canonical: https://jentic.com/apis/azure.com/privatednsmanagementclient

# Microsoft Azure PrivateDnsManagementClient

Jentic publishes the only available OpenAPI specification for PrivateDnsManagementClient, keeping it validated and agent-ready. The API manages Azure Private DNS zones under Microsoft.Network - the private name resolution surface used to resolve hostnames inside Azure virtual networks without exposing them publicly. It covers the zone lifecycle, virtual network links that bind zones to VNETs, and the full set of record sets (A, AAAA, CNAME, MX, PTR, SOA, SRV, TXT) that hold the records inside each zone.

## For AI agents

Provision and manage Azure Private DNS zones, link them to virtual networks, and create or update DNS record sets for private name resolution inside Azure.

## Scope

Does not manage public DNS zones, network security groups, or virtual network creation - use for Microsoft.Network Private DNS zones, virtual network links, and record sets only.

## Capabilities

- Provision a Private DNS zone in a resource group
- Link a Private DNS zone to one or more Azure virtual networks
- Create or update DNS record sets of any standard type inside a zone
- List record sets in a zone, optionally filtered by record type
- Delete a Private DNS zone or any of its record sets
- Inspect virtual network link configuration and registration state

## Use cases

### Private name resolution inside Azure VNETs

Teams that run internal services in Azure need to resolve hostnames privately without exposing them to the public internet. The API provisions a Private DNS zone, links it to the consuming virtual networks, and lets services register A and CNAME records that other workloads in the same VNET can resolve directly.

Example prompt: Create the Private DNS zone 'corp.internal' in resource group 'network-rg' and link it to virtual network 'vnet-prod' with auto-registration enabled

### Service discovery via DNS record sets

Microservices in a private VNET often use DNS for service discovery. The API supports the full set of record types (A, AAAA, CNAME, MX, PTR, SRV, TXT) so agents can register endpoints, rotate them on deploy, and remove them on teardown without touching public DNS.

Example prompt: Add an A record 'orders' pointing to 10.20.30.40 in the 'corp.internal' Private DNS zone with a 60-second TTL

### VNET link lifecycle management

When a new environment VNET is provisioned, it needs to be linked to existing Private DNS zones so workloads can resolve internal hostnames. When the VNET is decommissioned, those links should be torn down. The API exposes per-link create, get, update, delete, and listing endpoints to manage this lifecycle programmatically.

Example prompt: List all virtual network links on the 'corp.internal' Private DNS zone and delete any pointing to VNETs in resource group 'sandbox-rg'

### Agent-driven DNS automation

An AI agent fronting a platform engineering portal accepts service registration requests and creates or updates the matching Private DNS records, links new VNETs to the zone on demand, and cleans up records when services are retired. Jentic isolates the Azure AD client secret so the agent only sees scoped bearer tokens.

Example prompt: Given a service name and target IP, create the A record in the appropriate Private DNS zone and verify the record is resolvable

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName} | Create or update a Private DNS zone |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName} | Get a specific Private DNS zone |
| DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName} | Delete a Private DNS zone |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/ALL | List all record sets in a zone |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName} | Create or update a virtual network link |
| DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName} | Delete a virtual network link |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.Network/privateDnsZones | List all Private DNS zones in a subscription |

## Key resources

- **Private Zones** — Provisioning, listing, update, and delete of Private DNS zones at subscription and resource-group scope
- **Virtual Network Links** — Bind Private DNS zones to Azure virtual networks for in-VNET resolution
- **Record Sets** — Manage A, AAAA, CNAME, MX, PTR, SOA, SRV, and TXT records inside a zone

## Why Jentic

- **Setup:** Wiring PrivateDnsManagementClient by hand means registering an Azure AD app for OAuth 2.0, acquiring bearer tokens against management.azure.com, and polling the asynchronous virtual network link operations yourself. Through Jentic you install once, import PrivateDnsManagementClient from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** The subscription, resource group, zone name, record type, and record name all travel in the URL path (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/...), so a rule can pin your agent to one Private DNS zone and the operations it needs, such as creating A records and listing record sets. You choose the operations it may call, so destructive ones like deleting a zone or removing a virtual network link are not included unless you add them.
- **Credential handling:** Your Azure AD OAuth 2.0 credential is stored once, encrypted, by your own Jentic One instance and a scoped bearer token is injected at execution time. The client secret never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create an azure private dns A record' or 'link a private dns zone to a vnet', and Jentic returns the matching operation with its input schema so the agent supplies the zone name, record type segment, and record body without browsing the reference docs.

## Related APIs

- **DNS Management Client** — Manages public Azure DNS zones rather than private VNET-scoped zones
- **Storage Management Client** — Provisions Azure Storage accounts that often need private endpoints anchored in a Private DNS zone
- **SQL Management Client** — Provisions Azure SQL servers and private endpoints that resolve via Private DNS

## FAQ

### Why is there no official OpenAPI spec for PrivateDnsManagementClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call PrivateDnsManagementClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Azure Private DNS Management API use?

The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory under the azure_auth scheme with the user_impersonation scope. Through Jentic, the AAD client secret is held in the encrypted vault and a short-lived access token is supplied at execute time so the secret never appears in the agent's context.

### Can I link a Private DNS zone to multiple virtual networks?

Yes. Each VNET link is its own resource at PUT .../privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName}, so you can attach the same zone to many virtual networks and choose per-link whether auto-registration of VM A records is enabled.

### What are the rate limits for the Private DNS Management API?

Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. VNET link operations are long-running and should be polled with backoff.

### How do I add an A record through Jentic?

Search Jentic for 'create azure private dns A record', load the schema for PUT .../privateDnsZones/{privateZoneName}/A/{relativeRecordSetName}, then execute with subscriptionId, resourceGroupName, the zone name, the relative record name, and the ARecords array. The pip install jentic Python SDK uses the async search, load, execute pattern.

### Is the Private DNS Management API free?

There is no per-call charge for the management API itself; you pay for the Private DNS zones (per zone per month) and DNS queries served by the zone. Reads against the management plane are not separately metered.

### Can I limit what my agent is allowed to do with the Microsoft Azure Private DNS Management API?

Yes. Because the subscription, resource group, zone name, record type, and record name all travel in the URL path, a rule in your self-hosted Jentic One instance can pin the agent to a single Private DNS zone and only the operations you approve, such as creating A records and listing record sets. You choose which operations it may call, so destructive ones like deleting a zone or removing a virtual network link are excluded unless you add them. Your own rules decide which operations and credentials the agent is allowed to use, and the scoped Azure AD bearer token is injected only at execution time.