Microsoft Azure Service Map
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentDeveloper ToolsMonitoring Observabilityoauth225 EndpointsREST
For Agents
Read process- and connection-level dependency data for Windows and Linux servers reporting into a Log Analytics workspace, and generate a topology map for any machine or group.
Use for: Generate a dependency map for a specific machine in a workspace, List all processes running on a Service Map monitored machine, Find which processes are listening on port 443 on a host, Retrieve all TCP connections observed for a machine in the last hour
Not supported: Does not collect logs, manage alerts, or trace application requests — use for machine, process, port, and connection dependency reads only.
Jentic publishes the only available OpenAPI specification for Service Map, keeping it validated and agent-ready. The Azure Service Map API exposes the Microsoft.OperationalInsights/serviceMap feature inside a Log Analytics workspace, giving agents a structured view of every machine, process, listening port, and TCP connection that the Dependency Agent has observed. It models machines, machine groups, client groups, processes, ports, and connections, and produces an on-demand topology map that shows which services talk to which on each host.
Install Jentic One Beta
Connect the Service Map to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Service Map, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Service Map API.
List every machine reporting Service Map data into a Log Analytics workspace
Inspect the running processes observed on a specific machine
Enumerate the listening ports and accepting processes on a host
Read the inbound and outbound TCP connections for a machine, port, or process
Generate an on-demand dependency map for a machine or machine group
Group external clients into client groups to simplify the topology
Check the liveness state of a machine, port, or process at a given timestamp
Use Cases
Patterns agents use Service Map API for, with concrete tasks.
★ Migration Discovery
Cloud migration teams use Service Map to discover what actually runs and connects on each server before they pick up boxes for replatforming. The machines, processes, and connections endpoints expose the live dependency graph, so an agent can identify shared databases, hidden inbound clients, and chatty east-west traffic that would otherwise break a lift-and-shift plan.
Call generateMap for the workspace with the machine ID of the source server and a 24-hour interval, then return the list of unique connected machines and ports
Incident Blast Radius Analysis
When a service starts misbehaving, an SRE needs to know everything that depends on it. The connections endpoint at machine, port, and process scope returns inbound TCP traffic over a chosen interval, so an agent can build a list of upstream clients in seconds rather than chasing logs across hosts.
List connections for the machine and port name 443 with a 1-hour interval, then return distinct remote IPs and process names
Process and Port Inventory
Compliance and security teams need a clean inventory of what listens on every server. The ports and acceptingProcesses endpoints return the listening port catalogue per machine and the processes that own those sockets, giving an agent a structured feed for compliance evidence or unexpected listener detection.
List ports for the machine, then for each port list acceptingProcesses and return port number, executableName, and processGroupId
AI Agent Topology Q&A
An agent built on Jentic answers infrastructure questions like which servers does the order service depend on without forcing the user to open the Service Map portal. The agent runs generateMap for the relevant machine group, parses the returned nodes and edges, and gives the user a plain-language answer grounded in real telemetry.
Search Jentic for generate azure service map dependency map, load the schema, and execute generateMap for the machine group with a 4-hour window
Key Endpoints
25 endpoints — jentic publishes the only available openapi specification for service map, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines
List all machines in the workspace
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/generateMap
Generate a dependency map for a machine or group
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/connections
List inbound and outbound connections for a machine
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/processes
List processes observed on a machine
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/ports
List listening ports on a machine
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/ports/{portName}/acceptingProcesses
List processes accepting traffic on a port
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines
List all machines in the workspace
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/generateMap
Generate a dependency map for a machine or group
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/connections
List inbound and outbound connections for a machine
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/processes
List processes observed on a machine
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/ports
List listening ports on a machine
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/ports/{portName}/acceptingProcesses
List processes accepting traffic on a port
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD service principal credentials sit encrypted in the Jentic vault. Agents receive a short-lived bearer token scoped to user_impersonation — raw secrets never enter the agent context, so dependency data can be queried safely from chat-driven workflows.
Intent-based discovery
Agents search Jentic by intent such as map server dependencies or list listening ports azure and Jentic returns the matching Service Map operation with its full input schema.
Time to first call
Direct integration with the Service Map ARM endpoints: 1-2 days for AAD setup, ARM error handling, and writing the generateMap request body. Through Jentic: under 1 hour — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Service Map API through Jentic.
Why is there no official OpenAPI spec for Service Map?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Service Map via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the Service Map API use?
Service Map uses Azure AD OAuth 2.0 with the implicit flow against https://login.microsoftonline.com/common/oauth2/authorize and the user_impersonation scope. When called through Jentic, your AAD service principal credentials live in the Jentic vault and the agent only sees a short-lived bearer token scoped to the workspace it is reading.
Can I get a dependency map for a specific server?
Yes. POST to /.../features/serviceMap/generateMap with a machine ID or machine group ID and a time interval; the response returns the nodes (machines, processes, client groups) and edges (connections) of the topology for that window.
How do I find what processes listen on a port?
GET /.../machines/{machineName}/ports/{portName}/acceptingProcesses returns every process observed accepting connections on that port. You can pair that with /machines/{machineName}/ports/{portName}/connections to also see who connected to it during the interval.
What are the rate limits for the Service Map API?
Azure Resource Manager applies subscription-level read throttling around 12,000 requests per hour per principal and write throttling around 1,200 per hour, surfaced in the x-ms-ratelimit-remaining-subscription-reads and x-ms-ratelimit-remaining-subscription-writes response headers. Generating a map counts as a single read against quota.
How do I run a migration discovery query through Jentic?
Search Jentic for generate azure service map dependency map, load the schema for POST /.../features/serviceMap/generateMap, and execute it with the source machine ID and a 24-hour interval. The Jentic Python SDK ships the search, load, and execute pattern after pip install jentic.
Does Service Map require an agent on the server?
Yes — the underlying data comes from the Microsoft Dependency Agent installed on each Windows or Linux machine, reporting into a Log Analytics workspace. The API surfaces what the agent has captured; if no agent is installed, the machine simply will not appear in the listings.
GET STARTED