What authentication does the Azure Serial Console API use?

The API uses Azure Active Directory OAuth 2.0 with the user_impersonation scope against https://login.microsoftonline.com/common/oauth2/authorize. Jentic stores the AAD client secret or service principal credentials encrypted in its vault and supplies scoped bearer tokens to agents at execution time without exposing the underlying credential.

Can I enable Serial Console for a single VM through this API?

No. Enablement is subscription-scoped: POST /subscriptions/{subscriptionId}/providers/Microsoft.SerialConsole/consoleServices/{default}/enableConsole turns Serial Console on for every supported VM and VM scale set instance in the subscription. Per-VM diagnostic settings such as boot diagnostics are managed by the compute management API.

What are the rate limits for the Azure Serial Console API?

The API follows the standard Azure Resource Manager throttling limits, which apply per subscription and per region. Read operations are limited to 1200 requests per hour per subscription. Enable and disable operations are infrequent control-plane changes, so practical rate limits are not a concern outside of bulk governance scans across many subscriptions.

How do I disable Serial Console through Jentic?

Search Jentic for disable azure serial console, load the schema for POST /subscriptions/{subscriptionId}/providers/Microsoft.SerialConsole/consoleServices/{default}/disableConsole, and execute it with the target subscription ID. Jentic handles the AAD token exchange and returns the resulting state, which the agent can verify with a follow-up GET.

Does the Serial Console API stream console output?

No. The serial stream itself is delivered over a separate websocket channel established by the Azure portal or by the az serial-console CLI. This API only governs whether the feature is enabled at the subscription level; it does not transport keystrokes or boot output.

Can I limit what my agent is allowed to do with the Azure Serial Console API?

Yes. Because you run Jentic One yourself, your own rules decide which Serial Console operations the agent may call, so you can allow the read-only GET on consoleServices/{default} that checks the current enablement state while leaving out the state-changing enableConsole and disableConsole POST actions unless you choose to add them. Since the subscription ID travels in the URL path, you can also pin the agent to only the subscriptions you approve and nothing else. The Azure AD credential is held by your own instance and exchanged for a scoped token at execution time, so the agent never sees it.