Microsoft Azure azureactivedirectory
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory Servicesoauth26 EndpointsREST
For Agents
Configure where Azure AD sign-in and audit logs are routed by managing diagnostic settings on the aadiam tenant resource.
Use for: I need to send Azure AD sign-in logs to Log Analytics, Stream Azure AD audit logs to an Event Hub, List diagnostic settings on the AAD tenant, Get the named diagnostic setting on microsoft.aadiam
Not supported: Does not manage users, groups, applications, or conditional access — use for tenant-level Azure AD diagnostic settings only.
Jentic publishes the only available OpenAPI specification for Azure Active Directory diagnostic settings, keeping it validated and agent-ready. The API manages diagnostic settings on the microsoft.aadiam tenant resource, letting agents list and configure where Azure AD audit and sign-in logs are sent — Log Analytics workspace, storage account, or Event Hub. It exposes the diagnosticSettings, diagnosticSettingsCategories, and operations resources under the microsoft.aadiam provider on Azure Resource Manager.
Install Jentic One Beta
Connect the azureactivedirectory to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the azureactivedirectory, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with azureactivedirectory API.
List diagnostic settings on the Azure AD tenant resource
Retrieve a specific diagnostic setting by name
Create or update a diagnostic setting routing AAD logs to Log Analytics
Send Azure AD audit and sign-in logs to a storage account
Stream AAD logs to an Event Hub via diagnostic settings
List the categories of logs available for diagnostic export
Use Cases
Patterns agents use azureactivedirectory API for, with concrete tasks.
★ Stream Azure AD logs to Log Analytics
Configure a diagnostic setting that pushes Azure AD AuditLogs and SignInLogs into a Log Analytics workspace for KQL-based investigation. The PUT /providers/microsoft.aadiam/diagnosticSettings/{name} call attaches the workspaceId and selects log categories. The canonical configuration for Sentinel-based AAD monitoring.
PUT /providers/microsoft.aadiam/diagnosticSettings/aad-to-sentinel with workspaceId and logs[].category in (AuditLogs, SignInLogs) enabled, then verify the GET returns enabled=true
Long-term log archival to storage
Send Azure AD logs to a storage account for long-term retention beyond the default Azure AD log window. The same diagnosticSettings PUT accepts a storageAccountId and per-category retention days. Used by compliance teams who need year-scale retention of identity events.
PUT a diagnosticSetting named aad-archive with storageAccountId and per-category retentionPolicy.days set to 365
Event-driven SIEM integration
Stream Azure AD logs into an Event Hub so a non-Microsoft SIEM can subscribe and consume identity events in near real time. The diagnosticSettings PUT supports eventHubAuthorizationRuleId and eventHubName. This is the standard handoff point for Splunk, QRadar, and similar tools.
PUT diagnosticSetting with eventHubAuthorizationRuleId and confirm AuditLogs and SignInLogs categories are enabled
Agent-driven AAD log routing
Allow an AI agent to wire up an Azure AD log sink during environment bring-up without an operator hand-coding the long microsoft.aadiam resource path. Through Jentic the agent searches by intent, loads the diagnostic setting schema, and executes the PUT. Removes a class of typos when constructing the diagnostic settings request body.
Search Jentic for 'configure azure ad diagnostic setting', load the workspaceId and logs[] schema, and execute the PUT against microsoft.aadiam
Key Endpoints
6 endpoints — jentic publishes the only available openapi specification for azure active directory diagnostic settings, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/providers/microsoft.aadiam/diagnosticSettings
List diagnostic settings on the tenant
GET
/providers/microsoft.aadiam/diagnosticSettings/{name}
Get a specific diagnostic setting
PUT
/providers/microsoft.aadiam/diagnosticSettings/{name}
Create or update a diagnostic setting
DELETE
/providers/microsoft.aadiam/diagnosticSettings/{name}
Delete a diagnostic setting
GET
/providers/microsoft.aadiam/diagnosticSettingsCategories
List available log categories
GET
/providers/microsoft.aadiam/operations
List operations on microsoft.aadiam
GET
/providers/microsoft.aadiam/diagnosticSettings
List diagnostic settings on the tenant
GET
/providers/microsoft.aadiam/diagnosticSettings/{name}
Get a specific diagnostic setting
PUT
/providers/microsoft.aadiam/diagnosticSettings/{name}
Create or update a diagnostic setting
DELETE
/providers/microsoft.aadiam/diagnosticSettings/{name}
Delete a diagnostic setting
GET
/providers/microsoft.aadiam/diagnosticSettingsCategories
List available log categories
GET
/providers/microsoft.aadiam/operations
List operations on microsoft.aadiam
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD OAuth tokens are stored encrypted in the Jentic vault. Agents receive scoped bearer tokens at execution time — service principal client secrets never enter the agent's context.
Intent-based discovery
Agents search Jentic by intent (e.g., 'send azure ad logs to log analytics') and Jentic returns the matching microsoft.aadiam diagnosticSettings operation with its full request body schema.
Time to first call
Direct ARM integration: 1-2 days for AAD app registration, role assignment, and diagnostic setting plumbing. Through Jentic: under 1 hour — search, load, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using azureactivedirectory API through Jentic.
Why is there no official OpenAPI spec for the Azure Active Directory diagnostic settings API?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call the Azure Active Directory diagnostic settings API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does this API use?
The API uses Azure AD OAuth 2.0 with the implicit flow, scoped to user_impersonation against management.azure.com. The caller needs a role with Microsoft.aadiam/diagnosticSettings/write on the tenant. Through Jentic, the bearer token is held in the Jentic vault and exchanged for a scoped access token at execution time.
Can I send Azure AD logs to multiple destinations at once?
Yes. A single diagnostic setting can specify any combination of workspaceId, storageAccountId, and eventHubAuthorizationRuleId. To send to multiple workspaces, create separate named settings via PUT /diagnosticSettings/{name}.
What are the rate limits for this API?
Azure Resource Manager applies tenant-level throttling — typically 12,000 reads and 1,200 writes per hour per subscription. Diagnostic setting writes are synchronous and return 200 with the resulting resource.
How do I configure AAD log routing through Jentic?
Run pip install jentic, then search for 'configure azure ad diagnostic setting'. Jentic returns the PUT /providers/microsoft.aadiam/diagnosticSettings/{name} operation, loads the workspaceId and logs schema, and executes the call.
Does this API manage users, groups, or sign-in policies?
No. This API only manages tenant-level diagnostic settings under microsoft.aadiam. User and group management lives in Microsoft Graph; sign-in policies are managed via Conditional Access APIs.
GET STARTED