canonical: https://jentic.com/apis/azure.com/datalakestoreaccountmanagementclient

# Microsoft Azure DataLakeStoreAccountManagementClient

Jentic publishes the only available OpenAPI specification for DataLakeStoreAccountManagementClient, keeping it validated and agent-ready. The API manages the lifecycle of Azure Data Lake Store accounts under the Microsoft.DataLakeStore resource provider, covering account creation and deletion, firewall and virtual-network rule configuration, trusted identity providers, and per-region capability or usage queries. It is the control-plane surface for Data Lake Store Gen1 - file-level reads and writes live in a separate filesystem API.

## For AI agents

Provision, configure, and delete Azure Data Lake Store Gen1 accounts and manage their firewall rules, virtual network rules, and trusted identity providers.

## Scope

Does not read or write files in the lake, manage U-SQL jobs, or handle billing - use for Data Lake Store Gen1 account lifecycle and network configuration only.

## Capabilities

- Provision and delete Data Lake Store accounts in a resource group
- Configure firewall rules and virtual network rules on a Data Lake Store account
- Register and manage trusted identity providers for an account
- Check Data Lake Store account name availability per region
- Retrieve regional capability and usage information for Data Lake Store
- Update encryption configuration and account-level settings

## Use cases

### Automated Data Lake Store provisioning

Platform teams provision Data Lake Store Gen1 accounts as part of an analytics environment template. The management API lets an automation flow create the account, configure firewall and virtual network rules, register trusted identity providers, and verify the account is ready before downstream U-SQL jobs are scheduled.

Example prompt: Create a Data Lake Store account named 'analytics-dev01' in resource group 'analytics-rg' in East US 2 with default encryption and a single firewall rule allowing the corporate egress range

### Network access lockdown

Security teams routinely tighten access to Data Lake Store by restricting which IP ranges and virtual networks can reach an account. The firewall and vnet rule endpoints support adding, listing, and removing rules on an existing account so a controller can converge configuration to a desired state.

Example prompt: Replace the firewall rule list on Data Lake Store account 'analytics-dev01' with the approved CIDR ranges from the security catalogue and remove any rule not in the approved list

### Account name availability check

Before a self-service portal lets an analyst pick a name for a new Data Lake Store account, the portal calls the name-availability endpoint. This avoids a failed provisioning attempt and gives the user immediate feedback on whether the chosen name is taken in the target region.

Example prompt: Check whether the Data Lake Store account name 'salesanalytics2026' is available in West Europe and return the conflict reason if it is not

### Agent-driven environment provisioning

An AI agent owning an analytics workspace template uses Jentic to assemble Data Lake Store account creation alongside related steps. The agent searches for the create operation, supplies the resource group and configuration, then waits for the long-running provisioning to complete before signalling readiness to the rest of the workflow.

Example prompt: Provision a Data Lake Store account 'agent-test01' with the encryption-at-rest default and confirm the long-running operation reaches Succeeded provisioning state

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.DataLakeStore/accounts | List Data Lake Store accounts in a subscription |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DataLakeStore/accounts/{accountName} | Create or update a Data Lake Store account |
| DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DataLakeStore/accounts/{accountName} | Delete a Data Lake Store account |
| POST | /subscriptions/{subscriptionId}/providers/Microsoft.DataLakeStore/locations/{location}/checkNameAvailability | Check Data Lake Store account name availability |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.DataLakeStore/locations/{location}/usages | Get Data Lake Store usage in a region |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.DataLakeStore/operations | List Microsoft.DataLakeStore provider operations |

## Key resources

- **Accounts** — Create, read, update, list, and delete Data Lake Store accounts
- **Firewall Rules** — Manage IP-range firewall rules on a Data Lake Store account
- **Virtual Network Rules** — Manage vnet/subnet rules permitting access to a Data Lake Store account
- **Trusted Identity Providers** — Register and manage trusted identity providers on an account
- **Locations** — Query per-region capability and usage information
- **Operations** — List the operations exposed by the Microsoft.DataLakeStore provider

## Why Jentic

- **Setup:** Wiring Azure Data Lake Store account management by hand means registering an Azure AD app, handling OAuth 2.0 bearer tokens against management.azure.com, and polling long-running ARM operations for account create and delete yourself. Through Jentic you install once, import Data Lake Store Account Management from the API Directory, store the Azure service principal credential once, and your agent calls it.
- **Permission scoping:** Data Lake Store puts the account name in the URL path (/subscriptions/{id}/resourceGroups/{rg}/providers/Microsoft.DataLakeStore/accounts/{accountName}/...), so a rule can pin your agent to one account and its firewall and virtual-network rules. You choose the operations it may call, so a destructive one like Accounts_Delete is not included unless you add it alongside operations such as FirewallRules_CreateOrUpdate that it actually needs.
- **Credential handling:** Your Azure service principal credential is stored once, encrypted, by your own Jentic One instance and injected as a scoped ARM bearer token at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'provision an Azure Data Lake Store account' or 'add a firewall rule to Data Lake Store', and Jentic returns the matching operation with its input schema so the agent supplies the resource group and IP range without reading the reference docs.

## Related APIs

- **DataLakeStoreFileSystemManagementClient** — File-level operations on the data inside a Data Lake Store account
- **DataLakeAnalyticsCatalogManagementClient** — Manages the U-SQL catalog of an analytics account that consumes Data Lake Store data
- **DataShareManagementClient** — Shares datasets across Azure tenants without provisioning a Data Lake Store account

## FAQ

### Why is there no official OpenAPI spec for DataLakeStoreAccountManagementClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call DataLakeStoreAccountManagementClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Data Lake Store Account API use?

The API is part of Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory. Through Jentic, the AAD client secret or managed identity refresh token is held in the encrypted vault and a short-lived access token is supplied at execute time so the bearer token never enters the agent's context.

### Can I provision a Data Lake Store account with this API?

Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DataLakeStore/accounts/{accountName} creates or updates an account. The call returns immediately with a long-running operation; poll the resource until provisioningState reaches Succeeded before treating the account as ready.

### What are the rate limits for the Data Lake Store Account API?

Azure Resource Manager applies subscription-level read and write throttles (commonly 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. Batch list calls and avoid tight provisioning loops to stay within the writes budget.

### How do I add a firewall rule to a Data Lake Store account through Jentic?

Search Jentic for 'add firewall rule data lake store', load the schema for the firewall rules CreateOrUpdate operation under Microsoft.DataLakeStore/accounts/{accountName}/firewallRules/{firewallRuleName}, then execute with the start and end IP range. The pip install jentic Python SDK uses the async search, load, execute pattern.

### Is the Data Lake Store Account API free?

There is no per-call charge for the management API itself; you pay only for the Data Lake Store Gen1 storage and transactions on accounts that you create. Note that Data Lake Store Gen1 has been retired in favour of Gen2 - new workloads should target ADLS Gen2.

### Can I limit what my agent is allowed to do with the Microsoft Azure Data Lake Store API?

Yes. Jentic One runs self-hosted, so your own rules decide which Data Lake Store operations the agent may call and which Azure credential it uses. Because the account name sits in the URL path, you can pin the agent to a single account and its firewall and virtual-network rules, granting only what it needs such as FirewallRules_CreateOrUpdate. A destructive operation like Accounts_Delete stays out of reach unless you explicitly add it.