Microsoft Azure PolicyClient

Name: PolicyClient API
Brand: Azure Policy
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityComplianceoauth213 EndpointsREST

For Agents

Author and assign Azure Policy definitions across subscription, resource group, and resource scopes through 13 ARM operations on Microsoft.Authorization.

Use for: I need to create a custom policy definition that enforces a 'cost-center' tag, Assign the 'Allowed locations' built-in policy to our production subscription, List all policy assignments in a resource group, Remove a policy assignment that is blocking a deployment

Not supported: Does not evaluate compliance, query non-compliant resources, or manage RBAC role assignments - use for authoring policy definitions and creating policy assignments only.

Jentic publishes the only available OpenAPI specification for PolicyClient, keeping it validated and agent-ready. The Azure Policy management API exposes 13 operations under Microsoft.Authorization for managing policy definitions and policy assignments. Use it to author custom policy definitions, assign built-in or custom policies at subscription, resource group, or individual resource scope, and remove assignments when a control is no longer required. This is the foundational governance plane that enforces tagging, naming, location, and SKU rules across an Azure estate.

Install Jentic One Beta

Connect the PolicyClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the PolicyClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazure-policy" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazure-policy" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with PolicyClient API.

Create custom policy definitions with policyRule expressions and parameter schemas

Assign built-in or custom policy definitions at subscription scope

Assign policy definitions at resource group scope to scope governance to a workload

Assign policy definitions at individual resource scope for surgical exemptions

List every policy assignment that applies to a given resource group or subscription

GET STARTED

Start building with PolicyClient API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use PolicyClient API for, with concrete tasks.

★ Subscription Governance Baseline

Apply a baseline of Azure Policy assignments to every new subscription as part of a landing zone. Assignments typically include allowed regions, required tags, allowed VM SKUs, and disk encryption enforcement. The 13 endpoints in this API let an automation create custom definitions, assign them at subscription scope, and verify the assignments resolve correctly. The whole baseline applies in a few seconds and is enforced from the next ARM call onward.

Create the policy assignments for 'Allowed locations' (westeurope, northeurope), 'Required tag cost-center', and 'Allowed VM SKUs' at subscription scope

Custom Tag Enforcement

Author a custom policy definition that denies any resource creation missing a required tag (for example 'cost-center' or 'environment'). The policyRule expression checks for tag presence and returns deny when the tag is missing. Once assigned at the appropriate scope, every subsequent ARM PUT lacking the tag is rejected at the management plane before the resource is provisioned, eliminating drift instead of fixing it after the fact.

Create a custom policy definition 'require-cost-center-tag' with a deny effect when tags['cost-center'] is missing, and assign it at the production resource group

Targeted Policy Exception

Grant a temporary exception by assigning a policy with a different parameter value, or by removing a policy assignment at a narrower scope. The API supports assignment at subscription, resource group, parent resource path, or individual resource scope, so the exception can be as narrow as a single resource. Removal of the exception is a single DELETE, restoring the inherited policy from the parent scope.

Assign a relaxed location policy at resource '/subscriptions/{id}/resourceGroups/legacy-app/providers/Microsoft.Web/sites/legacy' to permit eastus, then remove the assignment after migration

AI Agent Governance Operator

An AI agent supporting a cloud governance team can author and assign policies through Jentic. The agent searches by intent ('assign an azure policy'), Jentic returns the PolicyAssignments_Create operation with its schema, and the agent executes the call with managed Azure credentials. Definition authoring and assignment removal follow the same intent-driven flow.

Search Jentic for 'assign an Azure policy', load the PolicyAssignments_Create schema, and execute it with the supplied policy definition ID and target scope

Key Endpoints

13 endpoints — jentic publishes the only available openapi specification for policyclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions

List all policy definitions in a subscription

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions/{policyDefinitionName}

Get a policy definition by name

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyassignments

List all policy assignments in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/policyAssignments

List policy assignments for a resource group

GET

/{policyAssignmentId}

Get a policy assignment by its full assignment ID

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions

List all policy definitions in a subscription

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policydefinitions/{policyDefinitionName}

Get a policy definition by name

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyassignments

List all policy assignments in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/policyAssignments

List policy assignments for a resource group

GET

/{policyAssignmentId}

Get a policy assignment by its full assignment ID

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the PolicyClient by hand means getting an Azure AD token from login.microsoftonline.com, routing every request to management.azure.com with the right api-version, and telling policy definition calls apart from policy assignment calls yourself. Through Jentic you install once, import PolicyClient from the API Directory, store the Azure AD credential once, and your agent calls it.

Permission scoping

This API puts the subscription id and resource group in the URL path (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/policyAssignments), so a rule can pin your agent to one subscription or resource group. You choose the operations it may call, so creating or deleting a policy assignment is not included unless you add them, letting the agent read definitions and assignments.

Credential isolation

Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'assign an Azure policy' or 'create a policy definition', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without learning the Microsoft.Authorization policy paths.

FAQs

Specific to using PolicyClient API through Jentic.

Why is there no official OpenAPI spec for PolicyClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call PolicyClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the Azure Policy API use?

It uses Azure Active Directory OAuth 2.0 against https://management.azure.com/ with the user_impersonation scope. The caller needs the Resource Policy Contributor role or equivalent permissions on Microsoft.Authorization/policyAssignments and policyDefinitions. Jentic stores service principal credentials encrypted and issues short-lived bearer tokens at execution time.

Can I assign a policy to a single resource through this API?

Yes. PUT to /{scope}/providers/Microsoft.Authorization/policyassignments/{policyAssignmentName} where {scope} is the full resource ID. Use this for narrow exemptions where a workload needs different rules from its containing resource group.

What are the rate limits for the Azure Policy API?

Azure Resource Manager applies subscription-level throttling at roughly 1,200 reads and 1,200 writes per hour. Policy definition and assignment operations are synchronous and typically complete in well under a second.

How do I assign a built-in Azure Policy through Jentic?

Run pip install jentic and search for 'assign an azure policy'. Jentic returns the PolicyAssignments_Create operation; load its schema and execute it with the target scope and the policy definition ID (built-in IDs follow /providers/Microsoft.Authorization/policyDefinitions/{name}).

Does this API evaluate policy compliance?

No. PolicyClient manages definitions and assignments. Compliance evaluation lives in PolicyStatesClient and PolicyEventsClient under Microsoft.PolicyInsights, which expose query endpoints over current state and historical evaluation events.

Can I limit what my agent is allowed to do with the Azure Policy API?

Yes. Because you run Jentic One yourself, your own rules decide which of the 13 Microsoft.Authorization operations the agent may call and which Azure AD credential it uses. Since the API carries the subscription id and resource group in the URL path, you can pin the agent to a single subscription or resource group. You can also grant only read access to policy definitions and assignments and leave out the create and delete assignment operations unless you explicitly add them.