Microsoft Azure ManagedServicesClient
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputeoauth29 EndpointsREST
For Agents
Manage Azure Lighthouse cross-tenant delegations: create registration definitions, assign them to customer scopes, and revoke access. Useful for MSPs and platform teams onboarding tenants programmatically.
Use for: I need to onboard a new customer tenant to Azure Lighthouse, List all registration assignments under a customer subscription, Get the registration definition that grants my tenant access to a subscription, Revoke a delegated access assignment for a customer scope
Not supported: Does not handle Azure RBAC role assignments inside a single tenant, Azure Policy enforcement, or marketplace billing — use for cross-tenant Azure Lighthouse delegated access management only.
Jentic publishes the only available OpenAPI specification for ManagedServicesClient, keeping it validated and agent-ready. The Azure ManagedServices API powers Azure Lighthouse, letting service providers manage customer Azure resources from their own tenant through delegated resource management. Use it to register a managed service offer in a customer scope, list and inspect registration definitions and assignments, and remove access when an engagement ends. The API operates over Azure Resource Manager scopes (subscriptions or resource groups) and is authenticated through Azure Active Directory OAuth 2.0.
Install Jentic One Beta
Connect the ManagedServicesClient to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the ManagedServicesClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with ManagedServicesClient API.
Create or update a registration definition that grants a managing tenant scoped access to a customer subscription
Assign a registration definition to a customer scope so a service provider can operate on their behalf
List all registration assignments attached to a given Azure scope to audit active delegations
Retrieve a single registration definition by ID to inspect granted role assignments and authorizations
Delete a registration assignment to revoke a managing tenant's delegated access to customer resources
Enumerate available Microsoft.ManagedServices resource provider operations for permission tooling
Use Cases
Patterns agents use ManagedServicesClient API for, with concrete tasks.
★ Onboard MSP customer tenants
Managed service providers use the ManagedServices API to programmatically onboard new customer subscriptions to Azure Lighthouse. The API creates a registration definition describing which managing tenant principals get which roles on the customer scope, then attaches a registration assignment so the access becomes active. This replaces the manual marketplace offer flow for repeatable onboarding pipelines.
Create a registration definition granting Reader and Contributor roles to managing tenant principal IDs, then PUT a registration assignment scoped to the customer subscription and confirm provisioningState is Succeeded.
Audit cross-tenant delegations
Security and compliance teams query the registration assignments and definitions endpoints to inventory every cross-tenant access path into a subscription. The List endpoints return all delegations under a given scope so reviewers can verify the managing tenant ID, role definition IDs, and principal authorizations for each active assignment.
Call GET /{scope}/providers/Microsoft.ManagedServices/registrationAssignments with $expand=registrationDefinition and produce a CSV of managing tenant IDs and granted role definitions.
Offboard a managed customer
When an MSP engagement ends, the API revokes delegated access by deleting the registration assignment. The assignment delete is asynchronous and the API returns a 202 with a status URL the agent polls until removal completes. The underlying registration definition can also be deleted once no assignments reference it.
Delete a registration assignment by ID at a customer subscription scope, poll the asynchronous operation until completion, then delete the orphaned registration definition.
Agent-driven Lighthouse provisioning
Through Jentic, an AI agent can search for 'onboard customer tenant to Azure Lighthouse', load the input schema for RegistrationAssignments_CreateOrUpdate, and execute the call with the customer subscription, registration definition ID, and principal authorizations. The agent never sees the Azure access token directly, and Jentic returns structured results the agent can branch on.
Use Jentic search for 'create azure lighthouse registration', load the operation, supply scope and registration definition body, and execute through the Jentic SDK.
Key Endpoints
9 endpoints — jentic publishes the only available openapi specification for managedservicesclient, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
PUT
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Create or update a registration definition
PUT
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}
Assign a registration definition to a scope
GET
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments
List registration assignments under a scope
GET
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Get a registration definition by ID
DELETE
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}
Revoke a registration assignment
DELETE
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Delete a registration definition
PUT
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Create or update a registration definition
PUT
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}
Assign a registration definition to a scope
GET
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments
List registration assignments under a scope
GET
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Get a registration definition by ID
DELETE
/{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}
Revoke a registration assignment
DELETE
/{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId}
Delete a registration definition
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD client credentials and tenant IDs are stored encrypted in the Jentic vault. At execution time Jentic mints a short-lived bearer token scoped to https://management.azure.com/ and injects it into the request, so the agent never handles client secrets.
Intent-based discovery
Agents search Jentic with intents like 'create azure lighthouse delegation' and Jentic returns the matching ManagedServices operation with its input schema, so the agent can call the right path without browsing Azure REST docs.
Time to first call
Direct integration: 2-4 days to wire up MSAL, ARM scope conventions, async polling, and rate-limit headers. Through Jentic: under an hour — search, load, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using ManagedServicesClient API through Jentic.
Why is there no official OpenAPI spec for ManagedServicesClient?
Microsoft Azure does not publish a standalone OpenAPI specification for the ManagedServices resource provider. Jentic generates and maintains this spec so that AI agents and developers can call ManagedServicesClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the ManagedServices API use?
The API uses Azure Active Directory OAuth 2.0 via the azure_auth flow, with the user_impersonation scope against https://management.azure.com/. Through Jentic, your Azure AD client credentials are stored encrypted in the Jentic vault and exchanged for a scoped access token at execution time, so the raw secret never enters the agent context.
Can I onboard a customer tenant to Azure Lighthouse with this API?
Yes. Create a registration definition with PUT /{scope}/providers/Microsoft.ManagedServices/registrationDefinitions/{registrationDefinitionId} listing the managing tenant ID and the principal-to-role authorizations, then attach it to a customer subscription with PUT /{scope}/providers/Microsoft.ManagedServices/registrationAssignments/{registrationAssignmentId}. Both calls are scoped to the customer subscription or resource group.
What are the rate limits for the Azure ManagedServices API?
Azure Resource Manager applies a default subscription-level write throttle of around 1,200 writes per hour and 12,000 reads per hour, surfaced through x-ms-ratelimit-remaining-* response headers. Agents should read those headers and back off when remaining quota approaches zero.
How do I list active delegations for a subscription through Jentic?
Search Jentic for 'list azure lighthouse registration assignments', load the RegistrationAssignments_List operation, and execute with scope set to /subscriptions/{subscriptionId}. Pass $expand=registrationDefinition to include the role authorization payload in the same response.
Is the Azure ManagedServices API free?
The control-plane calls themselves are not billed; you only pay for the underlying Azure resources the managing tenant subsequently operates on. Standard Azure egress and operational charges apply to those workloads.
Does this API support resource group scoped delegations?
Yes. The {scope} path parameter accepts both /subscriptions/{subscriptionId} and /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}, so registration definitions and assignments can be created at either granularity to limit blast radius.
GET STARTED