openapi: 3.1.0 info: title: Microsoft Graph Admin Admin.admin servicePrincipals.servicePrincipal.Functions API description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID. This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations, site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements, SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.' version: 1.0.0 contact: name: Microsoft Graph API Support url: https://developer.microsoft.com/graph servers: - url: https://graph.microsoft.com/v1.0 description: Microsoft Graph API v1.0 endpoint tags: - name: servicePrincipals.servicePrincipal.Functions x-ms-docs-toc-type: container paths: /servicePrincipals/delta(): description: Provides operations to call the delta method. x-ms-docs-grouped-path: - /servicePrincipals/delta() get: tags: - servicePrincipals.servicePrincipal.Functions summary: Microsoft Graph Invoke function delta description: Get newly created, updated, or deleted service principals without having to perform a full read of the entire resource collection. For more information, see Use delta query to track changes in Microsoft Graph data for details. externalDocs: description: Find more info here url: https://learn.microsoft.com/graph/api/serviceprincipal-delta?view=graph-rest-1.0 operationId: servicePrincipals.delta parameters: - $ref: '#/components/parameters/top' - $ref: '#/components/parameters/skip' - $ref: '#/components/parameters/search' - $ref: '#/components/parameters/filter' - $ref: '#/components/parameters/count' - name: $select in: query description: Select properties to be returned style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $orderby in: query description: Order items by property values style: form explode: false schema: uniqueItems: true type: array items: type: string - name: $expand in: query description: Expand related entities style: form explode: false schema: uniqueItems: true type: array items: type: string responses: 2XX: description: Success content: application/json: schema: title: Collection of servicePrincipal type: object allOf: - $ref: '#/components/schemas/BaseDeltaFunctionResponse' - type: object properties: value: type: array items: $ref: '#/components/schemas/microsoft.graph.servicePrincipal' 4XX: $ref: '#/components/responses/error' 5XX: $ref: '#/components/responses/error' x-ms-docs-operation-type: function x-ms-pageable: nextLinkName: '@odata.nextLink' operationName: listMore components: schemas: microsoft.graph.targetDeviceGroup: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: targetDeviceGroup required: - '@odata.type' type: object properties: displayName: type: string description: Display name for the target device group. nullable: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.targetDeviceGroup' microsoft.graph.synchronization: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: synchronization required: - '@odata.type' type: object properties: secrets: type: array items: $ref: '#/components/schemas/microsoft.graph.synchronizationSecretKeyStringValuePair' description: Represents a collection of credentials to access provisioned cloud applications. jobs: type: array items: $ref: '#/components/schemas/microsoft.graph.synchronizationJob' description: Performs synchronization by periodically running in the background, polling for changes in one directory, and pushing them to another directory. x-ms-navigationProperty: true templates: type: array items: $ref: '#/components/schemas/microsoft.graph.synchronizationTemplate' description: Preconfigured synchronization settings for a particular application. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.synchronization' microsoft.graph.objectDefinition: title: objectDefinition required: - '@odata.type' type: object properties: attributes: type: array items: $ref: '#/components/schemas/microsoft.graph.attributeDefinition' description: Defines attributes of the object. metadata: type: array items: $ref: '#/components/schemas/microsoft.graph.objectDefinitionMetadataEntry' description: Metadata for the given object. name: type: string description: Name of the object. Must be unique within a directory definition. Not nullable. nullable: true supportedApis: type: array items: type: string nullable: true description: The API that the provisioning service queries to retrieve data for synchronization. '@odata.type': type: string microsoft.graph.synchronizationTaskExecution: title: synchronizationTaskExecution required: - '@odata.type' type: object properties: activityIdentifier: type: string description: Identifier of the job run. nullable: true countEntitled: type: number description: Count of processed entries that were assigned for this application. format: int64 countEntitledForProvisioning: type: number description: Count of processed entries that were assigned for provisioning. format: int64 countEscrowed: type: number description: Count of entries that were escrowed (errors). format: int64 countEscrowedRaw: type: number description: Count of entries that were escrowed, including system-generated escrows. format: int64 countExported: type: number description: Count of exported entries. format: int64 countExports: type: number description: Count of entries that were expected to be exported. format: int64 countImported: type: number description: Count of imported entries. format: int64 countImportedDeltas: type: number description: Count of imported delta-changes. format: int64 countImportedReferenceDeltas: type: number description: Count of imported delta-changes pertaining to reference changes. format: int64 error: anyOf: - $ref: '#/components/schemas/microsoft.graph.synchronizationError' - type: object nullable: true description: If an error was encountered, contains a synchronizationError object with details. state: $ref: '#/components/schemas/microsoft.graph.synchronizationTaskExecutionResult' timeBegan: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Time when this job run began. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time timeEnded: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Time when this job run ended. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time '@odata.type': type: string microsoft.graph.appManagementRestrictionState: title: appManagementRestrictionState enum: - enabled - disabled - unknownFutureValue type: string microsoft.graph.stsPolicy: allOf: - $ref: '#/components/schemas/microsoft.graph.policyBase' - title: stsPolicy required: - '@odata.type' type: object properties: definition: type: array items: type: string description: A string collection containing a JSON string that defines the rules and settings for a policy. The syntax for the definition differs for each derived policy type. Required. isOrganizationDefault: type: boolean description: If set to true, activates this policy. There can be many policies for the same policy type, but only one can be activated as the organization default. Optional, default value is false. nullable: true appliesTo: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.stsPolicy' discriminator: propertyName: '@odata.type' mapping: '#microsoft.graph.activityBasedTimeoutPolicy': '#/components/schemas/microsoft.graph.activityBasedTimeoutPolicy' '#microsoft.graph.claimsMappingPolicy': '#/components/schemas/microsoft.graph.claimsMappingPolicy' '#microsoft.graph.homeRealmDiscoveryPolicy': '#/components/schemas/microsoft.graph.homeRealmDiscoveryPolicy' '#microsoft.graph.tokenIssuancePolicy': '#/components/schemas/microsoft.graph.tokenIssuancePolicy' '#microsoft.graph.tokenLifetimePolicy': '#/components/schemas/microsoft.graph.tokenLifetimePolicy' microsoft.graph.referencedObject: title: referencedObject required: - '@odata.type' type: object properties: referencedObjectName: type: string description: Name of the referenced object. Must match one of the objects in the directory definition. nullable: true referencedProperty: type: string description: Currently not supported. Name of the property in the referenced object, the value for which is used as the reference. nullable: true '@odata.type': type: string microsoft.graph.synchronizationSchema: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: synchronizationSchema required: - '@odata.type' type: object properties: synchronizationRules: type: array items: $ref: '#/components/schemas/microsoft.graph.synchronizationRule' description: A collection of synchronization rules configured for the synchronizationJob or synchronizationTemplate. version: type: string description: The version of the schema, updated automatically with every schema change. nullable: true directories: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryDefinition' description: Contains the collection of directories and all of their objects. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.synchronizationSchema' microsoft.graph.addIn: title: addIn required: - '@odata.type' type: object properties: id: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: The unique identifier for the addIn object. format: uuid nullable: true properties: type: array items: $ref: '#/components/schemas/microsoft.graph.keyValue' description: The collection of key-value pairs that define parameters that the consuming service can use or call. You must specify this property when performing a POST or a PATCH operation on the addIns collection. Required. type: type: string description: The unique name for the functionality exposed by the app. '@odata.type': type: string microsoft.graph.objectMappingMetadata: title: objectMappingMetadata enum: - EscrowBehavior - DisableMonitoringForChanges - OriginalJoiningProperty - Disposition - IsCustomerDefined - ExcludeFromReporting - Unsynchronized type: string microsoft.graph.synchronizationQuarantine: title: synchronizationQuarantine required: - '@odata.type' type: object properties: currentBegan: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Date and time when the quarantine was last evaluated and imposed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time error: anyOf: - $ref: '#/components/schemas/microsoft.graph.synchronizationError' - type: object nullable: true description: Describes the error(s) that occurred when putting the synchronization job into quarantine. nextAttempt: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Date and time when the next attempt to re-evaluate the quarantine will be made. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time reason: $ref: '#/components/schemas/microsoft.graph.quarantineReason' seriesBegan: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: Date and time when the quarantine was first imposed in this series (a series starts when a quarantine is first imposed, and is reset as soon as the quarantine is lifted). The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. format: date-time seriesCount: type: number description: Number of times in this series the quarantine was re-evaluated and left in effect (a series starts when quarantine is first imposed, and is reset as soon as quarantine is lifted). format: int64 '@odata.type': type: string microsoft.graph.objectDefinitionMetadata: title: objectDefinitionMetadata enum: - PropertyNameAccountEnabled - PropertyNameSoftDeleted - IsSoftDeletionSupported - IsSynchronizeAllSupported - ConnectorDataStorageRequired - Extensions - BaseObjectName type: string microsoft.graph.federatedIdentityCredential: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: federatedIdentityCredential required: - '@odata.type' type: object properties: audiences: type: array items: type: string description: The audience that can appear in the external token. This field is mandatory and should be set to api://AzureADTokenExchange for Microsoft Entra ID. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Microsoft Entra ID in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your identity provider to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters. Required. description: type: string description: The unvalidated description of the federated identity credential, provided by the user. It has a limit of 600 characters. Optional. nullable: true issuer: type: string description: The URL of the external identity provider, which must match the issuer claim of the external token being exchanged. The combination of the values of issuer and subject must be unique within the app. It has a limit of 600 characters. Required. name: type: string description: The unique identifier for the federated identity credential, which has a limit of 120 characters and must be URL friendly. The string is immutable after it's created. Alternate key. Required. Not nullable. Supports $filter (eq). subject: type: string description: Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format; each identity provider uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Microsoft Entra ID. The combination of issuer and subject must be unique within the app. It has a limit of 600 characters. Supports $filter (eq). '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.federatedIdentityCredential' microsoft.graph.customAppManagementConfiguration: allOf: - $ref: '#/components/schemas/microsoft.graph.appManagementConfiguration' - title: customAppManagementConfiguration required: - '@odata.type' type: object properties: '@odata.type': type: string default: '#microsoft.graph.customAppManagementConfiguration' x-ms-discriminator-value: '#microsoft.graph.customAppManagementConfiguration' microsoft.graph.delegatedPermissionClassification: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: delegatedPermissionClassification required: - '@odata.type' type: object properties: classification: anyOf: - $ref: '#/components/schemas/microsoft.graph.permissionClassificationType' - type: object nullable: true description: 'The classification value. Possible values: low, medium (preview), high (preview). Doesn''t support $filter.' permissionId: type: string description: The unique identifier (id) for the delegated permission listed in the oauth2PermissionScopes collection of the servicePrincipal. Required on create. Doesn't support $filter. nullable: true permissionName: type: string description: The claim value (value) for the delegated permission listed in the oauth2PermissionScopes collection of the servicePrincipal. Doesn't support $filter. nullable: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.delegatedPermissionClassification' microsoft.graph.filterOperand: title: filterOperand required: - '@odata.type' type: object properties: values: type: array items: type: string nullable: true description: Collection of values. '@odata.type': type: string microsoft.graph.synchronizationStatusCode: title: synchronizationStatusCode enum: - NotConfigured - NotRun - Active - Paused - Quarantine type: string microsoft.graph.synchronizationTemplate: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: synchronizationTemplate required: - '@odata.type' type: object properties: applicationId: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: Identifier of the application this template belongs to. format: uuid default: type: boolean description: true if this template is recommended to be the default for the application. description: type: string description: Description of the template. nullable: true discoverable: type: boolean description: true if this template should appear in the collection of templates available for the application instance (service principal). factoryTag: type: string description: One of the well-known factory tags supported by the synchronization engine. The factoryTag tells the synchronization engine which implementation to use when processing jobs based on this template. nullable: true metadata: type: array items: $ref: '#/components/schemas/microsoft.graph.synchronizationMetadataEntry' description: Additional extension properties. Unless mentioned explicitly, metadata values should not be changed. schema: anyOf: - $ref: '#/components/schemas/microsoft.graph.synchronizationSchema' - type: object nullable: true description: Default synchronization schema for the jobs based on this template. x-ms-navigationProperty: true '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.synchronizationTemplate' microsoft.graph.appManagementPolicy: allOf: - $ref: '#/components/schemas/microsoft.graph.policyBase' - title: appManagementPolicy required: - '@odata.type' type: object properties: isEnabled: type: boolean description: Denotes whether the policy is enabled. restrictions: anyOf: - $ref: '#/components/schemas/microsoft.graph.customAppManagementConfiguration' - type: object nullable: true description: Restrictions that apply to an application or service principal object. appliesTo: type: array items: $ref: '#/components/schemas/microsoft.graph.directoryObject' description: Collection of applications and service principals to which the policy is applied. x-ms-navigationProperty: true '@odata.type': type: string default: '#microsoft.graph.appManagementPolicy' x-ms-discriminator-value: '#microsoft.graph.appManagementPolicy' microsoft.graph.permissionScope: title: permissionScope required: - '@odata.type' type: object properties: adminConsentDescription: type: string description: A description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences. nullable: true adminConsentDisplayName: type: string description: The permission's title, intended to be read by an administrator granting the permission on behalf of all users. nullable: true id: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: Unique delegated permission identifier inside the collection of delegated permissions defined for a resource application. format: uuid isEnabled: type: boolean description: When you create or update a permission, this property must be set to true (which is the default). To delete a permission, this property must first be set to false. At that point, in a subsequent call, the permission may be removed. origin: type: string nullable: true type: type: string description: 'The possible values are: User and Admin. Specifies whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator consent should always be required. While Microsoft Graph defines the default consent requirement for each permission, the tenant administrator may override the behavior in their organization (by allowing, restricting, or limiting user consent to this delegated permission). For more information, see Configure how users consent to applications.' nullable: true userConsentDescription: type: string description: A description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves. nullable: true userConsentDisplayName: type: string description: A title for the permission, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves. nullable: true value: type: string description: 'Specifies the value to include in the scp (scope) claim in access tokens. Must not exceed 120 characters in length. Allowed characters are : ! # $ % & '' ( ) * + , - . / : ; = ? @ [ ] ^ + _ { } ~, and characters in the ranges 0-9, A-Z and a-z. Any other character, including the space character, aren''t allowed. May not begin with ..' nullable: true '@odata.type': type: string microsoft.graph.attributeFlowType: title: attributeFlowType enum: - Always - ObjectAddOnly - MultiValueAddOnly - ValueAddOnly - AttributeAddOnly type: string microsoft.graph.homeRealmDiscoveryPolicy: allOf: - $ref: '#/components/schemas/microsoft.graph.stsPolicy' - title: homeRealmDiscoveryPolicy required: - '@odata.type' type: object properties: '@odata.type': type: string default: '#microsoft.graph.homeRealmDiscoveryPolicy' x-ms-discriminator-value: '#microsoft.graph.homeRealmDiscoveryPolicy' microsoft.graph.tokenIssuancePolicy: allOf: - $ref: '#/components/schemas/microsoft.graph.stsPolicy' - title: tokenIssuancePolicy required: - '@odata.type' type: object properties: '@odata.type': type: string default: '#microsoft.graph.tokenIssuancePolicy' x-ms-discriminator-value: '#microsoft.graph.tokenIssuancePolicy' microsoft.graph.attributeMapping: title: attributeMapping required: - '@odata.type' type: object properties: defaultValue: type: string description: Default value to be used in case the source property was evaluated to null. Optional. nullable: true exportMissingReferences: type: boolean description: For internal use only. flowBehavior: $ref: '#/components/schemas/microsoft.graph.attributeFlowBehavior' flowType: $ref: '#/components/schemas/microsoft.graph.attributeFlowType' matchingPriority: maximum: 2147483647 minimum: -2147483648 type: number description: If higher than 0, this attribute will be used to perform an initial match of the objects between source and target directories. The synchronization engine will try to find the matching object using attribute with lowest value of matching priority first. If not found, the attribute with the next matching priority will be used, and so on a until match is found or no more matching attributes are left. Only attributes that are expected to have unique values, such as email, should be used as matching attributes. format: int32 source: anyOf: - $ref: '#/components/schemas/microsoft.graph.attributeMappingSource' - type: object nullable: true description: Defines how a value should be extracted (or transformed) from the source object. targetAttributeName: type: string description: Name of the attribute on the target object. nullable: true '@odata.type': type: string microsoft.graph.bulkUpload: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: bulkUpload required: - '@odata.type' type: object properties: '@odata.type': type: string x-ms-discriminator-value: '#microsoft.graph.bulkUpload' microsoft.graph.groupFilter: title: groupFilter required: - '@odata.type' type: object properties: includedGroups: type: array items: type: string nullable: true '@odata.type': type: string microsoft.graph.synchronizationScheduleState: title: synchronizationScheduleState enum: - Active - Disabled - Paused type: string microsoft.graph.appRoleAssignment: allOf: - $ref: '#/components/schemas/microsoft.graph.directoryObject' - title: appRoleAssignment required: - '@odata.type' type: object properties: appRoleId: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: The identifier (id) for the app role that's assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application hasn't declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles. Required on create. format: uuid createdDateTime: pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$ type: string description: The time when the app role assignment was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. format: date-time nullable: true principalDisplayName: type: string description: The display name of the user, group, or service principal that was granted the app role assignment. Maximum length is 256 characters. Read-only. Supports $filter (eq and startswith). nullable: true principalId: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: The unique identifier (id) for the user, security group, or service principal being granted the app role. Security groups with dynamic memberships are supported. Required on create. format: uuid nullable: true principalType: type: string description: The type of the assigned principal. This can either be User, Group, or ServicePrincipal. Read-only. nullable: true resourceDisplayName: type: string description: The display name of the resource app's service principal to which the assignment is made. Maximum length is 256 characters. nullable: true resourceId: pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ type: string description: The unique identifier (id) for the resource service principal for which the assignment is made. Required on create. Supports $filter (eq only). format: uuid nullable: true '@odata.type': type: string default: '#microsoft.graph.appRoleAssignment' x-ms-discriminator-value: '#microsoft.graph.appRoleAssignment' microsoft.graph.appManagementConfiguration: title: appManagementConfiguration required: - '@odata.type' type: object properties: keyCredentials: type: array items: $ref: '#/components/schemas/microsoft.graph.keyCredentialConfiguration' description: Collection of keyCredential restrictions settings to be applied to an application or service principal. passwordCredentials: type: array items: $ref: '#/components/schemas/microsoft.graph.passwordCredentialConfiguration' description: Collection of password restrictions settings to be applied to an application or service principal. '@odata.type': type: string discriminator: propertyName: '@odata.type' mapping: '#microsoft.graph.appManagementApplicationConfiguration': '#/components/schemas/microsoft.graph.appManagementApplicationConfiguration' '#microsoft.graph.appManagementServicePrincipalConfiguration': '#/components/schemas/microsoft.graph.appManagementServicePrincipalConfiguration' '#microsoft.graph.customAppManagementConfiguration': '#/components/schemas/microsoft.graph.customAppManagementConfiguration' microsoft.graph.customSecurityAttributeValue: title: customSecurityAttributeValue required: - '@odata.type' type: object properties: '@odata.type': type: string microsoft.graph.synchronizationTaskExecutionResult: title: synchronizationTaskExecutionResult enum: - Succeeded - Failed - EntryLevelErrors type: string microsoft.graph.remoteDesktopSecurityConfiguration: allOf: - $ref: '#/components/schemas/microsoft.graph.entity' - title: remoteDesktopSecurityConfiguration required: - '@odata.type' type: object properties: isRemoteDesktopProtocolEnabled: type: boolean description: Determines if Microsoft Entra ID RDS authentication protocol for RDP is enabled. targetDeviceGroups: type: array items: $ref: '#/components/schemas/microsoft.graph.targetDeviceGroup' description: The collection of target device groups that are associated with the RDS security configuration that will be enabled for SSO when a client connects to the target device over RDP using the new Microsoft Entra ID RDS authentication protocol.