canonical: https://jentic.com/apis/azure.com/managed-applications-client # Microsoft Azure Azure Managed Applications Client Jentic publishes the only available OpenAPI specification for Azure Managed Applications Client, keeping it validated and agent-ready. This API manages ARM Managed Applications and Application Definitions: catalogue templates that publishers offer to consumers, the deployed Managed Application instances inside customer subscriptions, and the operations to list, get, create, update, and delete them. It is the surface used by ISVs to ship turnkey Azure solutions and by customers to track deployed instances. ## For AI agents Manage Azure Managed Application Definitions and deployed Managed Application instances across subscriptions and resource groups. ## Scope Does not deploy ARM templates directly, manage marketplace listings, or configure Managed Application managed identities - use only for the Microsoft.Solutions Managed Application and Application Definition lifecycle. ## Capabilities - List deployed Managed Applications across a subscription or resource group - Retrieve a Managed Application by id, by name, or by application id - List Application Definitions available in a resource group - Get a specific Application Definition by name - Create or update a Managed Application from an Application Definition - Delete a Managed Application or Application Definition ## Use cases ### Customer Subscription Inventory ISVs and platform teams need to know every Managed Application instance deployed inside a customer subscription so they can plan upgrades or end-of-life migrations. GET /subscriptions/{subscriptionId}/providers/Microsoft.Solutions/applications returns the full subscription-wide list, while the resource-group-scoped variant supports per-tenant or per-environment auditing. Example prompt: List all Managed Applications in subscription 1111-2222-3333-4444 and emit a CSV of name, location, and applicationDefinitionId ### Catalogue-Driven Deployment Customers deploy a Managed Application by referencing an Application Definition published by an ISV. PUT on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Solutions/applications/{applicationName} creates the deployed instance with parameters bound to the definition, so a self-service portal can launch ISV solutions without raising a support ticket. Example prompt: Create a Managed Application named 'finance-app-prod' in 'rg-customer' from Application Definition '/subscriptions/.../applicationDefinitions/finance-suite' with provided parameters ### Application Definition Lifecycle for Publishers Publishers list and update Application Definitions in their publisher resource group. GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Solutions/applicationDefinitions lists definitions, and the per-name endpoints support get and delete, supporting CI/CD flows where each new version registers a new definition entry. Example prompt: List Application Definitions in resource group 'rg-publisher' and report the latest version per definition name ### Agent-Driven Solution Inventory and Cleanup An AI agent running monthly hygiene can list every Managed Application across customer subscriptions, flag those whose Application Definition has been retired, and delete or migrate the orphans. Through Jentic, intent search returns the right list, get, and delete operations; the Azure OAuth token is held in the credential vault so the agent never sees raw secrets. Example prompt: Search Jentic for 'list Azure Managed Applications', execute against subscription 1111-2222-3333-4444, and flag any Managed Application whose applicationDefinitionId returns 404 ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /subscriptions/{subscriptionId}/providers/Microsoft.Solutions/applications | List Managed Applications in a subscription | | GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Solutions/applications | List Managed Applications in a resource group | | GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Solutions/applications/{applicationName} | Get a Managed Application | | GET | /{applicationId} | Get a Managed Application by id | | GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Solutions/applicationDefinitions | List Application Definitions in a resource group | | GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Solutions/applicationDefinitions/{applicationDefinitionName} | Get an Application Definition | ## Key resources - **Applications** — List, get, create, update, and delete deployed Managed Applications - **Application Definitions** — List, get, and delete Application Definitions in a resource group - **Application by Id** — Retrieve a Managed Application directly by its applicationId ## Why Jentic - **Setup:** Wiring Azure Managed Applications by hand means registering an Azure AD app, acquiring and refreshing OAuth 2.0 bearer tokens for management.azure.com, polling the async create and delete operations, and following nextLink pagination across subscriptions yourself. Through Jentic you install once, import Azure Managed Applications from the API Directory, store the service principal credential once, and your agent calls it. - **Permission scoping:** Managed Applications and Application Definitions are addressed by path parameters (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Solutions/applications/{applicationName}), so a rule can pin your agent to one subscription and resource group. You choose the operations it may call, so destructive ones like deleting a Managed Application or an Application Definition are not included unless you add them. - **Credential handling:** Your Azure AD service principal credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. The secret never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'list Azure Managed Applications in a subscription' or 'get an Application Definition', and Jentic returns the matching operation with its input schema so the agent supplies the subscription and name without navigating the Microsoft.Solutions path tree. ## Related APIs - **Azure Resource Management Client** — Manages the resource groups and ARM resources that Managed Applications materialise inside. - **Azure Deployment Manager** — Coordinates multi-stage deployments that may include Managed Application rollouts. - **Azure Policy Client** — Enforces governance over which Application Definitions consumers may deploy. - **Google App Engine API** — GCP managed application surface - different model, similar consumer-deploys-from-template role. ## FAQ ### Why is there no official OpenAPI spec for Azure Managed Applications Client? Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure Managed Applications Client via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the Azure Managed Applications Client use? The API uses Azure Active Directory OAuth 2.0 bearer tokens (the azure_auth scheme) on management.azure.com. Through Jentic, the AAD app secret is held in your Jentic One instance and exchanged for a short-lived bearer token at execution time, so agents never see the raw secret. ### Can I deploy a Managed Application from a published definition with this API? Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Solutions/applications/{applicationName} creates a Managed Application bound to an Application Definition by id, with the consumer parameters in the request body. Poll the returned operation until it succeeds. ### How do I find every Managed Application in a subscription? Call GET /subscriptions/{subscriptionId}/providers/Microsoft.Solutions/applications. The response paginates with nextLink and includes each application's name, applicationDefinitionId, and provisioningState, which is the data you need for inventory and renewal workflows. ### What are the rate limits for this API? Azure Resource Manager applies subscription-level throttling. List operations are inexpensive but pagination adds calls; create and delete are async and trigger long-running operations. Honour HTTP 429 Retry-After values and avoid back-to-back create attempts on the same name. ### How do I list and audit Managed Applications through Jentic? Run pip install jentic, then search Jentic with 'list Azure Managed Applications'. Jentic returns the subscription-scope list endpoint with its input schema. Execute it, then for each entry call the get-by-id endpoint; the OAuth token is resolved from the vault automatically. ### Can I limit what my agent is allowed to do with the Azure Managed Applications Client API? Yes. Because you self-host Jentic One, your own rules decide which operations and credentials the agent may use. Managed Applications and Application Definitions are addressed by path parameters like /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Solutions/applications/{applicationName}, so a rule can pin the agent to a single subscription and resource group. You also choose the operations it may call, so you can grant read-only listing and get while withholding destructive ones such as deleting a Managed Application or an Application Definition.