Microsoft Azure ManagedServiceIdentityClient
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory Servicesoauth27 EndpointsREST
For Agents
Provision and manage Azure user-assigned managed identities through Azure Resource Manager. Use for identity resource lifecycle, not for assigning RBAC roles or granting access to specific resources.
Use for: Create a user-assigned managed identity 'app-identity' in resource group 'prod-app', List all user-assigned managed identities in my subscription, Find managed identities assigned to a specific resource group, Update tags on the 'pipeline-identity' managed identity
Not supported: Does not assign RBAC roles, manage system-assigned identities, or issue tokens directly — use only for Microsoft.ManagedIdentity user-assigned identity resource lifecycle.
Jentic publishes the only available OpenAPI specification for ManagedServiceIdentityClient, keeping it validated and agent-ready. ManagedServiceIdentityClient is the Azure Resource Manager surface for the Microsoft.ManagedIdentity provider — user-assigned managed identities. It provisions identity resources that other Azure resources (VMs, App Services, Functions) reference to obtain AAD tokens without storing client secrets, and exposes the operations catalog for the provider.
Install Jentic One Beta
Connect the ManagedServiceIdentityClient to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the ManagedServiceIdentityClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with ManagedServiceIdentityClient API.
Provision user-assigned managed identities in a resource group
List user-assigned managed identities across a subscription or resource group
Update tags or properties on an existing managed identity via PATCH
Delete user-assigned managed identities that are no longer in use
Inspect the operations catalog exposed by the Microsoft.ManagedIdentity resource provider
Use Cases
Patterns agents use ManagedServiceIdentityClient API for, with concrete tasks.
★ Provision Identities for Workload Authentication
Platform teams give applications a stable identity by provisioning user-assigned managed identities once and attaching them to compute resources (VMs, App Services, AKS clusters). The PUT on /userAssignedIdentities/{resourceName} returns the principalId and clientId — the values downstream resources use to obtain AAD tokens. Identities can be reused across resources, simplifying secret-free authentication patterns.
PUT a user-assigned managed identity 'app-prod-identity' in resource group 'app-prod' at westeurope, then return the principalId and clientId from the response so downstream RBAC role assignments can reference it.
Identity Inventory and Cleanup
Security teams audit which user-assigned managed identities exist, when they were created, and whether they are still attached to any resource. UserAssignedIdentities_ListBySubscription returns the full set; combined with Resource Graph queries for identity assignment, this surfaces orphan identities safe to delete. Removing unused identities reduces the AAD service principal sprawl.
List UserAssignedIdentities in the subscription, return name, principalId, and resource group for each, and flag identities not referenced by any resource for follow-up deletion.
Managed Identity Tag Governance
Compliance teams enforce tagging on managed identities to attribute usage and cost allocation. UserAssignedIdentities_Update (PATCH on the identity) lets an automation set or update tags such as costCenter, owner, or environment without altering the identity's principal or client IDs. Updates are atomic and do not require token refresh on dependent resources.
PATCH each user-assigned managed identity in resource group 'prod-app' to set tags costCenter=CC-1234 and owner=platform-team.
AI Agent Identity Provisioning
Platform agents that automate landing zone setup use Jentic to discover the managed identity creation operation. Searching for 'create azure user assigned managed identity' returns the schema; the agent loads it and executes against management.azure.com using a token retrieved from the Jentic vault, so identity provisioning runs as part of larger landing zone automations without bundling the ManagedServiceIdentity SDK.
Use Jentic to search 'create azure user assigned managed identity', load the UserAssignedIdentities_CreateOrUpdate schema, and PUT the identity in the requested resource group, returning principalId for use in subsequent RBAC role assignment.
Key Endpoints
7 endpoints — jentic publishes the only available openapi specification for managedserviceidentityclient, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}
Create or update a user-assigned managed identity
GET
/subscriptions/{subscriptionId}/providers/Microsoft.ManagedIdentity/userAssignedIdentities
List user-assigned identities in a subscription
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities
List user-assigned identities in a resource group
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}
Delete a user-assigned managed identity
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}
Update an identity's tags or properties
GET
/providers/Microsoft.ManagedIdentity/operations
List Microsoft.ManagedIdentity provider operations
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}
Create or update a user-assigned managed identity
GET
/subscriptions/{subscriptionId}/providers/Microsoft.ManagedIdentity/userAssignedIdentities
List user-assigned identities in a subscription
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities
List user-assigned identities in a resource group
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}
Delete a user-assigned managed identity
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}
Update an identity's tags or properties
GET
/providers/Microsoft.ManagedIdentity/operations
List Microsoft.ManagedIdentity provider operations
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
AAD client credentials are stored encrypted in the Jentic vault. Agents receive only short-lived bearer tokens scoped to https://management.azure.com/ at call time. The principalId and clientId returned from identity creation are surfaced through the agent's structured response, never logged in plaintext.
Intent-based discovery
Agents search by intent (for example, 'create azure user assigned managed identity') and Jentic returns the UserAssignedIdentities_CreateOrUpdate operation with its parameter schema, so the agent calls the correct endpoint without consulting Microsoft Docs.
Time to first call
Direct ARM integration: under 1 day for AAD setup and identity creation flow. Through Jentic: under 30 minutes — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using ManagedServiceIdentityClient API through Jentic.
Why is there no official OpenAPI spec for ManagedServiceIdentityClient?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call ManagedServiceIdentityClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the ManagedServiceIdentityClient use?
AAD OAuth 2.0 bearer tokens scoped to https://management.azure.com/. With Jentic, AAD client credentials live in the encrypted vault and a short-lived bearer token is injected into the Authorization header at call time.
Does this API assign RBAC roles to the managed identity?
No. RBAC role assignments are made through the Microsoft.Authorization provider (roleAssignments). This client only creates, updates, and deletes the identity resource itself; once you have its principalId, you assign roles separately.
What are the rate limits for the ManagedServiceIdentityClient?
Standard Azure Resource Manager throttling — typically 12,000 reads and 1,200 writes per hour per subscription per region. Identity create operations on /userAssignedIdentities/{resourceName} are normally synchronous and return the principalId and clientId in the response body.
How do I create a managed identity through Jentic?
Run pip install jentic, then search Jentic for 'create azure user assigned managed identity'. Jentic returns the UserAssignedIdentities_CreateOrUpdate schema; load it, supply the resource group, identity name, and location, and PUT to /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{resourceName}.
Can I create system-assigned identities with this API?
No. System-assigned identities are toggled on the parent resource (for example, on a VM via Microsoft.Compute) and cannot exist independently. This client is only for user-assigned identities, which are independent ARM resources.
GET STARTED