Agent report card
Can an agent use Microsoft Azure through API resource management?
Grade B: Only some material eligibility conditions are decidable before commitment.
Microsoft / active
Five-stage assessment
Where agent autonomy holds and where it breaks
- EvaluateLimited
- Sign upReady
- PayReady
- ProvisionLimited
- OperateLimited
Only some material eligibility conditions are decidable before commitment.
The exact service and stable evaluation or access entrypoints are publicly discoverable.
Applicable terms are stable, readable, retrievable, and materially complete.
Price or no-charge status, variables, currency, and material conditions are explicit.
Evidence and actions6 signals
Can an agent decide every material eligibility condition before commitment?
supported: freshOnly some material eligibility conditions are decidable before commitment.
Microsoft Azure Product Terms define specific registration and compliance requirements for Limited Access Services (such as certain Azure AI Services), requiring accurate registration forms. However, generic eligibility criteria across all Azure services are not fully detailed in this excerpt.
Can an agent estimate cost or confirm no-charge status before commitment?
supported: freshPrice or no-charge status, variables, currency, and material conditions are explicit.
Azure pricing models and currencies (USD worldwide) are explicit through the Azure pricing documentation and the Azure Retail Prices REST API, which provides unauthenticated programmatic access to retail rates, SKUs, and meter details.
Can an agent find the exact service and its stable entrypoints?
supported: freshThe exact service and stable evaluation or access entrypoints are publicly discoverable.
The Azure REST API reference documentation explicitly provides public documentation, HTTP methods, and guidance for discovering and calling stable Azure service REST API endpoints.
Are verified structured discovery artifacts available?
missing: unknownCurrent admissible evidence does not resolve this finding.
Can an agent retrieve and understand the applicable commitment terms?
supported: freshApplicable terms are stable, readable, retrievable, and materially complete.
Applicable legal terms and product conditions, including the Microsoft Customer Agreement (MCA) and Universal License Terms for Online Services, are publicly retrievable and explicitly defined on Microsoft Azure legal and product terms pages.
Does the vendor deliberately describe access for web agents?
missing: unknownCurrent admissible evidence does not resolve this finding.
What would improve this stage
- State every material eligibility condition and required input explicitly.
A stable canonical route begins the required access bootstrap.
Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.
Evidence and actions5 signals
Can an agent operate the access controls and safe handoffs deterministically?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained capture from signup.azure.com shows only an initial sign-up page heading without establishing agent operability for required access controls, navigation, validation, or handoffs.
Is there a stable route to begin obtaining service access?
supported: freshA stable canonical route begins the required access bootstrap.
Azure sign-up begins at signup.azure.com, and documented access route instructions direct users to sign in to the Azure portal, navigate to Subscriptions, and select Add.
Can an agent obtain access without an unsupported CAPTCHA boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The captured sign-up page and subscription documentation do not provide explicit evidence regarding whether a mandatory CAPTCHA challenge is present or if a verified-agent alternative exists across the flow.
Can an agent obtain scoped, revocable authority for this service?
supported: freshScoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.
Microsoft Entra supports the OAuth 2.0 client credentials grant flow for machine-to-machine authentication using app-only tokens, service principals, and managed identities to obtain scoped, revocable access.
Can required phone verification be completed through a supported boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The admitted captures do not state phone verification requirements or define a supported resumable boundary for phone verification.
Charge or no-charge status, currency, recurrence, and material conditions are disclosed.
A documented direct purchase path reaches paid access without a vendor decision point.
Evidence and actions4 signals
Can an agent construct checkout, hand off approval safely, and resume?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence describes adding or replacing credit cards in the Azure portal, but does not establish a complete end-to-end flow for deterministic agent checkout construction, approval handoff, and resumption.
Is the exact commercial commitment disclosed before authorization?
supported: freshCharge or no-charge status, currency, recurrence, and material conditions are disclosed.
Azure explicitly discloses its pay-as-you-go consumption model, USD currency default, and available commitment offers (such as reservations and savings plans) on its pricing page and through the Retail Rates Prices API.
Can payment be authorized within scoped agent or explicit human authority?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence details requiring account administrator or specific Microsoft Customer Agreement roles to manage payment methods, but does not state a documented rail for scoped delegation or explicit human-confirmed authorization with receipts.
Is a direct self-service path to paid access documented?
supported: freshA documented direct purchase path reaches paid access without a vendor decision point.
Documentation provides a direct self-service procedure in the Azure portal under Subscriptions > Add to select a billing account, billing profile, invoice section, and plan to create a new subscription immediately without vendor intervention.
Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
Provisioning is machine-triggerable or follows deterministically from an allowed handoff.
Credentials, grants, or configuration are delivered through a documented agent-usable flow.
Evidence and actions3 signals
Can usable access material be delivered securely to an authorized agent?
supported: freshCredentials, grants, or configuration are delivered through a documented agent-usable flow.
Documented agent-usable flows allow acquiring access material. The OAuth 2.0 client credentials flow supports POST requests to the /token endpoint with client_secret, certificate assertion, or federated credentials to receive an access token. Additionally, app registration and service principal creation provide client IDs and allow adding secrets or certificates programmatically.
Can an agent determine successful provisioning completion and reconcile asynchronous failure?
supported: freshCompletion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
Azure Resource Manager asynchronous operations report status via response codes (201, 202) and header polling URLs (Azure-AsyncOperation), exposing progress percentComplete, terminal provisioningState values (Succeeded, Failed, Canceled), and error details on failure. However, an explicit time or delay bound and specific reconciliation properties are not fully established in the evidence.
Can provisioning be initiated within supported agent authority?
supported: freshProvisioning is machine-triggerable or follows deterministically from an allowed handoff.
Resource provisioning can be initiated programmatically via Azure Resource Manager REST APIs, including PUT requests to create or update resource groups, storage accounts, or deploy ARM templates directly using Bearer authorization tokens.
What would improve this stage
- Expose bounded machine-readable terminal status and reconciliation semantics.
Safe failure handling is documented only partially.
Only part of the credential lifecycle is agent-operable.
Every essential target has a stable documented agent-usable interface alternative.
Request-time authentication is documented and usable under scoped agent authority.
Essential operations have stable readable request, response, and effect semantics.
Evidence and actions6 signals
Is an agent-native protocol interface verified against the essential targets?
missing: unknownCurrent admissible evidence does not resolve this finding.
Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?
supported: freshOnly part of the credential lifecycle is agent-operable.
Microsoft identity platform documentation describes credential security boundaries and mentions rotating/protecting client secrets or certificates. Furthermore, Entra service principal documentation details application deactivation, deletion, and recovery options, but explicit procedures for complete automated credential rotation and compromise recovery across all credential types remain unevidenced.
Can an agent handle applicable failure modes safely?
supported: freshSafe failure handling is documented only partially.
Azure Resource Manager documentation details status codes for tracking long-running asynchronous operations, headers like Azure-AsyncOperation and Retry-After, provisioning states (Succeeded, Failed, Canceled), and error response objects. However, explicit cancellation and idempotency semantics for all operations remain unevidenced.
Can an agent authenticate service operations with scoped authority?
supported: freshRequest-time authentication is documented and usable under scoped agent authority.
Microsoft identity platform and Entra ID document service operation authentication using OAuth 2.0 client credentials grant flow (shared secrets, certificates, or federated credentials) and scoped service principals to acquire Bearer tokens for server-to-server interactions without user involvement.
Are essential operation inputs, outputs, and effects stable and decidable?
supported: freshEssential operations have stable readable request, response, and effect semantics.
Across all required targets, Azure REST APIs and pricing services provide documented, stable endpoints, HTTP methods, request parameters, JSON response schemas, HTTP status codes, example payloads, and effect semantics.
- azure-resource-manager
- pricing-and-cost
Can an agent perform every essential assessment target through a usable interface?
supported: freshEvery essential target has a stable documented agent-usable interface alternative.
Machine-operable interfaces including REST APIs, Azure CLI, Azure PowerShell, and SDKs are documented and accessible across all assessed Azure service targets.
- azure-resource-manager
- pricing-and-cost
What would improve this stage
- Document applicable structured errors, retry, cancellation, and reconciliation semantics.
- Provide scoped expiry, rotation, revocation, compromise, and recovery operations.
What works
- Sign up: A stable canonical route begins the required access bootstrap.
- Pay: Charge or no-charge status, currency, recurrence, and material conditions are disclosed.
What blocks agents
- Evaluate: Only some material eligibility conditions are decidable before commitment.
- Provision: Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
- Operate: Safe failure handling is documented only partially.
Startup offers
Microsoft on the startup-offers board
- Up to $150,000 in creditsMicrosoft for Startups Program
Improve the report
Correct it, rerun it, or improve the funnel.
- Profile
- arp_01kzd4bb9sf13ma4xaxb73d82x
- Projection
- sha256:83d1d7853cc62f203b01b3ce8253cd5b8e43a7a2a4e3d15cb7fb780c72d9fb0a
- Policy
- service-use-2026-08-20-public-evidence-r9 · sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139
Every request carries these exact identifiers.How report cards are assessed →View the exact declaration