.aadiam/diagnosticSettings/{name} operation, loads the workspaceId and logs schema, and executes the call.

### Does this API manage users, groups, or sign-in policies?

No. This API only manages tenant-level diagnostic settings under microsoft.aadiam. User and group management lives in Microsoft Graph; sign-in policies are managed via Conditional Access APIs.

### Can I limit what my agent is allowed to do with the Azure Active Directory diagnostic settings API?

Yes. Because Jentic One is self-hosted, your own rules decide which of the microsoft.aadiam operations the agent may call and which credential it uses, so you can grant it list, get, and create-or-update on diagnosticSettings while withholding the DELETE that removes a log sink. Since the setting name sits in the URL path at /providers/microsoft.aadiam/diagnosticSettings/{name}, a rule can also pin the agent to one named diagnostic setting rather than every setting on the tenant. The Azure AD credential is injected at execution time by your instance and never enters the agent's prompt or context.