Microsoft Graph auditLogs.auditLogRoot API

openapi: 3.2.0
info:
  title: Microsoft Graph Admin Admin.admin Audit Logs.audit Log Root API
  description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.

    This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,

    site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,

    SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
  version: 1.0.0
  contact:
    name: Microsoft Graph API Support
    url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph API v1.0 endpoint
tags:
- name: auditLogs.auditLogRoot
  x-ms-docs-toc-type: page
paths:
  /auditLogs:
    description: Provides operations to manage the auditLogRoot singleton.
    get:
      tags:
      - auditLogs.auditLogRoot
      summary: Microsoft Graph Get auditLogs
      operationId: auditLogs.auditLogRoot.GetAuditLogRoot
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved entity
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.auditLogRoot'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - auditLogs.auditLogRoot
      summary: Microsoft Graph Update auditLogs
      operationId: auditLogs.auditLogRoot.UpdateAuditLogRoot
      requestBody:
        description: New property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.auditLogRoot'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.auditLogRoot'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
components:
  schemas:
    microsoft.graph.ODataErrors.ErrorDetails:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        target:
          type: string
          nullable: true
    microsoft.graph.targetResource:
      title: targetResource
      required:
      - '@odata.type'
      type: object
      properties:
        displayName:
          type: string
          description: Indicates the visible name defined for the resource. Typically specified when the resource is created.
          nullable: true
        groupType:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.groupType'
          - type: object
            nullable: true
          description: 'When type is set to Group, this indicates the group type. The possible values are: unifiedGroups, azureAD, and unknownFutureValue'
        id:
          type: string
          description: Indicates the unique ID of the resource.
          nullable: true
        modifiedProperties:
          type: array
          items:
            $ref: '#/components/schemas/microsoft.graph.modifiedProperty'
          description: Indicates name, old value and new value of each attribute that changed. Property values depend on the operation type.
        type:
          type: string
          description: Describes the resource type.  Example values include Application, Group, ServicePrincipal, and User.
          nullable: true
        userPrincipalName:
          type: string
          description: When type is set to User, this includes the user name that initiated the action; null for other types.
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.provisioningAction:
      title: provisioningAction
      enum:
      - other
      - create
      - delete
      - disable
      - update
      - stagedDelete
      - unknownFutureValue
      type: string
    microsoft.graph.provisioningServicePrincipal:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.identity'
      - title: provisioningServicePrincipal
        required:
        - '@odata.type'
        type: object
        properties:
          '@odata.type':
            type: string
            default: '#microsoft.graph.provisioningServicePrincipal'
      x-ms-discriminator-value: '#microsoft.graph.provisioningServicePrincipal'
    microsoft.graph.provisioningObjectSummary:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: provisioningObjectSummary
        required:
        - '@odata.type'
        type: object
        properties:
          activityDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: Represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.  SUpports $filter (eq, gt, lt) and orderby.
            format: date-time
          changeId:
            type: string
            description: Unique ID of this change in this cycle. Supports $filter (eq, contains).
            nullable: true
          cycleId:
            type: string
            description: Unique ID per job iteration. Supports $filter (eq, contains).
            nullable: true
          durationInMilliseconds:
            maximum: 2147483647
            minimum: -2147483648
            type: number
            description: Indicates how long this provisioning action took to finish. Measured in milliseconds.
            format: int32
            nullable: true
          initiatedBy:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.initiator'
            - type: object
              nullable: true
            description: Details of who initiated this provisioning. Supports $filter (eq, contains).
          jobId:
            type: string
            description: The unique ID for the whole provisioning job. Supports $filter (eq, contains).
            nullable: true
          modifiedProperties:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.modifiedProperty'
            description: Details of each property that was modified in this provisioning action on this object.
          provisioningAction:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.provisioningAction'
            - type: object
              nullable: true
            description: 'Indicates the activity name or the operation name. The possible values are: create, update, delete, stageddelete, disable, other and unknownFutureValue. For a list of activities logged, refer to Microsoft Entra activity list. Supports $filter (eq, contains).'
          provisioningStatusInfo:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.provisioningStatusInfo'
            - type: object
              nullable: true
            description: Details of provisioning status.
          provisioningSteps:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.provisioningStep'
            description: Details of each step in provisioning.
          servicePrincipal:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.provisioningServicePrincipal'
            - type: object
              nullable: true
            description: Represents the service principal used for provisioning. Supports $filter (eq) for id and name.
          sourceIdentity:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.provisionedIdentity'
            - type: object
              nullable: true
            description: Details of source object being provisioned. Supports $filter (eq, contains) for identityType, id, and displayName.
          sourceSystem:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.provisioningSystem'
            - type: object
              nullable: true
            description: Details of source system of the object being provisioned. Supports $filter (eq, contains) for displayName.
          targetIdentity:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.provisionedIdentity'
            - type: object
              nullable: true
            description: Details of target object being provisioned. Supports $filter (eq, contains) for identityType, id, and displayName.
          targetSystem:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.provisioningSystem'
            - type: object
              nullable: true
            description: Details of target system of the object being provisioned. Supports $filter (eq, contains) for displayName.
          tenantId:
            type: string
            description: Unique Microsoft Entra tenant ID. Supports $filter (eq, contains).
            nullable: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.provisioningObjectSummary'
    microsoft.graph.identity:
      title: identity
      required:
      - '@odata.type'
      type: object
      properties:
        displayName:
          type: string
          description: The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta.
          nullable: true
        id:
          type: string
          description: Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review.
          nullable: true
        '@odata.type':
          type: string
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.azureCommunicationServicesUserIdentity': '#/components/schemas/microsoft.graph.azureCommunicationServicesUserIdentity'
          '#microsoft.graph.communicationsApplicationIdentity': '#/components/schemas/microsoft.graph.communicationsApplicationIdentity'
          '#microsoft.graph.communicationsApplicationInstanceIdentity': '#/components/schemas/microsoft.graph.communicationsApplicationInstanceIdentity'
          '#microsoft.graph.communicationsEncryptedIdentity': '#/components/schemas/microsoft.graph.communicationsEncryptedIdentity'
          '#microsoft.graph.communicationsGuestIdentity': '#/components/schemas/microsoft.graph.communicationsGuestIdentity'
          '#microsoft.graph.communicationsPhoneIdentity': '#/components/schemas/microsoft.graph.communicationsPhoneIdentity'
          '#microsoft.graph.communicationsUserIdentity': '#/components/schemas/microsoft.graph.communicationsUserIdentity'
          '#microsoft.graph.emailIdentity': '#/components/schemas/microsoft.graph.emailIdentity'
          '#microsoft.graph.initiator': '#/components/schemas/microsoft.graph.initiator'
          '#microsoft.graph.provisionedIdentity': '#/components/schemas/microsoft.graph.provisionedIdentity'
          '#microsoft.graph.provisioningServicePrincipal': '#/components/schemas/microsoft.graph.provisioningServicePrincipal'
          '#microsoft.graph.provisioningSystem': '#/components/schemas/microsoft.graph.provisioningSystem'
          '#microsoft.graph.servicePrincipalIdentity': '#/components/schemas/microsoft.graph.servicePrincipalIdentity'
          '#microsoft.graph.sharePointIdentity': '#/components/schemas/microsoft.graph.sharePointIdentity'
          '#microsoft.graph.teamworkApplicationIdentity': '#/components/schemas/microsoft.graph.teamworkApplicationIdentity'
          '#microsoft.graph.teamworkConversationIdentity': '#/components/schemas/microsoft.graph.teamworkConversationIdentity'
          '#microsoft.graph.teamworkTagIdentity': '#/components/schemas/microsoft.graph.teamworkTagIdentity'
          '#microsoft.graph.teamworkUserIdentity': '#/components/schemas/microsoft.graph.teamworkUserIdentity'
          '#microsoft.graph.userIdentity': '#/components/schemas/microsoft.graph.userIdentity'
          '#microsoft.graph.callRecords.userIdentity': '#/components/schemas/microsoft.graph.callRecords.userIdentity'
    microsoft.graph.riskState:
      title: riskState
      enum:
      - none
      - confirmedSafe
      - remediated
      - dismissed
      - atRisk
      - confirmedCompromised
      - unknownFutureValue
      type: string
    microsoft.graph.signIn:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: signIn
        required:
        - '@odata.type'
        type: object
        properties:
          appDisplayName:
            type: string
            description: App name displayed in the Microsoft Entra admin center.  Supports $filter (eq, startsWith).
            nullable: true
          appId:
            type: string
            description: Unique GUID that represents the app ID in the Microsoft Entra ID.  Supports $filter (eq).
            nullable: true
          appliedConditionalAccessPolicies:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.appliedConditionalAccessPolicy'
            description: Provides a list of conditional access policies that the corresponding sign-in activity triggers. Apps need more Conditional Access-related privileges to read the details of this property. For more information, see Permissions for viewing applied conditional access (CA) policies in sign-ins.
          clientAppUsed:
            type: string
            description: Identifies the client used for the sign-in activity. Modern authentication clients include Browser, modern clients. Legacy authentication clients include Exchange ActiveSync, IMAP, MAPI, SMTP, POP, and other clients.  Supports $filter (eq).
            nullable: true
          conditionalAccessStatus:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.conditionalAccessStatus'
            - type: object
              nullable: true
            description: 'Reports status of an activated conditional access policy. The possible values are: success, failure, notApplied, and unknownFutureValue.  Supports $filter (eq).'
          correlationId:
            type: string
            description: The request ID sent from the client when the sign-in is initiated. Used to troubleshoot sign-in activity.  Supports $filter (eq).
            nullable: true
          createdDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: 'Date and time (UTC) the sign-in was initiated. Example: midnight on Jan 1, 2014 is reported as 2014-01-01T00:00:00Z.  Supports $orderby, $filter (eq, le, and ge).'
            format: date-time
          deviceDetail:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.deviceDetail'
            - type: object
              nullable: true
            description: Device information from where the sign-in occurred; includes device ID, operating system, and browser.  Supports $filter (eq, startsWith) on browser and operatingSytem properties.
          ipAddress:
            type: string
            description: IP address of the client used to sign in.  Supports $filter (eq, startsWith).
            nullable: true
          isInteractive:
            type: boolean
            description: Indicates whether a sign-in is interactive.
            nullable: true
          location:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.signInLocation'
            - type: object
              nullable: true
            description: Provides the city, state, and country code where the sign-in originated.  Supports $filter (eq, startsWith) on city, state, and countryOrRegion properties.
          resourceDisplayName:
            type: string
            description: Name of the resource the user signed into.  Supports $filter (eq).
            nullable: true
          resourceId:
            type: string
            description: ID of the resource that the user signed into.  Supports $filter (eq).
            nullable: true
          riskDetail:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.riskDetail'
            - type: object
              nullable: true
            description: 'The reason behind a specific state of a risky user, sign-in, or a risk event. The value none means that Microsoft Entra risk detection did not flag the user or the sign-in as a risky event so far.  Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.'
          riskEventTypes:
            type: array
            items:
              anyOf:
              - $ref: '#/components/schemas/microsoft.graph.riskEventType'
              - type: object
                nullable: true
          riskEventTypes_v2:
            type: array
            items:
              type: string
              nullable: true
            description: 'The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic, or unknownFutureValue.  Supports $filter (eq, startsWith).'
          riskLevelAggregated:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.riskLevel'
            - type: object
              nullable: true
            description: 'Aggregated risk level. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn''t enabled for Microsoft Entra ID Protection.  Supports $filter (eq).  Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.'
          riskLevelDuringSignIn:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.riskLevel'
            - type: object
              nullable: true
            description: 'Risk level during sign-in. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn''t enabled for Microsoft Entra ID Protection.  Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.'
          riskState:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.riskState'
            - type: object
              nullable: true
            description: 'Reports status of the risky user, sign-in, or a risk event. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.  Supports $filter (eq).'
          status:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.signInStatus'
            - type: object
              nullable: true
            description: Sign-in status. Includes the error code and description of the error (if a sign-in failure occurs).  Supports $filter (eq) on errorCode property.
          userDisplayName:
            type: string
            description: Display name of the user that initiated the sign-in.  Supports $filter (eq, startsWith).
            nullable: true
          userId:
            type: string
            description: ID of the user that initiated the sign-in.  Supports $filter (eq).
          userPrincipalName:
            type: string
            description: 'User principal name of the user that initiated the sign-in. This value is always in lowercase. For guest users whose values in the user object typically contain #EXT# before the domain part, this property stores the value in both lowercase and the ''true'' format. For example, while the user object stores AdeleVance_fabrikam.com#EXT#@contoso.com, the sign-in logs store adelevance@fabrikam.com. Supports $filter (eq, startsWith).'
            nullable: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.signIn'
    microsoft.graph.provisioningStepType:
      title: provisioningStepType
      enum:
      - import
      - scoping
      - matching
      - processing
      - referenceResolution
      - export
      - unknownFutureValue
      type: string
    microsoft.graph.userIdentity:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.identity'
      - title: userIdentity
        required:
        - '@odata.type'
        type: object
        properties:
          ipAddress:
            type: string
            description: Indicates the client IP address associated with the user performing the activity (audit log only).
            nullable: true
          userPrincipalName:
            type: string
            description: The userPrincipalName attribute of the user.
            nullable: true
          '@odata.type':
            type: string
            default: '#microsoft.graph.userIdentity'
      x-ms-discriminator-value: '#microsoft.graph.userIdentity'
    microsoft.graph.auditActivityInitiator:
      title: auditActivityInitiator
      required:
      - '@odata.type'
      type: object
      properties:
        app:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.appIdentity'
          - type: object
            nullable: true
          description: If the resource initiating the activity is an app, this property indicates all the app related information like appId and name.
        user:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.userIdentity'
          - type: object
            nullable: true
          description: If the resource initiating the activity is a user, this property Indicates all the user related information like user ID and userPrincipalName.
        '@odata.type':
          type: string
    microsoft.graph.initiatorType:
      title: initiatorType
      enum:
      - user
      - application
      - system
      - unknownFutureValue
      type: string
    microsoft.graph.riskEventType:
      title: riskEventType
      enum:
      - unlikelyTravel
      - anonymizedIPAddress
      - maliciousIPAddress
      - unfamiliarFeatures
      - malwareInfectedIPAddress
      - suspiciousIPAddress
      - leakedCredentials
      - investigationsThreatIntelligence
      - generic
      - adminConfirmedUserCompromised
      - mcasImpossibleTravel
      - mcasSuspiciousInboxManipulationRules
      - investigationsThreatIntelligenceSigninLinked
      - maliciousIPAddressValidCredentialsBlockedIP
      - unknownFutureValue
      type: string
    microsoft.graph.auditLogRoot:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: auditLogRoot
        required:
        - '@odata.type'
        type: object
        properties:
          directoryAudits:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.directoryAudit'
            x-ms-navigationProperty: true
          provisioning:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.provisioningObjectSummary'
            x-ms-navigationProperty: true
          signIns:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.signIn'
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.auditLogRoot'
    microsoft.graph.detailsInfo:
      title: detailsInfo
      required:
      - '@odata.type'
      type: object
      properties:
        '@odata.type':
          type: string
    microsoft.graph.provisioningStatusErrorCategory:
      title: provisioningStatusErrorCategory
      enum:
      - failure
      - nonServiceFailure
      - success
      - unknownFutureValue
      type: string
    microsoft.graph.ODataErrors.InnerError:
      title: InnerError
      required:
      - '@odata.type'
      type: object
      properties:
        request-id:
          type: string
          description: Request Id as tracked internally by the service
          nullable: true
        client-request-id:
          type: string
          description: Client request Id as sent by the client application.
          nullable: true
        date:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: Date when the error occured.
          format: date-time
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.appliedConditionalAccessPolicyResult:
      title: appliedConditionalAccessPolicyResult
      enum:
      - success
      - failure
      - notApplied
      - notEnabled
      - unknown
      - unknownFutureValue
      - reportOnlySuccess
      - reportOnlyFailure
      - reportOnlyNotApplied
      - reportOnlyInterrupted
      type: string
    microsoft.graph.geoCoordinates:
      title: geoCoordinates
      required:
      - '@odata.type'
      type: object
      properties:
        altitude:
          oneOf:
          - type: number
            format: double
            nullable: true
          - type: string
            nullable: true
          - $ref: '#/components/schemas/ReferenceNumeric'
          description: Optional. The altitude (height), in feet,  above sea level for the item. Read-only.
        latitude:
          oneOf:
          - type: number
            format: double
            nullable: true
          - type: string
            nullable: true
          - $ref: '#/components/schemas/ReferenceNumeric'
          description: Optional. The latitude, in decimal, for the item. Read-only.
        longitude:
          oneOf:
          - type: number
            format: double
            nullable: true
          - type: string
            nullable: true
          - $ref: '#/components/schemas/ReferenceNumeric'
          description: Optional. The longitude, in decimal, for the item. Read-only.
        '@odata.type':
          type: string
    microsoft.graph.groupType:
      title: groupType
      enum:
      - unifiedGroups
      - azureAD
      - unknownFutureValue
      type: string
    microsoft.graph.provisioningStatusInfo:
      title: provisioningStatusInfo
      required:
      - '@odata.type'
      type: object
      properties:
        errorInformation:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.provisioningErrorInfo'
          - type: object
            nullable: true
          description: If status isn't success/ skipped details for the error are contained in this.
        status:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.provisioningResult'
          - type: object
            nullable: true
          description: 'The possible values are: success, warning, failure, skipped, unknownFutureValue.'
        '@odata.type':
          type: string
    microsoft.graph.operationResult:
      title: operationResult
      enum:
      - success
      - failure
      - timeout
      - unknownFutureValue
      type: string
    microsoft.graph.provisioningResult:
      title: provisioningResult
      enum:
      - success
      - failure
      - skipped
      - warning
      - unknownFutureValue
      type: string
    ReferenceNumeric:
      enum:
      - -INF
      - INF
      - NaN
      type: string
      nullable: true
    microsoft.graph.provisionedIdentity:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.identity'
      - title: provisionedIdentity
        required:
        - '@odata.type'
        type: object
        properties:
          details:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.detailsInfo'
            - type: object
              nullable: true
            description: Details of the identity.
          identityType:
            type: string
            description: Type of identity that has been provisioned, such as 'user' or 'group'. Supports $filter (eq, contains).
            nullable: true
          '@odata.type':
            type: string
            default: '#microsoft.graph.provisionedIdentity'
      x-ms-discriminator-value: '#microsoft.graph.provisionedIdentity'
    microsoft.graph.ODataErrors.MainError:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
          x-ms-primary-error-message: true
        target:
          type: string
          nullable: true
        details:
          type: array
          items:
            $ref: '#/components/schemas/microsoft.graph.ODataErrors.ErrorDetails'
        innerError:
          $ref: '#/components/schemas/microsoft.graph.ODataErrors.InnerError'
    microsoft.graph.riskDetail:
      title: riskDetail
      enum:
      - none
      - adminGeneratedTemporaryPassword
      - userPerformedSecuredPasswordChange
      - userPerformedSecuredPasswordReset
      - adminConfirmedSigninSafe
      - aiConfirmedSigninSafe
      - userPassedMFADrivenByRiskBasedPolicy
      - adminDismissedAllRiskForUser
      - adminConfirmedSigninCompromised
      - hidden
      - adminConfirmedUserCompromised
      - unknownFutureValue
      - m365DAdminDismissedDetection
      - adminConfirmedServicePrincipalCompromised
      - adminDismissedAllRiskForServicePrincipal
      - userChangedPasswordOnPremises
      - adminDismissedRiskForSignIn
      - adminConfirmedAccountSafe
      type: string
    microsoft.graph.appIdentity:
      title: appIdentity
      required:
      - '@odata.type'
      type: object
      properties:
        appId:
          type: string
          description: Refers to the unique ID representing application in Microsoft Entra ID.
          nullable: true
        displayName:
          type: string
          description: Refers to the application name displayed in the Microsoft Entra admin center.
          nullable: true
        servicePrincipalId:
          type: string
          description: Refers to the unique ID for the service principal in Microsoft Entra ID.
          nullable: true
        servicePrincipalName:
          type: string
          description: Refers to the Service Principal Name is the Application name in the tenant.
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.conditionalAccessStatus:
      title: conditionalAccessStatus
      enum:
      - success
      - failure
      - notApplied
      - unknownFutureValue
      type: string
    microsoft.graph.provisioningErrorInfo:
      title: provisioningErrorInfo
      required:
      - '@odata.type'
      type: object
      properties:
        additionalDetails:
          type: string
          description: Additional details if there's error.
          nullable: true
        errorCategory:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.provisioningStatusErrorCategory'
          - type: object
            nullable: true
          description: Categorizes the error code. Possible values are failure, nonServiceFailure, success, unknownFutureValue
        errorCode:
          type: string
          description: Unique error code if any occurre

# --- truncated at 32 KB (166 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-auditlogs-auditlogroot-api-openapi.yml