Microsoft Graph deviceAppManagement.deviceAppManagement API

openapi: 3.2.0
info:
  title: Microsoft Graph Admin Admin.admin Device App Management.device App Management API
  description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.

    This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,

    site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,

    SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
  version: 1.0.0
  contact:
    name: Microsoft Graph API Support
    url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph API v1.0 endpoint
tags:
- name: deviceAppManagement.deviceAppManagement
paths:
  /deviceAppManagement:
    description: Provides operations to manage the deviceAppManagement singleton.
    get:
      tags:
      - deviceAppManagement.deviceAppManagement
      summary: Microsoft Graph Get deviceAppManagement
      description: Read properties and relationships of the deviceAppManagement object.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/intune-policyset-deviceappmanagement-get?view=graph-rest-1.0
      operationId: deviceAppManagement.deviceAppManagement.GetDeviceAppManagement
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved entity
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.deviceAppManagement'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - deviceAppManagement.deviceAppManagement
      summary: Microsoft Graph Update deviceAppManagement
      description: Update the properties of a deviceAppManagement object.
      externalDocs:
        description: Find more info here
        url: https://learn.microsoft.com/graph/api/intune-policyset-deviceappmanagement-update?view=graph-rest-1.0
      operationId: deviceAppManagement.deviceAppManagement.UpdateDeviceAppManagement
      requestBody:
        description: New property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.deviceAppManagement'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.deviceAppManagement'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
components:
  schemas:
    microsoft.graph.ODataErrors.ErrorDetails:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        target:
          type: string
          nullable: true
    microsoft.graph.windowsInformationProtectionDataRecoveryCertificate:
      title: windowsInformationProtectionDataRecoveryCertificate
      required:
      - '@odata.type'
      type: object
      properties:
        certificate:
          type: string
          description: Data recovery Certificate
          format: base64url
          nullable: true
        description:
          type: string
          description: Data recovery Certificate description
          nullable: true
        expirationDateTime:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: Data recovery Certificate expiration datetime
          format: date-time
        subjectName:
          type: string
          description: Data recovery Certificate subject name
          nullable: true
        '@odata.type':
          type: string
      description: Windows Information Protection DataRecoveryCertificate
    microsoft.graph.managedAppDataTransferLevel:
      title: managedAppDataTransferLevel
      enum:
      - allApps
      - managedApps
      - none
      type: string
      description: Data can be transferred from/to these classes of apps
      x-ms-enum:
        name: managedAppDataTransferLevel
        modelAsString: false
        values:
        - value: allApps
          description: All apps.
          name: allApps
        - value: managedApps
          description: Managed apps.
          name: managedApps
        - value: none
          description: No apps.
          name: none
    microsoft.graph.managedAppDataStorageLocation:
      title: managedAppDataStorageLocation
      enum:
      - oneDriveForBusiness
      - sharePoint
      - box
      - localStorage
      type: string
      description: The storage locations where managed apps can potentially store their data.
      x-ms-enum:
        name: managedAppDataStorageLocation
        modelAsString: false
        values:
        - value: oneDriveForBusiness
          description: Indicates allowed storage location for the managed app to save files is 'OneDrive for Business'.
          name: oneDriveForBusiness
        - value: sharePoint
          description: Indicates allowed storage location for the managed app to save files is 'Sharepoint'.
          name: sharePoint
        - value: box
          description: Indicates that the allowed storage location for a managed app to save files is to 'Box'. Box is a non-Microsoft solution that enables cloud-based file storage capabilities.
          name: box
        - value: localStorage
          description: Indicates allowed storage location for the managed app to save files is local storage on the device.
          name: localStorage
    microsoft.graph.windowsInformationProtection:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.managedAppPolicy'
      - title: windowsInformationProtection
        required:
        - '@odata.type'
        type: object
        properties:
          azureRightsManagementServicesAllowed:
            type: boolean
            description: Specifies whether to allow Azure RMS encryption for WIP
          dataRecoveryCertificate:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionDataRecoveryCertificate'
            - type: object
              nullable: true
            description: Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent(DRA) certificate for encrypting file system(EFS)
          enforcementLevel:
            $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionEnforcementLevel'
          enterpriseDomain:
            type: string
            description: Primary enterprise domain
            nullable: true
          enterpriseInternalProxyServers:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionResourceCollection'
            description: This is the comma-separated list of internal proxy servers. For example, '157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59'. These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the EnterpriseProxiedDomains policy to force traffic to the matched domains through these proxies
          enterpriseIPRanges:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionIPRangeCollection'
            description: Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to
          enterpriseIPRangesAreAuthoritative:
            type: boolean
            description: Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. Default is false
          enterpriseNetworkDomainNames:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionResourceCollection'
            description: This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to
          enterpriseProtectedDomainNames:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionResourceCollection'
            description: List of enterprise domains to be protected
          enterpriseProxiedDomains:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionProxiedDomainCollection'
            description: Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the EnterpriseInternalProxyServers policy
          enterpriseProxyServers:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionResourceCollection'
            description: This is a list of proxy servers. Any server not on this list is considered non-enterprise
          enterpriseProxyServersAreAuthoritative:
            type: boolean
            description: Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. Default is false
          exemptApps:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionApp'
            description: Exempt applications can also access enterprise data, but the data handled by those applications are not protected. This is because some critical enterprise applications may have compatibility problems with encrypted data.
          iconsVisible:
            type: boolean
            description: Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles in the Start menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the WIP icon in the title bar of a WIP-protected app
          indexingEncryptedStoresOrItemsBlocked:
            type: boolean
            description: This switch is for the Windows Search Indexer, to allow or disallow indexing of items
          isAssigned:
            type: boolean
            description: Indicates if the policy is deployed to any inclusion groups or not.
          neutralDomainResources:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionResourceCollection'
            description: List of domain names that can used for work or personal resource
          protectedApps:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionApp'
            description: Protected applications can access enterprise data and the data handled by those applications are protected with encryption
          protectionUnderLockConfigRequired:
            type: boolean
            description: Specifies whether the protection under lock feature (also known as encrypt under pin) should be configured
          revokeOnUnenrollDisabled:
            type: boolean
            description: This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 1 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after unenrollment. If the keys are not revoked, there will be no revoked file cleanup subsequently.
          rightsManagementServicesTemplateId:
            pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
            type: string
            description: TemplateID GUID to use for RMS encryption. The RMS template allows the IT admin to configure the details about who has access to RMS-protected file and how long they have access
            format: uuid
            nullable: true
          smbAutoEncryptedFileExtensions:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionResourceCollection'
            description: Specifies a list of file extensions, so that files with these extensions are encrypted when copying from an SMB share within the corporate boundary
          assignments:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.targetedManagedAppPolicyAssignment'
            description: Navigation property to list of security groups targeted for policy.
            x-ms-navigationProperty: true
          exemptAppLockerFiles:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionAppLockerFile'
            description: Another way to input exempt apps through xml files
            x-ms-navigationProperty: true
          protectedAppLockerFiles:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionAppLockerFile'
            description: Another way to input protected apps through xml files
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
            default: '#microsoft.graph.windowsInformationProtection'
        description: Policy for Windows information protection to configure detailed management settings
        discriminator:
          propertyName: '@odata.type'
          mapping:
            '#microsoft.graph.mdmWindowsInformationProtectionPolicy': '#/components/schemas/microsoft.graph.mdmWindowsInformationProtectionPolicy'
            '#microsoft.graph.windowsInformationProtectionPolicy': '#/components/schemas/microsoft.graph.windowsInformationProtectionPolicy'
    microsoft.graph.mobileAppPublishingState:
      title: mobileAppPublishingState
      enum:
      - notPublished
      - processing
      - published
      type: string
      description: Indicates the publishing state of an app.
      x-ms-enum:
        name: mobileAppPublishingState
        modelAsString: false
        values:
        - value: notPublished
          description: The app is not yet published.
          name: notPublished
        - value: processing
          description: The app is pending service-side processing.
          name: processing
        - value: published
          description: The app is published.
          name: published
    microsoft.graph.managedAppPinCharacterSet:
      title: managedAppPinCharacterSet
      enum:
      - numeric
      - alphanumericAndSymbol
      type: string
      description: Character set which is to be used for a user's app PIN
      x-ms-enum:
        name: managedAppPinCharacterSet
        modelAsString: false
        values:
        - value: numeric
          description: Numeric characters
          name: numeric
        - value: alphanumericAndSymbol
          description: Alphanumeric and symbolic characters
          name: alphanumericAndSymbol
    microsoft.graph.deviceAndAppManagementAssignmentTarget:
      title: deviceAndAppManagementAssignmentTarget
      required:
      - '@odata.type'
      type: object
      properties:
        '@odata.type':
          type: string
      description: Base type for assignment targets.
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.allDevicesAssignmentTarget': '#/components/schemas/microsoft.graph.allDevicesAssignmentTarget'
          '#microsoft.graph.allLicensedUsersAssignmentTarget': '#/components/schemas/microsoft.graph.allLicensedUsersAssignmentTarget'
          '#microsoft.graph.configurationManagerCollectionAssignmentTarget': '#/components/schemas/microsoft.graph.configurationManagerCollectionAssignmentTarget'
          '#microsoft.graph.groupAssignmentTarget': '#/components/schemas/microsoft.graph.groupAssignmentTarget'
          '#microsoft.graph.exclusionGroupAssignmentTarget': '#/components/schemas/microsoft.graph.exclusionGroupAssignmentTarget'
    microsoft.graph.defaultManagedAppProtection:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.managedAppProtection'
      - title: defaultManagedAppProtection
        required:
        - '@odata.type'
        type: object
        properties:
          appDataEncryptionType:
            $ref: '#/components/schemas/microsoft.graph.managedAppDataEncryptionType'
          customSettings:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.keyValuePair'
            description: A set of string key and string value pairs to be sent to the affected users, unalterned by this service
          deployedAppCount:
            maximum: 2147483647
            minimum: -2147483648
            type: number
            description: Count of apps to which the current policy is deployed.
            format: int32
          disableAppEncryptionIfDeviceEncryptionIsEnabled:
            type: boolean
            description: When this setting is enabled, app level encryption is disabled if device level encryption is enabled. (Android only)
          encryptAppData:
            type: boolean
            description: Indicates whether managed-app data should be encrypted. (Android only)
          faceIdBlocked:
            type: boolean
            description: Indicates whether use of the FaceID is allowed in place of a pin if PinRequired is set to True. (iOS Only)
          minimumRequiredPatchVersion:
            type: string
            description: Define the oldest required Android security patch level a user can have to gain secure access to the app. (Android only)
            nullable: true
          minimumRequiredSdkVersion:
            type: string
            description: Versions less than the specified version will block the managed app from accessing company data. (iOS Only)
            nullable: true
          minimumWarningPatchVersion:
            type: string
            description: Define the oldest recommended Android security patch level a user can have for secure access to the app. (Android only)
            nullable: true
          screenCaptureBlocked:
            type: boolean
            description: Indicates whether screen capture is blocked. (Android only)
          apps:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.managedMobileApp'
            description: List of apps to which the policy is deployed.
            x-ms-navigationProperty: true
          deploymentSummary:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.managedAppPolicyDeploymentSummary'
            - type: object
              nullable: true
            description: Navigation property to deployment summary of the configuration.
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
            default: '#microsoft.graph.defaultManagedAppProtection'
        description: Policy used to configure detailed management settings for a specified set of apps for all users not targeted by a TargetedManagedAppProtection Policy
      x-ms-discriminator-value: '#microsoft.graph.defaultManagedAppProtection'
    microsoft.graph.windowsInformationProtectionAppLockerFile:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: windowsInformationProtectionAppLockerFile
        required:
        - '@odata.type'
        type: object
        properties:
          displayName:
            type: string
            description: The friendly name
            nullable: true
          file:
            type: string
            description: File as a byte array
            format: base64url
            nullable: true
          fileHash:
            type: string
            description: SHA256 hash of the file
            nullable: true
          version:
            type: string
            description: Version of the entity.
            nullable: true
          '@odata.type':
            type: string
        description: Windows Information Protection AppLocker File
      x-ms-discriminator-value: '#microsoft.graph.windowsInformationProtectionAppLockerFile'
    microsoft.graph.mobileAppIdentifier:
      title: mobileAppIdentifier
      required:
      - '@odata.type'
      type: object
      properties:
        '@odata.type':
          type: string
      description: The identifier for a mobile app.
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.androidMobileAppIdentifier': '#/components/schemas/microsoft.graph.androidMobileAppIdentifier'
          '#microsoft.graph.iosMobileAppIdentifier': '#/components/schemas/microsoft.graph.iosMobileAppIdentifier'
    microsoft.graph.mobileAppAssignmentSettings:
      title: mobileAppAssignmentSettings
      required:
      - '@odata.type'
      type: object
      properties:
        '@odata.type':
          type: string
      description: Abstract class to contain properties used to assign a mobile app to a group.
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.iosLobAppAssignmentSettings': '#/components/schemas/microsoft.graph.iosLobAppAssignmentSettings'
          '#microsoft.graph.iosStoreAppAssignmentSettings': '#/components/schemas/microsoft.graph.iosStoreAppAssignmentSettings'
          '#microsoft.graph.iosVppAppAssignmentSettings': '#/components/schemas/microsoft.graph.iosVppAppAssignmentSettings'
          '#microsoft.graph.macOsLobAppAssignmentSettings': '#/components/schemas/microsoft.graph.macOsLobAppAssignmentSettings'
          '#microsoft.graph.microsoftStoreForBusinessAppAssignmentSettings': '#/components/schemas/microsoft.graph.microsoftStoreForBusinessAppAssignmentSettings'
          '#microsoft.graph.win32LobAppAssignmentSettings': '#/components/schemas/microsoft.graph.win32LobAppAssignmentSettings'
          '#microsoft.graph.windowsAppXAppAssignmentSettings': '#/components/schemas/microsoft.graph.windowsAppXAppAssignmentSettings'
          '#microsoft.graph.windowsUniversalAppXAppAssignmentSettings': '#/components/schemas/microsoft.graph.windowsUniversalAppXAppAssignmentSettings'
    microsoft.graph.windowsInformationProtectionPolicy:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.windowsInformationProtection'
      - title: windowsInformationProtectionPolicy
        required:
        - '@odata.type'
        type: object
        properties:
          daysWithoutContactBeforeUnenroll:
            maximum: 2147483647
            minimum: -2147483648
            type: number
            description: Offline interval before app data is wiped (days) . Valid values 0 to 999
            format: int32
          mdmEnrollmentUrl:
            type: string
            description: Enrollment url for the MDM
            nullable: true
          minutesOfInactivityBeforeDeviceLock:
            maximum: 2147483647
            minimum: -2147483648
            type: number
            description: Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked.   Range is an integer X where 0 <= X <= 999. Valid values 0 to 999
            format: int32
          numberOfPastPinsRemembered:
            maximum: 2147483647
            minimum: -2147483648
            type: number
            description: Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. This node was added in Windows 10, version 1511. Default is 0. Valid values 0 to 50
            format: int32
          passwordMaximumAttemptCount:
            maximum: 2147483647
            minimum: -2147483648
            type: number
            description: The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality. Range is an integer X where 4 <= X <= 16 for desktop and 0 <= X <= 999 for mobile devices. Valid values 0 to 999
            format: int32
          pinExpirationDays:
            maximum: 2147483647
            minimum: -2147483648
            type: number
            description: Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire. This node was added in Windows 10, version 1511. Default is 0. Valid values 0 to 730
            format: int32
          pinLowercaseLetters:
            $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionPinCharacterRequirements'
          pinMinimumLength:
            maximum: 2147483647
            minimum: -2147483648
            type: number
            description: Integer value that sets the minimum number of characters required for the PIN. Default value is 4. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127, whichever is the lowest. Valid values 0 to 127
            format: int32
          pinSpecialCharacters:
            $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionPinCharacterRequirements'
          pinUppercaseLetters:
            $ref: '#/components/schemas/microsoft.graph.windowsInformationProtectionPinCharacterRequirements'
          revokeOnMdmHandoffDisabled:
            type: boolean
            description: New property in RS2, pending documentation
          windowsHelloForBusinessBlocked:
            type: boolean
            description: Boolean value that sets Windows Hello for Business as a method for signing into Windows.
          '@odata.type':
            type: string
            default: '#microsoft.graph.windowsInformationProtectionPolicy'
        description: Policy for Windows information protection without MDM
      x-ms-discriminator-value: '#microsoft.graph.windowsInformationProtectionPolicy'
    microsoft.graph.managedMobileApp:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: managedMobileApp
        required:
        - '@odata.type'
        type: object
        properties:
          mobileAppIdentifier:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.mobileAppIdentifier'
            - type: object
              nullable: true
            description: The identifier for an app with it's operating system type.
          version:
            type: string
            description: Version of the entity.
            nullable: true
          '@odata.type':
            type: string
        description: The identifier for the deployment an app.
      x-ms-discriminator-value: '#microsoft.graph.managedMobileApp'
    microsoft.graph.windowsInformationProtectionResourceCollection:
      title: windowsInformationProtectionResourceCollection
      required:
      - '@odata.type'
      type: object
      properties:
        displayName:
          type: string
          description: Display name
        resources:
          type: array
          items:
            type: string
            nullable: true
          description: Collection of resources
        '@odata.type':
          type: string
      description: Windows Information Protection Resource Collection
    microsoft.graph.vppToken:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: vppToken
        required:
        - '@odata.type'
        type: object
        properties:
          appleId:
            type: string
            description: The apple Id associated with the given Apple Volume Purchase Program Token.
            nullable: true
          automaticallyUpdateApps:
            type: boolean
            description: Whether or not apps for the VPP token will be automatically updated.
          countryOrRegion:
            type: string
            description: Whether or not apps for the VPP token will be automatically updated.
            nullable: true
          expirationDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: The expiration date time of the Apple Volume Purchase Program Token.
            format: date-time
          lastModifiedDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: Last modification date time associated with the Apple Volume Purchase Program Token.
            format: date-time
          lastSyncDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: The last time when an application sync was done with the Apple volume purchase program service using the the Apple Volume Purchase Program Token.
            format: date-time
          lastSyncStatus:
            $ref: '#/components/schemas/microsoft.graph.vppTokenSyncStatus'
          organizationName:
            type: string
            description: The organization associated with the Apple Volume Purchase Program Token
            nullable: true
          state:
            $ref: '#/components/schemas/microsoft.graph.vppTokenState'
          token:
            type: string
            description: The Apple Volume Purchase Program Token string downloaded from the Apple Volume Purchase Program.
            nullable: true
          vppTokenAccountType:
            $ref: '#/components/schemas/microsoft.graph.vppTokenAccountType'
          '@odata.type':
            type: string
        description: You purchase multiple licenses for iOS apps through the Apple Volume Purchase Program for Business or Education. This involves setting up an Apple VPP account from the Apple website and uploading the Apple VPP Business or Education token to Intune. You can then synchronize your volume purchase information with Intune and track your volume-purchased app use. You can upload multiple Apple VPP Business or Education tokens.
      x-ms-discriminator-value: '#microsoft.graph.vppToken'
    microsoft.graph.mimeContent:
      title: mimeContent
      required:
      - '@odata.type'
      type: object
      properties:
        type:
          type: string
          description: Indicates the content mime type.
          nullable: true
        va

# --- truncated at 32 KB (231 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-deviceappmanagement-deviceappmanagement-api-openapi.yml