Microsoft Azure Service Map

Name: Service Map API
Brand: Service Map
Availability: InStock

★ Only Publicly Available OpenAPI DocumentDeveloper ToolsMonitoring Observabilityoauth225 EndpointsREST

For Agents

Read process- and connection-level dependency data for Windows and Linux servers reporting into a Log Analytics workspace, and generate a topology map for any machine or group.

Use for: Generate a dependency map for a specific machine in a workspace, List all processes running on a Service Map monitored machine, Find which processes are listening on port 443 on a host, Retrieve all TCP connections observed for a machine in the last hour

Not supported: Does not collect logs, manage alerts, or trace application requests - use for machine, process, port, and connection dependency reads only.

Jentic publishes the only available OpenAPI specification for Service Map, keeping it validated and agent-ready. The Azure Service Map API exposes the Microsoft.OperationalInsights/serviceMap feature inside a Log Analytics workspace, giving agents a structured view of every machine, process, listening port, and TCP connection that the Dependency Agent has observed. It models machines, machine groups, client groups, processes, ports, and connections, and produces an on-demand topology map that shows which services talk to which on each host.

Install Jentic One Beta

Connect the Service Map to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Service Map, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazure-service-map" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazure-service-map" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Service Map API.

List every machine reporting Service Map data into a Log Analytics workspace

Inspect the running processes observed on a specific machine

Enumerate the listening ports and accepting processes on a host

Read the inbound and outbound TCP connections for a machine, port, or process

Generate an on-demand dependency map for a machine or machine group

GET STARTED

Start building with Service Map API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use Service Map API for, with concrete tasks.

★ Migration Discovery

Cloud migration teams use Service Map to discover what actually runs and connects on each server before they pick up boxes for replatforming. The machines, processes, and connections endpoints expose the live dependency graph, so an agent can identify shared databases, hidden inbound clients, and chatty east-west traffic that would otherwise break a lift-and-shift plan.

Call generateMap for the workspace with the machine ID of the source server and a 24-hour interval, then return the list of unique connected machines and ports

Incident Blast Radius Analysis

When a service starts misbehaving, an SRE needs to know everything that depends on it. The connections endpoint at machine, port, and process scope returns inbound TCP traffic over a chosen interval, so an agent can build a list of upstream clients in seconds rather than chasing logs across hosts.

List connections for the machine and port name 443 with a 1-hour interval, then return distinct remote IPs and process names

Process and Port Inventory

Compliance and security teams need a clean inventory of what listens on every server. The ports and acceptingProcesses endpoints return the listening port catalogue per machine and the processes that own those sockets, giving an agent a structured feed for compliance evidence or unexpected listener detection.

List ports for the machine, then for each port list acceptingProcesses and return port number, executableName, and processGroupId

AI Agent Topology Q&A

An agent built on Jentic answers infrastructure questions like which servers does the order service depend on without forcing the user to open the Service Map portal. The agent runs generateMap for the relevant machine group, parses the returned nodes and edges, and gives the user a plain-language answer grounded in real telemetry.

Search Jentic for generate azure service map dependency map, load the schema, and execute generateMap for the machine group with a 4-hour window

Key Endpoints

25 endpoints — jentic publishes the only available openapi specification for service map, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines

List all machines in the workspace

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/generateMap

Generate a dependency map for a machine or group

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/connections

List inbound and outbound connections for a machine

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/processes

List processes observed on a machine

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/ports

List listening ports on a machine

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/ports/{portName}/acceptingProcesses

List processes accepting traffic on a port

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines

List all machines in the workspace

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/generateMap

Generate a dependency map for a machine or group

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/connections

List inbound and outbound connections for a machine

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/processes

List processes observed on a machine

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/ports

List listening ports on a machine

GET

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the Service Map API by hand means registering an Azure AD app, running the OAuth2 azure_auth implicit flow with the user_impersonation scope against management.azure.com, and writing the generateMap request body plus the nested Log Analytics workspace path yourself. Through Jentic you install once, import Service Map from the API Directory, store the Azure service principal credential once, and your agent calls it.

Permission scoping

Service Map puts the workspace and machine names in the URL path (.../workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/...), so a rule can pin your agent to one workspace. Its operations are read and map-generation calls, so you choose which the agent may run, such as listing machines or generating a dependency map.

Credential isolation

Your Azure service principal credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'generate an Azure Service Map dependency map' or 'list listening ports on a monitored machine', and Jentic returns the matching Service Map operation with its input schema so the agent calls the right endpoint directly.

FAQs

Specific to using Service Map API through Jentic.

Why is there no official OpenAPI spec for Service Map?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Service Map via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the Service Map API use?

Service Map uses Azure AD OAuth 2.0 with the implicit flow against https://login.microsoftonline.com/common/oauth2/authorize and the user_impersonation scope. When called through Jentic, your AAD service principal credentials live in your Jentic One instance and the agent only sees a short-lived bearer token scoped to the workspace it is reading.

Can I get a dependency map for a specific server?

Yes. POST to /.../features/serviceMap/generateMap with a machine ID or machine group ID and a time interval; the response returns the nodes (machines, processes, client groups) and edges (connections) of the topology for that window.

How do I find what processes listen on a port?

GET /.../machines/{machineName}/ports/{portName}/acceptingProcesses returns every process observed accepting connections on that port. You can pair that with /machines/{machineName}/ports/{portName}/connections to also see who connected to it during the interval.

What are the rate limits for the Service Map API?

Azure Resource Manager applies subscription-level read throttling around 12,000 requests per hour per principal and write throttling around 1,200 per hour, surfaced in the x-ms-ratelimit-remaining-subscription-reads and x-ms-ratelimit-remaining-subscription-writes response headers. Generating a map counts as a single read against quota.

How do I run a migration discovery query through Jentic?

Search Jentic for generate azure service map dependency map, load the schema for POST /.../features/serviceMap/generateMap, and execute it with the source machine ID and a 24-hour interval. The Jentic Python SDK ships the search, load, and execute pattern after pip install jentic.

Does Service Map require an agent on the server?

Yes - the underlying data comes from the Microsoft Dependency Agent installed on each Windows or Linux machine, reporting into a Log Analytics workspace. The API surfaces what the agent has captured; if no agent is installed, the machine simply will not appear in the listings.

Can I limit what my agent is allowed to do with the Service Map API?

Yes. Because Jentic One is self-hosted, you set the rules that decide which Service Map operations and credentials your agent may use. Since the workspace and machine names sit in the URL path (.../workspaces/{workspaceName}/features/serviceMap/machines/{machineName}/...), you can pin the agent to a single Log Analytics workspace, and because every operation is a read or a map-generation call, you choose whether it may only list machines, processes, ports, and connections or also run generateMap. Your Azure service principal credential stays in your own Jentic One instance and is injected at execution time, so the agent never sees it directly.