Microsoft Graph auditLogs.signIn API

openapi: 3.2.0
info:
  title: Microsoft Graph Admin Admin.admin Audit Logs.sign In API
  description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.

    This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,

    site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,

    SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
  version: 1.0.0
  contact:
    name: Microsoft Graph API Support
    url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph API v1.0 endpoint
tags:
- name: auditLogs.signIn
  x-ms-docs-toc-type: page
paths:
  /auditLogs/signIns:
    description: Provides operations to manage the signIns property of the microsoft.graph.auditLogRoot entity.
    get:
      tags:
      - auditLogs.signIn
      summary: Microsoft Graph List signIns
      description: Retrieve the Microsoft Entra user sign-ins for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.  The maximum and default page size is 1,000 objects and by default, the most recent sign-ins are returned first. Only sign-in events that occurred within the Microsoft Entra ID default retention period are available.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/signin-list?view=graph-rest-1.0
      operationId: auditLogs.ListSignIns
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - name: $orderby
        in: query
        description: Order items by property values
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          $ref: '#/components/responses/microsoft.graph.signInCollectionResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-pageable:
        nextLinkName: '@odata.nextLink'
        operationName: listMore
      x-ms-docs-operation-type: operation
    post:
      tags:
      - auditLogs.signIn
      summary: Microsoft Graph Create new navigation property to signIns for auditLogs
      operationId: auditLogs.CreateSignIns
      requestBody:
        description: New navigation property
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.signIn'
        required: true
      responses:
        2XX:
          description: Created navigation property.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.signIn'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /auditLogs/signIns/{signIn-id}:
    description: Provides operations to manage the signIns property of the microsoft.graph.auditLogRoot entity.
    parameters:
    - name: signIn-id
      in: path
      description: The unique identifier of signIn
      required: true
      schema:
        type: string
      x-ms-docs-key-type: signIn
    get:
      tags:
      - auditLogs.signIn
      summary: Microsoft Graph Get signIn
      description: Retrieve a specific Microsoft Entra user sign-in event for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/signin-get?view=graph-rest-1.0
      operationId: auditLogs.GetSignIns
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved navigation property
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.signIn'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - auditLogs.signIn
      summary: Microsoft Graph Update the navigation property signIns in auditLogs
      operationId: auditLogs.UpdateSignIns
      requestBody:
        description: New navigation property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.signIn'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.signIn'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    delete:
      tags:
      - auditLogs.signIn
      summary: Microsoft Graph Delete navigation property signIns for auditLogs
      operationId: auditLogs.DeleteSignIns
      parameters:
      - name: If-Match
        in: header
        description: ETag
        schema:
          type: string
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
  /auditLogs/signIns/$count:
    description: Provides operations to count the resources in the collection.
    get:
      tags:
      - auditLogs.signIn
      summary: Microsoft Graph Get the number of the resource
      operationId: auditLogs.signIns.GetCount-9ee4
      parameters:
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      responses:
        2XX:
          $ref: '#/components/responses/ODataCountResponse'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
  /auditLogs/signIns/confirmCompromised:
    description: Provides operations to call the confirmCompromised method.
    post:
      tags:
      - auditLogs.signIn
      summary: Microsoft Graph Invoke action confirmCompromised
      description: Mark an event in the Microsoft Entra sign-in logs as risky. Events marked as risky by an admin are immediately flagged as high risk in Microsoft Entra ID Protection, overriding previous risk states. Admins can confirm that events flagged as risky by Microsoft Entra ID Protection are in fact risky. For details about investigating Identity Protection risks, see How to investigate risk.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/signin-confirmcompromised?view=graph-rest-1.0
      operationId: auditLogs.signIns.confirmCompromised
      requestBody:
        description: Action parameters
        content:
          application/json:
            schema:
              type: object
              properties:
                requestIds:
                  type: array
                  items:
                    type: string
                    nullable: true
        required: true
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: action
  /auditLogs/signIns/confirmSafe:
    description: Provides operations to call the confirmSafe method.
    post:
      tags:
      - auditLogs.signIn
      summary: Microsoft Graph Invoke action confirmSafe
      description: Mark an event in Microsoft Entra sign-in logs as safe. Admins can either mark the events flagged as risky by Microsoft Entra ID Protection as safe, or they can mark unflagged events as safe. For details about investigating Identity Protection risks, see How to investigate risk.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/signin-confirmsafe?view=graph-rest-1.0
      operationId: auditLogs.signIns.confirmSafe
      requestBody:
        description: Action parameters
        content:
          application/json:
            schema:
              type: object
              properties:
                requestIds:
                  type: array
                  items:
                    type: string
                    nullable: true
        required: true
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: action
  /auditLogs/signIns/dismiss:
    description: Provides operations to call the dismiss method.
    post:
      tags:
      - auditLogs.signIn
      summary: Microsoft Graph Invoke action dismiss
      description: Mark an event in Microsoft Entra sign-in logs as dismissed. For details about investigating Identity Protection risks, see How to investigate risk.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/signin-dismiss?view=graph-rest-1.0
      operationId: auditLogs.signIns.dismiss
      requestBody:
        description: Action parameters
        content:
          application/json:
            schema:
              type: object
              properties:
                requestIds:
                  type: array
                  items:
                    type: string
                    nullable: true
        required: true
      responses:
        '204':
          description: Success
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: action
components:
  schemas:
    ODataCountResponse:
      type: integer
      format: int32
    microsoft.graph.ODataErrors.ErrorDetails:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        target:
          type: string
          nullable: true
    microsoft.graph.signInCollectionResponse:
      title: Collection of signIn
      type: object
      allOf:
      - $ref: '#/components/schemas/BaseCollectionPaginationCountResponse'
      - type: object
        properties:
          value:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.signIn'
    microsoft.graph.riskState:
      title: riskState
      enum:
      - none
      - confirmedSafe
      - remediated
      - dismissed
      - atRisk
      - confirmedCompromised
      - unknownFutureValue
      type: string
    microsoft.graph.signIn:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: signIn
        required:
        - '@odata.type'
        type: object
        properties:
          appDisplayName:
            type: string
            description: App name displayed in the Microsoft Entra admin center.  Supports $filter (eq, startsWith).
            nullable: true
          appId:
            type: string
            description: Unique GUID that represents the app ID in the Microsoft Entra ID.  Supports $filter (eq).
            nullable: true
          appliedConditionalAccessPolicies:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.appliedConditionalAccessPolicy'
            description: Provides a list of conditional access policies that the corresponding sign-in activity triggers. Apps need more Conditional Access-related privileges to read the details of this property. For more information, see Permissions for viewing applied conditional access (CA) policies in sign-ins.
          clientAppUsed:
            type: string
            description: Identifies the client used for the sign-in activity. Modern authentication clients include Browser, modern clients. Legacy authentication clients include Exchange ActiveSync, IMAP, MAPI, SMTP, POP, and other clients.  Supports $filter (eq).
            nullable: true
          conditionalAccessStatus:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.conditionalAccessStatus'
            - type: object
              nullable: true
            description: 'Reports status of an activated conditional access policy. The possible values are: success, failure, notApplied, and unknownFutureValue.  Supports $filter (eq).'
          correlationId:
            type: string
            description: The request ID sent from the client when the sign-in is initiated. Used to troubleshoot sign-in activity.  Supports $filter (eq).
            nullable: true
          createdDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: 'Date and time (UTC) the sign-in was initiated. Example: midnight on Jan 1, 2014 is reported as 2014-01-01T00:00:00Z.  Supports $orderby, $filter (eq, le, and ge).'
            format: date-time
          deviceDetail:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.deviceDetail'
            - type: object
              nullable: true
            description: Device information from where the sign-in occurred; includes device ID, operating system, and browser.  Supports $filter (eq, startsWith) on browser and operatingSytem properties.
          ipAddress:
            type: string
            description: IP address of the client used to sign in.  Supports $filter (eq, startsWith).
            nullable: true
          isInteractive:
            type: boolean
            description: Indicates whether a sign-in is interactive.
            nullable: true
          location:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.signInLocation'
            - type: object
              nullable: true
            description: Provides the city, state, and country code where the sign-in originated.  Supports $filter (eq, startsWith) on city, state, and countryOrRegion properties.
          resourceDisplayName:
            type: string
            description: Name of the resource the user signed into.  Supports $filter (eq).
            nullable: true
          resourceId:
            type: string
            description: ID of the resource that the user signed into.  Supports $filter (eq).
            nullable: true
          riskDetail:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.riskDetail'
            - type: object
              nullable: true
            description: 'The reason behind a specific state of a risky user, sign-in, or a risk event. The value none means that Microsoft Entra risk detection did not flag the user or the sign-in as a risky event so far.  Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.'
          riskEventTypes:
            type: array
            items:
              anyOf:
              - $ref: '#/components/schemas/microsoft.graph.riskEventType'
              - type: object
                nullable: true
          riskEventTypes_v2:
            type: array
            items:
              type: string
              nullable: true
            description: 'The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic, or unknownFutureValue.  Supports $filter (eq, startsWith).'
          riskLevelAggregated:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.riskLevel'
            - type: object
              nullable: true
            description: 'Aggregated risk level. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn''t enabled for Microsoft Entra ID Protection.  Supports $filter (eq).  Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.'
          riskLevelDuringSignIn:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.riskLevel'
            - type: object
              nullable: true
            description: 'Risk level during sign-in. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn''t enabled for Microsoft Entra ID Protection.  Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden.'
          riskState:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.riskState'
            - type: object
              nullable: true
            description: 'Reports status of the risky user, sign-in, or a risk event. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.  Supports $filter (eq).'
          status:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.signInStatus'
            - type: object
              nullable: true
            description: Sign-in status. Includes the error code and description of the error (if a sign-in failure occurs).  Supports $filter (eq) on errorCode property.
          userDisplayName:
            type: string
            description: Display name of the user that initiated the sign-in.  Supports $filter (eq, startsWith).
            nullable: true
          userId:
            type: string
            description: ID of the user that initiated the sign-in.  Supports $filter (eq).
          userPrincipalName:
            type: string
            description: 'User principal name of the user that initiated the sign-in. This value is always in lowercase. For guest users whose values in the user object typically contain #EXT# before the domain part, this property stores the value in both lowercase and the ''true'' format. For example, while the user object stores AdeleVance_fabrikam.com#EXT#@contoso.com, the sign-in logs store adelevance@fabrikam.com. Supports $filter (eq, startsWith).'
            nullable: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.signIn'
    microsoft.graph.riskEventType:
      title: riskEventType
      enum:
      - unlikelyTravel
      - anonymizedIPAddress
      - maliciousIPAddress
      - unfamiliarFeatures
      - malwareInfectedIPAddress
      - suspiciousIPAddress
      - leakedCredentials
      - investigationsThreatIntelligence
      - generic
      - adminConfirmedUserCompromised
      - mcasImpossibleTravel
      - mcasSuspiciousInboxManipulationRules
      - investigationsThreatIntelligenceSigninLinked
      - maliciousIPAddressValidCredentialsBlockedIP
      - unknownFutureValue
      type: string
    microsoft.graph.ODataErrors.InnerError:
      title: InnerError
      required:
      - '@odata.type'
      type: object
      properties:
        request-id:
          type: string
          description: Request Id as tracked internally by the service
          nullable: true
        client-request-id:
          type: string
          description: Client request Id as sent by the client application.
          nullable: true
        date:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: Date when the error occured.
          format: date-time
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.appliedConditionalAccessPolicyResult:
      title: appliedConditionalAccessPolicyResult
      enum:
      - success
      - failure
      - notApplied
      - notEnabled
      - unknown
      - unknownFutureValue
      - reportOnlySuccess
      - reportOnlyFailure
      - reportOnlyNotApplied
      - reportOnlyInterrupted
      type: string
    microsoft.graph.geoCoordinates:
      title: geoCoordinates
      required:
      - '@odata.type'
      type: object
      properties:
        altitude:
          oneOf:
          - type: number
            format: double
            nullable: true
          - type: string
            nullable: true
          - $ref: '#/components/schemas/ReferenceNumeric'
          description: Optional. The altitude (height), in feet,  above sea level for the item. Read-only.
        latitude:
          oneOf:
          - type: number
            format: double
            nullable: true
          - type: string
            nullable: true
          - $ref: '#/components/schemas/ReferenceNumeric'
          description: Optional. The latitude, in decimal, for the item. Read-only.
        longitude:
          oneOf:
          - type: number
            format: double
            nullable: true
          - type: string
            nullable: true
          - $ref: '#/components/schemas/ReferenceNumeric'
          description: Optional. The longitude, in decimal, for the item. Read-only.
        '@odata.type':
          type: string
    ReferenceNumeric:
      enum:
      - -INF
      - INF
      - NaN
      type: string
      nullable: true
    microsoft.graph.ODataErrors.MainError:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
          x-ms-primary-error-message: true
        target:
          type: string
          nullable: true
        details:
          type: array
          items:
            $ref: '#/components/schemas/microsoft.graph.ODataErrors.ErrorDetails'
        innerError:
          $ref: '#/components/schemas/microsoft.graph.ODataErrors.InnerError'
    microsoft.graph.riskDetail:
      title: riskDetail
      enum:
      - none
      - adminGeneratedTemporaryPassword
      - userPerformedSecuredPasswordChange
      - userPerformedSecuredPasswordReset
      - adminConfirmedSigninSafe
      - aiConfirmedSigninSafe
      - userPassedMFADrivenByRiskBasedPolicy
      - adminDismissedAllRiskForUser
      - adminConfirmedSigninCompromised
      - hidden
      - adminConfirmedUserCompromised
      - unknownFutureValue
      - m365DAdminDismissedDetection
      - adminConfirmedServicePrincipalCompromised
      - adminDismissedAllRiskForServicePrincipal
      - userChangedPasswordOnPremises
      - adminDismissedRiskForSignIn
      - adminConfirmedAccountSafe
      type: string
    microsoft.graph.conditionalAccessStatus:
      title: conditionalAccessStatus
      enum:
      - success
      - failure
      - notApplied
      - unknownFutureValue
      type: string
    microsoft.graph.riskLevel:
      title: riskLevel
      enum:
      - low
      - medium
      - high
      - hidden
      - none
      - unknownFutureValue
      type: string
    microsoft.graph.appliedConditionalAccessPolicy:
      title: appliedConditionalAccessPolicy
      required:
      - '@odata.type'
      type: object
      properties:
        displayName:
          type: string
          description: 'Refers to the name of the conditional access policy (example: ''Require MFA for Salesforce'').'
          nullable: true
        enforcedGrantControls:
          type: array
          items:
            type: string
            nullable: true
          description: 'Refers to the grant controls enforced by the conditional access policy (example: ''Require multifactor authentication'').'
        enforcedSessionControls:
          type: array
          items:
            type: string
            nullable: true
          description: 'Refers to the session controls enforced by the conditional access policy (example: ''Require app enforced controls'').'
        id:
          type: string
          description: An identifier of the conditional access policy. Supports $filter (eq).
          nullable: true
        result:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.appliedConditionalAccessPolicyResult'
          - type: object
            nullable: true
          description: 'Indicates the result of the CA policy that was triggered. The possible values are: success, failure, notApplied (policy isn''t applied because policy conditions weren''t met), notEnabled (This is due to the policy in a disabled state), unknown, unknownFutureValue, reportOnlySuccess, reportOnlyFailure, reportOnlyNotApplied, reportOnlyInterrupted. Use the Prefer: include-unknown-enum-members request header to get the following values in this evolvable enum: reportOnlySuccess, reportOnlyFailure, reportOnlyNotApplied, reportOnlyInterrupted.'
        '@odata.type':
          type: string
    microsoft.graph.signInLocation:
      title: signInLocation
      required:
      - '@odata.type'
      type: object
      properties:
        city:
          type: string
          description: Provides the city where the sign-in originated and is determined using latitude/longitude information from the sign-in activity.
          nullable: true
        countryOrRegion:
          type: string
          description: Provides the country code info (two letter code) where the sign-in originated.  This is calculated using latitude/longitude information from the sign-in activity.
          nullable: true
        geoCoordinates:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.geoCoordinates'
          - type: object
            nullable: true
          description: Provides the latitude, longitude and altitude where the sign-in originated.
        state:
          type: string
          description: Provides the State where the sign-in originated. This is calculated using latitude/longitude information from the sign-in activity.
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.signInStatus:
      title: signInStatus
      required:
      - '@odata.type'
      type: object
      properties:
        additionalDetails:
          type: string
          description: Provides additional details on the sign-in activity
          nullable: true
        errorCode:
          maximum: 2147483647
          minimum: -2147483648
          type: number
          description: Provides the 5-6 digit error code that's generated during a sign-in failure. Check out the list of error codes and messages.
          format: int32
          nullable: true
        failureReason:
          type: string
          description: Provides the error message or the reason for failure for the corresponding sign-in activity. Check out the list of error codes and messages.
          nullable: true
        '@odata.type':
          type: string
    BaseCollectionPaginationCountResponse:
      title: Base collection pagination and count responses
      type: object
      properties:
        '@odata.count':
          type: integer
          format: int64
          nullable: true
        '@odata.nextLink':
          type: string
          nullable: true
    microsoft.graph.ODataErrors.ODataError:
      required:
      - error
      type: object
      properties:
        error:
          $ref: '#/components/schemas/microsoft.graph.ODataErrors.MainError'
    microsoft.graph.deviceDetail:
      title: deviceDetail
      required:
      - '@odata.type'
      type: object
      properties:
        browser:
          type: string
          description: Indicates the browser information of the used in the sign-in. Populated for devices registered in Microsoft Entra.
          nullable: true
        deviceId:
          type: string
          description: Refers to the unique ID of the device used in the sign-in. Populated for devices registered in Microsoft Entra.
          nullable: true
        displayName:
          type: string
          description: Refers to the name of the device used in the sign-in. Populated for devices registered in Microsoft Entra.
          nullable: true
        isCompliant:
          type: boolean
          description: Indicates whether the device is compliant or not.
          nullable: true
        isManaged:
          type: boolean
          description: Indicates if the device is managed or not.
          nullable: true
        operatingSystem:
          type: string
          description: Indicates the OS name and version used in the sign-in.
          nullable: true
        trustType:
          type: string
          description: Indicates information on whether the device used in the sign-in is workplace-joined, Microsoft Entra-joined, domain-joined.
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.entity:
      title: entity
      required:
      - '@odata.type'
      type: object
      properties:
        id:
          type: string
          description: The unique identifier for an entity. Read-only.
        '@odata.type':
          type: string
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.accessPackage': '#/components/schemas/microsoft.graph.accessPackage'
          '#microsoft.graph.accessPackageAssignment': '#/components/schemas/microsoft.graph.accessPackageAssignment'
          '#microsoft.graph.accessPackageAssignmentPolicy': '#/components/schemas/microsoft.graph.accessPackageAssignmentPolicy'
          '#microsoft.graph.accessPackageAssignmentRequest': '#/components/schemas/microsoft.graph.accessPackageAssignmentRequest'
          '#microsoft.graph.accessPackageCatalog': '#/components/schemas/microsoft.graph.accessPackageCatalog'
          '#microsoft.graph.accessPackageQuestion': '#/components/schemas/microsoft.graph.accessPackageQuestion'
          '#microsoft.graph.accessPackageMultipleChoiceQuestion': '#/components/schemas/microsoft.graph.accessPackageMultipleChoiceQuestion'
          '#microsoft.graph.accessPackageTextInputQuestion': '#/components/schemas/microsoft.graph.accessPackageTextInputQuestion'
          '#microsoft.graph.accessPackageResource': '#/components/schemas/microsoft.graph.accessPackageResource'
          '#microsoft.graph.accessPackageResourceEnvironment': '#/components/schemas/microsoft.graph.accessPackageResourceEnvironment'
          '#microsoft.graph.accessPackageResourceRequest': '#/components/schemas/microsoft.graph.accessPackageResourceRequest'
          '#microsoft.graph.accessPackageResourceRole': '#/components/schemas/microsoft.graph.accessPackageResourceRole'
          '#microsoft.graph.accessPackageResourceRoleScope': '#/components/schemas/microsoft.graph.accessPackageResourceRoleScope'
          '#microsoft.graph.accessPackageResourceScope': '#/components/schemas/microsoft.graph.accessPackageResourceScope'
          '#microsoft.graph.accessPackageSubject': '#/components/schemas/microsoft.graph.accessPackageSubject'
          '#microsoft.graph.accessReviewH

# --- truncated at 32 KB (152 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-auditlogs-signin-api-openapi.yml