openapi: 3.1.0
info:
  title: Microsoft Graph Admin Admin.admin Audit Logs Sign Ins API
  description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.

    This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,

    site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,

    SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
  version: 1.0.0
  contact:
    name: Microsoft Graph API Support
    url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph API v1.0 endpoint
tags:
- name: Audit Logs Sign Ins
  description: Operations for accessing audit log data
paths:
  /auditLogs/signIns:
    description: Provides operations to manage the signIns property of the microsoft.graph.auditLogRoot entity.
    get:
      tags:
      - Audit Logs Sign Ins
      summary: Microsoft Graph List signIns
      description: Retrieve the Microsoft Entra user sign-ins for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.  The maximum and default page size is 1,000 objects and by default, the most recent sign-ins are returned first. Only sign-in events that occurred within the Microsoft Entra ID default retention period are available.
      operationId: listAuditLogsSignIns
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/signin-list?view=graph-rest-1.0
      parameters:
      - $ref: '#/components/parameters/Top'
      - $ref: '#/components/parameters/Skip'
      - $ref: '#/components/parameters/Search'
      - $ref: '#/components/parameters/Filter'
      - $ref: '#/components/parameters/Count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/SignInCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-microcks-operation:
        delay: 100
        dispatcher: FALLBACK
        dispatcherRules: 2XX
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
    post:
      tags:
      - Audit Logs Sign Ins
      summary: Microsoft Graph Create Sign Ins
      description: Performs POST operation on /auditLogs/signIns
      operationId: createAuditLogsSignIns
      requestBody:
        description: New navigation property
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignIn'
            examples:
              SignInRequestExample:
                $ref: '#/components/examples/SignInRequestExample'
        required: true
      responses:
        2XX:
          description: Created navigation property.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignIn'
              examples:
                SignInExample:
                  $ref: '#/components/examples/SignInExample'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-microcks-operation:
        delay: 100
        dispatcher: FALLBACK
        dispatcherRules: 2XX
      x-ms-docs-operation-type: operation
  /auditLogs/signIns/{signIn-id}:
    description: Provides operations to manage the signIns property of the microsoft.graph.auditLogRoot entity.
    parameters:
    - name: signIn-id
      in: path
      description: The unique identifier of signIn
      required: true
      schema:
        type: string
      x-ms-docs-key-type: signIn
    get:
      tags:
      - Audit Logs Sign Ins
      summary: Microsoft Graph Get signIn
      description: Retrieve a specific Microsoft Entra user sign-in event for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.
      operationId: getAuditLogsSignIns
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/signin-get?view=graph-rest-1.0
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignIn'
              examples:
                SignInExample:
                  $ref: '#/components/examples/SignInExample'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-microcks-operation:
        delay: 100
        dispatcher: FALLBACK
        dispatcherRules: 2XX
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - Audit Logs Sign Ins
      summary: Microsoft Graph Update Sign Ins
      description: Performs PATCH operation on /auditLogs/signIns/{signIn-id}
      operationId: updateAuditLogsSignIns
      requestBody:
        description: New navigation property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignIn'
            examples:
              SignInRequestExample:
                $ref: '#/components/examples/SignInRequestExample'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignIn'
              examples:
                SignInExample:
                  $ref: '#/components/examples/SignInExample'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-microcks-operation:
        delay: 100
        dispatcher: FALLBACK
        dispatcherRules: 2XX
      x-ms-docs-operation-type: operation
    delete:
      tags:
      - Audit Logs Sign Ins
      summary: Microsoft Graph Delete Sign Ins
      description: Performs DELETE operation on /auditLogs/signIns/{signIn-id}
      operationId: deleteAuditLogsSignIns
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-microcks-operation:
        delay: 100
        dispatcher: FALLBACK
        dispatcherRules: '204'
      x-ms-docs-operation-type: operation
  /auditLogs/signIns/$count:
    description: Provides operations to count the resources in the collection.
    get:
      tags:
      - Audit Logs Sign Ins
      summary: Microsoft Graph Get the number of the resource
      description: Performs GET operation on /auditLogs/signIns/$count
      operationId: countAuditLogsSignIns
      parameters:
      - $ref: '#/components/parameters/Search'
      - $ref: '#/components/parameters/Filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-microcks-operation:
        delay: 100
        dispatcher: FALLBACK
        dispatcherRules: 2XX
  /auditLogs/signIns/confirmCompromised:
    description: Provides operations to call the confirmCompromised method.
    post:
      tags:
      - Audit Logs Sign Ins
      summary: Microsoft Graph Create Confirm Compromised
      description: Mark an event in the Microsoft Entra sign-in logs as risky. Events marked as risky by an admin are immediately flagged as high risk in Microsoft Entra ID Protection, overriding previous risk states. Admins can confirm that events flagged as risky by Microsoft Entra ID Protection are in fact risky. For details about investigating Identity Protection risks, see How to investigate risk.
      operationId: confirmCompromisedAuditLogsSignIns
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/signin-confirmcompromised?view=graph-rest-1.0
      requestBody:
        description: Action parameters
        content:
          application/json:
            schema:
              type: object
              properties:
                requestIds:
                  type: array
                  items:
                    type: string
                    nullable: true
            examples:
              confirmCompromisedAuditLogsSignInsRequestExample:
                $ref: '#/components/examples/confirmCompromisedAuditLogsSignInsRequestExample'
        required: true
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-microcks-operation:
        delay: 100
        dispatcher: FALLBACK
        dispatcherRules: '204'
      x-ms-docs-operation-type: action
  /auditLogs/signIns/confirmSafe:
    description: Provides operations to call the confirmSafe method.
    post:
      tags:
      - Audit Logs Sign Ins
      summary: Microsoft Graph Create Confirm Safe
      description: Mark an event in Microsoft Entra sign-in logs as safe. Admins can either mark the events flagged as risky by Microsoft Entra ID Protection as safe, or they can mark unflagged events as safe. For details about investigating Identity Protection risks, see How to investigate risk.
      operationId: confirmSafeAuditLogsSignIns
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/signin-confirmsafe?view=graph-rest-1.0
      requestBody:
        description: Action parameters
        content:
          application/json:
            schema:
              type: object
              properties:
                requestIds:
                  type: array
                  items:
                    type: string
                    nullable: true
            examples:
              confirmSafeAuditLogsSignInsRequestExample:
                $ref: '#/components/examples/confirmSafeAuditLogsSignInsRequestExample'
        required: true
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-microcks-operation:
        delay: 100
        dispatcher: FALLBACK
        dispatcherRules: '204'
      x-ms-docs-operation-type: action
  /auditLogs/signIns/dismiss:
    description: Provides operations to call the dismiss method.
    post:
      tags:
      - Audit Logs Sign Ins
      summary: Microsoft Graph Create Dismiss
      description: Mark an event in Microsoft Entra sign-in logs as dismissed. For details about investigating Identity Protection risks, see How to investigate risk.
      operationId: dismissAuditLogsSignIns
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/signin-dismiss?view=graph-rest-1.0
      requestBody:
        description: Action parameters
        content:
          application/json:
            schema:
              type: object
              properties:
                requestIds:
                  type: array
                  items:
                    type: string
                    nullable: true
            examples:
              dismissAuditLogsSignInsRequestExample:
                $ref: '#/components/examples/dismissAuditLogsSignInsRequestExample'
        required: true
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-microcks-operation:
        delay: 100
        dispatcher: FALLBACK
        dispatcherRules: '204'
      x-ms-docs-operation-type: action
components:
  responses:
    ODataCountResponse:
      description: The count of the resource
      content:
        text/plain:
          schema:
            $ref: '#/components/schemas/ODataCountResponse'
          examples:
            ODataCountResponseExample:
              $ref: '#/components/examples/ODataCountResponseExample'
    SignInCollectionResponse:
      description: Retrieved collection
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/SignInCollectionResponse'
    error:
      description: error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
          examples:
            ODataErrorExample:
              $ref: '#/components/examples/ODataErrorExample'
  schemas:
    ErrorDetail:
      title: ErrorDetail
      type: object
      required:
      - code
      - message
      properties:
        code:
          type: string
        message:
          type: string
        target:
          type: string
          nullable: true
    MainError:
      title: MainError
      type: object
      required:
      - code
      - message
      properties:
        code:
          type: string
          description: Error code
        message:
          type: string
          description: Error message
        target:
          type: string
          description: Target of the error
          nullable: true
        details:
          type: array
          items:
            $ref: '#/components/schemas/ErrorDetail'
        innerError:
          $ref: '#/components/schemas/InnerError'
    InnerError:
      title: InnerError
      type: object
      properties:
        request-id:
          type: string
        date:
          type: string
          format: date-time
        client-request-id:
          type: string
    Entity:
      title: Entity
      type: object
      properties:
        id:
          type: string
          description: The unique identifier for the entity.
    SignIn:
      allOf:
      - $ref: '#/components/schemas/Entity'
      - title: signIn
        required:
        - '@odata.type'
        type: object
        properties:
          appDisplayName:
            type: string
            description: App name displayed in the Microsoft Entra admin center.  Supports $filter (eq, startsWith).
            nullable: true
          appId:
            type: string
            description: Unique GUID that represents the app ID in the Microsoft Entra ID.  Supports $filter (eq).
            nullable: true
          appliedConditionalAccessPolicies:
            type: array
            items:
              $ref: '#/components/schemas/AppliedConditionalAccessPolicy'
            description: Provides a list of conditional access policies that the corresponding sign-in activity triggers. Apps need more Conditional Access-related privileges to read the details of this property. For more information, see Permissions for viewing applied conditional access (CA) policies in sign-ins.
          clientAppUsed:
            type: string
            description: Identifies the client used for the sign-in activity. Modern authentication clients include Browser, modern clients. Legacy authentication clients include Exchange ActiveSync, IMAP, MAPI, SMTP, POP, and other clients.  Supports $filter (eq).
            nullable: true
          conditionalAccessStatus:
            anyOf:
            - $ref: '#/components/schemas/ConditionalAccessStatus'
            - type: object
              nullable: true
            description: 'Reports status of an activated conditional access policy. The possible values are: success, failure, notApplied, and unknownFutureValue.  Supports $filter (eq).'
          correlationId:
            type: string
            description: The request ID sent from the client when the sign-in is initiated. Used to troubleshoot sign-in activity.  Supports $filter (eq).
            nullable: true
          createdDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: 'Date and time (UTC) the sign-in was initiated. Example: midnight on Jan 1, 2014 is reported as 2014-01-01T00:00:00Z.  Supports $orderby, $filter (eq, le, and ge).'
            format: date-time
          deviceDetail:
            anyOf:
            - $ref: '#/components/schemas/DeviceDetail'
            - type: object
              nullable: true
            description: Device information from where the sign-in occurred; includes device ID, operating system, and browser.  Supports $filter (eq, startsWith) on browser and operatingSytem properties.
          ipAddress:
            type: string
            description: IP address of the client used to sign in.  Supports $filter (eq, startsWith).
            nullable: true
          isInteractive:
            type: boolean
            description: Indicates whether a sign-in is interactive.
            nullable: true
          location:
            anyOf:
            - $ref: '#/components/schemas/SignInLocation'
            - type: object
              nullable: true
            description: Provides the city, state, and country code where the sign-in originated.  Supports $filter (eq, startsWith) on city, state, and countryOrRegion properties.
          resourceDisplayName:
            type: string
            description: Name of the resource the user signed into.  Supports $filter (eq).
            nullable: true
          resourceId:
            type: string
            description: ID of the resource that the user signed into.  Supports $filter (eq).
            nullable: true
          riskDetail:
            anyOf:
            - $ref: '#/components/schemas/RiskDetail'
            - type: object
              nullable: true
            description: 'The reason behind a specific state of a risky user, sign-in, or a risk event. The value none means that Microsoft Entra risk detection did not flag the user or the sign-in as a risky event so far.  Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.'
          riskEventTypes:
            type: array
            items:
              anyOf:
              - $ref: '#/components/schemas/RiskEventType'
              - type: object
                nullable: true
          riskEventTypes_v2:
            type: array
            items:
              type: string
              nullable: true
            description: 'The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic, or unknownFutureValue.  Supports $filter (eq, startsWith).'
          riskLevelAggregated:
            anyOf:
            - $ref: '#/components/schemas/RiskLevel'
            - type: object
              nullable: true
            description: 'Aggregated risk level. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn''t enabled for Microsoft Entra ID Protection.  Supports $filter (eq).  Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.'
          riskLevelDuringSignIn:
            anyOf:
            - $ref: '#/components/schemas/RiskLevel'
            - type: object
              nullable: true
            description: 'Risk level during sign-in. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn''t enabled for Microsoft Entra ID Protection.  Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.'
          riskState:
            anyOf:
            - $ref: '#/components/schemas/RiskState'
            - type: object
              nullable: true
            description: 'Reports status of the risky user, sign-in, or a risk event. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.  Supports $filter (eq).'
          status:
            anyOf:
            - $ref: '#/components/schemas/SignInStatus'
            - type: object
              nullable: true
            description: Sign-in status. Includes the error code and description of the error (if a sign-in failure occurs).  Supports $filter (eq) on errorCode property.
          userDisplayName:
            type: string
            description: Display name of the user that initiated the sign-in.  Supports $filter (eq, startsWith).
            nullable: true
          userId:
            type: string
            description: ID of the user that initiated the sign-in.  Supports $filter (eq).
          userPrincipalName:
            type: string
            description: 'User principal name of the user that initiated the sign-in. This value is always in lowercase. For guest users whose values in the user object typically contain #EXT# before the domain part, this property stores the value in both lowercase and the ''true'' format. For example, while the user object stores AdeleVance_fabrikam.com#EXT#@contoso.com, the sign-in logs store adelevance@fabrikam.com. Supports $filter (eq, startsWith).'
            nullable: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.signIn'
    ODataCountResponse:
      title: ODataCountResponse
      type: integer
      format: int32
      description: The count of entities
    ODataError:
      title: ODataError
      type: object
      required:
      - error
      properties:
        error:
          $ref: '#/components/schemas/MainError'
  parameters:
    Filter:
      name: $filter
      in: query
      description: Filter items by property values
      style: form
      explode: false
      schema:
        type: string
    Top:
      name: $top
      in: query
      description: Show only the first n items
      style: form
      explode: false
      schema:
        minimum: 0
        type: integer
      example: 50
    Skip:
      name: $skip
      in: query
      description: Skip the first n items
      style: form
      explode: false
      schema:
        minimum: 0
        type: integer
    Count:
      name: $count
      in: query
      description: Include count of items
      style: form
      explode: false
      schema:
        type: boolean
    Search:
      name: $search
      in: query
      description: Search items by search phrases
      style: form
      explode: false
      schema:
        type: string
  examples:
    SignInRequestExample:
      value:
        id: 00000000-0000-0000-0000-000000000001
        appDisplayName: Example Display Name
        appId: 00000000-0000-0000-0000-000000000001
        appliedConditionalAccessPolicies:
        - {}
        clientAppUsed: string-value
        conditionalAccessStatus: {}
        correlationId: 00000000-0000-0000-0000-000000000001
        '@odata.type': '#microsoft.graph.signin'
    confirmSafeAuditLogsSignInsRequestExample:
      value:
        requestIds:
        - 00000000-0000-0000-0000-000000000001
    ODataCountResponseExample:
      value: 42
    dismissAuditLogsSignInsRequestExample:
      value:
        requestIds:
        - 00000000-0000-0000-0000-000000000001
    confirmCompromisedAuditLogsSignInsRequestExample:
      value:
        requestIds:
        - 00000000-0000-0000-0000-000000000001
    ODataErrorExample:
      value:
        error:
          code: BadRequest
          message: The request is invalid.
          target: /resource
          details:
          - code: InvalidParameter
            message: Parameter value is invalid.
            target: parameterName
          innerError:
            request-id: 00000000-0000-0000-0000-000000000001
            date: '2024-01-15T10:30:00Z'
            client-request-id: 00000000-0000-0000-0000-000000000002
    SignInExample:
      value:
        id: 00000000-0000-0000-0000-000000000001
        appDisplayName: Example Display Name
        appId: 00000000-0000-0000-0000-000000000001
        appliedConditionalAccessPolicies:
        - {}
        clientAppUsed: string-value
        conditionalAccessStatus: {}
        correlationId: 00000000-0000-0000-0000-000000000001
        '@odata.type': '#microsoft.graph.signin'