canonical: https://jentic.com/apis/azure.com/ml-team-account-management # Microsoft Azure ML Team Account Management Client Jentic publishes the only available OpenAPI specification for Azure ML Team Account Management, keeping it validated and agent-ready. The Microsoft.MachineLearningExperimentation Resource Provider manages the legacy Team Accounts hierarchy of Azure Machine Learning Workbench: an account contains workspaces, and each workspace contains projects that hold experiment runs and assets. The control plane exposed here covers full lifecycle for accounts, workspaces, and projects, including SKU and tag updates. Although Workbench has been superseded by the modern Azure Machine Learning Workspace, organizations still operating on this preview can drive provisioning, RBAC scoping, and decommissioning entirely through the API. ## For AI agents Manage Azure ML Workbench team accounts, workspaces, and projects across 17 control-plane endpoints under Microsoft.MachineLearningExperimentation. ## Scope Does not handle model training, model deployment, or modern Azure Machine Learning workspaces - use for the legacy ML Workbench team account hierarchy only. ## Capabilities - Create and update ML team accounts in a chosen Azure region with a SKU - List ML team accounts at the subscription or resource group scope - Provision workspaces inside an ML team account for a specific project group - Create projects inside a workspace to hold experiment runs and assets - Update tags and friendly names on accounts, workspaces, and projects in place - Delete projects, workspaces, or whole team accounts during decommissioning - Expose Microsoft.MachineLearningExperimentation operations metadata for tooling ## Use cases ### Onboarding a new data science team Platform teams that still operate on the ML Workbench preview create one team account per business unit, then provision a workspace for each data science squad and a project per modelling initiative. The API performs the full hierarchy creation in a single workflow, applies tags for cost allocation, and grants RBAC roles via the resource manager. Onboarding a new team takes minutes rather than the manual portal walkthrough. Example prompt: Create ML team account churn-team in eastus2, create workspace marketing-ml inside it, then create project churn-q3 inside that workspace, all in resource group ml-prod. ### Decommissioning legacy Workbench environments As organizations migrate from ML Workbench to the modern Azure Machine Learning workspace, they need a clean way to inventory and tear down the legacy hierarchy. Listing accounts, then walking down to workspaces and projects, gives the full set of resources to decommission. The API supports DELETE on each level, allowing scripted teardown after final artifact export. Example prompt: List all projects under workspace experiments-old, export their metadata to a JSON manifest, then delete each project followed by the workspace and the parent ML team account. ### Cost allocation across ML team accounts Finance teams allocating cloud spend across ML projects need consistent tags on every account, workspace, and project. The PATCH operations on each resource type accept tag updates without recreating the resource, allowing a governance agent to enforce tag policy across hundreds of objects in a single pass. Example prompt: Apply the tag costCenter=DS-204 to ML team account contoso-ml and to every workspace and project beneath it, using PATCH on each resource. ### Agent-driven ML hierarchy management AI agents can use Jentic to discover Microsoft.MachineLearningExperimentation operations by intent, load the structured input schema, and execute calls against management.azure.com without browsing the Azure REST docs. A platform agent handling new project requests can stand up an entire account-workspace-project chain from a single natural language request and report the resulting ARM IDs back to the requester. Example prompt: Search Jentic for create azure ml team account, load the input schema, and execute it for a new account in westus2 with the SKU F1Basic and tag environment=dev. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningExperimentation/accounts/{accountName} | Create or update an ML team account | | GET | /subscriptions/{subscriptionId}/providers/Microsoft.MachineLearningExperimentation/accounts | List ML team accounts in a subscription | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningExperimentation/accounts/{accountName}/workspaces/{workspaceName} | Create or update a workspace under an ML team account | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningExperimentation/accounts/{accountName}/workspaces/{workspaceName}/projects/{projectName} | Create or update a project under a workspace | | DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningExperimentation/accounts/{accountName} | Delete an ML team account and all child resources | ## Key resources - **Team Accounts** — Top-level Microsoft.MachineLearningExperimentation resource that contains workspaces and inherits SKU and location. - **Workspaces** — Mid-tier container under a team account that groups related ML projects and applies team-level RBAC. - **Projects** — Leaf resource under a workspace holding experiment runs, scripts, and outputs for a single ML initiative. - **Operations** — Self-describing metadata for the Microsoft.MachineLearningExperimentation resource provider operations. ## Why Jentic - **Setup:** Wiring ML Team Account Management by hand means implementing Azure AD OAuth 2.0, minting an ARM-scoped bearer token for management.azure.com, and walking the three-tier account, workspace, and project hierarchy under Microsoft.MachineLearningExperimentation yourself. Through Jentic you install once, import Azure ML Team Account Management from the API Directory, store the Azure AD credential once, and your agent calls it. - **Permission scoping:** The API puts the subscription, resource group, account, workspace, and project names in the URL path, so a rule can pin your agent to one team account: it can create workspaces and projects under that account and nothing else. You choose the operations it may call, so destructive ones like deleting a project, workspace, or the whole team account are not included unless you add them. - **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived ARM-scoped bearer token at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'create an Azure ML team account' or 'create an ML project inside a workspace', and Jentic returns the matching operation with its input schema so the agent supplies the account, workspace, and project names and executes. ## Related APIs - **Azure Machine Learning Workspaces** — Modern Azure Machine Learning workspace control plane that supersedes ML Workbench team accounts. - **Azure ML Compute** — Provisions and manages compute targets that ML projects use for training and inference. - **Azure ML Model Management** — Registers and deploys trained models built within ML projects. ## FAQ ### Why is there no official OpenAPI spec for ML Team Account Management? Microsoft Azure does not publish an OpenAPI specification for the Microsoft.MachineLearningExperimentation Resource Provider. Jentic generates and maintains this spec from the Azure Resource Manager contracts so that AI agents and developers can call ML Team Account Management via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the Azure ML Team Account Management API use? The API uses Azure Active Directory OAuth 2.0 with the user_impersonation scope against https://login.microsoftonline.com/common/oauth2/authorize. Jentic stores the AAD client secret or service principal credentials encrypted in its vault and supplies scoped bearer tokens to agents at execution time without exposing the underlying credential. ### Can I create a new ML team account through this API? Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningExperimentation/accounts/{accountName} creates or updates a team account. The body must include a location and SKU and may include tags. Workspaces and projects are then created as child resources under the account. ### What are the rate limits for the ML Team Account Management API? The API follows the standard Azure Resource Manager throttling limits, which apply per subscription and per region. Read operations are limited to 1200 requests per hour per subscription. Bulk provisioning of many accounts in parallel should be paced to avoid 429 responses on the ARM control plane. ### How do I create a project inside a workspace through Jentic? Search Jentic for create azure ml project, load the schema for PUT under accounts/{accountName}/workspaces/{workspaceName}/projects/{projectName}, and execute it with the account, workspace, and project names plus a friendly name and tags. Jentic handles the AAD token exchange and returns the project resource. ### Is ML Workbench still supported by Microsoft? Microsoft has retired the Azure Machine Learning Workbench client tooling, but the underlying Microsoft.MachineLearningExperimentation control plane remains reachable for organizations that still hold these resources. Net-new ML projects should use the modern Azure Machine Learning workspace under Microsoft.MachineLearningServices. ### Can I limit what my agent is allowed to do with the Azure ML Team Account Management API? Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use. Since this API carries the subscription, resource group, account, workspace, and project names in the URL path, you can pin the agent to a single team account so it only creates or reads workspaces and projects beneath it. You also choose the exact operations it may call, so destructive ones like deleting a project, workspace, or the whole team account are excluded unless you add them.