Microsoft Azure RemediationsClient
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputeoauth224 EndpointsREST
For Agents
Trigger and track Azure Policy remediation tasks that automatically bring non-compliant resources into policy compliance across management groups, subscriptions, and resource groups.
Use for: I want to remediate non-compliant resources for an Azure Policy assignment, Find all in-progress remediation tasks in a subscription, Cancel a remediation that is touching the wrong resources, List the deployments triggered by a specific remediation run
Not supported: Does not define policies, evaluate compliance, or run scripts inside VMs — use for executing and tracking Azure Policy remediation tasks only.
Jentic publishes the only available OpenAPI specification for RemediationsClient, keeping it validated and agent-ready. The Azure Policy Insights RemediationsClient API creates and manages remediation tasks that bring non-compliant Azure resources back into compliance with assigned policies. Agents can launch remediations at management group, subscription, resource group, or individual resource scope, list deployments triggered by a remediation, and cancel in-progress remediation jobs. The service operates against the Azure Resource Manager control plane and integrates with Azure Policy assignments to drive bulk drift correction.
Install Jentic One Beta
Connect the RemediationsClient to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the RemediationsClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with RemediationsClient API.
Create remediation tasks that re-evaluate non-compliant resources for a specific Azure Policy assignment
List remediation deployments to inspect which resources were touched and whether each fix succeeded
Cancel an in-progress remediation when a policy assignment needs to be rolled back
Scope remediation runs to a management group, subscription, resource group, or single resource
Retrieve the status, filters, and failure thresholds of an existing remediation by name
Delete completed remediation records to keep the policy compliance history clean
Use Cases
Patterns agents use RemediationsClient API for, with concrete tasks.
★ Bulk Policy Compliance Drift Correction
Cloud governance teams use RemediationsClient to fix large numbers of non-compliant Azure resources after a new policy assignment is created. Instead of editing thousands of resources manually, an agent creates a remediation at subscription or management group scope and the service iterates through every non-compliant resource, applying the deployIfNotExists or modify effect defined in the policy. The remediation job reports per-resource success and failure so operators can audit the run.
Create a remediation named tag-cleanup at subscription scope for policy assignment id /subscriptions/abc/providers/Microsoft.Authorization/policyAssignments/require-tags and poll its provisioningState until Succeeded
Targeted Resource-Group Remediation
When a single resource group falls out of compliance after a misconfiguration, an agent can scope a remediation to that resource group only, avoiding side effects elsewhere in the subscription. The PUT operation on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/remediations/{remediationName} accepts a policyAssignmentId and resource discovery mode, letting the agent re-evaluate only resources currently flagged non-compliant.
Submit a PUT remediation named storage-encryption-fix on resource group rg-prod with policyAssignmentId /subscriptions/abc/.../require-storage-encryption and resourceDiscoveryMode set to ReEvaluateCompliance
Audit Trail for Remediation Deployments
Compliance auditors need to see exactly which resources a remediation touched and when. The listDeployments operation returns an ordered list of deployment records for each remediation, including the target resource id, the deployment id, status, and timestamps. Agents can pull this trail to feed compliance reports or trigger alerts when deployment failures exceed a threshold.
List all deployments for remediation tag-cleanup in subscription abc and return the count of deployments where status is Failed
Agent-Driven Compliance Workflow via Jentic
Through Jentic, an autonomous compliance agent can search for the right remediation operation by intent, load the input schema for the PUT remediation call, populate it from a policy assignment, execute the remediation, and then poll the GET endpoint for completion. The Azure OAuth token is handled by Jentic's vault, so the agent never sees the raw client secret. End-to-end remediation orchestration moves from a multi-step Azure SDK integration to a few Jentic search and execute calls.
Search Jentic for remediate non-compliant azure resources, load the PUT remediation schema, execute it for a given policy assignment, then poll the resulting remediation until it reaches a terminal provisioningState
Key Endpoints
24 endpoints — jentic publishes the only available openapi specification for remediationsclient, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
PUT
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}
Create a subscription-scoped remediation
GET
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations
List subscription remediations
POST
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/cancel
Cancel an in-progress remediation
GET
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/listDeployments
List remediation deployments
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/remediations/{remediationName}
Create a resource-group-scoped remediation
DELETE
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}
Delete a remediation record
PUT
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}
Create a subscription-scoped remediation
GET
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations
List subscription remediations
POST
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/cancel
Cancel an in-progress remediation
GET
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/listDeployments
List remediation deployments
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/remediations/{remediationName}
Create a resource-group-scoped remediation
DELETE
/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}
Delete a remediation record
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure service principal credentials and OAuth 2.0 tokens are stored encrypted in the Jentic vault. Agents receive scoped bearer tokens for the management.azure.com audience only — the underlying client secret never enters the agent context.
Intent-based discovery
Agents search by intent such as remediate non-compliant azure resources or cancel azure policy remediation, and Jentic returns the matching RemediationsClient operation with its full input schema, so the agent can call the right scope-specific endpoint without browsing Azure docs.
Time to first call
Direct integration: 1-3 days to wire up MSAL, ARM async polling, and per-scope path logic. Through Jentic: under an hour to search, load the schema, and execute a remediation.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using RemediationsClient API through Jentic.
Why is there no official OpenAPI spec for RemediationsClient?
Microsoft Azure does not publish a unified OpenAPI specification for the Policy Insights RemediationsClient. Jentic generates and maintains this spec so that AI agents and developers can call RemediationsClient via structured tooling. It is validated against the live Azure Resource Manager API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the RemediationsClient API use?
RemediationsClient uses Azure Active Directory OAuth 2.0 via the azure_auth flow defined in the spec. You acquire a bearer token for the https://management.azure.com/.default scope and pass it as Authorization: Bearer. Through Jentic, the Azure service principal credential is held in the vault and the agent receives a scoped token rather than the raw client secret.
Can I cancel a remediation that has already started with the RemediationsClient API?
Yes. Call POST on /subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/cancel (or the equivalent management-group or resource-group path). The service moves the remediation into a Cancelling state and stops scheduling new deployments, though deployments already in flight will run to completion.
What scopes can a RemediationsClient remediation target?
The API supports four scopes: management group (/providers/Microsoft.Management/managementGroups/{id}/...), subscription (/subscriptions/{subscriptionId}/...), resource group (/subscriptions/{subscriptionId}/resourceGroups/{rg}/...), and individual resource via the same paths with a resource filter. Each scope has its own PUT, GET, DELETE, cancel, and listDeployments endpoints.
What are the rate limits for the RemediationsClient API?
Azure Resource Manager applies subscription-level throttling: roughly 1,200 reads and 1,200 writes per hour per subscription, with per-tenant ceilings on top. Throttled responses return HTTP 429 with a Retry-After header. Long-running remediation creates also count against ARM async operation limits.
How do I trigger a remediation through Jentic?
Search Jentic for remediate non-compliant azure resources, then call client.load on the matching PUT remediation operation to receive its input schema. Populate policyAssignmentId and resourceDiscoveryMode, then call client.execute. Jentic injects the OAuth token and returns the remediation resource so you can poll its provisioningState.
GET STARTED