Microsoft Azure Microsoft Insights
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentDeveloper ToolsMonitoring Observabilityoauth26 EndpointsREST
For Agents
Manage Azure Monitor scheduled query rules: create log-based alerts that run KQL queries on a cadence, list existing rules, and update or delete them. Useful for log-driven alerting automation.
Use for: I need to create a log-based alert on failed sign-ins, List all scheduled query rules in this subscription, Update the threshold on an existing log alert, Delete a noisy scheduled query rule
Not supported: Does not run KQL queries directly, manage action groups, or evaluate metric alerts — use for managing scheduled query rule definitions only.
Jentic publishes the only available OpenAPI specification for Microsoft Insights, keeping it validated and agent-ready. This Azure Monitor surface manages Scheduled Query Rules, the alert rules that run a Kusto query on a Log Analytics workspace at a defined cadence and trigger actions when a threshold is met. Use it to create, list, retrieve, update, and delete scheduled query rules across a subscription or a single resource group. Authentication is via Azure Active Directory OAuth 2.0 on Azure Resource Manager.
Install Jentic One Beta
Connect the Microsoft Insights to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Microsoft Insights, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Microsoft Insights API.
Create or update a scheduled query rule that runs a KQL query against Log Analytics on a defined cadence
List every scheduled query rule in a subscription to inventory log-based alerts
List scheduled query rules within a single resource group for environment-level reviews
Retrieve a single scheduled query rule by name to inspect its query, schedule, and action group
Update an existing scheduled query rule to change its query, severity, or action group
Delete a scheduled query rule that is no longer needed
Use Cases
Patterns agents use Microsoft Insights API for, with concrete tasks.
★ Codify log-based alerts as scheduled query rules
Operations teams use the API to define log-based alerts in version control and apply them through CI rather than clicking through the Azure portal. Each rule pairs a KQL query with a schedule, severity, threshold, and action group, and a single PUT call applies or updates the rule. The same definition can be reused across environments by templating the workspace ID and action group ID.
PUT /subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName} with the KQL query, schedule, action, and severity in the body.
Audit log alert coverage
Reliability teams query the subscription-scoped list endpoint to inventory every scheduled query rule and confirm critical workloads have alerts in place. The output drives gap analysis: a workload missing alerts on its core failure metrics gets new rules, while duplicated or noisy rules are flagged for cleanup or merging.
GET /subscriptions/{subscriptionId}/providers/microsoft.insights/scheduledQueryRules and emit a report grouping rules by source resource and severity.
Tune alert thresholds in response to noise
When a scheduled query rule fires too often, the team adjusts the threshold or query window without recreating the rule. PATCH on the rule path updates the body in place, preserving the rule ID and history. Combine with the GET endpoint to read the current threshold before computing the new value.
GET the rule, compute a new threshold based on the past week's evaluation history, then PATCH /subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName} with the updated trigger condition.
Agent-driven alert deployment
Through Jentic, an AI agent can read an SLO definition, infer the right KQL query and threshold, and create the corresponding scheduled query rule automatically. The agent searches Jentic for 'create azure log alert', loads the input schema, and executes with the workspace ID and action group ID. Jentic injects the Azure AD bearer token at execution time so the agent never sees raw secrets.
Use Jentic search 'create azure scheduled query rule', load ScheduledQueryRules_CreateOrUpdate, supply the source workspace, KQL query, and action group, and execute.
Key Endpoints
6 endpoints — jentic publishes the only available openapi specification for microsoft insights, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
PUT
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName}
Create or update a scheduled query rule
GET
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName}
Get a scheduled query rule
PATCH
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName}
Update a scheduled query rule
DELETE
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName}
Delete a scheduled query rule
GET
/subscriptions/{subscriptionId}/providers/microsoft.insights/scheduledQueryRules
List rules in a subscription
GET
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules
List rules in a resource group
PUT
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName}
Create or update a scheduled query rule
GET
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName}
Get a scheduled query rule
PATCH
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName}
Update a scheduled query rule
DELETE
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName}
Delete a scheduled query rule
GET
/subscriptions/{subscriptionId}/providers/microsoft.insights/scheduledQueryRules
List rules in a subscription
GET
/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules
List rules in a resource group
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD client credentials live encrypted in the Jentic vault. Jentic mints a short-lived ARM-scoped bearer token at execution time so the agent never handles raw client secrets.
Intent-based discovery
Agents search Jentic with phrases like 'create azure scheduled query rule' and Jentic returns the matching ScheduledQueryRules operation with its full input schema, including trigger conditions and action groups.
Time to first call
Direct integration: 1-2 days to handle MSAL, the rule body schema, and PATCH semantics. Through Jentic: under an hour.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Microsoft Insights API through Jentic.
Why is there no official OpenAPI spec for Microsoft Insights scheduled query rules?
Microsoft Azure does not publish a standalone OpenAPI specification for the scheduled query rules surface of Azure Monitor. Jentic generates and maintains this spec so that AI agents and developers can call Microsoft Insights via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the Microsoft Insights API use?
The API uses Azure Active Directory OAuth 2.0 via the azure_auth scheme on https://management.azure.com/. Through Jentic, your Azure AD application credentials are stored encrypted in the Jentic vault and exchanged for a short-lived bearer token at execution time.
Can I create a log-based alert with this API?
Yes. Call PUT /subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName} with the source workspace, KQL query, schedule, action group, and trigger condition in the body. The rule begins evaluating on the configured cadence as soon as it is created.
What are the rate limits for the scheduled query rules API?
The endpoints inherit standard Azure Resource Manager throttle quotas, surfaced through x-ms-ratelimit-remaining-* response headers. Bulk creation should respect those headers and back off when remaining quota approaches zero.
How do I update an existing rule through Jentic?
Search Jentic for 'update azure scheduled query rule', load ScheduledQueryRules_Update, supply the rule name and the changed properties (such as a new threshold or query) in the body, and execute. PATCH semantics mean unspecified properties remain untouched.
Can the same rule run against multiple workspaces?
No. Each scheduled query rule references a single source resource ID, typically a Log Analytics workspace or an Application Insights resource. To alert across multiple workspaces, create one rule per workspace or use a cross-workspace KQL query against a single workspace that has read access to the others.
Does deleting a rule remove past alert history?
DELETE on a rule removes the rule definition and stops future evaluations. Historic alert instances and their state remain in Azure Monitor's alerts subsystem for the configured retention period and can still be queried through the alerts management API.
GET STARTED