Microsoft Azure AuthorizationManagementClient
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthorizationoauth219 EndpointsREST
For Agents
Manage Azure RBAC role assignments and role definitions, enumerate permissions, and elevate access — the identity control plane for Azure resources, callable by an AI agent.
Use for: I need to grant a service principal Reader on a resource group, List all role assignments on my subscription, Create a custom role that only allows starting and stopping VMs, Find the permissions a user has at a specific resource scope
Not supported: Does not authenticate users, manage Azure AD identities, or enforce policy compliance — use for RBAC role assignment and definition management on Azure resources only.
AuthorizationManagementClient is the Azure Resource Manager API for role-based access control (RBAC). It governs role definitions, role assignments, provider operations metadata, permissions enumeration, and emergency access elevation across subscriptions, resource groups, and individual resources. Use this client to grant, revoke, and audit access to Azure resources programmatically — the foundational identity layer for any Azure automation.
Install Jentic One Beta
Connect the AuthorizationManagementClient to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AuthorizationManagementClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with AuthorizationManagementClient API.
Create, list, and delete role assignments at subscription, resource group, or resource scope
Manage custom role definitions including allowed actions, notActions, and assignable scopes
Enumerate the effective permissions a principal has at a given scope
List provider operations metadata to discover the action strings used in role definitions
Elevate global administrator access for break-glass scenarios
Look up role assignments by ID, scope, or principal
Use Cases
Patterns agents use AuthorizationManagementClient API for, with concrete tasks.
★ Programmatic Access Provisioning
Platform engineering teams running automation pipelines need to grant service principals or managed identities access to specific Azure scopes as part of resource provisioning. The role assignments endpoint creates the assignment in a single PUT, taking the principal ID, role definition ID, and scope. Assignments propagate quickly enough to be used in the same pipeline run.
PUT a roleAssignments/{roleAssignmentId} resource with the target principalId, roleDefinitionId, and scope to grant access, then verify by GETting the assignment back.
Custom Role Authoring
Security teams building least-privilege custom roles need to know which provider operations exist before defining the role's actions and notActions. The providerOperations endpoint returns the full list per provider, which is then used to compose a role definition. The custom role is created via PUT on roleDefinitions/{roleDefinitionId} with a fresh GUID.
GET providerOperations/{resourceProviderNamespace} for each in-scope provider, build the role definition's actions and notActions arrays, and PUT a new roleDefinitions resource with the composed permissions.
Access Audit and Cleanup
Compliance audits require a snapshot of who has what access where. Listing role assignments at the subscription scope (and recursing into nested resources) produces the access map. Combined with directory lookups, this drives quarterly access reviews and the targeted removal of stale assignments via DELETE on the role assignment resource.
List role assignments at the subscription scope, filter to principals not in the active directory, and DELETE each stale assignment by its assignment ID.
Effective Permission Check
Before letting an agent call a write operation on a resource, an orchestrator can call the permissions endpoint to confirm the calling principal has the necessary actions. This prevents partial failures mid-pipeline and surfaces missing permissions early so they can be granted before retrying.
GET /resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions, check the returned actions list for the required action string, and proceed only if it is present.
Agent-Driven RBAC Operations via Jentic
An AI ops agent provisioning Azure resources for a new project can use Jentic to grant the project's managed identity Contributor on a fresh resource group without holding the tenant admin token. Jentic returns the schema for role assignment creation and the agent supplies principal, role, and scope, with credentials staying in the vault.
Search Jentic for 'create an Azure role assignment', execute the PUT with principalId, roleDefinitionId, and scope, and verify the resulting assignment exists.
Key Endpoints
19 endpoints — authorizationmanagementclient is the azure resource manager api for role-based access control (rbac).
METHOD
PATH
DESCRIPTION
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments
List role assignments at the subscription scope
GET
/providers/Microsoft.Authorization/providerOperations
List all provider operations metadata
GET
/providers/Microsoft.Authorization/providerOperations/{resourceProviderNamespace}
List operations for a specific resource provider
GET
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions
Get effective permissions on a resource group
POST
/providers/Microsoft.Authorization/elevateAccess
Elevate to User Access Administrator for tenant root scope
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments
List role assignments at the subscription scope
GET
/providers/Microsoft.Authorization/providerOperations
List all provider operations metadata
GET
/providers/Microsoft.Authorization/providerOperations/{resourceProviderNamespace}
List operations for a specific resource provider
GET
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions
Get effective permissions on a resource group
POST
/providers/Microsoft.Authorization/elevateAccess
Elevate to User Access Administrator for tenant root scope
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
AAD bearer tokens with RBAC management permissions are vaulted in Jentic. Agents receive a scoped session at call time; the underlying client secret stays in the MAXsystem vault and the agent never sees it.
Intent-based discovery
Agents search by intent ('grant Reader to a service principal') and Jentic returns the role assignment operation with its principalId, roleDefinitionId, and scope schema, removing the need to look up role GUIDs by hand.
Time to first call
Direct integration: 1-2 days for AAD setup, ARM client wiring, and role definition discovery. Through Jentic: under 30 minutes — search, load, execute the role assignment PUT.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using AuthorizationManagementClient API through Jentic.
What authentication does the AuthorizationManagementClient use?
Azure Active Directory OAuth 2.0 bearer tokens scoped to https://management.azure.com/. The calling principal must hold a role with Microsoft.Authorization/roleAssignments/write to manage assignments. Jentic vaults the AAD token and supplies a scoped session at call time.
Can I create custom roles with this API?
Yes. PUT to /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} with a body containing roleName, description, actions, notActions, and assignableScopes. Custom role IDs are GUIDs you generate; the role is then assignable just like built-in roles.
What are the rate limits for the AuthorizationManagementClient?
Calls go through Azure Resource Manager and are subject to ARM throttling — typically 12,000 reads and 1,200 writes per hour per subscription. RBAC writes have additional propagation latency; allow up to a few minutes for assignments to take effect across all regions.
How do I list role assignments through Jentic?
Search Jentic for 'list Azure role assignments'. Jentic returns the schema for GET /subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments; execute it with your subscription ID. The response is a paged list of assignments including principalId, roleDefinitionId, and scope.
Is the AuthorizationManagementClient free?
RBAC management calls do not have a per-request charge; access control is a foundational Azure capability included with the platform. Calls still count toward ARM throttling budgets, so design read-heavy automations with caching.
What does the elevateAccess endpoint do?
POST to /providers/Microsoft.Authorization/elevateAccess grants the calling principal the User Access Administrator role at the tenant root scope, which is required to manage RBAC across all subscriptions including those the principal is not assigned to. This is a break-glass capability for global admins; the assignment must be removed manually after use.
GET STARTED