ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
unreviewedRiskEventsExist	boolean		If true, then there are new risk events that need to be reviewed at https://portal.azure.com/#blade/Microsoft_AAD_IAM/SecurityMenuBlade/RiskDetections.
globalAdminUserCount	number		The total number of global admin users.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
remindersEnabled	boolean		Specifies whether reviewers will receive reminder emails. Reminder frequency is determined by the durationInDays setting.
requestDurationInDays	number		Specifies the duration in days that a request is active before it expires if no action is taken.
reviewers	list<object>		The list of reviewers for the admin consent request. Reviewers can approve or deny consent requests.
query	string		The query used to identify the reviewer (e.g. /users/{id} or /groups/{id}).
queryType	string		The type of the reviewer query. Possible values are MicrosoftGraph.
queryRoot	string		The queryRoot field is used when the query requires dynamic lookup (e.g. manager lookup). Possible values are null, decisions.
isEnabled	boolean		Specifies whether the admin consent request feature is enabled or disabled. When enabled, users can request admin consent for apps they are not able to consent to themselves.
version	number		Specifies the version of this policy. When the policy is updated, this version is automatically updated.
notifyReviewers	boolean		Specifies whether reviewers will receive notifications via email when a new admin consent request is made.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
displayName	string		Admin provided name of the device configuration.
passwordExpirationDays	number		Number of days before the password expires. Valid values 1 to 365.
passwordPreviousPasswordBlockCount	number		Number of previous passwords to block. Valid values 1 to 24.
passwordSignInFailureCountBeforeFactoryReset	number		Number of sign-in failures allowed before factory reset. Valid values 1 to 16.
securityRequireVerifyApps	boolean		Require the Android Verify apps feature is turned on.
deviceThreatProtectionRequiredSecurityLevel	string		Require Mobile Threat Protection minimum risk level to report noncompliance. Possible values are: unavailable, secured, low, medium, high, notSet.
minAndroidSecurityPatchLevel	string		Minimum Android security patch level.
securityBlockDeviceAdministratorManagedDevices	boolean		Block device administrator managed devices.
securityRequireSafetyNetAttestationBasicIntegrity	boolean		Require the device to pass the SafetyNet basic integrity check.
securityRequireUpToDateSecurityProviders	boolean		Require the device to have up to date security providers. The device will require Google Play Services to be enabled and up to date.
description	string		Admin provided description of the Device Configuration.
passwordMinutesOfInactivityBeforeLock	number		Minutes of inactivity before a password is required.
securityBlockJailbrokenDevices	boolean		Devices must not be jailbroken or rooted.
osMinimumVersion	string		Minimum Android version.
conditionStatementId	string		Condition statement id.
lastModifiedDateTime	number		DateTime the object was last modified.
passwordRequiredType	string		Type of characters in password. Possible values are: deviceDefault, alphabetic, alphanumeric, alphanumericWithSymbols, lowSecurityBiometric, numeric, numericComplex, any.
requiredPasswordComplexity	string		Indicates the required password complexity on Android. One of: NONE, LOW, MEDIUM, HIGH. This is a new API targeted to Android 11+. Possible values are: none, low, medium, high.
createdDateTime	number		DateTime the object was created.
passwordRequired	boolean		Require a password to unlock device.
osMaximumVersion	string		Maximum Android version.
securityRequireCompanyPortalAppIntegrity	boolean		Require the device to pass the Company Portal client app runtime integrity check.
restrictedApps	list<object>		Require the device to not have the specified apps installed. This collection can contain a maximum of 100 elements.
publisher	string		The publisher of the application.
appStoreUrl	string		The Store URL of the application.
appId	string		The application or bundle identifier of the application.
odatatype	string		The application data type.
name	string		The application name.
id	string		Key of the entity.
version	number		Version of the device configuration.
securityDisableUsbDebugging	boolean		Disable USB debugging on Android devices.
storageRequireEncryption	boolean		Require encryption on Android devices.
securityRequireGooglePlayServices	boolean		Require Google Play Services to be installed and enabled on the device.
roleScopeTagIds	list<string>		List of Scope Tags for this Entity instance.
securityPreventInstallAppsFromUnknownSources	boolean		Require that devices disallow installation of apps from unknown sources.
advancedThreatProtectionRequiredSecurityLevel	string		MDATP Require Mobile Threat Protection minimum risk level to report noncompliance. Possible values are: unavailable, secured, low, medium, high, notSet.
odatatype	string		Microsoft Graph data type.
passwordMinimumLength	number		Minimum password length. Valid values 4 to 16.
deviceThreatProtectionEnabled	boolean		Require that devices have enabled device threat protection.
securityRequireSafetyNetAttestationCertifiedDevice	boolean		Require the device to pass the SafetyNet certified device check.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
odatatype	string		Microsoft graph android device owner compliance policy type.
roleScopeTagIds	list<string>		List of Scope Tags for this Entity instance.
description	string		Admin provided description of the Device Configuration.
osMinimumVersion	string		Minimum Android version.
passwordMinimumLowerCaseCharacters	number		Indicates the minimum number of lower case characters required for device password. Valid values 1 to 16.
storageRequireEncryption	boolean		Require encryption on Android devices.
id	string		Key of the entity.
displayName	string		Admin provided name of the device configuration.
passwordMinimumLetterCharacters	number		Indicates the minimum number of letter characters required for device password. Valid values 1 to 16.
securityRequireIntuneAppIntegrity	boolean		If setting is set to true, checks that the Intune app installed on fully managed, dedicated, or corporate-owned work profile Android Enterprise enrolled devices, is the one provided by Microsoft from the Managed Google Playstore. If the check fails, the device will be reported as non-compliant.
securityRequireSafetyNetAttestationBasicIntegrity	boolean		Require the device to pass the SafetyNet basic integrity check.
minAndroidSecurityPatchLevel	string		Minimum Android security patch level.
passwordMinimumNumericCharacters	number		Indicates the minimum number of numeric characters required for device password. Valid values 1 to 16.
passwordMinimumSymbolCharacters	number		Indicates the minimum number of symbol characters required for device password. Valid values 1 to 16.
passwordExpirationDays	number		Number of days before the password expires. Valid values 1 to 365.
deviceThreatProtectionEnabled	boolean		Require that devices have enabled device threat protection.
securityRequireSafetyNetAttestationCertifiedDevice	boolean		Require the device to pass the SafetyNet certified device check.
passwordRequired	boolean		Require a password to unlock device.
lastModifiedDateTime	number		DateTime the object was last modified.
advancedThreatProtectionRequiredSecurityLevel	string		MDATP Require Mobile Threat Protection minimum risk level to report noncompliance. Possible values are: unavailable, secured, low, medium, high, notSet.
passwordMinimumUpperCaseCharacters	number		Indicates the minimum number of upper case letter characters required for device password. Valid values 1 to 16.
passwordRequiredType	string		Type of characters in password. Possible values are: deviceDefault, required, numeric, numericComplex, alphabetic, alphanumeric, alphanumericWithSymbols, lowSecurityBiometric, customPassword.
createdDateTime	number		DateTime the object was created.
version	number		Version of the device configuration.
deviceThreatProtectionRequiredSecurityLevel	string		Require Mobile Threat Protection minimum risk level to report noncompliance. Possible values are: unavailable, secured, low, medium, high, notSet.
osMaximumVersion	string		Maximum Android version.
passwordMinimumLength	number		Minimum password length. Valid values 4 to 16.
passwordMinimumNonLetterCharacters	number		Indicates the minimum number of non-letter characters required for device password. Valid values 1 to 16.
passwordMinutesOfInactivityBeforeLock	number		Minutes of inactivity before a password is required.
passwordPreviousPasswordCountToBlock	number		Number of previous passwords to block. Valid values 1 to 24.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
securityRequireSafetyNetAttestationCertifiedDevice	boolean		Require the device to pass the SafetyNet certified device check.
id	string		Key of the entity.
securityRequireUpToDateSecurityProviders	boolean		Require the device to have up to date security providers. The device will require Google Play Services to be enabled and up to date.
passwordMinutesOfInactivityBeforeLock	number		Minutes of inactivity before a password is required.
roleScopeTagIds	list<string>		List of Scope Tags for this Entity instance.
description	string		Admin provided description of the Device Configuration.
passwordRequiredType	string		Type of characters in password. Possible values are: deviceDefault, alphabetic, alphanumeric, alphanumericWithSymbols, lowSecurityBiometric, numeric, numericComplex, any.
storageRequireEncryption	boolean		Require encryption on Android devices.
odatatype	string		Microsoft graph device compliance policy type.
version	number		Version of the device configuration.
securityDisableUsbDebugging	boolean		Disable USB debugging on Android devices.
deviceThreatProtectionRequiredSecurityLevel	string		Require Mobile Threat Protection minimum risk level to report noncompliance. Possible values are: unavailable, secured, low, medium, high, notSet.
osMinimumVersion	string		Minimum Android version.
securityRequiredAndroidSafetyNetEvaluationType	string		Require a specific SafetyNet evaluation type for compliance. Possible values are: basic, hardwareBacked.
lastModifiedDateTime	number		DateTime the object was last modified.
passwordMinimumLength	number		Minimum password length. Valid values 4 to 16.
deviceThreatProtectionEnabled	boolean		Require that devices have enabled device threat protection.
advancedThreatProtectionRequiredSecurityLevel	string		MDATP Require Mobile Threat Protection minimum risk level to report noncompliance. Possible values are: unavailable, secured, low, medium, high, notSet.
displayName	string		Admin provided name of the device configuration.
passwordRequired	boolean		Require a password to unlock device.
passwordPreviousPasswordBlockCount	number		Number of previous passwords to block. Valid values 1 to 24.
securityRequireVerifyApps	boolean		Require the Android Verify apps feature is turned on.
osMaximumVersion	string		Maximum Android version.
passwordExpirationDays	number		Number of days before the password expires. Valid values 1 to 365.
securityPreventInstallAppsFromUnknownSources	boolean		Require that devices disallow installation of apps from unknown sources.
securityBlockJailbrokenDevices	boolean		Devices must not be jailbroken or rooted.
securityRequireSafetyNetAttestationBasicIntegrity	boolean		Require the device to pass the SafetyNet basic integrity check.
securityRequireGooglePlayServices	boolean		Require Google Play Services to be installed and enabled on the device.
securityRequireCompanyPortalAppIntegrity	boolean		Require the device to pass the Company Portal client app runtime integrity check.
createdDateTime	number		DateTime the object was created.
requiredPasswordComplexity	string		Indicates the required device password complexity on Android. One of: NONE, LOW, MEDIUM, HIGH. This is a new API targeted to Android API 12+. Possible values are: none, low, medium, high.
passwordSignInFailureCountBeforeFactoryReset	number		Number of sign-in failures allowed before factory reset. Valid values 1 to 16.
minAndroidSecurityPatchLevel	string		Minimum Android security patch level.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
odatatype	string		Microsoft graph aosp device compliance policy type.
roleScopeTagIds	list<string>		List of Scope Tags for this Entity instance.
lastModifiedDateTime	number		DateTime the object was last modified.
storageRequireEncryption	boolean		Require encryption on Android devices.
id	string		Key of the entity.
osMaximumVersion	string		Maximum Android version.
securityBlockJailbrokenDevices	boolean		Devices must not be jailbroken or rooted.
passwordRequiredType	string		Type of characters in password. Possible values are: deviceDefault, required, numeric, numericComplex, alphabetic, alphanumeric, alphanumericWithSymbols, lowSecurityBiometric, customPassword.
passwordMinutesOfInactivityBeforeLock	number		Minutes of inactivity before a password is required. Valid values 1 to 8640.
passwordMinimumLength	number		Minimum password length. Valid values 4 to 16.
version	number		Version of the device configuration.
createdDateTime	number		DateTime the object was created.
description	string		Admin provided description of the Device Configuration.
displayName	string		Admin provided name of the device configuration.
osMinimumVersion	string		Minimum Android version.
minAndroidSecurityPatchLevel	string		Minimum Android security patch level.
passwordRequired	boolean		Require a password to unlock device.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
principalType	string		The type of the assigned principal. This can either be User, Group, or ServicePrincipal.
resourceDisplayName	string		The display name of the resource app's service principal to which the assignment is made.
resourceId	string	ServicePrincipal	The unique identifier (id) for the resource service principal for which the assignment is made.
appRoleId	string		The identifier (id) for the app role which is assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application has not declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles.
createdDateTime	number		The time when the app role assignment was created.
id	string		A unique identifier for the appRoleAssignment key. Not nullable.
principalDisplayName	string		The display name of the user, group, or service principal that was granted the app role assignment.
principalId	string	Group ServicePrincipal User	The unique identifier (id) for the user, group, or service principal being granted the app role.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
logo	string		The main logo for the application.
appId	string	Application	The unique identifier for the application that is assigned to an application by Azure AD. Not nullable.
createdByAppId	string		Unique identifier of the application that created the app registration.
createdDateTime	number		The date and time the application was registered.
disabledByMicrosoftStatus	string		Specifies whether Microsoft has disabled the registered application. Possible values are: null (default value), NotDisabled, and DisabledDueToViolationOfServicesAgreement (reasons may include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement).
groupMembershipClaims	string		Configures the groups claim issued in a user or OAuth 2.0 access token that the application expects. To set this attribute, use one of the following valid string values: None, SecurityGroup (for security groups and Azure AD roles), All (this gets all of the security groups, distribution groups, and Azure AD directory roles that the signed-in user is a member of).
info	object		Basic profile information of the application such as app's marketing, support, terms of service and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience.
supportUrl	string		Link to the application's support page.
termsOfServiceUrl	string		Link to the application's terms of service statement.
logoUrl	string		CDN URL to the application's logo, Read-only.
marketingUrl	string		Link to the application's marketing page.
privacyStatementUrl	string		Link to the application's privacy statement.
requestSignatureVerification	object		Specifies whether this application requires Microsoft Entra ID to verify the signed authentication requests.
isSignedRequestRequired	boolean		Specifies whether signed authentication requests for this application should be required.
allowedWeakAlgorithms	string		Specifies which weak algorithms are allowed. Possible values include rsaSha1 and unknownFutureValue.
isDisabled	boolean		Specifies whether Microsoft has disabled the registered application.
isFallbackPublicClient	boolean		Specifies the fallback application type as public client, such as an installed application running on a mobile device. The default value is false which means the fallback application type is confidential client such as a web app. There are certain scenarios where Azure AD cannot determine the client application type. For example, the ROPC flow where it is configured without specifying a redirect URI. In those cases Azure AD interprets the application type based on the value of this property
optionalClaims	object		Application developers can configure optional claims in their Azure AD applications to specify the claims that are sent to their application by the Microsoft security token service.
saml2Token	list<object>		The optional claims returned in the SAML token.
source	string		The source (directory object) of the claim. There are predefined claims and user-defined claims from extension properties. If the source value is null, the claim is a predefined optional claim. If the source value is user, the value in the name property is the extension property from the user object.
additionalProperties	list<string>		Additional properties of the claim. If a property exists in this collection, it modifies the behavior of the optional claim specified in the name property.
essential	boolean		If the value is true, the claim specified by the client is necessary to ensure a smooth authorization experience for the specific task requested by the end user. The default value is false.
name	string		The name of the optional claim.
idToken	list<object>		The optional claims returned in the JWT ID token.
name	string		The name of the optional claim.
source	string		The source (directory object) of the claim. There are predefined claims and user-defined claims from extension properties. If the source value is null, the claim is a predefined optional claim. If the source value is user, the value in the name property is the extension property from the user object.
additionalProperties	list<string>		Additional properties of the claim. If a property exists in this collection, it modifies the behavior of the optional claim specified in the name property.
essential	boolean		If the value is true, the claim specified by the client is necessary to ensure a smooth authorization experience for the specific task requested by the end user. The default value is false.
accessToken	list<object>		The optional claims returned in the JWT access token.
additionalProperties	list<string>		Additional properties of the claim. If a property exists in this collection, it modifies the behavior of the optional claim specified in the name property.
essential	boolean		If the value is true, the claim specified by the client is necessary to ensure a smooth authorization experience for the specific task requested by the end user. The default value is false.
name	string		The name of the optional claim.
source	string		The source (directory object) of the claim. There are predefined claims and user-defined claims from extension properties. If the source value is null, the claim is a predefined optional claim. If the source value is user, the value in the name property is the extension property from the user object.
requiredResourceAccess	list<object>		Specifies the resources that the application needs to access. This property also specifies the set of delegated permissions and application roles that it needs for each of those resources. This configuration of access to the required resources drives the consent experience. No more than 50 resource services (APIs) can be configured. Beginning mid-October 2021, the total number of required permissions must not exceed 400. Not nullable.
resourceAppId	string		The unique identifier for the resource that the application requires access to. This should be equal to the appId declared on the target resource application.
resourceAccess	list<object>		The list of OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
id	string		The unique identifier of an app role or delegated permission exposed by the resource application. For delegated permissions, this should match the id property of one of the delegated permissions in the oauth2PermissionScopes collection of the resource application's service principal. For app roles (application permissions), this should match the id property of an app role in the appRoles collection of the resource application's service principal.
type	string		Specifies whether the id property references a delegated permission or an app role (application permission). The possible values are: Scope (for delegated permissions) or Role (for app roles).
spa	object		Specifies settings for a single-page application, including sign out URLs and redirect URIs for authorization codes and access tokens.
redirectUris	list<string>		Specifies the URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent.
tags	list<string>		Custom strings that can be used to categorize and identify the application. Not nullable.
addIns	list<object>		Defines custom behavior that a consuming service can use to call an app in specific contexts. For example, applications that can render file streams may set the addIns property for its "FileHandler" functionality. This will let services like Office 365 call the application in the context of a document the user is working on.
id	string		id of an addIn.
properties	list<object>		property of an addIn.
key	string		Key for the key-value pair.
value	string		Value for the key-value pair.
type	string		type of an addIn.
certification	object		Specifies the certification status of the application.
isPublisherAttested	boolean		Indicates whether the application has been self-attested by the application developer or the publisher.
lastCertificationDateTime	number		The timestamp when the certification for the application was most recently added or updated.
certificationDetailsUrl	string		URL that shows certification details for the application.
certificationExpirationDateTime	number		The timestamp when the current certification for the application will expire.
isCertifiedByMicrosoft	boolean		Indicates whether the application is certified by Microsoft.
isDeviceOnlyAuthSupported	boolean		Specifies whether this application supports device authentication without a user. The default is false.
uniqueName	string		The unique identifier that can be assigned to an application and used as an alternate key.
oauth2RequiredPostResponse	boolean		Specifies whether, as part of OAuth 2.0 token requests, Azure AD allows POST requests, as opposed to GET requests. The default is false, which specifies that only GET requests are allowed.
api	object		Specifies settings for an application that implements a web API.
preAuthorizedApplications	list<object>		Lists the client applications that are pre-authorized with the specified delegated permissions to access this application's APIs. Users are not required to consent to any pre-authorized application (for the permissions specified). However, any additional permissions not listed in preAuthorizedApplications (requested through incremental consent for example) will require user consent.
appId	string		The unique identifier for the application.
delegatedPermissionIds	list<string>		The unique identifier for the oauth2PermissionScopes the application requires.
requestedAccessTokenVersion	number		Specifies the access token version expected by this resource. This changes the version and format of the JWT produced independent of the endpoint or client used to request the access token.
acceptMappedClaims	boolean		When true, allows an application to use claims mapping without specifying a custom signing key.
knownClientApplications	list<string>		Used for bundling consent if you have a solution that contains two parts: a client app and a custom web API app. If you set the appID of the client app to this value, the user only consents once to the client app. Azure AD knows that consenting to the client means implicitly consenting to the web API and automatically provisions service principals for both APIs at the same time. Both the client and the web API app must be registered in the same tenant.
oauth2PermissionScopes	list<object>		The definition of the delegated permissions exposed by the web API represented by this application registration. These delegated permissions may be requested by a client application, and may be granted by users or administrators during consent. Delegated permissions are sometimes referred to as OAuth 2.0 scopes.
type	string		The possible values are: User and Admin. Specifies whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator consent should always be required. While Microsoft Graph defines the default consent requirement for each permission, the tenant administrator may override the behavior in their organization (by allowing, restricting, or limiting user consent to this delegated permission).
userConsentDescription	string		A description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.
userConsentDisplayName	string		A title for the permission, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.
value	string		Specifies the value to include in the scp (scope) claim in access tokens.
adminConsentDescription	string		A description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences.
adminConsentDisplayName	string		The permission's title, intended to be read by an administrator granting the permission on behalf of all users.
id	string		Unique delegated permission identifier inside the collection of delegated permissions defined for a resource application.
isEnabled	boolean		When creating or updating a permission, this property must be set to true (which is the default). To delete a permission, this property must first be set to false. At that point, in a subsequent call, the permission may be removed.
applicationTemplateId	string		Unique identifier of the applicationTemplate.
publicClient	object		Specifies settings for installed clients such as desktop or mobile devices.
redirectUris	list<string>		Specifies the URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent.
appRoles	list<object>		The collection of roles assigned to the application. With app role assignments, these roles can be assigned to users, groups, or service principals associated with other applications. Not nullable.
displayName	string		Display name for the permission that appears in the app role assignment and consent experiences.
id	string		Unique role identifier inside the appRoles collection. When creating a new app role, a new GUID identifier must be provided.
isEnabled	boolean		When creating or updating an app role, this must be set to true (which is the default). To delete a role, this must first be set to false. At that point, in a subsequent call, this role may be removed.
origin	string		Specifies if the app role is defined on the application object or on the servicePrincipal entity. Must not be included in any POST or PATCH requests.
value	string		Specifies the value to include in the roles claim in ID tokens and access tokens authenticating an assigned user or service principal.
allowedMemberTypes	list<string>		Specifies whether this app role can be assigned to users and groups (by setting to ["User"]), to other application's (by setting to ["Application"], or both (by setting to ["User", "Application"]). App roles supporting assignment to other applications' service principals are also known as application permissions. The "Application" value is only supported for app roles defined on application entities.
description	string		The description for the app role. This is displayed when the app role is being assigned and, if the app role functions as an application permission, during consent experiences.
description	string		Free text field to provide a description of the application object to end users.
identifierUris	list<string>		Also known as App ID URI, this value is set when an application is used as a resource app. The identifierUris acts as the prefix for the scopes you'll reference in your API's code, and it must be globally unique. You can use the default value provided, which is in the form api://<application-client-id>, or specify a more readable URI like https://contoso.com/api.
parentalControlSettings	object		Specifies parental control settings for an application.
countriesBlockedForMinors	list<string>		Specifies the two-letter ISO country codes. Access to the application will be blocked for minors from the countries specified in this list.
legalAgeGroupRule	string		Specifies the legal age group rule that applies to users of the app. Can be set to one of the following values: Allow(Default. Enforces the legal minimum. This means parental consent is required for minors in the European Union and Korea), RequireConsentForPrivacyServices(Enforces the user to specify date of birth to comply with COPPA rules), RequireConsentForMinors(Requires parental consent for ages below 18, regardless of country minor rules), RequireConsentForKids(Requires parental consent for ages below 14, regardless of country minor rules), BlockMinors(Blocks minors from using the app)
passwordCredentials	list<object>		The collection of password credentials associated with the application. Not nullable.
keyId	string		The unique identifier for the password.
secretText	string		Contains the strong passwords generated by Azure AD that are 16-64 characters in length. The generated password value is only returned during the initial POST request to addPassword. There is no way to retrieve this password in the future.
startDateTime	number		The date and time at which the password becomes valid.
customKeyIdentifier	string		Do not use.
displayName	string		Friendly name for the password.
endDateTime	number		The date and time at which the password expires represented using ISO 8601 format and is always in UTC time.
hint	string		Contains the first three characters of the password.
samlMetadataUrl	string		The URL where the service exposes SAML metadata for federation. This property is valid only for single-tenant applications. Nullable.
tokenEncryptionKeyId	string		Specifies the keyId of a public key from the keyCredentials collection. When configured, Azure AD encrypts all the tokens it emits by using the key this property points to. The application code that receives the encrypted token must use the matching private key to decrypt the token before it can be used for the signed-in user.
defaultRedirectUri	string		The default redirect URI. If specified and there's no explicit redirect URI in the sign-in request for SAML and OIDC flows, Microsoft Entra ID sends the token to this redirect URI.
keyCredentials	list<object>		The collection of key credentials associated with the application. Not nullable.
displayName	string		Friendly name for the key.
endDateTime	number		The date and time at which the credential expires.
key	string		The certificate's raw data in byte array converted to Base64 string.
keyId	string		The unique identifier (GUID) for the key.
startDateTime	number		The date and time at which the credential becomes valid.
type	string		The type of key credential; for example, Symmetric, AsymmetricX509Cert.
usage	string		A string that describes the purpose for which the key can be used; for example, Verify.
customKeyIdentifier	string		Custom key identifier
nativeAuthenticationApisEnabled	string		Specifies whether the Native Authentication APIs are enabled for the application. Possible values are none and all.
notes	string		Notes relevant for the management of the application.
publisherDomain	string		The verified publisher domain for the application.
serviceManagementReference	string		References application or service contact information from a Service or Asset Management database. Nullable.
signInAudience	string		Specifies the Microsoft accounts that are supported for the current application. The possible values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount (default), and PersonalMicrosoftAccount
verifiedPublisher	object		Specifies the verified publisher of the application. For more information about how publisher verification helps support application security, trustworthiness, and compliance, see Publisher verification.
addedDateTime	number		The timestamp when the verified publisher was first added or most recently updated.
displayName	string		The verified publisher name from the app publisher's Partner Center account.
verifiedPublisherId	string		The ID of the verified publisher from the app publisher's Partner Center account.
deletedDateTime	number		The date and time the application was deleted.
displayName	string		The display name for the application.
id	string		Unique identifier for the application object. This property is referred to as Object ID in the Azure portal. Inherited from directoryObject Key. Not nullable.
servicePrincipalLockConfiguration	object		Specifies whether sensitive properties of a multitenant application should be locked for editing after the application is provisioned in a tenant. Nullable. null by default.
credentialsWithUsageVerify	boolean		Locks the keyCredentials and passwordCredentials properties for modification where credential usage type is Verify.
identifierUris	boolean		Locks the identifierUris property for modification on the service principal.
tokenEncryptionKeyId	boolean		Locks the tokenEncryptionKeyId property for modification on the service principal.
isEnabled	boolean		Enables or disables service principal lock configuration. To allow the sensitive properties to be updated, update this property to false.
allProperties	boolean		Controls locking for all sensitive properties, namely keyCredentials, passwordCredentials, and tokenEncryptionKeyId.
credentialsWithUsageSign	boolean		Restricts modification of keyCredentials and passwordCredentials when the credential usage type is designated as Sign.
web	object		Specifies settings for a web application.
homePageUrl	string		Home page or landing page of the application.
implicitGrantSettings	object		Specifies whether this web application can request tokens using the OAuth 2.0 implicit flow.
enableIdTokenIssuance	boolean		Specifies whether this web application can request an ID token using the OAuth 2.0 implicit flow.
enableAccessTokenIssuance	boolean		Specifies whether this web application can request an access token using the OAuth 2.0 implicit flow.
logoutUrl	string		Specifies the URL that will be used by Microsoft's authorization service to logout an user using front-channel, back-channel or SAML logout protocols.
redirectUris	list<string>		Specifies the URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
defaultUserRolePermissions	object		Default user role permissions for the AAD tenant.
allowedToCreateApps	boolean		Indicates whether the default user role can create applications.
allowedToCreateSecurityGroups	boolean		Indicates whether the default user role can create security groups.
allowedToCreateTenants	boolean		Indicates whether the default user role can create tenants.
allowedToReadOtherUsers	boolean		Indicates whether the default user role can read other users.
permissionGrantPoliciesAssigned	list<string>		Indicates if user consent to apps is allowed, and if it is, which permission to grant consent and which app consent policy (permissionGrantPolicy) govern the permission for users to grant consent. Value should be in the format managePermissionGrantsForSelf.{id}, where {id} is the id of a built-in or custom app consent policy. An empty list indicates user consent to apps is disabled.
allowedToReadBitlockerKeysForOwnedDevice	boolean		Indicates whether a user is allowed to read bitlocker keys for owned device.
allowUserConsentForRiskyApps	boolean		Description pending.
allowedToSignUpEmailBasedSubscriptions	boolean		Indicates whether users can sign up for email based subscriptions.
allowEmailVerifiedUsersToJoinOrganization	boolean		Indicates whether a user can join the tenant by email validation.
blockMsolPowerShell	boolean		To disable the use of MSOL PowerShell set this property to true. This will also disable user-based access to the legacy service endpoint used by MSOL PowerShell. This does not affect Azure AD Connect or Microsoft Graph.
displayName	string		Display name for this policy.
allowInvitesFrom	string		Indicates who can invite external users to the organization. Possible values are: none, adminsAndGuestInviters, adminsGuestInvitersAndAllMembers, everyone. everyone is the default setting for all cloud environments except US Government.
guestUserRoleId	string	UnifiedRoleDefinition	Represents role templateId for the role that should be granted to guest user. Currently following roles are supported: User (a0b1b346-4d3e-4e8b-98f8-753987be4970), Guest User (10dae51f-b6af-4016-8d66-8c2a99b929b3), and Restricted Guest User (2af84b1e-32c8-42b7-82bc-daa82404023b).
id	string		ID of the authorization policy.
allowedToUseSSPR	boolean		Indicates whether the Self-Serve Password Reset feature can be used by users on the tenant.
description	string		Description of this policy.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
invitationsAllowedAndBlockedDomainsPolicy	object		This policy specifies domain restrictions with regards to inviting external users to collaborate. Only one of the blockedDomains and allowedDomains list can be populated at once. If blockedDomains is populated, any domain outside of blockedDomains can be invited to collaborate. If allowedDomains is populated, any domain outside of allowedDomains will be blocked. If both lists are empty, then there are no domain restrictions on invitations to collaborate.
blockedDomains	list<string>		Domains in this list are not allowed to be sent invitations to collaborate.
allowedDomains	list<string>		Domains in this list are allowed to be sent invitations to collaborate.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
displayName	string		Specifies a display name for the conditionalAccessPolicy object.
sessionControls	object		Specifies the session controls that are enforced after sign-in.
disableResilienceDefaults	boolean		Session control that determines whether it is acceptable for Microsoft Entra ID to extend existing sessions based on information collected prior to an outage or not
applicationEnforcedRestrictions	object		Session control to enforce application restrictions. Only Exchange Online and Sharepoint Online support this session control
isEnabled	boolean		Specifies whether the session control is enabled or not
cloudAppSecurity	object		Session control to apply cloud app security
isEnabled	boolean		Specifies whether the session control is enabled
cloudAppSecurityType	string		Possible values are: mcasConfigured, monitorOnly, blockDownloads, unknownFutureValue
persistentBrowser	object		Session control to define whether to persist cookies or not. All apps should be selected for this session control to work correctly
isEnabled	boolean		Specifies whether the session control is enabled
mode	string		Possible values are: always, never
signInFrequency	object		Session control to enforce signin frequency
frequencyInterval	string		The possible values are timeBased, everyTime, unknownFutureValue. Sign-in frequency of everyTime is available for risky users, risky sign-ins, and Intune device enrollment
authenticationType	string		The possible values are primaryAndSecondaryAuthentication, secondaryAuthentication, unknownFutureValue. This property isn't required when using frequencyInterval with the value of timeBased
isEnabled	boolean		Specifies whether the session control is enabled
value	number		The number of days or hours
type	string		Possible values are: days, hours
id	string		Specifies the identifier of a conditionalAccessPolicy object.
state	string		Specifies the state of the conditionalAccessPolicy object. Possible values are "enabled", "disabled", "enabledForReportingButNotEnforced".
conditions	object		Specifies the rules that must be met for the policy to apply.
userRiskLevels	list<string>		User risk levels included in the policy. Possible values are: low, medium, high, hidden, none, unknownFutureValue
servicePrincipalRiskLevels	list<string>		Service principal risk levels included in the policy. Possible values are: low, medium, high, none, unknownFutureValue
devices	object		Devices in the policy
deviceFilter	object		Filter that defines the dynamic-device-syntax rule to include/exclude devices. A filter can use device properties (such as extension attributes) to include/exclude them.
mode	string		Mode to use for the filter. Possible values are include or exclude
rule	string		Rule syntax is similar to that used for membership rules for groups in Microsoft Entra ID.
authenticationFlows	object		Authentication flows included in the policy scope.
transferMethods	string		Enable or block authentication transfer methods. Possible values are none, deviceCodeFlow, authenticationTransfer, unknownFutureValue.
users	object		Users, groups, and roles included in and excluded from the policy.
excludeUsers	list<string>		A list of user IDs excluded from the scope of the policy and/or "GuestsOrExternalUsers".
includeGroups	list<string>		A list of group IDs in the scope of the policy (unless the group ID is explicitly excluded, i.e. the group ID is in the "excludeGroups" list), or "All".
excludeGroups	list<string>		Group IDs excluded from scope of policy.
includeRoles	list<string>		A list of role IDs in scope of policy (unless explicitly excluded, i.e. the role ID is in the "excludeRoles" list), or "All".
excludeRoles	list<string>		Role IDs excluded from scope of policy.
includeUsers	list<string>		A list of user IDs in the scope of the policy (unless the user ID explicitly excluded, i.e. the user ID is in the "excludeUsers" list), or one of "None", "All", or "GuestsOrExternalUsers", .
signInRiskLevels	list<string>		Sign-in risk levels included in the policy. Possible values are: low, medium, high, hidden, none, unknownFutureValue
platforms	object		Platforms included in and excluded from the policy
excludePlatforms	list<string>		Platforms excluded from the policy. Possible values are: android, iOS, windows, windowsPhone, macOS, linux, all, unknownFutureValue
includePlatforms	list<string>		Platforms included in the policy. Possible values are: android, iOS, windows, windowsPhone, macOS, linux, all, unknownFutureValue
locations	object		Locations included in and excluded from the policy
excludeLocations	list<string>		Location IDs excluded from scope of policy
includeLocations	list<string>		Location IDs in scope of policy unless explicitly excluded, All, or AllTrusted
clientApplications	object		Client applications (service principals and workload identities) included in and excluded from the policy
excludeServicePrincipals	list<string>		Service principal IDs excluded from the policy scope
includeServicePrincipals	list<string>		Service principal IDs included in the policy scope, or ServicePrincipalsInMyTenant
applications	object		Applications and user actions included in and excluded from the policy
excludeApplications	list<string>		Can be one of the following - The list of client IDs (appId) explicitly excluded from the policy, Office365, MicrosoftAdminPortals.
includeApplications	list<string>		Can be one of the following - The list of client IDs (appId) the policy applies to, unless explicitly excluded (in excludeApplications), All, Office365, MicrosoftAdminPortals
includeUserActions	list<string>		User actions to include. Supported values are urn:user:registersecurityinfo and urn:user:registerdevice
clientAppTypes	list<string>		Client application types included in the policy. Possible values are "all", "browser", "mobileAppsAndDesktopClients", "exchangeActiveSync", "easSupported", "other".
grantControls	object		Specifies the grant controls that must be fulfilled to pass the policy.
customAuthenticationFactors	list<string>		List of custom controls IDs required by the policy
operator	string		Defines the relationship of the grant controls. Possible values: AND, OR
termsOfUse	list<string>		List of terms of use IDs required by the policy
authenticationStrength	object		The authentication strength required by the Conditional Access policy.
modifiedDateTime	number		The last time this authentication strength policy was modified.
id	string		The unique identifier for this authentication strength policy.
displayName	string		The display name of the authentication strength policy.
policyType	string		Whether this strength is builtIn or custom.
requirementsSatisfied	string		Which authentication methods this policy satisfies. Possible values are none, mfa, mfaAndMicrosoftAuthenticatorPhoneSignIn.
allowedCombinations	list<string>		A collection of authentication method modes that can be used to satisfy this authentication strength policy.
combinationConfigurations	list<object>		Settings for the authentication strength policy, including which types of combinations to allow.
description	string		The description of the authentication strength policy.
builtInControls	list<string>		List of values of built-in controls required by the policy. Possible values are "block", "mfa", "compliantDevice", "domainJoinedDevice", "approvedApplication", "compliantApplication", "passwordChange".
createdDateTime	number		conditionalAccessPolicy created time
modifiedDateTime	number		conditionalAccessPolicy modified time

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
appID	string		The unique identifier of Connected Application
riskLevel	string		The risk level associated with the Connected Application.
permissionsMetadata	list<object>		Metadata for each permission associated with the Connected Application.
removedTime	number		Timestamp when the permission was removed (0 if not removed).
riskScore	number		Risk score of the permission. Not present when riskLevel is Unknown.
name	string		Name of the permission.
riskLevel	string		Risk level of the permission.
firstSeenTime	number		Timestamp when the permission was first seen.
connectedAppName	string		Name of the Connected Application.
riskScore	number		The risk score associated with the Connected Application.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
id	string		The ID of the compliance policy.
odatatype	string		The OData type of the entity, e.g. "#microsoft.graph.iosCompliancePolicy".
securityBlockJailbrokenDevices	boolean		If true, block jailbroken or rooted devices.
managedEmailProfileRequired	boolean		If true, the owner of the device will only be able to use a managed email account.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
passwordExpirationDays	number		Password expiration in days. "null" if no expiration.
passcodeMinimumLength	number		Minimum length of the password. (iOS)
passcodeRequiredType	string		The password type (e.g. alphanumeric). (iOS)
defenderRequireCloudProtection	boolean		Indicates whether or not to require Windows Defender cloud protection. (Windows 8 and later)
defenderRequireRealTimeMonitoring	boolean		Indicates whether or not to require Windows Defender real-time monitoring. (Windows 8 and later)
passcodePreviousPasscodeBlockCount	number		For iOS to prevent reuse of previous passwords.
passcodeExpirationDays	number		Passcode expiration in days. "null" if no expiration. (iOS)
passwordSignInFailureCountBeforeFactoryReset	number		Number of failed authentication attempts before a device is wiped. (Windows 8)
passwordMinutesOfInactivityBeforeScreenTimeout	number		Minutes of inactivity before the screen times out.
passcodeMinutesOfInactivityBeforeLock	number		Minutes of inactivity before the screen locks. (iOS)
securityDeveloperSettingsEnabled	boolean		Indicates whether or not the user is allowed to access developer settings on the device. (Android Enterprise)
storageBlockExternalMedia	boolean		Indicates whether or not to block external media. (Android Enterprise)
defenderRequireBehaviorMonitoring	boolean		Indicates whether or not to require Windows Defender behavior monitoring. (Windows 8 and later)
passcodeRequired	boolean		Require the use of a password. (iOS)
passwordMinimumCharacterSetCount	number		Number of character sets required in the password. (macOS)
defenderSignatureUpdateIntervalInHours	number		Windows Defender signature update interval in hours. Valid values 0 to 24. (Windows 8 and later)
passwordRequiredType	string		The password type (e.g. alphanumeric).
passcodeMinutesOfInactivityBeforeScreenTimeout	number		Minutes of inactivity before the screen times out.
airDropBlocked	boolean		Indicates whether or not to block AirDrop. (macOS, iOS)
keychainBlockCloudSync	boolean		Indicates whether or not to block keychain sync to iCloud. (macOS, iOS)
passwordMaximumAttemptCount	number		Maximum number of password attempts before the device is wiped. (macOS)
iCloudDesktopAndDocumentsBlocked	boolean		Indicates whether or not to block iCloud Desktop and Documents sync. (macOS)
iCloudBlockDocumentSync	boolean		Indicates whether or not to block iCloud document sync. (macOS, iOS)
id	string		The ID of the compliance policy.
odatatype	string		To distinguish between different platforms (Android, iOS).
passwordPreviousPasswordBlockCount	number		Prevent reuse of previous passwords.
passcodeBlockSimple	boolean		Block simple passwords. (iOS)
storageRequireDeviceEncryption	boolean		Indicates whether or not to require device encryption.
passwordBlockSimple	boolean		Block simple passwords.
passcodeSignInFailureCountBeforeWipe	number		Number of failed authentication attempts before a device is wiped. (iOS)
passcodeMinimumCharacterSetCount	number		Number of character sets required in the passcode. (iOS)
passwordPreviousPasswordCountToBlock	number		Prevent reuse of previous passwords.
passwordMinutesOfInactivityBeforeLock	number		Minutes of inactivity before the screen locks. (macOS)
passwordRequireWhenResumeFromIdleState	boolean		Require the user to provide a password when the device is resumed from idle status.
appsAllowInstallFromUnknownSources	boolean		Indicates whether or not the user is allowed to enable unknown sources setting. (Android Enterprise)
passwordMinimumLength	number		Minimum length of the password.
passwordRequired	boolean		Require the use of a password.
securityRequireVerifyApps	boolean		Require the Android Verify apps feature to be turned on. (Android)

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
odatatype	string		Device configuration policy type.
id	string		Key of the policy document. Automatically generated.
name	string		Policy name.
description	string		Policy description.
platforms	string		Platforms for this policy. Possible values are: none, android, iOS, macOS, windows10X, windows10, linux, unknownFutureValue.
technologies	string		Technologies for this policy. Possible values are: none, mdm, windows10XManagement, configManager, appleRemoteManagement, microsoftSense, exchangeOnline, mobileApplicationManagement, linuxMdm, enrollment, endpointPrivilegeManagement, unknownFutureValue.
createdDateTime	number		Policy creation date and time.
settingCount	number		Number of settings.
lastModifiedDateTime	number		Policy last modification date and time.
creationSource	string		Policy creation source.
roleScopeTagIds	list<string>		List of Scope Tags for this Entity instance.
isAssigned	boolean		Policy assignment status.
templateReference	object		Template reference information.
templateId	string		Template id.
templateFamily	string		Template Family of the referenced Template. This property is read-only. Possible values are: none, endpointSecurityAntivirus, endpointSecurityDiskEncryption, endpointSecurityFirewall, endpointSecurityEndpointDetectionAndResponse, endpointSecurityAttackSurfaceReduction, endpointSecurityAccountProtection, endpointSecurityApplicationControl, endpointSecurityEndpointPrivilegeManagement, enrollmentConfiguration, appQuietTime, baseline, unknownFutureValue, deviceConfigurationScripts, deviceConfigurationPolicies.
templateDisplayName	string		Template Display Name of the referenced template.
templateDisplayVersion	string		Template Display Version of the referenced Template.
odatatype	string		Template reference data type.
priorityMetaData	object		Indicates the priority of each policies that are selected by the admin during enrollment process.
odatatype	string		PriorityMetaData data type.
priority	number		Priority of the policy. Valid values 1 to 500.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
odatatype	string		Device configuration policy setting data type.
id	string		Device configuration policy setting id.
policyId	string		Device configuration policy id.
settingInstance	object		settingInstance
settingInstanceTemplateReference	object		settingInstanceTemplateReference
odatatype	string		odatatype
settingInstanceTemplateId	string		settingInstanceTemplateId
choiceSettingValue	object		choiceSettingValue
settingValueTemplateReference	object		settingValueTemplateReference
odatatype	string		odatatype
settingValueTemplateId	string		settingValueTemplateId
useTemplateDefault	boolean		useTemplateDefault
value	string		value
children	list<object>		children
choiceSettingValue	object		choiceSettingValue
odatatype	string		odatatype
settingValueTemplateReference	object		settingValueTemplateReference
odatatype	string		odatatype
settingValueTemplateId	string		settingValueTemplateId
useTemplateDefault	boolean		useTemplateDefault
value	string		value
children	list<object>		children
settingInstanceTemplateReference	object		settingInstanceTemplateReference
settingInstanceTemplateId	string		settingInstanceTemplateId
odatatype	string		odatatype
choiceSettingValue	object		choiceSettingValue
settingValueTemplateReference	object		settingValueTemplateReference
odatatype	string		odatatype
settingValueTemplateId	string		settingValueTemplateId
useTemplateDefault	boolean		useTemplateDefault
value	string		value
children	list<object>		children
odatatype	string		odatatype
settingDefinitionId	string		settingDefinitionId
settingInstanceTemplateReference	object		settingInstanceTemplateReference
odatatype	string		odatatype
settingInstanceTemplateId	string		settingInstanceTemplateId
choiceSettingValue	object		choiceSettingValue
odatatype	string		odatatype
settingValueTemplateReference	object		settingValueTemplateReference
odatatype	string		odatatype
settingValueTemplateId	string		settingValueTemplateId
useTemplateDefault	boolean		useTemplateDefault
value	string		value
children	list<object>		children
odatatype	string		odatatype
settingDefinitionId	string		settingDefinitionId
settingInstanceTemplateReference	object		settingInstanceTemplateReference
odatatype	string		odatatype
settingInstanceTemplateId	string		settingInstanceTemplateId
choiceSettingValue	object		choiceSettingValue
odatatype	string		odatatype
settingValueTemplateReference	object		settingValueTemplateReference
settingValueTemplateId	string		settingValueTemplateId
useTemplateDefault	boolean		useTemplateDefault
odatatype	string		odatatype
value	string		value
children	list<object>		children
settingInstanceTemplateReference	object		settingInstanceTemplateReference
odatatype	string		odatatype
settingInstanceTemplateId	string		settingInstanceTemplateId
choiceSettingValue	object		choiceSettingValue
children	list<object>		children
odatatype	string		odatatype
settingDefinitionId	string		settingDefinitionId
settingInstanceTemplateReference	object		settingInstanceTemplateReference
odatatype	string		odatatype
settingInstanceTemplateId	string		settingInstanceTemplateId
choiceSettingValue	object		choiceSettingValue
odatatype	string		odatatype
settingValueTemplateReference	object		settingValueTemplateReference
odatatype	string		odatatype
settingValueTemplateId	string		settingValueTemplateId
useTemplateDefault	boolean		useTemplateDefault
value	string		value
children	list<object>		children
odatatype	string		odatatype
settingDefinitionId	string		settingDefinitionId
settingInstanceTemplateReference	object		settingInstanceTemplateReference
odatatype	string		odatatype
settingInstanceTemplateId	string		settingInstanceTemplateId
choiceSettingValue	object		choiceSettingValue
odatatype	string		odatatype
settingValueTemplateReference	object		settingValueTemplateReference
odatatype	string		odatatype
settingValueTemplateId	string		settingValueTemplateId
useTemplateDefault	boolean		useTemplateDefault
value	string		value
children	list<object>		children
choiceSettingValue	object		choiceSettingValue
odatatype	string		odatatype
settingValueTemplateReference	object		settingValueTemplateReference
odatatype	string		odatatype
settingValueTemplateId	string		settingValueTemplateId
useTemplateDefault	boolean		useTemplateDefault
value	string		value
children	list<object>		children
choiceSettingValue	object		choiceSettingValue
odatatype	string		odatatype
settingValueTemplateReference	object		settingValueTemplateReference
useTemplateDefault	boolean		useTemplateDefault
odatatype	string		odatatype
settingValueTemplateId	string		settingValueTemplateId
value	string		value
children	list<object>		children
odatatype	string		odatatype
settingDefinitionId	string		settingDefinitionId
settingInstanceTemplateReference	object		settingInstanceTemplateReference
odatatype	string		odatatype
settingInstanceTemplateId	string		settingInstanceTemplateId
choiceSettingValue	object		choiceSettingValue
odatatype	string		odatatype
settingValueTemplateReference	object		settingValueTemplateReference
odatatype	string		odatatype
settingValueTemplateId	string		settingValueTemplateId
useTemplateDefault	boolean		useTemplateDefault
value	string		value
odatatype	string		odatatype
settingDefinitionId	string		settingDefinitionId
settingInstanceTemplateReference	object		settingInstanceTemplateReference
odatatype	string		odatatype
settingInstanceTemplateId	string		settingInstanceTemplateId
odatatype	string		odatatype
settingDefinitionId	string		settingDefinitionId
settingInstanceTemplateReference	object		settingInstanceTemplateReference
odatatype	string		odatatype
settingInstanceTemplateId	string		settingInstanceTemplateId
odatatype	string		odatatype
settingValueTemplateReference	object		settingValueTemplateReference
odatatype	string		odatatype
settingValueTemplateId	string		settingValueTemplateId
useTemplateDefault	boolean		useTemplateDefault
value	string		value
odatatype	string		odatatype
settingDefinitionId	string		settingDefinitionId
odatatype	string		odatatype
odatatype	string		odatatype
settingDefinitionId	string		settingDefinitionId
odatatype	string		odatatype
settingDefinitionId	string		settingDefinitionId
settingInstanceTemplateReference	object		settingInstanceTemplateReference
odatatype	string		odatatype
settingInstanceTemplateId	string		settingInstanceTemplateId
odatatype	string		odatatype
odatatype	string		odatatype
settingDefinitionId	string		settingDefinitionId

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
deviceComplianceCheckinThresholdDays	number		The number of days a device is allowed to go without checking in to remain compliant.
isScheduledActionEnabled	boolean		Is feature enabled or not for scheduled action for rule.
secureByDefault	boolean		Device should be noncompliant when there is no compliance policy targeted when this is true.
enhancedJailBreak	boolean		Is feature enabled or not for enhanced jailbreak detection.
deviceInactivityBeforeRetirementInDay	number		When the device does not check in for specified number of days, the company data might be removed and the device will not be under management.
derivedCredentialUrl	string		The Derived Credential Provider self-service URI.
androidDeviceAdministratorEnrollmentEnabled	boolean		The property to enable Android device administrator enrollment.
enableLogCollection	boolean		Determines whether the log collection feature should be available for use.
derivedCredentialProvider	string		The Derived Credential Provider to use for Mobile Device Management. Possible values are notConfigured, entrustDataCard, purebred, xTec, intercede.
ignoreDevicesForUnsupportedSettingsEnabled	boolean		The property to enable ignore unsupported compliance settings on certain models of devices.
enableAutopilotDiagnostics	boolean		Determines whether the autopilot diagnostic feature is enabled or not.
enableEnhancedTroubleshootingExperience	boolean		Determines whether the enhanced troubleshooting UX is enabled or not.
enableDeviceGroupMembershipReport	boolean		Determines whether the device group membership report feature is enabled or not.
m365AppDiagnosticsEnabled	boolean		The property to enable M365 App log collection and Microsoft Entra ID Device ID correlation for M365 App Diagnostics.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
multiFactorAuthConfiguration	string		Specifies the authentication policy for a user to complete registration using Microsoft Entra join or Microsoft Entra registered. Possible values are notRequired or required.
userDeviceQuota	number		Specifies the maximum number of devices that a user can have within the organization before blocking new device registrations.
azureADJoin	object		Specifies the settings for Microsoft Entra join.
isAdminConfigurable	boolean		Whether the policy is configurable by admins.
localAdmins	object		Specifies local admin settings for Microsoft Entra joined devices.
enableGlobalAdmins	boolean		Whether global admins are added as local administrators on Microsoft Entra joined devices.
azureADRegistration	object		Specifies the settings for Microsoft Entra registration.
isAdminConfigurable	boolean		Whether the policy is configurable by admins.
localAdminPassword	object		Specifies the setting for Local Admin Password Solution (LAPS) in the organization.
isEnabled	boolean		Whether LAPS is enabled in the tenant.
id	string		The unique identifier for the device registration policy.
displayName	string		The display name of the device registration policy.
description	string		The description of the device registration policy.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
state	string		The current state of the email authentication method configuration. Valid values are "enabled" or "disabled".
allowExternalIdToUseEmailOtp	string		Determines whether email OTP is usable by external users for authentication. Possible values are: default, enabled, disabled, unknownFutureValue. Tenants in the default state who did not use public preview will automatically have email OTP enabled beginning in October 2021.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
createdDateTime	number		Timestamp of when the group was created. The value cannot be modified and is automatically populated when the group is created.
isAssignableToRole	boolean		Indicates whether this group can be assigned to an Azure Active Directory role or not. Optional. This property can only be set while creating the group and is immutable. If set to true, the securityEnabled property must also be set to true and the group cannot be a dynamic group (that is, groupTypes cannot contain DynamicMembership). Only callers in Global administrator and Privileged role administrator roles can set this property. The caller must be assigned the RoleManagement.ReadWrite.Directory permission to set this property or update the membership of such groups.
licenseProcessingState	string		Indicates status of the group license assignment to all members of the group. Default value is false. Read-only. Possible values: QueuedForProcessing, ProcessingInProgress, and ProcessingComplete.
mailNickname	string		The mail alias for the group, unique for Microsoft 365 groups in the organization.
onPremisesSecurityIdentifier	string		Contains the on-premises security identifier (SID) for the group that was synchronized from on-premises to the cloud.
securityEnabled	boolean		Specifies whether the group is a security group. Required.
visibility	string		Specifies the group join policy and group content visibility for groups. Possible values are: Private, Public, or Hiddenmembership. Hiddenmembership can be set only for Microsoft 365 groups, when the groups are created. It can't be updated later. Other values of visibility can be updated after group creation. If visibility value is not specified during group creation on Microsoft Graph, a security group is created as Private by default and Microsoft 365 group is Public. Groups assignable to roles are always Private.
membershipRule	string		The rule that determines members for this group if the group is a dynamic group (groupTypes contains DynamicMembership).
membershipRuleProcessingState	string		Indicates whether the dynamic membership processing is on or paused. Possible values are On or Paused.
renewedDateTime	number		Timestamp of when the group was last renewed. This cannot be modified directly and is only updated via the renew service action.
assignedLicenses	list<object>		The licenses that are assigned to the group.
disabledPlans	list<string>		A collection of the unique identifiers for plans that have been disabled.
skuId	string		The unique identifier for the SKU.
classification	string		Describes a classification for the group (such as low, medium or high business impact). Valid values for this property are defined by creating a ClassificationList setting value, based on the template definition.
id	string		The unique identifier for the group. Returned by default. Inherited from directoryObject. Key. Not nullable.
mail	string		The SMTP address for the group, for example, "serviceadmins@contoso.onmicrosoft.com".
securityIdentifier	string		Security identifier of the group, used in Windows scenarios.
groupTypes	list<string>		Specifies the group type and its membership. If the collection contains Unified, the group is a Microsoft 365 group; otherwise, it's either a security group or distribution group. For details, see groups overview. If the collection includes DynamicMembership, the group has dynamic membership; otherwise, membership is static.
onPremisesSamAccountName	string		Contains the on-premises SAM account name synchronized from the on-premises directory. The property is only populated for customers who are synchronizing their on-premises directory to Azure Active Directory via Azure AD Connect.
preferredDataLocation	string		The preferred data location for the Microsoft 365 group. By default, the group inherits the group creator's preferred data location.
preferredLanguage	string		The preferred language for a Microsoft 365 group. Should follow ISO 639-1 Code; for example en-US.
onPremisesProvisioningErrors	list<object>		Errors when using Microsoft synchronization product during provisioning.
category	string		Category of the provisioning error. Note: Currently, there is only one possible value. Possible value: PropertyConflict - indicates a property value is not unique. Other objects contain the same value for the property.
occurredDateTime	number		The date and time at which the error occurred.
propertyCausingError	string		Name of the directory property causing the error. Current possible values: UserPrincipalName or ProxyAddress
value	string		Value of the property causing the error.
onPremisesSyncEnabled	boolean		true if this group is synced from an on-premises directory; false if this group was originally synced from an on-premises directory but is no longer synced; null if this object has never been synced from an on-premises directory (default).
deletedDateTime	number		For some Azure Active Directory objects (user, group, application), if the object is deleted, it is first logically deleted, and this property is updated with the date and time when the object was deleted. Otherwise this property is null. If the object is restored, this property is updated to null.
description	string		An optional description for the group.
resourceProvisioningOptions	list<string>		Specifies the group resources that are provisioned as part of Microsoft 365 group creation, that are not normally part of default group creation. Possible value is Team.
theme	string		Specifies a Microsoft 365 group's color theme. Possible values are Teal, Purple, Green, Blue, Pink, Orange or Red.
mailEnabled	boolean		Specifies whether the group is mail-enabled. Required.
displayName	string		The display name for the group. This property is required when a group is created and cannot be cleared during updates.
proxyAddresses	list<string>		Email addresses for the group that direct to the same group mailbox. For example: ["SMTP: bob@contoso.com", "smtp: bob@sales.contoso.com"]. The any operator is required to filter expressions on multi-valued properties.
assignedLabels	list<object>		The list of sensitivity label pairs (label ID, label name) associated with a Microsoft 365 group.
labelId	string		The unique identifier of the label.
displayName	string		The display name of the label.
expirationDateTime	number		Timestamp of when the group is set to expire. The value cannot be modified and is automatically populated when the group is created.
resourceBehaviorOptions	list<string>		Specifies the group behaviors that can be set for a Microsoft 365 group during creation. This can be set only as part of creation (POST). Possible values are AllowOnlyMembersToPost, HideGroupInOutlook, SubscribeNewGroupMembers, WelcomeEmailDisabled.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
preferredLanguage	string		The preferred language for the user. The preferred language format is based on RFC 4646. The name is a combination of an ISO 639 two-letter lowercase culture code associated with the language, and an ISO 3166 two-letter uppercase subculture code associated with the country or region. Example: "en-US", or "es-ES".
deletedDateTime	number		For some Microsoft Entra objects (user, group, application), if the object is deleted, it is first logically deleted, and this property is updated with the date and time when the object was deleted. Otherwise this property is null. If the object is restored, this property is updated to null.
classification	string		Describes a classification for the group (such as low, medium or high business impact). Valid values for this property are defined by creating a ClassificationList setting value, based on the template definition.
createdDateTime	number		Timestamp of when the group was created. The value cannot be modified and is automatically populated when the group is created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
expirationDateTime	number		Timestamp of when the group is set to expire. It is null for security groups, but for Microsoft 365 groups, it represents when the group is set to expire as defined in the groupLifecyclePolicy. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
onPremisesDomainName	string		The on-premise domain name.
onPremisesSamAccountName	string		Contains the on-premises SAM account name synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect.
odatatype	string		The graph data type, either User or Graph
membershipRule	string		The rule that determines members for this group if the group is a dynamic group (groupTypes contains DynamicMembership).
preferredDataLocation	string		The preferred data location for the Microsoft 365 group. By default, the group inherits the group creator's preferred data location.
serviceProvisioningErrors	list<string>		The list of Service Provisioning Errors.
displayName	string		The name displayed in the address book for the user/group. This property is required when a user/group is created and it cannot be cleared during updates. Maximum length is 256 characters.
givenName	string		The given name (first name) of the user. Maximum length is 64 characters.
jobTitle	string		The user's job title. Maximum length is 128 characters.
creationOptions	list<string>		Creation options.
onPremisesNetBiosName	string		The on-premise net bios name.
onPremisesSyncEnabled	string		true if this group is synced from an on-premises directory; false if this group was originally synced from an on-premises directory but is no longer synced; null if this object has never been synced from an on-premises directory (default).
theme	string		Specifies a Microsoft 365 group's color theme. Possible values are Teal, Purple, Green, Blue, Pink, Orange or Red.
id	string		The member id. It is groupid_userid
resource_id	string	User Group	The actual resource id for which the member refers to.
groupTypes	list<string>		Specifies the group type and its membership.If the collection contains Unified, the group is a Microsoft 365 group; otherwise, it's either a security group or a distribution group. For details, see groups overview.If the collection includes DynamicMembership, the group has dynamic membership; otherwise, membership is static.
mailNickname	string		The mail alias for the group, unique for Microsoft 365 groups in the organization. Maximum length is 64 characters. This property can contain only characters in the ASCII character set 0 - 127 except the following: @ () \ [] " ; : <> , SPACE.
onPremisesSecurityIdentifier	string		Contains the on-premises security identifier (SID) for the group synchronized from on-premises to the cloud.
resourceBehaviorOptions	list<string>		Specifies the group behaviors that can be set for a Microsoft 365 group during creation. This can be set only as part of creation (POST). Possible values are AllowOnlyMembersToPost, HideGroupInOutlook, SubscribeNewGroupMembers, WelcomeEmailDisabled.
resourceProvisioningOptions	list<string>		Specifies the group resources provisioned as part of Microsoft 365 group creation that are not normally part of default group creation. The possible value is Team.
securityEnabled	boolean		Specifies whether the group is a security group. Required.
mail	string		The SMTP address for the user, for example, jeff@contoso.onmicrosoft.com. Changes to this property will also update the user's proxyAddresses collection to include the value as an SMTP address. This property can't contain accent characters.
officeLocation	string		The office location in the user's place of business.
surname	string		The user's surname (family name or last name). Maximum length is 64 characters.
description	string		An optional description for the group.
isAssignableToRole	boolean		Indicates whether this group can be assigned to a Microsoft Entra role. Optional.This property can only be set while creating the group and is immutable. If set to true, the securityEnabled property must also be set to true, visibility must be Hidden, and the group cannot be a dynamic group (that is, groupTypes cannot contain DynamicMembership).Only callers in Global Administrator and Privileged Role Administrator roles can set this property. The caller must also be assigned the RoleManagement.ReadWrite.Directory permission to set this property or update the membership of such groups.
membershipRuleProcessingState	string		Indicates whether the dynamic membership processing is on or paused. Possible values are On or Paused.
securityIdentifier	string		Security identifier of the group, used in Windows scenarios.
userPrincipalName	string		The user principal name (UPN) of the user. The UPN is an Internet-style sign-in name for the user based on the Internet standard RFC 822. By convention, this should map to the user's email name. The general format is alias@domain, where domain must be present in the tenant's collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of organization.
renewedDateTime	number		Timestamp of when the group was last renewed. This cannot be modified directly and is only updated via the renew service action. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
onPremisesProvisioningErrors	list<object>		Errors when using Microsoft synchronization product during provisioning.
category	string		Category of the provisioning error. Note: Currently, there is only one possible value. Possible value: PropertyConflict - indicates a property value is not unique. Other objects contain the same value for the property.
occurredDateTime	number		The date and time at which the error occurred.
propertyCausingError	string		Name of the directory property causing the error. Current possible values: UserPrincipalName or ProxyAddress
value	string		Value of the property causing the error.
mailEnabled	boolean		Specifies whether the group is mail-enabled. Required.
proxyAddresses	list<string>		Email addresses for the group that direct to the same group mailbox. For example: ["SMTP: bob@contoso.com", "smtp: bob@sales.contoso.com"]. The any operator is required to filter expressions on multi-valued properties.
visibility	string		Specifies the group join policy and group content visibility for groups. Possible values are: Private, Public, or HiddenMembership. HiddenMembership can be set only for Microsoft 365 groups when the groups are created. It can't be updated later. Other values of visibility can be updated after group creation.If visibility value is not specified during group creation on Microsoft Graph, a security group is created as Private by default, and the Microsoft 365 group is Public. Groups assignable to roles are always Private.
parent_group_id	string	Group	The parent group id for which the member(user/group) belongs.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
odatatype	string		The graph data type, either User or Group
id	string		The owner id. It is groupid_userid
resource_id	string	User	The actual resource id for which the owner refers to.
parent_group_id	string	Group	The parent group id for which the owner(user/group) belongs.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
osMinimumBuildVersion	string		Minimum IOS build version.
osMaximumBuildVersion	string		Maximum IOS build version.
advancedThreatProtectionRequiredSecurityLevel	string		MDATP Require Mobile Threat Protection minimum risk level to report noncompliance. Possible values are: unavailable, secured, low, medium, high, notSet.
managedEmailProfileRequired	boolean		Indicates whether or not to require a managed email profile.
lastModifiedDateTime	number		DateTime the object was last modified.
displayName	string		Admin provided name of the device configuration.
passcodeMinutesOfInactivityBeforeScreenTimeout	number		Minutes of inactivity before the screen times out.
passcodeRequiredType	string		The required passcode type. Possible values are: deviceDefault, alphanumeric, numeric.
osMaximumVersion	string		Maximum IOS version.
restrictedApps	list<object>		Require the device to not have the specified apps installed. This collection can contain a maximum of 100 elements.
odatatype	string		The application data type.
name	string		The application name.
publisher	string		The publisher of the application.
appStoreUrl	string		The Store URL of the application.
appId	string		The application or bundle identifier of the application.
createdDateTime	number		DateTime the object was created.
description	string		Admin provided description of the Device Configuration.
passcodeMinimumLength	number		Minimum length of passcode. Valid values 4 to 14.
passcodePreviousPasscodeBlockCount	number		Number of previous passcodes to block. Valid values 1 to 24.
osMinimumVersion	string		Minimum IOS version.
odatatype	string		Microsoft graph ios compliance policy type.
version	number		Version of the device configuration.
passcodeBlockSimple	boolean		Indicates whether or not to block simple passcodes.
passcodeExpirationDays	number		Number of days before the passcode expires. Valid values 1 to 65535.
passcodeMinimumCharacterSetCount	number		The number of character sets required in the password.
securityBlockJailbrokenDevices	boolean		Devices must not be jailbroken or rooted.
deviceThreatProtectionEnabled	boolean		Require that devices have enabled device threat protection .
deviceThreatProtectionRequiredSecurityLevel	string		Require Mobile Threat Protection minimum risk level to report noncompliance. Possible values are: unavailable, secured, low, medium, high, notSet.
roleScopeTagIds	list<string>		List of Scope Tags for this Entity instance.
id	string		Key of the entity.
passcodeMinutesOfInactivityBeforeLock	number		Minutes of inactivity before a passcode is required.
passcodeRequired	boolean		Indicates whether or not to require a passcode.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
osMinimumBuildVersion	string		Minimum MacOS build version.
osMaximumBuildVersion	string		Maximum MacOS build version.
passwordRequired	boolean		Whether or not to require a password.
osMinimumVersion	string		Minimum MacOS version.
lastModifiedDateTime	number		DateTime the object was last modified.
deviceThreatProtectionRequiredSecurityLevel	string		Require Mobile Threat Protection minimum risk level to report noncompliance. Possible values are: unavailable, secured, low, medium, high, notSet.
displayName	string		Admin provided name of the device configuration.
version	number		Version of the device configuration.
passwordPreviousPasswordBlockCount	number		Number of previous passwords to block. Valid values 1 to 24.
firewallBlockAllIncoming	boolean		Corresponds to the "Block all incoming connections" option.
odatatype	string		Microsoft graph mac os compliance type.
passwordBlockSimple	boolean		Indicates whether or not to block simple passwords.
passwordExpirationDays	number		Number of days before the password expires. Valid values 1 to 65535.
passwordRequiredType	string		The required password type. Possible values are: deviceDefault, alphanumeric, numeric.
gatekeeperAllowedAppSource	string		System and Privacy setting that determines which download locations apps can be run from on a macOS device. Possible values are: notConfigured, macAppStore, macAppStoreAndIdentifiedDevelopers, anywhere.
id	string		Key of the entity.
createdDateTime	number		DateTime the object was created.
passwordMinimumCharacterSetCount	number		The number of character sets required in the password.
osMaximumVersion	string		Maximum MacOS version.
systemIntegrityProtectionEnabled	boolean		Require that devices have enabled system integrity protection.
deviceThreatProtectionEnabled	boolean		Require that devices have enabled device threat protection.
storageRequireEncryption	boolean		Require encryption on Mac OS devices.
firewallEnabled	boolean		Whether the firewall should be enabled or not.
roleScopeTagIds	list<string>		List of Scope Tags for this Entity instance.
description	string		Admin provided description of the Device Configuration.
passwordMinimumLength	number		Minimum length of password. Valid values 4 to 14.
passwordMinutesOfInactivityBeforeLock	number		Minutes of inactivity before a password is required.
advancedThreatProtectionRequiredSecurityLevel	string		MDATP Require Mobile Threat Protection minimum risk level to report noncompliance. Possible values are: unavailable, secured, low, medium, high, notSet.
firewallEnableStealthMode	boolean		Corresponds to 'Enable stealth mode'.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
displayName	string		Display name of the managed app policy.
odatatype	string		OData type identifier. Sample values are "#microsoft.graph.iosManagedAppProtection", "#microsoft.graph.androidManagedAppProtection".
dataBackupBlocked	boolean		Indicates whether the backup of a managed app's data is blocked.
deviceComplianceRequired	boolean		Indicates whether device compliance is required.
minimumRequiredOsVersion	string		Versions less than the specified version will block the managed app from accessing company data.
appDataEncryptionType	string		Type of encryption which should be used for data in a managed app. Sample values are "whenDeviceLocked", "useDeviceSettings" (iOS only).
minimumWarningPatchVersion	string		Define the oldest recommended Android security patch level a user can have for secure access to the app (Android only).
lastModifiedDateTime	string		Date and time when the policy was last modified.
periodOfflineBeforeAccessCheck	string		The period after which access is checked when the device is not connected to the internet. Sample values are "P1D", "PT30M".
managedBrowserToOpenLinksRequired	boolean		Indicates whether internet links should be opened in the managed browser app.
saveAsBlocked	boolean		Indicates whether users may use the "Save As" menu item to save a copy of protected files.
maximumPinRetries	number		Maximum number of incorrect pin retry attempts before the managed app is either blocked or wiped.
minimumWarningOsVersion	string		Versions less than the specified version will result in warning message on the managed app.
minimumWarningAppVersion	string		Versions less than the specified version will result in warning message on the managed app.
minimumRequiredPatchVersion	string		Define the oldest required Android security patch level a user can have to gain secure access to the app (Android only).
allowedOutboundDataTransferDestinations	string		Destinations to which data can be transferred. Sample values are "allApps", "managedApps".
allowedOutboundClipboardSharingLevel	string		The level to which the clipboard may be shared between apps. Sample values are "managedAppsWithPasteIn", "allApps".
contactSyncBlocked	boolean		Indicates whether contacts can be synced to the user's device.
managedBrowser	string		Indicates in which managed browser(s) that internet links should be opened. Sample values are "notConfigured", "microsoftEdge".
screenCaptureBlocked	boolean		Indicates whether screen capture is blocked (Android only).
customBrowserDisplayName	string		Friendly name of the preferred custom browser to open weblink on Android (Android only).
printBlocked	boolean		Indicates whether printing is allowed from managed apps.
version	string		Version of the managed app policy.
periodOnlineBeforeAccessCheck	string		The period after which access is checked when the device is connected to the internet. Sample values are "PT30M", "PT1M".
pinRequired	boolean		Indicates whether an app-level pin is required.
description	string		Description of the managed app policy.
periodBeforePinReset	string		TimePeriod before the app-level pin must be reset if PinRequired is set to True. Sample values are "PT0S".
disableAppPinIfDevicePinIsSet	boolean		Indicates whether use of the app pin is disabled if the device pin is set.
minimumRequiredAppVersion	string		Versions less than the specified version will block the managed app from accessing company data.
disableAppEncryptionIfDeviceEncryptionIsEnabled	boolean		When this setting is enabled, app level encryption is disabled if device level encryption is enabled (Android only).
platform	string		Platform type detected from @odata.type. Sample values are "ios", "android", "universal".
fingerprintBlocked	boolean		Indicates whether use of the fingerprint reader is allowed in place of a pin if PinRequired is set to True.
deployedAppCount	number		Count of apps to which the current policy is deployed.
encryptAppData	boolean		Indicates whether application data for managed apps should be encrypted (Android only).
customBrowserPackageId	string		Unique identifier of a custom browser to open weblink on Android (Android only).
allowedInboundDataTransferSources	string		Sources from which data can be transferred. Sample values are "allApps", "managedApps".
minimumPinLength	number		Minimum pin length required for an app-level pin if PinRequired is set to True.
pinCharacterSet	string		Character set which may be used for an app-level pin if PinRequired is set to True. Sample values are "numeric", "alphanumericAndSymbol".
isAssigned	boolean		Indicates if the policy is deployed to any inclusion groups or not.
minimumRequiredSdkVersion	string		Versions less than the specified version will block the managed app from accessing company data.
allowedDataStorageLocations	list<string>		Data storage locations where a user may store managed data.
id	string		Unique identifier of the managed app policy.
createdDateTime	string		Date and time when the policy was created.
organizationalCredentialsRequired	boolean		Indicates whether organizational credentials are required for app use.
periodOfflineBeforeWipeIsEnforced	string		The amount of time an app is allowed to remain disconnected from the internet before all managed data it is wiped. Sample values are "P90D", "P1D".
simplePinBlocked	boolean		Indicates whether simplePin is blocked.
faceIdBlocked	boolean		Indicates whether use of the FaceID is allowed in place of a pin if PinRequired is set to True (iOS only).
customBrowserProtocol	string		A custom browser protocol to open weblink on iOS (iOS only).

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
azureADDeviceId	string		The unique identifier for the Azure Active Directory device. Read only.
deviceCategoryDisplayName	string		Device category display name. Default is an empty string. Supports $filter operator 'eq' and 'or'.
isEncrypted	boolean		Device encryption status.
phoneNumber	string		Phone number of the device.
androidSecurityPatchLevel	string		Android security patch level.
odatatype	string		To distinguish between different platforms (Android, iOS).
deviceActionResults	list<object>		List of ComplexType deviceActionResult objects.
odatatype	string		deviceActionResult type
actionName	string		Action name
actionState	string		State of the action. Possible values are: none, pending, canceled, active, done, failed, notSupported.
startDateTime	number		Time the action was initiated.
lastUpdatedDateTime	number		Time the action state was last updated.
complianceGracePeriodExpirationDateTime	number		The DateTime when device compliance grace period expires.
totalStorageSpaceInBytes	number		Total Storage in Bytes.
managementCertificateExpirationDate	number		Reports device management certificate expiration date.
iccid	string		Integrated Circuit Card Identifier, it is A SIM card's unique identification number. Default is an empty string. To retrieve actual values GET call needs to be made, with device id and included in select parameter. Supports: $select. $Search is not supported.
udid	string		Unique Device Identifier for iOS and macOS devices. Default is an empty string. To retrieve actual values GET call needs to be made, with device id and included in select parameter. Supports: $select. $Search is not supported.
enrolledDateTime	number		Enrollment time of the device. Supports $filter operator 'lt' and 'gt'.
osVersion	string		Operating system version of the device.
remoteAssistanceSessionErrorDetails	string		An error string that identifies issues when creating Remote Assistance session objects.
freeStorageSpaceInBytes	number		Free Storage in Bytes. Default value is 0.
managedDeviceName	string		Automatically generated name to identify a device.
ethernetMacAddress	string		Indicates Ethernet MAC Address of the device. Default, is Null (Non-Default property) for this property when returned as part of managedDevice entity. Individual get call with select query options is needed to retrieve actual values. Example: deviceManagement/managedDevices({managedDeviceId})?$select=ethernetMacAddress Supports: $select. $Search is not supported.
managedDeviceOwnerType	string		Ownership of the device. Can be 'company' or 'personal'.Possible values are: unknown, company, personal.
easActivated	boolean		Whether the device is Exchange ActiveSync activated.
imei	string		IMEI string.
physicalMemoryInBytes	number		Total Memory in Bytes. Default is 0. To retrieve actual values GET call needs to be made, with device id and included in select parameter. Supports: $select.
easActivationDateTime	number		Exchange ActivationSync activation time of the device.
exchangeLastSuccessfulSyncDateTime	number		Last time the device contacted Exchange.
exchangeAccessState	string		The Access State of the device in Exchange. Possible values are: none, unknown, allowed, blocked, quarantined.
model	string		Model of the device.
deviceHealthAttestationState	object		The device health attestation state.
resetCount	number		The number of times a PC device has hibernated or resumed.
secureBoot	string		When Secure Boot is enabled, the core components must have the correct cryptographic signatures.
codeIntegrityPolicy	string		The Code Integrity policy that is controlling the security of the boot environment.
odatatype	string		Device health attestation state type.
lastUpdateDateTime	number		The Timestamp of the last update.
bootAppSecurityVersion	string		The security version number of the Boot Application.
bootManagerSecurityVersion	string		The security version number of the Boot Application.
healthStatusMismatchInfo	string		This attribute appears if DHA-Service detects an integrity issue.
deviceHealthAttestationStatus	string		The DHA report version. (Namespace version).
codeIntegrity	string		When code integrity is enabled, code execution is restricted to integrity verified code.
earlyLaunchAntiMalwareDriverProtection	string		ELAM provides protection for the computers in your network when they start up.
tpmVersion	string		The security version number of the Boot Application.
contentVersion	string		The HealthAttestation state schema version.
bitLockerStatus	string		On or Off of BitLocker Drive Encryption.
bootDebugging	string		When bootDebugging is enabled, the device is used in development and testing.
operatingSystemKernelDebugging	string		When operatingSystemKernelDebugging is enabled, the device is used in development and testing.
windowsPE	string		Operating system running with limited services that is used to prepare a computer for Windows.
operatingSystemRevListInfo	string		The Operating System Revision List that was loaded during initial boot on the attested device.
attestationIdentityKey	string		TWhen an Attestation Identity Key (AIK) is present on a device, it indicates that the device has an endorsement key (EK) certificate.
safeMode	string		Safe mode is a troubleshooting option for Windows that starts your computer in a limited state.
pcrHashAlgorithm	string		Informational attribute that identifies the HASH algorithm that was used by TPM.
pcr0	string		The measurement that is captured in PCR[0].
bootRevisionListInfo	string		The Boot Revision List that was loaded during initial boot on the attested device.
issuedDateTime	number		The DateTime when device was evaluated or issued to MDM.
codeIntegrityCheckVersion	string		The version of the Boot Manager
contentNamespaceUrl	string		The DHA report version. (Namespace version).
bootManagerVersion	string		The version of the Boot Manager.
virtualSecureMode	string		VSM is a container that protects high value assets from a compromised kernel.
secureBootConfigurationPolicyFingerPrint	string		Fingerprint of the Custom Secure Boot Configuration Policy.
healthAttestationSupportedStatus	string		This attribute indicates if DHA is supported for the device.
restartCount	number		The number of times a PC device has rebooted.
dataExcutionPolicy	string		DEP Policy defines a set of hardware and software technologies that perform additional checks on memory.
testSigning	string		When test signing is allowed, the device does not enforce signature validation during boot.
meid	string		MEID.
operatingSystem	string		Operating system of the device. Windows, iOS, etc.
jailBroken	string		Whether the device is jail broken or rooted. Default is an empty string. Supports $filter operator 'eq' and 'or'.
easDeviceId	string		Exchange ActiveSync Id of the device.
azureADRegistered	boolean		Whether the device is Azure Active Directory registered.
manufacturer	string		Manufacturer of the device.
serialNumber	string		SerialNumber.
configurationManagerClientEnabledFeatures	object		ConfigrMgr client enabled features.
odatatype	string		Configuration manage client enabled feature types
inventory	boolean		Whether inventory is managed by Intune.
modernApps	boolean		Whether modern application is managed by Intune.
resourceAccess	boolean		Whether resource access is managed by Intune.
deviceConfiguration	boolean		Whether device configuration is managed by Intune.
compliancePolicy	boolean		Whether compliance policy is managed by Intune.
windowsUpdateForBusiness	boolean		Whether Windows Update for Business is managed by Intune.
notes	string		Notes on the device created by IT Admin. Default is null. To retrieve actual values GET call needs to be made, with device id and included in select parameter. Supports: $select. $Search is not supported.
lastSyncDateTime	number		The date and time that the device last completed a successful sync with Intune. Supports $filter operator 'lt' and 'gt'.
complianceState	string		Compliance state of the device. Examples: Compliant, Conflict, Error, etc. Default is unknown. Supports $filter operator 'eq' and 'or'. Possible values are: unknown, compliant, noncompliant, conflict, error, inGracePeriod, configManager.
activationLockBypassCode	string		The code that allows the Activation Lock on managed device to be bypassed. Default, is Null (Non-Default property) for this property when returned as part of managedDevice entity in LIST call. To retrieve actual values GET call needs to be made, with device id and included in select parameter. Supports: $select. $Search is not supported.
deviceRegistrationState	string		Device registration state. Possible values are: notRegistered, registered, revoked, keyConflict, approvalPending, certificateReset, notRegisteredPendingEnrollment, unknown.
isSupervised	boolean		Device supervised status.
exchangeAccessStateReason	string		The reason for the device's access state in Exchange. Possible values are: none, unknown, exchangeGlobalRule, exchangeIndividualRule, exchangeDeviceRule, exchangeUpgrade, exchangeMailboxPolicy, other, compliant, notCompliant, notEnrolled, unknownLocation, mfaRequired, azureADBlockDueToAccessPolicy, compromisedPassword, deviceNotKnownWithManagedApp.
userPrincipalName	string		Device user principal name.
userDisplayName	string		User display name.
userId	string		Unique Identifier for the user associated with the device.
managementAgent	string		Management channel of the device. Examples: Intune, EAS, etc. Default is unknown. Supports $filter operator 'eq' and 'or'. Possible values are: eas, mdm, easMdm, intuneClient, easIntuneClient, configurationManagerClient, configurationManagerClientMdm, configurationManagerClientMdmEas, unknown, jamf, googleCloudDevicePolicyController.
emailAddress	string		Email(s) for the user associated with the device.
remoteAssistanceSessionUrl	string		Url that allows a Remote Assistance session to be established with the device. Default is an empty string. To retrieve actual values GET call needs to be made, with device id and included in select parameter.
wiFiMacAddress	string		Wi-Fi MAC address.
subscriberCarrier	string		Subscriber Carrier.
partnerReportedThreatState	string		Indicates the threat state of a device when a Mobile Threat Defense partner is in use by the account and device. Read Only. Possible values are: unknown, activated, deactivated, secured, lowSeverity, mediumSeverity, highSeverity, unresponsive, compromised, misconfigured.
requireUserEnrollmentApproval	boolean		Reports if the managed iOS device is user approval enrollment.
id	string		Unique Identifier for the device.
deviceName	string		Name of the device.
deviceEnrollmentType	string		Enrollment type of the device. Possible values are: unknown, userEnrollment, deviceEnrollmentManager, appleBulkWithUser, appleBulkWithoutUser, windowsAzureADJoin, windowsBulkUserless, windowsAutoEnrollment, windowsBulkAzureDomainJoin, windowsCoManagement, windowsAzureADJoinUsingDeviceAuth, appleUserEnrollment, appleUserEnrollmentWithServiceAccount.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
state	string		The state of the Microsoft Authenticator authentication method configuration. Possible values are enabled, disabled.
featureSettings	object		A collection of Microsoft Authenticator settings such as number matching and additional context.
numberMatchingRequiredState	object		Requires number matching for MFA notifications. Value is ignored for phone sign-in notifications.
state	string		Whether the feature is enabled or disabled. Possible values are default, enabled, disabled, unknownFutureValue.
includeTarget	object		A single entity that is targeted by this feature.
id	string		The ID of the entity targeted. Use all_users for all users.
targetType	string		The kind of entity targeted. Possible values are user, group, unknownFutureValue.
displayAppInformationRequiredState	object		Determines whether the user sees the app name and location in the Authenticator notification.
state	string		Whether the feature is enabled or disabled. Possible values are default, enabled, disabled, unknownFutureValue.
companionAppAllowedState	object		Determines whether companion applications are allowed for Microsoft Authenticator.
state	string		Whether the feature is enabled or disabled. Possible values are default, enabled, disabled, unknownFutureValue.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
displayName	string		The display name of the named location.
countriesAndRegions	list<string>		List of countries and/or regions in two-letter format specified by ISO 3166-2.
includeUnknownCountriesAndRegions	boolean		true if IP addresses that don't map to a country or region should be included in the named location.
countryLookupMethod	string		Determines what method is used to decide which country the user is located in. Possible values are clientIpAddress(default) and authenticatorAppGps.
isTrusted	boolean		true if this location is explicitly trusted.
ipRanges	list<object>		List of IP address ranges in IPv4 CIDR format (e.g. 1.2.3.4/32) or any allowable IPv6 format from IETF RFC596.
odatatype	string		Used to distinguish between different types of ip ranges. Possible values are #microsoft.graph.iPv4CidrRange and #microsoft.graph.iPv6CidrRange.
cidrAddress	string		IPv4 or IPv6 address in CIDR notation.
id	string		The id of the named location.
odatatype	string		To distinguish between different types of named locations. Value can be #microsoft.graph.countryNamedLocation or #microsoft.graph.ipNamedLocation.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
clientId	string	ServicePrincipal	The ID of the client service principal for the application which is authorized to act on behalf of a signed-in user when accessing an API. Corresponds to the 'objectId' field inside the Azure 'Enterprise applications' page.
consentType	string		Indicates if authorization is granted for the client application to impersonate all users or only a specific user. 'AllPrincipals' indicates authorization to impersonate all users. 'Principal' indicates authorization to impersonate a specific user. Consent on behalf of all users can be granted by an administrator. Non-admin users may be authorized to consent on behalf of themselves in some cases, for some delegated permissions.
principalId	string	User	The ID of the user on behalf of whom the client is authorized to access the resource, when consentType is Principal. If consentType is 'AllPrincipals' this value is null. Required when consentType is 'Principal'.
resourceId	string	ServicePrincipal	The ID of the resource service principal to which access is authorized. This identifies the API which the client is authorized to attempt to call on behalf of a signed-in user.
scope	string		A space-separated list of the claim values for delegated permissions which should be included in access tokens for the resource application (the API). For example, 'openid User.Read GroupMember.Read.All'. Each claim value should match the value field of one of the delegated permissions defined by the API, listed in the publishedPermissionScopes property of the resource service principal.
id	string		The ID of the OAuth2PermissionGrant.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
appRoleAssignmentRequired	boolean		Specifies whether users or other service principals need to be granted an app role assignment for this service principal before users can sign in or apps can get tokens. The default value is false.
displayName	string		The display name for the service principal.
passwordCredentials	list<object>		The collection of password credentials associated with the application.
hint	string		Contains the first three characters of the password.
keyId	string		The unique identifier for the password.
secretText	string		Contains the strong passwords generated by Azure AD that are 16-64 characters in length. The generated password value is only returned during the initial POST request to addPassword. There is no way to retrieve this password in the future.
startDateTime	number		The date and time at which the password becomes valid.
customKeyIdentifier	string		Do not use.
displayName	string		Friendly name for the password.
endDateTime	number		The date and time at which the password expires represented using ISO 8601 format and is always in UTC time.
preferredSingleSignOnMode	string		Specifies the single sign-on mode configured for this application. Azure AD uses the preferred single sign-on mode to launch the application from Microsoft 365 or the Azure AD My Apps. The supported values are password, saml, notSupported, and oidc.
samlSingleSignOnSettings	object		The collection for settings related to saml single sign-on.
relayState	string		The relative URI the service provider would redirect to after completion of the single sign-on flow.
servicePrincipalNames	list<string>		Contains the list of identifiersUris, copied over from the associated application. Additional values can be added to hybrid applications. These values can be used to identify the permissions exposed by this app within Azure AD.
verifiedPublisher	object		Specifies the verified publisher of the application which this service principal represents.
addedDateTime	number		The timestamp when the verified publisher was first added or most recently updated.
displayName	string		The verified publisher name from the app publisher's Partner Center account.
verifiedPublisherId	string		The ID of the verified publisher from the app publisher's Partner Center account.
accountEnabled	boolean		true if the service principal account is enabled; otherwise, false.
disabledByMicrosoftStatus	string		Specifies whether Microsoft has disabled the registered application. Possible values are: null (default value), NotDisabled, and DisabledDueToViolationOfServicesAgreement (reasons may include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement).
signInAudience	string		Specifies the Microsoft accounts that are supported for the current application. Supported values are: AzureADMyOrg-Users with a Microsoft work or school account in my organization's Azure AD tenant (single-tenant). AzureADMultipleOrgs-Users with a Microsoft work or school account in any organization's Azure AD tenant (multi-tenant). AzureADandPersonalMicrosoftAccount-Users with a personal Microsoft account, or a work or school account in any organization's Azure AD tenant. PersonalMicrosoftAccount-Users with a personal Microsoft account only.
tags	list<string>		Custom strings that can be used to categorize and identify the service principal.
alternativeNames	list<string>		Used to retrieve service principals by subscription, identify resource group and full resource ids for managed identities.
appRoles	list<object>		The roles exposed by the application which this service principal represents. For more information see the appRoles property definition on the application entity. Not nullable.
value	string		Specifies the value to include in the roles claim in ID tokens and access tokens authenticating an assigned user or service principal.
allowedMemberTypes	list<string>		Specifies whether this app role can be assigned to users and groups (by setting to ["User"]), to other application's (by setting to ["Application"], or both (by setting to ["User", "Application"]). App roles supporting assignment to other applications' service principals are also known as application permissions. The "Application" value is only supported for app roles defined on application entities.
description	string		The description for the app role. This is displayed when the app role is being assigned and, if the app role functions as an application permission, during consent experiences.
displayName	string		Display name for the permission that appears in the app role assignment and consent experiences.
id	string		Unique role identifier inside the appRoles collection. When creating a new app role, a new GUID identifier must be provided.
isEnabled	boolean		When creating or updating an app role, this must be set to true (which is the default). To delete a role, this must first be set to false. At that point, in a subsequent call, this role may be removed.
origin	string		Specifies if the app role is defined on the application object or on the servicePrincipal entity. Must not be included in any POST or PATCH requests.
homepage	string		Home page or landing page of the application.
servicePrincipalType	string		Identifies whether the service principal represents an application, a managed identity, or a legacy application. This is set by Azure AD internally. The servicePrincipalType property can be set to three different values: Application - A service principal that represents an application or service. The appId property identifies the associated app registration, and matches the appId of an application, possibly from a different tenant. If the associated app registration is missing, tokens are not issued for the service principal. ManagedIdentity - A service principal that represents a managed identity. Service principals representing managed identities can be granted access and permissions, but cannot be updated or modified directly. Legacy - A service principal that represents an app created before app registrations, or through legacy experiences. Legacy service principal can have credentials, service principal names, reply URLs, and other properties which are editable by an authorized user, but does not have an associated app registration. The appId value does not associate the service principal with an app registration. The service principal can only be used in the tenant where it was created.
addIns	list<object>		Defines custom behavior that a consuming service can use to call an app in specific contexts. For example, applications that can render file streams may set the addIns property for its "FileHandler" functionality. This will let services like Office 365 call the application in the context of a document the user is working on.
id	string		id of an addIn.
properties	list<object>		property of an addIn.
key	string		Key for the key-value pair.
value	string		Value for the key-value pair.
type	string		type of an addIn.
appOwnerOrganizationId	string	Account	Contains the tenant id where the application is registered. This is applicable only to service principals backed by applications.
id	string		The unique identifier for the service principal. Inherited from directoryObject Key
appDisplayName	string		The display name exposed by the associated application.
applicationTemplateId	string		Unique identifier of the applicationTemplate that the servicePrincipal was created from.
deletedDateTime	number		The date and time the service principal was deleted.
logoutUrl	string		Specifies the URL that will be used by Microsoft's authorization service to logout an user using OpenId Connect front-channel, back-channel or SAML logout protocols.
oauth2PermissionScopes	list<object>		The delegated permissions exposed by the application. For more information see the oauth2PermissionScopes property on the application entity's api property.
adminConsentDisplayName	string		The permission's title, intended to be read by an administrator granting the permission on behalf of all users.
id	string		Unique delegated permission identifier inside the collection of delegated permissions defined for a resource application.
isEnabled	boolean		When creating or updating a permission, this property must be set to true (which is the default). To delete a permission, this property must first be set to false. At that point, in a subsequent call, the permission may be removed.
type	string		The possible values are: User and Admin. Specifies whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator consent should always be required. While Microsoft Graph defines the default consent requirement for each permission, the tenant administrator may override the behavior in their organization (by allowing, restricting, or limiting user consent to this delegated permission).
userConsentDescription	string		A description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.
userConsentDisplayName	string		A title for the permission, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.
value	string		Specifies the value to include in the scp (scope) claim in access tokens.
adminConsentDescription	string		A description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences.
resourceSpecificApplicationPermissions	list<object>		The resource-specific application permissions exposed by this application. Currently, resource-specific permissions are only supported for Teams apps accessing to specific chats and teams using Microsoft Graph.
description	string		Describes the level of access that the resource-specific permission represents.
displayName	string		The display name for the resource-specific permission.
id	string		The unique identifier for the resource-specific application permission.
isEnabled	boolean		Indicates whether the permission is enabled.
value	string		The value of the permission.
description	string		Free text field to provide an internal end-user facing description of the service principal. End-user portals such MyApps will display the application description in this field.
info	object		Basic profile information of the acquired application such as app's marketing, support, terms of service and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience.
logoUrl	string		CDN URL to the application's logo.
marketingUrl	string		Link to the application's marketing page.
privacyStatementUrl	string		Link to the application's privacy statement.
supportUrl	string		Link to the application's support page.
termsOfServiceUrl	string		Link to the application's terms of service statement.
keyCredentials	list<object>		The collection of key credentials associated with the service principal.
endDateTime	number		The date and time at which the credential expires.
key	string		The certificate's raw data in byte array converted to Base64 string.
keyId	string		The unique identifier (GUID) for the key.
startDateTime	number		The date and time at which the credential becomes valid.
type	string		The type of key credential; for example, Symmetric, AsymmetricX509Cert.
usage	string		A string that describes the purpose for which the key can be used; for example, Verify.
customKeyIdentifier	string		Custom key identifier
displayName	string		Friendly name for the key.
loginUrl	string		Specifies the URL where the service provider redirects the user to Azure AD to authenticate. Azure AD uses the URL to launch the application from Microsoft 365 or the Azure AD My Apps. When blank, Azure AD performs IdP-initiated sign-on for applications configured with SAML-based single sign-on. The user launches the application from Microsoft 365, the Azure AD My Apps, or the Azure AD SSO URL.
notes	string		Free text field to capture information about the service principal, typically used for operational purposes.
notificationEmailAddresses	list<string>		Specifies the list of email addresses where Azure AD sends a notification when the active certificate is near the expiration date. This is only for the certificates used to sign the SAML token issued for Azure AD Gallery applications.
tokenEncryptionKeyId	string		Specifies the keyId of a public key from the keyCredentials collection. When configured, Azure AD issues tokens for this application encrypted using the key specified by this property. The application code that receives the encrypted token must use the matching private key to decrypt the token before it can be used for the signed-in user.
appDescription	string		The description exposed by the associated application.
appId	string	Application	The unique identifier for the associated application (its appId property).
replyUrls	list<string>		The URLs that user tokens are sent to for sign in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
principalId	string	Group ServicePrincipal User	Identifier of the principal to which the assignment is granted.
principal	object		Details of the principal the assignment is for. Read only.
odatatype	string		Type of principal, can be a user or group.
id	string		Identifier of the principal to which the assignment is granted.
mail	string		email id of the principal user.
displayName	string		display of the principal user.
id	string		The unique identifier for the role assignment. Key, not nullable, Read-only.
appScopeId	string		Identifier of the app-specific scope when the assignment scope is app-specific. Either this property or directoryScopeId is required. App scopes are scopes that are defined and understood by this application only
directoryScopeId	string		Identifier of the directory object representing the scope of the assignment. Either this property or appScopeId is required. The scope of an assignment determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications.
roleDefinitionId	string	UnifiedRoleDefinition	Identifier of the role definition the assignment is for. Read only.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
description	string		The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true.
displayName	string		The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true.
id	string		The unique identifier for the role definition. Key, not nullable, Read-only. Inherited from entity.
isBuiltIn	boolean		Flag indicating whether the role definition is part of the default set included in Azure Active Directory (Azure AD) or a custom definition.
resourceScopes	list<string>		List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true.
rolePermissions	list<object>		List of permissions included in the role. Read-only when isBuiltIn is true.
allowedResourceActions	list<string>		Set of tasks that can be performed on a resource.
condition	string		Optional constraints that must be met for the permission to be effective. Not supported for custom roles.
excludedResourceActions	list<string>		Set of tasks that may not be performed on a resource. Not yet supported.
templateId	string		Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories.
inheritsPermissionsFrom	list<object>		Read-only collection of role definitions that the given role definition inherits from. Only Azure AD built-in roles (isBuiltIn is true) support this attribute.
id	string		The unique identifier for the role definition. Key, not nullable, Read-only. Inherited from entity.
isEnabled	boolean		Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true.
version	string		Indicates version of the role definition. Read-only when isBuiltIn is true.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
externalUserStateChangeDateTime	number		Shows the timestamp for the latest change to the externalUserState property.
mobilePhone	string		The primary cellular telephone number for the user. Read-only for users synced from on-premises directory.
onPremisesProvisioningErrors	list<object>		Errors when using Microsoft synchronization product during provisioning.
category	string		Category of the provisioning error. Note: Currently, there is only one possible value. Possible value: PropertyConflict - indicates a property value is not unique. Other objects contain the same value for the property.
occurredDateTime	number		The date and time at which the error occurred.
propertyCausingError	string		Name of the directory property causing the error. Current possible values: UserPrincipalName or ProxyAddress
value	string		Value of the property causing the error.
passwordPolicies	string		Specifies password policies for the user. This value is an enumeration with one possible value being DisableStrongPassword, which allows weaker passwords than the default policy to be specified. DisablePasswordExpiration can also be specified. The two may be specified together; for example: DisablePasswordExpiration, DisableStrongPassword.
employeeId	string		The employee identifier assigned to the user by the organization.
onPremisesImmutableId	string		This property is used to associate an on-premises Active Directory user account to their Azure AD user object. This property must be specified when creating a new user account in the Graph if you are using a federated domain for the user's userPrincipalName (UPN) property.
signInSessionsValidFromDateTime	number		Any refresh tokens or sessions tokens (session cookies) issued before this time are invalid, and applications will get an error when using an invalid refresh or sessions token to acquire a delegated access token (to access APIs such as Microsoft Graph). If this happens, the application will need to acquire a new refresh token by making a request to the authorize endpoint.
country	string		The country/region in which the user is located; for example, US or UK.
department	string		The name for the department in which the user works.
legalAgeGroupClassification	string		Used by enterprise applications to determine the legal age group of the user. This property is read-only and calculated based on ageGroup and consentProvidedForMinor properties. Allowed values: null, MinorWithOutParentalConsent, MinorWithParentalConsent, MinorNoParentalConsentRequired, NotAdult and Adult.
licenseAssignmentStates	list<object>		State of license assignments for this user.
assignedByGroup	string		The id of the group that assigns this license. If the assignment is a direct-assigned license, this field will be Null.
disabledPlans	list<string>		The service plans that are disabled in this assignment.
error	string		License assignment failure error. If the license is assigned successfully, this field will be Null. Read-Only. The possible values are CountViolation, MutuallyExclusiveViolation, DependencyViolation, ProhibitedInUsageLocationViolation, UniquenessViolation, and Other.
lastUpdatedDateTime	number		The timestamp when the state of the license assignment was last updated.
skuId	string		The unique identifier for the SKU.
state	string		Indicate the current state of this assignment. Read-Only. The possible values are Active, ActiveWithError, Disabled, and Error.
onPremisesSamAccountName	string		Contains the on-premises samAccountName synchronized from the on-premises directory. The property is only populated for customers who are synchronizing their on-premises directory to Azure Active Directory via Azure AD Connect.
preferredLanguage	string		The preferred language for the user. Should follow ISO 639-1 Code; for example en-US.
faxNumber	string		The fax number of the user.
jobTitle	string		The user's job title.
mail	string		The SMTP address for the user, for example, jeff@contoso.onmicrosoft.com.
postalCode	string		The postal code for the user's postal address. The postal code is specific to the user's country/region. In the United States of America, this attribute contains the ZIP code.
businessPhones	list<string>		The telephone numbers for the user. NOTE: Although this is a string collection, only one number can be set for this property. Read-only for users synced from on-premises directory.
userRegistrationDetails	object		Represents the state of a user's authentication methods, including which methods are registered and which features the user is registered and capable of.
isAdmin	boolean		Indicates whether the user has an admin role in the tenant.
isPasswordlessCapable	boolean		Indicates whether the user has registered a passwordless strong authentication method.
isSsprCapable	boolean		Indicates whether the user has registered the required number of authentication methods for self-service password reset and the user is allowed to perform self-service password reset by policy.
isSystemPreferredAuthenticationMethodEnabled	boolean		Indicates whether system preferred authentication method is enabled. If enabled, the system dynamically determines the most secure authentication method among the methods registered by the user.
systemPreferredAuthenticationMethods	list<string>		Collection of authentication methods that the system determined to be the most secure authentication methods among the registered methods for second factor authentication.
userPreferredMethodForSecondaryAuthentication	string		The method the user selected as the default second-factor for performing multifactor authentication.
lastUpdatedDateTime	number		The date and time (UTC) when the record was last updated.
isMfaCapable	boolean		Indicates whether the user has registered a strong authentication method for multifactor authentication.
isMfaRegistered	boolean		Indicates whether the user has registered a strong authentication method for multifactor authentication.
isSsprEnabled	boolean		Indicates whether the user is allowed to perform self-service password reset by policy. The user may not necessarily have registered the required number of authentication methods for self-service password reset.
isSsprRegistered	boolean		Indicates whether the user has registered the required number of authentication methods for self-service password reset. The user may not necessarily be allowed to perform self-service password reset by policy.
methodsRegistered	list<string>		Collection of authentication methods registered.
onPremisesExtensionAttributes	object		Contains extensionAttributes1-15 for the user. These extension attributes are also known as Exchange custom attributes 1-15. For an onPremisesSyncEnabled user, the source of authority for this set of properties is the on-premises and is read-only. For a cloud-only user (where onPremisesSyncEnabled is false), these properties can be set during creation or update of a user object. For a cloud-only user previously synced from on-premises Active Directory, these properties are read-only in Microsoft Graph but can be fully managed through the Exchange Admin Center or the Exchange Online V2 module in PowerShell.
extensionAttribute10	string		Tenth customizable extension attribute.
extensionAttribute11	string		Eleventh customizable extension attribute.
extensionAttribute14	string		Fourteenth customizable extension attribute.
extensionAttribute4	string		Fourth customizable extension attribute.
extensionAttribute5	string		Fifth customizable extension attribute.
extensionAttribute13	string		Thirteenth customizable extension attribute.
extensionAttribute2	string		Second customizable extension attribute.
extensionAttribute1	string		First customizable extension attribute.
extensionAttribute3	string		Third customizable extension attribute.
extensionAttribute7	string		Seventh customizable extension attribute.
extensionAttribute8	string		Eighth customizable extension attribute.
extensionAttribute12	string		Twelfth customizable extension attribute.
extensionAttribute15	string		Fifteenth customizable extension attribute.
extensionAttribute6	string		Sixth customizable extension attribute.
extensionAttribute9	string		Ninth customizable extension attribute.
onPremisesUserPrincipalName	string		Contains the on-premises userPrincipalName synchronized from the on-premises directory. The property is only populated for customers who are synchronizing their on-premises directory to Azure Active Directory via Azure AD Connect.
showInAddressList	boolean		Do not use in Microsoft Graph. Manage this property through the Microsoft 365 admin center instead. Represents whether the user should be included in the Outlook global address list.
ageGroup	string		Sets the age group of the user. Allowed values: null, Minor, NotAdult and Adult.
creationType	string		Indicates whether the user account was created through one of the following methods: As a regular school or work account (null), As an external account (Invitation), As a local account for an Azure Active Directory B2C tenant (LocalAccount), Through self-service sign-up by an internal user using email verification (EmailVerified), Through self-service sign-up by an external user signing up through a link that is part of a user flow (SelfServiceSignUp).
hireDate	number		The hire date of the user. Note: This property is specific to SharePoint Online. We recommend using the native employeeHireDate property to set and update hire date values using Microsoft Graph APIs.
onPremisesDomainName	string		Contains the on-premises domainFQDN, also called dnsDomainName synchronized from the on-premises directory. The property is only populated for customers who are synchronizing their on-premises directory to Azure Active Directory via Azure AD Connect.
onPremisesSecurityIdentifier	string		Contains the on-premises security identifier (SID) for the user that was synchronized from on-premises to the cloud.
usageLocation	string		A two letter country code (ISO standard 3166). Required for users that will be assigned licenses due to legal requirement to check for availability of services in countries. Examples include: US, JP, and GB.
id	string		The unique identifier for the user.
onPremisesSyncEnabled	boolean		true if this object is synced from an on-premises directory; false if this object was originally synced from an on-premises directory but is no longer synced; null if this object has never been synced from an on-premises directory (default).
assignedLicenses	list<object>		The licenses that are assigned to the user, including inherited (group-based) licenses.
disabledPlans	list<string>		A collection of the unique identifiers for plans that have been disabled.
skuId	string		The unique identifier for the SKU.
employeeType	string		Captures enterprise worker type. For example, Employee, Contractor, Consultant, or Vendor.
schools	list<string>		A list for the user to enumerate the schools they have attended.
userType	string		A string value that can be used to classify user types in your directory, such as Member and Guest.
companyName	string		The company name which the user is associated. This property can be useful for describing the company that an external user comes from.
accountEnabled	boolean		true if the account is enabled; otherwise, false. This property is required when a user is created.
imAddresses	list<string>		The instant message voice over IP (VOIP) session initiation protocol (SIP) addresses for the user.
consentProvidedForMinor	string		Sets whether consent has been obtained for minors. Allowed values: null, Granted, Denied and NotRequired.
givenName	string		The given name (first name) of the user.
proxyAddresses	list<string>		For example: ["SMTP: bob@contoso.com", "smtp: bob@sales.contoso.com"]. Changes to the mail property will also update this collection to include the value as an SMTP address. For more information, see mail and proxyAddresses properties. The proxy address prefixed with SMTP (capitalized) is the primary proxy address while those prefixed with smtp are the secondary proxy addresses. For Azure AD B2C accounts, this property has a limit of ten unique addresses.
city	string		The city in which the user is located.
displayName	string		The name displayed in the address book for the user. This is usually the combination of the user's first name, middle initial and last name. This property is required when a user is created and it cannot be cleared during updates.
externalUserState	string		For an external user invited to the tenant using the invitation API, this property represents the invited user's invitation status. For invited users, the state can be PendingAcceptance or Accepted, or null for all other users.
isResourceAccount	boolean		Do not use - reserved for future use.
surname	string		The user's surname (family name or last name).
userPrincipalName	string		The user principal name (UPN) of the user. The UPN is an Internet-style login name for the user based on the Internet standard RFC 822. By convention, this should map to the user's email name. The general format is alias@domain, where domain must be present in the tenant's collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of organization.
identities	list<object>		Represents the identities that can be used to sign in to this user account. An identity can be provided by Microsoft (also known as a local account), by organizations, or by social identity providers such as Facebook, Google, and Microsoft, and tied to a user account. May contain multiple items with the same signInType value.
issuerAssignedId	string		Specifies the unique identifier assigned to the user by the issuer. The combination of issuer and issuerAssignedId must be unique within the organization. Represents the sign-in name for the user, when signInType is set to emailAddress or userName (also known as local accounts). When signInType is set to: emailAddress, (or a custom string that starts with emailAddress like emailAddress1) issuerAssignedId must be a valid email address userName, issuerAssignedId must be a valid local part of an email address
signInType	string		Specifies the user sign-in types in your directory, such as emailAddress, userName, federated, or userPrincipalName. federated represents a unique identifier for a user from an issuer, that can be in any format chosen by the issuer. Setting or updating a userPrincipalName identity will update the value of the userPrincipalName property on the user object. The validations performed on the userPrincipalName property on the user object, for example, verified domains and acceptable characters, will be performed when setting or updating a userPrincipalName identity. Additional validation is enforced on issuerAssignedId when the sign-in type is set to emailAddress or userName. This property can also be set to any custom string.
issuer	string		Specifies the issuer of the identity, for example facebook.com. For local accounts (where signInType is not federated), this property is the local B2C tenant default domain name, for example contoso.onmicrosoft.com. For external users from other Azure AD organization, this will be the domain of the federated organization, for example contoso.com.
onPremisesDistinguishedName	string		Contains the on-premises Active Directory distinguished name or DN. The property is only populated for customers who are synchronizing their on-premises directory to Azure Active Directory via Azure AD Connect.
passwordProfile	object		Specifies the password profile for the user. The profile contains the user's password. This property is required when a user is created. The password in the profile must satisfy minimum requirements as specified by the passwordPolicies property. By default, a strong password is required.
forceChangePasswordNextSignIn	boolean		true if the user must change her password on the next login; otherwise false. If not set, default is false.
forceChangePasswordNextSignInWithMfa	boolean		If true, at next sign-in, the user must perform a multi-factor authentication (MFA) before being forced to change their password. The behavior is identical to forceChangePasswordNextSignIn except that the user is required to first perform a multi-factor authentication before password change. After a password change, this property will be automatically reset to false. If not set, default is false.
password	string		The password for the user. This property is required when a user is created. It can be updated, but the user will be required to change the password on the next login. The password must satisfy minimum requirements as specified by the user's passwordPolicies property. By default, a strong password is required.
refreshTokensValidFromDateTime	number		Any refresh tokens or sessions tokens (session cookies) issued before this time are invalid, and applications will get an error when using an invalid refresh or sessions token to acquire a delegated access token (to access APIs such as Microsoft Graph). If this happens, the application will need to acquire a new refresh token by making a request to the authorize endpoint.
state	string		The state or province in the user's address.
mailNickname	string		The mail alias for the user. This property must be specified when a user is created.
officeLocation	string		The office location in the user's place of business.
otherMails	list<string>		A list of additional email addresses for the user; for example: ["bob@contoso.com", "Robert@fabrikam.com"].
streetAddress	string		The street address of the user's place of business.
createdDateTime	number		The created date of the user object.
deletedDateTime	number		The date and time the user was deleted.
employeeHireDate	number		The date and time when the user was hired or will start work in case of a future hire.
employeeOrgData	object		Represents organization data (e.g. division and costCenter) associated with a user.
division	string		The name of the division in which the user works.
costCenter	string		The cost center associated with the user.
lastPasswordChangeDateTime	number		The time when this Azure AD user last changed their password or when their password was created, whichever date the latest action was performed.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
id	string	User	The ID of the User for which sign activity is fetched.
signInActivity	object		signInActivity
lastSuccessfulSignInDateTime	number		The date and time of the user's most recent successful sign-in activity.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
antiSpywareRequired	boolean		Require any AntiSpyware solution registered with Windows Decurity Center to be on and monitoring (e.g. Symantec, Windows Defender).
tpmRequired	boolean		Require Trusted Platform Module(TPM) to be present.
deviceCompliancePolicyScript	object		Device compliance policy script object.
odatatype	string		Device compliance policy script data type.
deviceComplianceScriptId	string		Device compliance script Id.
rulesContent	string		Json of the rules.
passwordMinutesOfInactivityBeforeLock	number		Minutes of inactivity before a password is required.
odatatype	string		Microsoft graph windows10 compliance policy type.
version	number		Version of the device configuration.
mobileOsMinimumVersion	string		Minimum Windows Phone version.
codeIntegrityEnabled	boolean		Require devices to be reported as healthy by Windows Device Health Attestation.
deviceThreatProtectionEnabled	boolean		Require that devices have enabled device threat protection.
passwordRequiredType	string		The required password type. Possible values are: deviceDefault, alphanumeric, numeric.
secureBootEnabled	boolean		Require devices to be reported as healthy by Windows Device Health Attestation - secure boot is enabled.
activeFirewallRequired	boolean		Require active firewall on Windows devices.
rtpEnabled	boolean		Require Windows Defender Antimalware Real-Time Protection on Windows devices.
deviceThreatProtectionRequiredSecurityLevel	string		Require Device Threat Protection minimum risk level to report noncompliance. Possible values are: unavailable, secured, low, medium, high, notSet.
osMinimumVersion	string		Minimum Windows 10 version.
roleScopeTagIds	list<string>		List of Scope Tags for this Entity instance.
id	string		Key of the entity.
passwordMinimumCharacterSetCount	number		The number of character sets required in the password.
validOperatingSystemBuildRanges	list<object>		The valid operating system build ranges on Windows devices. This collection can contain a maximum of 10000 elements.
odatatype	string		Operating system build range data type.
description	string		The description of this range (e.g. Valid 1702 builds)
lowestVersion	string		The lowest inclusive version that this range contains.
highestVersion	string		The highest inclusive version that this range contains.
passwordRequired	boolean		Require a password to unlock Windows device.
passwordBlockSimple	boolean		Indicates whether or not to block simple password.
passwordExpirationDays	number		The password expiration in days.
passwordRequiredToUnlockFromIdle	boolean		Require a password to unlock an idle device.
lastModifiedDateTime	number		DateTime the object was last modified.
antivirusRequired	boolean		Require any Antivirus solution registered with Windows Decurity Center to be on and monitoring (e.g. Symantec, Windows Defender).
passwordPreviousPasswordBlockCount	number		The number of previous passwords to prevent re-use of.
osMaximumVersion	string		Maximum Windows 10 version.
storageRequireEncryption	boolean		Require encryption on windows devices.
defenderVersion	string		Require Windows Defender Antimalware minimum version on Windows devices.
signatureOutOfDate	boolean		Require Windows Defender Antimalware Signature to be up to date on Windows devices.
configurationManagerComplianceRequired	boolean		Require to consider SCCM Compliance state into consideration for Intune Compliance State.
passwordMinimumLength	number		The minimum password length.
createdDateTime	number		DateTime the object was created.
description	string		Admin provided description of the Device Configuration.
displayName	string		Admin provided name of the device configuration.
requireHealthyDeviceReport	boolean		Require devices to be reported as healthy by Windows Device Health Attestation.
mobileOsMaximumVersion	string		Maximum Windows Phone version.
earlyLaunchAntiMalwareDriverEnabled	boolean		Require devices to be reported as healthy by Windows Device Health Attestation - early launch antimalware driver is enabled.
bitLockerEnabled	boolean		Require devices to be reported healthy by Windows Device Health Attestation - bit locker is enabled.
defenderEnabled	boolean		Require Windows Defender Antimalware on Windows devices.

ATTRIBUTE	TYPE	REFERS TO	DESCRIPTION
passwordBlockSimple	boolean		Indicates whether or not to block simple password.
passwordRequiredType	string		The required password type. Possible values are: deviceDefault, alphanumeric, numeric.
passwordPreviousPasswordBlockCount	number		The number of previous passwords to prevent re-use of. Valid values 0 to 24.
roleScopeTagIds	list<string>		List of Scope Tags for this Entity instance.
passwordMinimumLength	number		The minimum password length.
lastModifiedDateTime	number		DateTime the object was last modified.
displayName	string		Admin provided name of the device configuration.
passwordRequired	boolean		Require a password to unlock Windows device.
passwordExpirationDays	number		Password expiration in days.
osMaximumVersion	string		Maximum Windows 8.1 version.
storageRequireEncryption	boolean		Indicates whether or not to require encryption on a windows 8.1 device.
odatatype	string		Microsoft graph windows 8.1 compliance policy type.
createdDateTime	number		DateTime the object was created.
version	number		Version of the device configuration.
passwordMinutesOfInactivityBeforeLock	number		Minutes of inactivity before a password is required.
passwordMinimumCharacterSetCount	number		The number of character sets required in the password.
osMinimumVersion	string		Minimum Windows 8.1 version.
id	string		Key of the entity.
description	string		Admin provided description of the Device Configuration.