openapi: 3.1.0 info: title: Microsoft Graph Admin Admin.admin applicationTemplates.applicationTemplate.Actions API description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID. This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations, site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements, SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.' version: 1.0.0 contact: name: Microsoft Graph API Support url: https://developer.microsoft.com/graph servers: - url: https://graph.microsoft.com/v1.0 description: Microsoft Graph API v1.0 endpoint tags: - name: applicationTemplates.applicationTemplate.Actions x-ms-docs-toc-type: container paths: /applicationTemplates/{applicationTemplate-id}/instantiate: description: Provides operations to call the instantiate method. parameters: - name: applicationTemplate-id in: path description: The unique identifier of applicationTemplate required: true schema: type: string x-ms-docs-key-type: applicationTemplate post: tags: - applicationTemplates.applicationTemplate.Actions summary: Microsoft Graph Invoke action instantiate description: Add an instance of an application from the Microsoft Entra application gallery into your directory. For non-gallery apps, use an application template with one of the following IDs to configure different single sign-on (SSO) modes like SAML SSO and password-based SSO. externalDocs: description: Find more info here url: https://learn.microsoft.com/graph/api/applicationtemplate-instantiate?view=graph-rest-1.0 operationId: applicationTemplates.applicationTemplate.instantiate requestBody: description: Action parameters content: application/json: schema: type: object properties: displayName: type: string nullable: true serviceManagementReference: type: string nullable: true required: true responses: 2XX: description: Success content: application/json: schema: anyOf: - $ref: '#/components/schemas/microsoft.graph.applicationServicePrincipal' - type: object nullable: true 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: action components: schemas: microsoft.graph.targetDeviceGroup: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: targetDeviceGroup required: - '@odata.type' type: object properties: displayName: type: string description: Display name for the target device group. nullable: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.targetDeviceGroup' microsoft.graph.synchronization: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: synchronization required: - '@odata.type' type: object properties: secrets: type: array items: $ref: '#/components/schemas/microsoft.graph.synchronizationSecretKeyStringValuePair' description: Represents a collection of credentials to access provisioned cloud applications. jobs: type: array items: $ref: '#/components/schemas/microsoft.graph.synchronizationJob' description: Performs synchronization by periodically running in the background, polling for changes in one directory, and pushing them to another directory. x-ms-navigationProperty: true templates: type: array items: $ref: '#/components/schemas/microsoft.graph.synchronizationTemplate' description: Preconfigured synchronization settings for a particular application. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.synchronization' microsoft.graph.objectDefinition: title: objectDefinition required: - '@odata.type' type: object properties: attributes: type: array items: $ref: '#/components/schemas/microsoft.graph.attributeDefinition' description: Defines attributes of the object. metadata: type: array items: $ref: '#/components/schemas/microsoft.graph.objectDefinitionMetadataEntry' description: Metadata for the given object. name: type: string description: Name of the object. Must be unique within a directory definition. Not nullable. nullable: true supportedApis: type: array items: type: string nullable: true description: The API that the provisioning service queries to retrieve data for synchronization. '@odata.type': type: string microsoft.graph.synchronizationTaskExecution: title: synchronizationTaskExecution required: - '@odata.type' type: object properties: activityIdentifier: type: string description: Identifier of the job run. nullable: true countEntitled: type: number description: Count of processed entries that were assigned for this application. format: int64 countEntitledForProvisioning: type: number description: Count of processed entries that were assigned for provisioning. format: int64 countEscrowed: type: number description: Count of entries that were escrowed (errors). format: int64 countEscrowedRaw: type: number description: Count of entries that were escrowed, including system-generated escrows. format: int64 countExported: type: number description: Count of exported entries. format: int64 countExports: type: number description: Count of entries that were expected to be exported. format: int64 countImported: type: number description: Count of imported entries. format: int64 countImportedDeltas: type: number description: Count of imported delta-changes. format: int64 countImportedReferenceDeltas: type: number description: Count of imported delta-changes pertaining to reference changes. format: int64 error: anyOf: - $ref: '#/components/schemas/microsoft.graph.synchronizationError' - type: object nullable: true description: If an error was encountered, contains a synchronizationError object with details. state: $ref: '#/components/schemas/microsoft.graph.synchronizationTaskExecutionResult' timeBegan: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Time when this job run began. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time timeEnded: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Time when this job run ended. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time '@odata.type': type: string microsoft.graph.appManagementRestrictionState: title: appManagementRestrictionState enum: - enabled - disabled - unknownFutureValue type: string microsoft.graph.applicationServicePrincipal: title: applicationServicePrincipal required: - '@odata.type' type: object properties: application: anyOf: - $ref: '#/components/schemas/microsoft.graph.application' - type: object nullable: true x-ms-navigationProperty: true servicePrincipal: anyOf: - $ref: '#/components/schemas/microsoft.graph.servicePrincipal' - type: object nullable: true x-ms-navigationProperty: true '@odata.type': type: string microsoft.graph.stsPolicy: allOf: - $ref: '#/components/schemas/microsoft.graph.policyBase' - title: stsPolicy required: - '@odata.type' type: object properties: definition: type: array items: type: string description: A string collection containing a JSON string that defines the rules and settings for a policy. The syntax for the definition differs for each derived policy type. Required. isOrganizationDefault: type: boolean description: If set to true, activates this policy. There can be many policies for the same policy type, but only one can be activated as the organization default. Optional, default value is false. nullable: true appliesTo: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.stsPolicy' discriminator: propertyName: '@odata.type' mapping: '#microsoft.graph.activityBasedTimeoutPolicy': '#/components/schemas/microsoft.graph.activityBasedTimeoutPolicy' '#microsoft.graph.claimsMappingPolicy': '#/components/schemas/microsoft.graph.claimsMappingPolicy' '#microsoft.graph.homeRealmDiscoveryPolicy': '#/components/schemas/microsoft.graph.homeRealmDiscoveryPolicy' '#microsoft.graph.tokenIssuancePolicy': '#/components/schemas/microsoft.graph.tokenIssuancePolicy' '#microsoft.graph.tokenLifetimePolicy': '#/components/schemas/microsoft.graph.tokenLifetimePolicy' microsoft.graph.application: allOf: - $ref: '#/components/schemas/microsoft.graph.directoryObject' - title: application required: - '@odata.type' type: object properties: addIns: type: array items: $ref: '#/components/schemas/microsoft.graph.addIn' description: Defines custom behavior that a consuming service can use to call an app in specific contexts. For example, applications that can render file streams can set the addIns property for its 'FileHandler' functionality. This lets services like Microsoft 365 call the application in the context of a document the user is working on. api: anyOf: - $ref: '#/components/schemas/microsoft.graph.apiApplication' - type: object nullable: true description: Specifies settings for an application that implements a web API. appId: type: string description: The unique identifier for the application that is assigned to an application by Microsoft Entra ID. Not nullable. Read-only. Alternate key. Supports $filter (eq). nullable: true applicationTemplateId: type: string description: Unique identifier of the applicationTemplate. Supports $filter (eq, not, ne). Read-only. null if the app wasn't created from an application template. nullable: true appRoles: type: array items: $ref: '#/components/schemas/microsoft.graph.appRole' description: The collection of roles defined for the application. With app role assignments, these roles can be assigned to users, groups, or service principals associated with other applications. Not nullable. authenticationBehaviors: anyOf: - $ref: '#/components/schemas/microsoft.graph.authenticationBehaviors' - type: object nullable: true certification: anyOf: - $ref: '#/components/schemas/microsoft.graph.certification' - type: object nullable: true description: Specifies the certification status of the application. createdDateTime: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The date and time the application was registered. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. Supports $filter (eq, ne, not, ge, le, in, and eq on null values) and $orderby. format: date-time nullable: true defaultRedirectUri: type: string nullable: true description: type: string description: Free text field to provide a description of the application object to end users. The maximum allowed size is 1,024 characters. Supports $filter (eq, ne, not, ge, le, startsWith) and $search. nullable: true disabledByMicrosoftStatus: type: string description: 'Specifies whether Microsoft has disabled the registered application. The possible values are: null (default value), NotDisabled, and DisabledDueToViolationOfServicesAgreement (reasons include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement). Supports $filter (eq, ne, not).' nullable: true displayName: type: string description: The display name for the application. Maximum length is 256 characters. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values), $search, and $orderby. nullable: true groupMembershipClaims: type: string description: 'Configures the groups claim issued in a user or OAuth 2.0 access token that the application expects. To set this attribute, use one of the following valid string values: None, SecurityGroup (for security groups and Microsoft Entra roles), All (this gets all of the security groups, distribution groups, and Microsoft Entra directory roles that the signed-in user is a member of).' nullable: true identifierUris: type: array items: type: string description: Also known as App ID URI, this value is set when an application is used as a resource app. The identifierUris acts as the prefix for the scopes you reference in your API's code, and it must be globally unique across Microsoft Entra ID. For more information on valid identifierUris patterns and best practices, see Microsoft Entra application registration security best practices. Not nullable. Supports $filter (eq, ne, ge, le, startsWith). info: anyOf: - $ref: '#/components/schemas/microsoft.graph.informationalUrl' - type: object nullable: true description: 'Basic profile information of the application such as app''s marketing, support, terms of service and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience. For more info, see How to: Add Terms of service and privacy statement for registered Microsoft Entra apps. Supports $filter (eq, ne, not, ge, le, and eq on null values).' isDeviceOnlyAuthSupported: type: boolean description: Specifies whether this application supports device authentication without a user. The default is false. nullable: true isFallbackPublicClient: type: boolean description: Specifies the fallback application type as public client, such as an installed application running on a mobile device. The default value is false, which means the fallback application type is confidential client such as a web app. There are certain scenarios where Microsoft Entra ID can't determine the client application type. For example, the ROPC flow where it's configured without specifying a redirect URI. In those cases, Microsoft Entra ID interprets the application type based on the value of this property. nullable: true keyCredentials: type: array items: $ref: '#/components/schemas/microsoft.graph.keyCredential' description: The collection of key credentials associated with the application. Not nullable. Supports $filter (eq, not, ge, le). logo: type: string description: The main logo for the application. Not nullable. format: base64url nativeAuthenticationApisEnabled: anyOf: - $ref: '#/components/schemas/microsoft.graph.nativeAuthenticationApisEnabled' - type: object nullable: true description: 'Specifies whether the Native Authentication APIs are enabled for the application. The possible values are: none and all. Default is none. For more information, see Native Authentication.' notes: type: string description: Notes relevant for the management of the application. nullable: true oauth2RequirePostResponse: type: boolean optionalClaims: anyOf: - $ref: '#/components/schemas/microsoft.graph.optionalClaims' - type: object nullable: true description: 'Application developers can configure optional claims in their Microsoft Entra applications to specify the claims that are sent to their application by the Microsoft security token service. For more information, see How to: Provide optional claims to your app.' parentalControlSettings: anyOf: - $ref: '#/components/schemas/microsoft.graph.parentalControlSettings' - type: object nullable: true description: Specifies parental control settings for an application. passwordCredentials: type: array items: $ref: '#/components/schemas/microsoft.graph.passwordCredential' description: The collection of password credentials associated with the application. Not nullable. publicClient: anyOf: - $ref: '#/components/schemas/microsoft.graph.publicClientApplication' - type: object nullable: true description: Specifies settings for installed clients such as desktop or mobile devices. publisherDomain: type: string description: 'The verified publisher domain for the application. Read-only. For more information, see How to: Configure an application''s publisher domain. Supports $filter (eq, ne, ge, le, startsWith).' nullable: true requestSignatureVerification: anyOf: - $ref: '#/components/schemas/microsoft.graph.requestSignatureVerification' - type: object nullable: true description: Specifies whether this application requires Microsoft Entra ID to verify the signed authentication requests. requiredResourceAccess: type: array items: $ref: '#/components/schemas/microsoft.graph.requiredResourceAccess' description: Specifies the resources that the application needs to access. This property also specifies the set of delegated permissions and application roles that it needs for each of those resources. This configuration of access to the required resources drives the consent experience. No more than 50 resource services (APIs) can be configured. Beginning mid-October 2021, the total number of required permissions must not exceed 400. For more information, see Limits on requested permissions per app. Not nullable. Supports $filter (eq, not, ge, le). samlMetadataUrl: type: string description: The URL where the service exposes SAML metadata for federation. This property is valid only for single-tenant applications. Nullable. nullable: true serviceManagementReference: type: string description: References application or service contact information from a Service or Asset Management database. Nullable. nullable: true servicePrincipalLockConfiguration: anyOf: - $ref: '#/components/schemas/microsoft.graph.servicePrincipalLockConfiguration' - type: object nullable: true description: Specifies whether sensitive properties of a multitenant application should be locked for editing after the application is provisioned in a tenant. Nullable. null by default. signInAudience: type: string description: 'Specifies the Microsoft accounts that are supported for the current application. The possible values are: AzureADMyOrg (default), AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, and PersonalMicrosoftAccount. See more in the table. The value of this object also limits the number of permissions an app can request. For more information, see Limits on requested permissions per app. The value for this property has implications on other app object properties. As a result, if you change this property, you might need to change other properties first. For more information, see Validation differences for signInAudience.Supports $filter (eq, ne, not).' nullable: true spa: anyOf: - $ref: '#/components/schemas/microsoft.graph.spaApplication' - type: object nullable: true description: Specifies settings for a single-page application, including sign out URLs and redirect URIs for authorization codes and access tokens. tags: type: array items: type: string description: Custom strings that can be used to categorize and identify the application. Not nullable. Strings added here will also appear in the tags property of any associated service principals.Supports $filter (eq, not, ge, le, startsWith) and $search. tokenEncryptionKeyId: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: Specifies the keyId of a public key from the keyCredentials collection. When configured, Microsoft Entra ID encrypts all the tokens it emits by using the key this property points to. The application code that receives the encrypted token must use the matching private key to decrypt the token before it can be used for the signed-in user. format: uuid nullable: true uniqueName: type: string description: The unique identifier that can be assigned to an application and used as an alternate key. Immutable. Read-only. nullable: true verifiedPublisher: anyOf: - $ref: '#/components/schemas/microsoft.graph.verifiedPublisher' - type: object nullable: true description: Specifies the verified publisher of the application. For more information about how publisher verification helps support application security, trustworthiness, and compliance, see Publisher verification. web: anyOf: - $ref: '#/components/schemas/microsoft.graph.webApplication' - type: object nullable: true description: Specifies settings for a web application. appManagementPolicies: type: array items: $ref: '#/components/schemas/microsoft.graph.appManagementPolicy' description: The appManagementPolicy applied to this application. x-ms-navigationProperty: true createdOnBehalfOf: anyOf: - $ref: '#/components/schemas/microsoft.graph.directoryObject' - type: object nullable: true description: Supports $filter (/$count eq 0, /$count ne 0). Read-only. x-ms-navigationProperty: true extensionProperties: type: array items: $ref: '#/components/schemas/microsoft.graph.extensionProperty' description: Read-only. Nullable. Supports $expand and $filter (/$count eq 0, /$count ne 0). x-ms-navigationProperty: true federatedIdentityCredentials: type: array items: $ref: '#/components/schemas/microsoft.graph.federatedIdentityCredential' description: Federated identities for applications. Supports $expand and $filter (startsWith, /$count eq 0, /$count ne 0). x-ms-navigationProperty: true homeRealmDiscoveryPolicies: type: array items: $ref: '#/components/schemas/microsoft.graph.homeRealmDiscoveryPolicy' x-ms-navigationProperty: true owners: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: Directory objects that are owners of this application. The owners are a set of nonadmin users or service principals who are allowed to modify this object. Supports $expand, $filter (/$count eq 0, /$count ne 0, /$count eq 1, /$count ne 1), and $select nested in $expand. x-ms-navigationProperty: true synchronization: anyOf: - $ref: '#/components/schemas/microsoft.graph.synchronization' - type: object nullable: true description: Represents the capability for Microsoft Entra identity synchronization through the Microsoft Graph API. x-ms-navigationProperty: true tokenIssuancePolicies: type: array items: $ref: '#/components/schemas/microsoft.graph.tokenIssuancePolicy' x-ms-navigationProperty: true tokenLifetimePolicies: type: array items: $ref: '#/components/schemas/microsoft.graph.tokenLifetimePolicy' x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.application' x-ms-discriminator-value: '#microsoft.graph.application' microsoft.graph.referencedObject: title: referencedObject required: - '@odata.type' type: object properties: referencedObjectName: type: string description: Name of the referenced object. Must match one of the objects in the directory definition. nullable: true referencedProperty: type: string description: Currently not supported. Name of the property in the referenced object, the value for which is used as the reference. nullable: true '@odata.type': type: string microsoft.graph.synchronizationSchema: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: synchronizationSchema required: - '@odata.type' type: object properties: synchronizationRules: type: array items: $ref: '#/components/schemas/microsoft.graph.synchronizationRule' description: A collection of synchronization rules configured for the synchronizationJob or synchronizationTemplate. version: type: string description: The version of the schema, updated automatically with every schema change. nullable: true directories: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryDefinition' description: Contains the collection of directories and all of their objects. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.synchronizationSchema' microsoft.graph.addIn: title: addIn required: - '@odata.type' type: object properties: id: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: The unique identifier for the addIn object. format: uuid nullable: true properties: type: array items: $ref: '#/components/schemas/microsoft.graph.keyValue' description: The collection of key-value pairs that define parameters that the consuming service can use or call. You must specify this property when performing a POST or a PATCH operation on the addIns collection. Required. type: type: string description: The unique name for the functionality exposed by the app. '@odata.type': type: string microsoft.graph.objectMappingMetadata: title: objectMappingMetadata enum: - EscrowBehavior - DisableMonitoringForChanges - OriginalJoiningProperty - Disposition - IsCustomerDefined - ExcludeFromReporting - Unsynchronized type: string microsoft.graph.synchronizationQuarantine: title: synchronizationQuarantine required: - '@odata.type' type: object properties: currentBegan: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Date and time when the quarantine was last evaluated and imposed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time error: anyOf: - $ref: '#/components/schemas/microsoft.graph.synchronizationError' - type: object nullable: true description: Describes the error(s) that occurred when putting the synchronization job into quarantine. nextAttempt: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Date and time when the next attempt to re-evaluate the quarantine will be made. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time reason: $ref: '#/components/schemas/microsoft.graph.quarantineReason' seriesBegan: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Date and time when the quarantine was first imposed in this series (a series starts when a quarantine is first imposed, and is reset as soon as the quarantine is lifted). The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time seriesCount: type: number description: Number of times in this series the quarantine was re-evaluated and left in effect (a series starts when quarantine is first imposed, and is reset as soon as quarantine is lifted). format: int64 '@odata.type': type: string microsoft.graph.objectDefinitionMetadata: title: objectDefinitionMetadata enum: - PropertyNameAccountEnabled - PropertyNameSoftDeleted - IsSoftDeletionSupported - IsSynchronizeAllSupported - ConnectorDataStorageRequired - Extensions - BaseObjectName type: string microsoft.graph.federatedIdentityCredential: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: federatedIdentityCredential required: - '@odata.type' type: object properties: audiences: type: array items: type: string description: The audience that can appear in the external token. This field is mandatory and should be set to api://AzureADTokenExchange for Microsoft Entra ID. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Microsoft Entra ID in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your identity provider to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters. Required. description: type: string description: The unvalidated description of the federated identity credential, provided by the user. It has a limit of 600 characters. Optional. nullable: true issuer: type: string description: The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique within the app. It has a limit of 600 characters. Required. name: type: string description: The unique identifier for the federated identity credential, which has a limit of 120 characters and must be URL friendly. The string is immutable after it's created. Alternate key. Required. Not nullable. Supports $filter (eq). subject: type: string description: Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format; each identity provider uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Microsoft Entra ID. The combination of issuer and subject must be unique within the app. It has a limit of 600 characters. Supports $filter (eq). '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.federatedIdentityCredential' microsoft.graph.customAppManagementConfiguration: allOf: - $ref: '#/components/schemas/microsoft.graph.appManagementConfiguration' - title: customAppManagementConfiguration required: - '@odata.type' type: object properties: '@odata.type': type: string default: '#microsoft.graph.customAppManagementConfiguration' x-ms-discriminator-value: '#microsoft.graph.customAppManagementConfiguration' microsoft.graph.filterOperand: title: filterOperand required: - '@odata.type' type: object properties: values: type: array items: type: string nullable: true description: Collection of values. '@odata.type': type: string microsoft.graph.delegatedPermissionClassification: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: delegatedPermissionClassification required: - '@odata.type' type: object properties: classification: anyOf: - $ref: '#/components/schemas/microsoft.graph.permissionClassificationType' - type: object nullable: true description: 'The classification value. Possible values: low, medium (preview), high (preview). Doesn''t support $filter.' permissionId: type: string description: The unique identifier (id) for the delegated permission listed in the oauth2PermissionScopes collection of the servicePrincipal. Required on create. Doesn't support $filter. nullable: true permissionName: type: string description: The claim value (value) for the delegated permission listed in the oauth2PermissionScopes collection of the servicePrincipal. Doesn't support $filter. nullable: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.delegatedPermissionClassification' microsoft.graph.synchronizationStatusCode: title: synchronizationStatusCode enum: - NotConfigured - NotRun - Active - Paused - Quarantine type: string microsoft.graph.synchronizationTemplate: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: synchronizationTemplate required: - '@odata.type' type: object properties: applicationId: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: Identifier of the application this template belongs to. format: uuid default: type: boolean description: true if this template is recommended to be the default for the application. description: type: string description: Description of the template. nullable: true discoverable: type: boolean description: true if this template should appear in the collection of templates available for the application instance (service principal). factoryTag: type: string description: One of the well-known factory tags supported by the synchronization engine. The factoryTag tells the synchronization engine which implementation to use when processing jobs based on this template. nullable: true metadata: type: array items: $ref: '#/components/schemas/microsoft.graph.synchronizationMetadataEntry' description: Additional extension properties. Unless mentioned explicitly, metadata values should not be changed. schema: anyOf: - $ref: '#/components/schemas/microsoft.graph.synchronizationSchema' - type: object nullable: true description: Default synchronization schema for the jobs based on this template. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.synchronizationTemplate' microsoft.graph.appManagementPolicy: allOf: - $ref: '#/components/schemas/microsoft.graph.policyBase' - title: appManagementPolicy required: - '@odata.type' type: object properties: isEnabled: type: boolean description: Denotes whether the policy is enabled. restrictions: anyOf: - $ref: '#/components/schemas/microsoft.graph.customAppManagementConfiguration' - type: object nullable: true description: Restrictions that apply to an application or service principal object. appliesTo: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: Collection of applications and service principals to which the policy is applied. x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.appManagementPolicy' x-ms-discriminator-value: '#microsoft.graph.appManagementPolicy' microsoft.graph.permissionScope: title: permissionScope required: - '@odata.type' type: object properties: adminConsentDescription: type: string description: A description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences. nullable: true adminConsentDisplayName: type: string description: The permission's title, intended to be read by an administrator granting the permission on behalf of all users. nullable: true id: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: Unique delegated permission identifier inside the collection of delegated permissions defined for a resource application. format: uuid isEnabled: type: boolean description: When you create or update a permission, this property must be set to true (which is the default). To delete a permission, this property must first be set to false. At that point, in a subsequent call, the permission may be removed. origin: type: string nullable: true type: type: string description: 'The possible values are: User and Admin. Specifies whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator consent should always be required. While Microsoft Graph defines the default consent requirement for each permission, the tenant administrator may override the behavior in their organization (by allowing, restricting, or limiting user consent to this delegated permission). For more information, see Configure how users consent to applications.' nullable: true userConsentDescription: type: string description: A description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves. nullable: true userConsentDisplayName: type: string description: A title for the permission, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves. nullable: true value: type: string description: 'Specifies the value to include in the scp (scope) claim in access tokens. Must not exceed 120 characters in length. Allowed characters are : ! # $ % & '' ( ) * + , - . / : ; = ? @ [ ] ^ + _ { } ~, and characters in the ranges 0-9, A-Z and a-z. Any other character, including the space character, aren''t allowed. May not begin with ..' nullable: true '@odata.type': type: string microsoft.graph.attributeFlowType: title: attributeFlowType enum: - Always - ObjectAddOnly - MultiValueAddOnly - ValueAddOnly - AttributeAddOnly type: string microsoft.graph.requestSignatureVerification: title: requestSignatureVerification required: - '@odata.type' type: object properties: allowedWeakAlgorithms: anyOf: - $ref: '#/components/schemas/microsoft.graph.weakAlgorithms' - type: object nullable: true description: 'Specifies which weak algorithms are allowed. The possible values are: rsaSha1, unknownFutureValue.' isSignedRequestRequired: type: boolean description: Specifies whether signed authentication requests for this application should be required. '@odata.type': type: string microsoft.graph.parentalControlSettings: title: parentalControlSettings required: - '@odata.type' type: object properties: countriesBlockedForMinors: type: array items: type: string nullable: true description: Specifies the two-letter ISO country codes. Access to the application will be blocked for minors from the countries specified in this list. legalAgeGroupRule: type: string description: 'Specifies the legal age group rule that applies to users of the app. Can be set to one of the following values: ValueDescriptionAllowDefault. Enforces the legal minimum. This means parental consent is required for minors in the European Union and Korea.RequireConsentForPrivacyServicesEnforces the user to specify date of birth to comply with COPPA rules. RequireConsentForMinorsRequires parental consent for ages below 18, regardless of country/region minor rules.RequireConsentForKidsRequires parental consent for ages below 14, regardless of country/region minor rules.BlockMinorsBlocks minors from using the app.' nullable: true '@odata.type': type: string microsoft.graph.homeRealmDiscoveryPolicy: allOf: - $ref: '#/components/schemas/microsoft.graph.stsPolicy' - title: homeRealmDiscoveryPolicy required: - '@odata.type' type: object properties: '@odata.type': type: string default: '#microsoft.graph.homeRealmDiscoveryPolicy' x-ms-discriminator-value: '#microsoft.graph.homeRealmDiscoveryPolicy' microsoft.graph.servicePrincipalLockConfiguration: title: servicePrincipalLockConfiguration required: - '@odata.type' type: object properties: allProperties: type: boolean description: Enables locking all sensitive properties. The sensitive properties are keyCredentials, passwordCredentials, and tokenEncryptionKeyId. nullable: true credentialsWithUsageSign: type: boolean description: Locks the keyCredentials and passwordCredentials properties for modification where credential usage type is Sign. nullable: true credentialsWithUsageVerify: type: boolean description: Locks the keyCredentials and passwordCredentials properties for modification where credential usage type is Verify. This locks OAuth service principals. nullable: true isEnabled: type: boolean description: Enables or disables service principal lock configuration. To allow the sensitive properties to be updated, update this property to false to disable the lock on the service principal. tokenEncryptionKeyId: type: boolean description: Locks the tokenEncryptionKeyId property for modification on the service principal. nullable: true '@odata.type': type: string microsoft.graph.tokenIssuancePolicy: allOf: - $ref: '#/components/schemas/microsoft.graph.stsPolicy' - title: tokenIssuancePolicy required: - '@odata.type' type: object properties: '@odata.type': type: string default: '#microsoft.graph.tokenIssuancePolicy' x-ms-discriminator-value: '#microsoft.graph.tokenIssuancePolicy' microsoft.graph.attributeMapping: title: attributeMapping required: - '@odata.type' type: object properties: defaultValue: type: string description: Default value to be used in case the source property was evaluated to null. Optional. nullable: true exportMissingReferences: type: boolean description: For internal use only. flowBehavior: $ref: '#/components/schemas/microsoft.graph.attributeFlowBehavior' flowType: $ref: '#/components/schemas/microsoft.graph.attributeFlowType' matchingPriority: maximum: 2147483647 minimum: -2147483648 type: number description: If higher than 0, this attribute will be used to perform an initial match of the objects between source and target directories. The synchronization engine will try to find the matching object using attribute with lowest value of matching priority first. If not found, the attribute with the next matching priority will be used, and so on a until match is found or no more matching attributes are left. Only attributes that are expected to have unique values, such as email, should be used as matching attributes. format: int32 source: anyOf: - $ref: '#/components/schemas/microsoft.graph.attributeMappingSource' - type: object nullable: true description: Defines how a value should be extracted (or transformed) from the source object. targetAttributeName: type: string description: Name of the attribute on the target object. nullable: true '@odata.type': type: string microsoft.graph.bulkUpload: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: bulkUpload required: - '@odata.type' type: object properties: '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.bulkUpload' microsoft.graph.groupFilter: title: groupFilter required: - '@odata.type' type: object properties: includedGroups: type: array items: type: string nullable: true '@odata.type': type: string microsoft.graph.synchronizationScheduleState: title: synchronizationScheduleState enum: - Active - Disabled - Paused type: string microsoft.graph.appRoleAssignment: allOf: - $ref: '#/components/schemas/microsoft.graph.directoryObject' - title: appRoleAssignment required: - '@odata.type' type: object properties: appRoleId: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: The identifier (id) for the app role that's assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application hasn't declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles. Required on create. format: uuid createdDateTime: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The time when the app role assignment was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. format: date-time nullable: true principalDisplayName: type: string description: The display name of the user, group, or service principal that was granted the app role assignment. Maximum length is 256 characters. Read-only. Supports $filter (eq and startswith). nullable: true principalId: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: The unique identifier (id) for the user, security group, or service principal being granted the app role. Security groups with dynamic memberships are supported. Required on create. format: uuid nullable: true principalType: type: string description: The type of the assigned principal. This can either be User, Group, or ServicePrincipal. Read-only. nullable: true resourceDisplayName: type: string description: The display name of the resource app's service principal to which the assignment is made. Maximum length is 256 characters. nullable: true resourceId: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: The unique identifier (id) for the resource service principal for which the assignment is made. Required on create. Supports $filter (eq only). format: uuid nullable: true '@odata.type': type: string default: '#microsoft.graph.appRoleAssignment' x-ms-discriminator-value: '#microsoft.graph.appRoleAssignment' microsoft.graph.certification: title: certification required: - '@odata.type' type: object properties: certificationDetailsUrl: type: string description: URL that shows certification details for the application. nullable: true readOnly: true certificationExpirationDateTime: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The timestamp when the current certification for the application expires. format: date-time nullable: true isCertifiedByMicrosoft: type: boolean description: Indicates whether the application is certified by Microsoft. nullable: true readOnly: true isPublisherAttested: type: boolean description: Indicates whether the application developer or publisher completed Publisher Attestation. nullable: true lastCertificationDateTime: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The timestamp when the certification for the application was most recently added or updated. format: date-time nullable: true '@odata.type': type: string microsoft.graph.appManagementConfiguration: title: appManagementConfiguration required: - '@odata.type' type: object properties: keyCredentials: type: array items: $ref: '#/components/schemas/microsoft.graph.keyCredentialConfiguration' description: Collection of keyCredential restrictions settings to be applied to an application or service principal. passwordCredentials: type: array items: $ref: '#/components/schemas/microsoft.graph.passwordCredentialConfiguration' description: Collection of password restrictions settings to be applied to an application or service principal. '@odata.type': type: string discriminator: propertyName: '@odata.type' mapping: '#microsoft.graph.appManagementApplicationConfiguration': '#/components/schemas/microsoft.graph.appManagementApplicationConfiguration' '#microsoft.graph.appManagementServicePrincipalConfiguration': '#/components/schemas/microsoft.graph.appManagementServicePrincipalConfiguration' '#microsoft.graph.customAppManagementConfiguration': '#/components/schemas/microsoft.graph.customAppManagementConfiguration' microsoft.graph.customSecurityAttributeValue: title: customSecurityAttributeValue required: - '@odata.type' type: object properties: '@odata.type': type: string microsoft.graph.synchronizationTaskExecutionResult: title: synchronizationTaskExecutionResult enum: - Succeeded - Failed - EntryLevelErrors type: string microsoft.graph.remoteDesktopSecurityConfiguration: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: remoteDesktopSecurityConfiguration required: - '@odata.type' type: object properties: isRemoteDesktopProtocolEnabled: type: boolean description: Determines if Microsoft Entra ID RDS authentication protocol for RDP is enabled. targetDeviceGroups: type: array items: $ref: '#/components/schemas/microsoft.graph.targetDeviceGroup' description: The collection of target device groups that are associated with the RDS security configuration that will be enabled for SSO when a client connects to the target device over RDP using the new Microsoft Entra ID RDS authentication protocol.