canonical: https://jentic.com/apis/azure.com/microsoftserialconsoleclient # Microsoft Azure MicrosoftSerialConsoleClient Jentic publishes the only available OpenAPI specification for MicrosoftSerialConsoleClient, keeping it validated and agent-ready. The Azure Serial Console API enables and disables text-based serial console access at the subscription level for virtual machines and VM scale set instances. Serial Console is the recovery channel that operators reach for when SSH or RDP is unavailable, allowing direct keyboard input to the VM bootloader, single-user mode, or kernel debugger. The control plane exposed here governs subscription-wide enablement of the feature; the actual console stream is delivered over a separate websocket channel established through the Azure portal or CLI. ## For AI agents Enable or disable Azure Serial Console access at the subscription level and inspect operations metadata. Covers 4 endpoints for the consoleServices control plane. ## Scope Does not handle the serial console websocket stream, per-VM boot diagnostics, or VM lifecycle operations - use for subscription-level Serial Console enablement only. ## Capabilities - Enable Serial Console access for an entire Azure subscription - Disable Serial Console access subscription-wide for compliance or lockdown scenarios - Retrieve the current Serial Console enablement state for a subscription - Expose Serial Console operations metadata for self-describing tooling - Toggle the recovery channel that allows VM bootloader and single-user mode access ## Use cases ### VM recovery prep When a virtual machine becomes unreachable over the network, operators need Serial Console enabled before they can recover it. The API allows infrastructure-as-code workflows to enable the console at subscription provisioning time, so when the unreachable-VM page fires the on-call engineer can connect immediately rather than waiting on a portal toggle. Enablement is idempotent and takes effect within seconds. Example prompt: Enable Serial Console for subscription abc by calling POST /subscriptions/abc/providers/Microsoft.SerialConsole/consoleServices/{default}/enableConsole and confirm the enabled flag is true. ### Compliance lockdown of recovery channels Some regulated environments require Serial Console to be disabled outside of break-glass scenarios because it bypasses identity-aware proxies. Compliance tooling can call the disableConsole endpoint on a schedule and verify the state via the get endpoint, then re-enable it only when an approved change ticket is open. This produces an auditable trail of when out-of-band access was available. Example prompt: Disable Serial Console for subscription abc by calling POST /subscriptions/abc/providers/Microsoft.SerialConsole/consoleServices/{default}/disableConsole and assert the get endpoint returns disabled true. ### Console state reporting across subscriptions Cloud governance teams that manage many subscriptions need a quick way to report which ones have Serial Console enabled. Iterating subscriptions and calling GET on the consoleServices/{default} resource yields a per-subscription enabled flag that can populate a compliance dashboard. The endpoint is read-only and inexpensive, so it can run on a frequent governance cadence. Example prompt: Retrieve Serial Console state for each subscription in the tenant and produce a CSV with subscription ID, name, and enabled status. ### Agent-driven recovery readiness AI agents can use Jentic to discover MicrosoftSerialConsoleClient operations by intent, load the structured input schema, and execute calls against management.azure.com without browsing the Azure REST docs. When an alerting agent escalates an unreachable-VM page, it can pre-flight Serial Console enablement on the subscription so the human responder finds the channel ready when they connect. Example prompt: Search Jentic for enable azure serial console, load the input schema, and execute it for the affected subscription before paging the on-call engineer. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /subscriptions/{subscriptionId}/providers/Microsoft.SerialConsole/consoleServices/{default} | Get current Serial Console enablement state | | POST | /subscriptions/{subscriptionId}/providers/Microsoft.SerialConsole/consoleServices/{default}/enableConsole | Enable Serial Console for a subscription | | POST | /subscriptions/{subscriptionId}/providers/Microsoft.SerialConsole/consoleServices/{default}/disableConsole | Disable Serial Console for a subscription | | GET | /providers/Microsoft.SerialConsole/operations | List Microsoft.SerialConsole operations | ## Key resources - **Console Services** — Subscription-level resource representing Serial Console enablement state and operations. - **Operations** — Self-describing metadata for the Microsoft.SerialConsole resource provider operations. ## Why Jentic - **Setup:** Wiring MicrosoftSerialConsoleClient by hand means implementing Azure AD OAuth 2.0, minting an ARM-scoped bearer token for management.azure.com, and handling the subscription-scoped enable and disable POST actions and ARM throttling yourself. Through Jentic you install once, import MicrosoftSerialConsoleClient from the API Directory, store the Azure AD credential once, and your agent calls it. - **Permission scoping:** Serial Console enablement is subscription-scoped and the subscription travels in the URL path, so you limit the agent to the operations it needs, such as reading the current console state, while state-changing operations like enabling or disabling the console are not included unless you add them. The rule pins the agent to the subscriptions you allow and nothing else. - **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived ARM-scoped bearer token at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'enable Azure Serial Console for a subscription' or 'check whether Serial Console is enabled', and Jentic returns the matching Serial Console operation with its input schema so the agent supplies the subscription and executes. ## Related APIs - **Azure Compute Management** — Manages the virtual machines that Serial Console provides recovery access to. - **Microsoft Resource Health** — Reports whether a VM is unreachable due to a platform issue before the operator opens Serial Console. - **Azure Disk Resource Provider** — Disk-level recovery operations such as attaching the OS disk to a rescue VM. ## FAQ ### Why is there no official OpenAPI spec for MicrosoftSerialConsoleClient? Microsoft Azure does not publish an OpenAPI specification for the Microsoft.SerialConsole Resource Provider. Jentic generates and maintains this spec from the Azure Resource Manager contracts so that AI agents and developers can call MicrosoftSerialConsoleClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the Azure Serial Console API use? The API uses Azure Active Directory OAuth 2.0 with the user_impersonation scope against https://login.microsoftonline.com/common/oauth2/authorize. Jentic stores the AAD client secret or service principal credentials encrypted in its vault and supplies scoped bearer tokens to agents at execution time without exposing the underlying credential. ### Can I enable Serial Console for a single VM through this API? No. Enablement is subscription-scoped: POST /subscriptions/{subscriptionId}/providers/Microsoft.SerialConsole/consoleServices/{default}/enableConsole turns Serial Console on for every supported VM and VM scale set instance in the subscription. Per-VM diagnostic settings such as boot diagnostics are managed by the compute management API. ### What are the rate limits for the Azure Serial Console API? The API follows the standard Azure Resource Manager throttling limits, which apply per subscription and per region. Read operations are limited to 1200 requests per hour per subscription. Enable and disable operations are infrequent control-plane changes, so practical rate limits are not a concern outside of bulk governance scans across many subscriptions. ### How do I disable Serial Console through Jentic? Search Jentic for disable azure serial console, load the schema for POST /subscriptions/{subscriptionId}/providers/Microsoft.SerialConsole/consoleServices/{default}/disableConsole, and execute it with the target subscription ID. Jentic handles the AAD token exchange and returns the resulting state, which the agent can verify with a follow-up GET. ### Does the Serial Console API stream console output? No. The serial stream itself is delivered over a separate websocket channel established by the Azure portal or by the az serial-console CLI. This API only governs whether the feature is enabled at the subscription level; it does not transport keystrokes or boot output. ### Can I limit what my agent is allowed to do with the Azure Serial Console API? Yes. Because you run Jentic One yourself, your own rules decide which Serial Console operations the agent may call, so you can allow the read-only GET on consoleServices/{default} that checks the current enablement state while leaving out the state-changing enableConsole and disableConsole POST actions unless you choose to add them. Since the subscription ID travels in the URL path, you can also pin the agent to only the subscriptions you approve and nothing else. The Azure AD credential is held by your own instance and exchanged for a scoped token at execution time, so the agent never sees it.