Microsoft Azure PolicyClient
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentSecurityComplianceoauth213 EndpointsREST
For Agents
Author and assign Azure Policy definitions across subscription, resource group, and resource scopes through 13 ARM operations on Microsoft.Authorization.
Use for: I need to create a custom policy definition that enforces a 'cost-center' tag, Assign the 'Allowed locations' built-in policy to our production subscription, List all policy assignments in a resource group, Remove a policy assignment that is blocking a deployment
Not supported: Does not evaluate compliance, query non-compliant resources, or manage RBAC role assignments — use for authoring policy definitions and creating policy assignments only.
Jentic publishes the only available OpenAPI specification for PolicyClient, keeping it validated and agent-ready. The Azure Policy management API exposes 13 operations under Microsoft.Authorization for managing policy definitions and policy assignments. Use it to author custom policy definitions, assign built-in or custom policies at subscription, resource group, or individual resource scope, and remove assignments when a control is no longer required. This is the foundational governance plane that enforces tagging, naming, location, and SKU rules across an Azure estate.
Install Jentic One Beta
Connect the PolicyClient to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the PolicyClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with PolicyClient API.
Create custom policy definitions with policyRule expressions and parameter schemas
Assign built-in or custom policy definitions at subscription scope
Assign policy definitions at resource group scope to scope governance to a workload
Assign policy definitions at individual resource scope for surgical exemptions
List every policy assignment that applies to a given resource group or subscription
Remove a policy assignment by name to unblock a deployment that the policy was failing
Retrieve a policy assignment by its full assignment ID for audit reporting
Use Cases
Patterns agents use PolicyClient API for, with concrete tasks.
★ Subscription Governance Baseline
Apply a baseline of Azure Policy assignments to every new subscription as part of a landing zone. Assignments typically include allowed regions, required tags, allowed VM SKUs, and disk encryption enforcement. The 13 endpoints in this API let an automation create custom definitions, assign them at subscription scope, and verify the assignments resolve correctly. The whole baseline applies in a few seconds and is enforced from the next ARM call onward.
Create the policy assignments for 'Allowed locations' (westeurope, northeurope), 'Required tag cost-center', and 'Allowed VM SKUs' at subscription scope
Custom Tag Enforcement
Author a custom policy definition that denies any resource creation missing a required tag (for example 'cost-center' or 'environment'). The policyRule expression checks for tag presence and returns deny when the tag is missing. Once assigned at the appropriate scope, every subsequent ARM PUT lacking the tag is rejected at the management plane before the resource is provisioned, eliminating drift instead of fixing it after the fact.
Create a custom policy definition 'require-cost-center-tag' with a deny effect when tags['cost-center'] is missing, and assign it at the production resource group
Targeted Policy Exception
Grant a temporary exception by assigning a policy with a different parameter value, or by removing a policy assignment at a narrower scope. The API supports assignment at subscription, resource group, parent resource path, or individual resource scope, so the exception can be as narrow as a single resource. Removal of the exception is a single DELETE, restoring the inherited policy from the parent scope.
Assign a relaxed location policy at resource '/subscriptions/{id}/resourceGroups/legacy-app/providers/Microsoft.Web/sites/legacy' to permit eastus, then remove the assignment after migration
AI Agent Governance Operator
An AI agent supporting a cloud governance team can author and assign policies through Jentic. The agent searches by intent ('assign an azure policy'), Jentic returns the PolicyAssignments_Create operation with its schema, and the agent executes the call with managed Azure credentials. Definition authoring and assignment removal follow the same intent-driven flow.
Search Jentic for 'assign an Azure policy', load the PolicyAssignments_Create schema, and execute it with the supplied policy definition ID and target scope
Key Endpoints
13 endpoints — jentic publishes the only available openapi specification for policyclient, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions
List all policy definitions in a subscription
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions/{policyDefinitionName}
Get a policy definition by name
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyassignments
List all policy assignments in a subscription
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/policyAssignments
List policy assignments for a resource group
GET
/{policyAssignmentId}
Get a policy assignment by its full assignment ID
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions
List all policy definitions in a subscription
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions/{policyDefinitionName}
Get a policy definition by name
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyassignments
List all policy assignments in a subscription
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/policyAssignments
List policy assignments for a resource group
GET
/{policyAssignmentId}
Get a policy assignment by its full assignment ID
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure service principal credentials are encrypted in the Jentic vault. Agents receive scoped ARM bearer tokens at execution time and never see the underlying client secret.
Intent-based discovery
Agents search by intent ('assign an azure policy' or 'create a policy definition') and Jentic returns the matching operation, avoiding the need to learn the 13 endpoints under Microsoft.Authorization.
Time to first call
Direct ARM integration: half a day for AAD app registration, MSAL token handling, and policy rule modelling. Through Jentic: under 30 minutes.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using PolicyClient API through Jentic.
Why is there no official OpenAPI spec for PolicyClient?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call PolicyClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the Azure Policy API use?
It uses Azure Active Directory OAuth 2.0 against https://management.azure.com/ with the user_impersonation scope. The caller needs the Resource Policy Contributor role or equivalent permissions on Microsoft.Authorization/policyAssignments and policyDefinitions. Jentic stores service principal credentials encrypted and issues short-lived bearer tokens at execution time.
Can I assign a policy to a single resource through this API?
Yes. PUT to /{scope}/providers/Microsoft.Authorization/policyassignments/{policyAssignmentName} where {scope} is the full resource ID. Use this for narrow exemptions where a workload needs different rules from its containing resource group.
What are the rate limits for the Azure Policy API?
Azure Resource Manager applies subscription-level throttling at roughly 1,200 reads and 1,200 writes per hour. Policy definition and assignment operations are synchronous and typically complete in well under a second.
How do I assign a built-in Azure Policy through Jentic?
Run pip install jentic and search for 'assign an azure policy'. Jentic returns the PolicyAssignments_Create operation; load its schema and execute it with the target scope and the policy definition ID (built-in IDs follow /providers/Microsoft.Authorization/policyDefinitions/{name}).
Does this API evaluate policy compliance?
No. PolicyClient manages definitions and assignments. Compliance evaluation lives in PolicyStatesClient and PolicyEventsClient under Microsoft.PolicyInsights, which expose query endpoints over current state and historical evaluation events.
GET STARTED