Microsoft Entra ID (formerly Azure AD)

Microsoft Entra ID (formerly Azure AD) Policies.authentication Strength Policy API

The policies.authenticationStrengthPolicy API from Microsoft Entra ID (formerly Azure AD) — 8 operation(s) for policies.authenticationstrengthpolicy.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 14

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /policies/authenticationStrengthPolicies List authentication strength policies · List authenticationStrengthPolicies #
Ask an LLM
“Which authentication strengths, built-in and custom, are available in my tenant?”
“How do I see all the MFA strength policies I can use in Conditional Access?”
Tell an agent
List all authentication strength policies.
Show authentication strength policies matching {filter}.
POST /policies/authenticationStrengthPolicies Create a custom authentication strength · Create authenticationStrengthPolicy #
Ask an LLM
“How do I define a custom authentication strength that only allows phishing-resistant methods?”
“What do I need to create my own authentication strength policy?”
Tell an agent
Create a custom authentication strength named {displayName} allowing {allowedCombinations}.
Add a new authentication strength {displayName} described as {description}.
GET /policies/authenticationStrengthPolicies/{authenticationStrengthPolicy-id} Get an authentication strength policy · Get authenticationStrengthPolicy #
Ask an LLM
“Which method combinations does a specific authentication strength allow?”
“How do I look up one authentication strength policy by ID?”
Tell an agent
Get authentication strength policy {policy}.
Show the allowed method combinations of strength {policy}.
PATCH /policies/authenticationStrengthPolicies/{authenticationStrengthPolicy-id} Update an authentication strength's name or description · Update authenticationStrengthPolicy #
Ask an LLM
“How do I rename a custom authentication strength?”
“Can I change an authentication strength's description without touching its allowed combinations?”
Tell an agent
Rename authentication strength {policy} to {displayName}.
Change the description of authentication strength {policy} to {description}.
DELETE /policies/authenticationStrengthPolicies/{authenticationStrengthPolicy-id} Delete a custom authentication strength · Delete authenticationStrengthPolicy #
Ask an LLM
“How do I delete a custom authentication strength I created?”
“Can I remove an authentication strength policy by ID?”
Tell an agent destructive · confirm first
Delete custom authentication strength {policy}.
Remove authentication strength policy {policy}.
GET /policies/authenticationStrengthPolicies/{authenticationStrengthPolicy-id}/combinationConfigurations List combination configurations of a strength · Get combinationConfigurations from policies #
Ask an LLM
“What extra restrictions, like specific FIDO2 key models, are set on an authentication strength?”
“How do I list the combination configurations attached to a strength policy?”
Tell an agent
List combination configurations on authentication strength {policy}.
Show the method-specific restrictions set on strength {policy}.
POST /policies/authenticationStrengthPolicies/{authenticationStrengthPolicy-id}/combinationConfigurations Add a combination configuration to a strength · Create new navigation property to combinationConfigurations for policies #
Ask an LLM
“How do I require a specific kind of authenticator for one combination in an authentication strength?”
“Can I add a combination configuration that applies to certain method combinations?”
Tell an agent
Add a combination configuration to strength {policy} that applies to {appliesToCombinations}.
Create a new method restriction on authentication strength {policy}.
GET /policies/authenticationStrengthPolicies/{authenticationStrengthPolicy-id}/combinationConfigurations/{authenticationCombinationConfiguration-id} Get one combination configuration of a strength · Get combinationConfigurations from policies #
Ask an LLM
“How do I read a single combination configuration on an authentication strength?”
“Which combinations does a specific combination configuration apply to?”
Tell an agent
Get combination configuration {config} on strength {policy}.
Show what restriction {config} of strength {policy} enforces.
PATCH /policies/authenticationStrengthPolicies/{authenticationStrengthPolicy-id}/combinationConfigurations/{authenticationCombinationConfiguration-id} Update a combination configuration on a strength · Update the navigation property combinationConfigurations in policies #
Ask an LLM
“How do I change which combinations an existing combination configuration applies to?”
“Can I edit a method restriction on an authentication strength after creating it?”
Tell an agent
Make combination configuration {config} on strength {policy} apply to {appliesToCombinations}.
Update restriction {config} of authentication strength {policy}.
DELETE /policies/authenticationStrengthPolicies/{authenticationStrengthPolicy-id}/combinationConfigurations/{authenticationCombinationConfiguration-id} Remove a combination configuration from a strength · Delete navigation property combinationConfigurations for policies #
Ask an LLM
“How do I drop a method restriction from an authentication strength?”
“Can I delete one combination configuration without deleting the whole strength?”
Tell an agent destructive · confirm first
Delete combination configuration {config} from strength {policy}.
Remove restriction {config} on authentication strength {policy}.
GET /policies/authenticationStrengthPolicies/{authenticationStrengthPolicy-id}/combinationConfigurations/$count Count combination configurations on a strength · Get the number of the resource #
Ask an LLM
“How many combination configurations does an authentication strength have?”
“What's the number of method restrictions set on a strength policy?”
Tell an agent
Count combination configurations on strength {policy}.
Tell me how many method restrictions authentication strength {policy} has.
POST /policies/authenticationStrengthPolicies/{authenticationStrengthPolicy-id}/microsoft.graph.updateAllowedCombinations Change the allowed method combinations of a strength · Invoke action updateAllowedCombinations #
Ask an LLM
“How do I change which MFA method combinations satisfy an authentication strength?”
“Why can't I update allowed combinations with a normal update, and what do I call instead?”
Tell an agent
Set the allowed combinations of authentication strength {policy} to {allowedCombinations}.
Allow only {allowedCombinations} to satisfy strength {policy}.
GET /policies/authenticationStrengthPolicies/{authenticationStrengthPolicy-id}/microsoft.graph.usage() See which Conditional Access policies use a strength · Invoke function usage #
Ask an LLM
“Which Conditional Access policies reference a given authentication strength?”
“Is it safe to delete this authentication strength, or is a Conditional Access policy still using it?”
Tell an agent
Show the Conditional Access policies that use authentication strength {policy}.
Check where strength {policy} is referenced in Conditional Access.
GET /policies/authenticationStrengthPolicies/$count Count authentication strength policies · Get the number of the resource #
Ask an LLM
“How many authentication strength policies exist in my tenant?”
“What's the total of built-in plus custom authentication strengths?”
Tell an agent
Count the authentication strength policies.
Tell me how many authentication strengths are defined.

Documentation

📖
Documentation
https://learn.microsoft.com/en-us/graph/api/overview
📖
Authentication
https://learn.microsoft.com/en-us/graph/auth/
📖
Documentation
https://learn.microsoft.com/en-us/graph/change-notifications-overview

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-policies-authenticationstrengthpolicy-api-openapi.yml

Other Resources

🔗
SDKs
https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
🔗
ChangeLog
https://developer.microsoft.com/en-us/graph/changelog
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/asyncapi/azure-ad-change-notifications-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/azure-ad:azure-ad-policies-authenticationstrengthpolicy-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

azure-ad-policies-authenticationstrengthpolicy-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Identity.SignIns Policies.authentication Strength Policy API
  version: v1.0
servers:
- url: https://graph.microsoft.com/v1.0/
  description: Core
security:
- azureaadv2: []
tags:


# --- truncated at 32 KB (49 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-policies-authenticationstrengthpolicy-api-openapi.yml