Microsoft Graph Directory.directory API

openapi: 3.2.0
info:
  title: Microsoft Graph Admin Admin.admin Directory.directory API
  description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.

    This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,

    site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,

    SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
  version: 1.0.0
  contact:
    name: Microsoft Graph API Support
    url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph API v1.0 endpoint
tags:
- name: Directory.directory
paths:
  /directory:
    description: Provides operations to manage the directory singleton.
    get:
      tags:
      - Directory.directory
      summary: Microsoft Graph Get directory
      operationId: directory.directory.GetDirectory
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved entity
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.directory'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - Directory.directory
      summary: Microsoft Graph Update directory
      operationId: directory.directory.UpdateDirectory
      requestBody:
        description: New property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.directory'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.directory'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
components:
  schemas:
    microsoft.graph.ODataErrors.ErrorDetails:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        target:
          type: string
          nullable: true
    microsoft.graph.onPremisesDirectorySynchronizationDeletionPreventionType:
      title: onPremisesDirectorySynchronizationDeletionPreventionType
      enum:
      - disabled
      - enabledForCount
      - enabledForPercentage
      - unknownFutureValue
      type: string
    microsoft.graph.deviceLocalCredentialInfo:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: deviceLocalCredentialInfo
        required:
        - '@odata.type'
        type: object
        properties:
          credentials:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.deviceLocalCredential'
            description: The credentials of the device's local administrator account backed up to Azure Active Directory.
          deviceName:
            type: string
            description: Display name of the device that the local credentials are associated with.
          lastBackupDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: When the local administrator account credential was backed up to Azure Active Directory.
            format: date-time
          refreshDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: When the local administrator account credential will be refreshed and backed up to Azure Active Directory.
            format: date-time
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.deviceLocalCredentialInfo'
    microsoft.graph.deviceLocalCredential:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: deviceLocalCredential
        required:
        - '@odata.type'
        type: object
        properties:
          accountName:
            type: string
            description: The name of the local admin account for which LAPS is enabled.
          accountSid:
            type: string
            description: The SID of the local admin account for which LAPS is enabled.
          backupDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: When the local administrator account credential for the device object was backed up to Azure Active Directory.
            format: date-time
          passwordBase64:
            type: string
            description: The password for the local administrator account that is backed up to Azure Active Directory and returned as a Base64 encoded value.
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.deviceLocalCredential'
    microsoft.graph.identity:
      title: identity
      required:
      - '@odata.type'
      type: object
      properties:
        displayName:
          type: string
          description: The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta.
          nullable: true
        id:
          type: string
          description: Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review.
          nullable: true
        '@odata.type':
          type: string
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.azureCommunicationServicesUserIdentity': '#/components/schemas/microsoft.graph.azureCommunicationServicesUserIdentity'
          '#microsoft.graph.communicationsApplicationIdentity': '#/components/schemas/microsoft.graph.communicationsApplicationIdentity'
          '#microsoft.graph.communicationsApplicationInstanceIdentity': '#/components/schemas/microsoft.graph.communicationsApplicationInstanceIdentity'
          '#microsoft.graph.communicationsEncryptedIdentity': '#/components/schemas/microsoft.graph.communicationsEncryptedIdentity'
          '#microsoft.graph.communicationsGuestIdentity': '#/components/schemas/microsoft.graph.communicationsGuestIdentity'
          '#microsoft.graph.communicationsPhoneIdentity': '#/components/schemas/microsoft.graph.communicationsPhoneIdentity'
          '#microsoft.graph.communicationsUserIdentity': '#/components/schemas/microsoft.graph.communicationsUserIdentity'
          '#microsoft.graph.emailIdentity': '#/components/schemas/microsoft.graph.emailIdentity'
          '#microsoft.graph.initiator': '#/components/schemas/microsoft.graph.initiator'
          '#microsoft.graph.provisionedIdentity': '#/components/schemas/microsoft.graph.provisionedIdentity'
          '#microsoft.graph.provisioningServicePrincipal': '#/components/schemas/microsoft.graph.provisioningServicePrincipal'
          '#microsoft.graph.provisioningSystem': '#/components/schemas/microsoft.graph.provisioningSystem'
          '#microsoft.graph.servicePrincipalIdentity': '#/components/schemas/microsoft.graph.servicePrincipalIdentity'
          '#microsoft.graph.sharePointIdentity': '#/components/schemas/microsoft.graph.sharePointIdentity'
          '#microsoft.graph.teamworkApplicationIdentity': '#/components/schemas/microsoft.graph.teamworkApplicationIdentity'
          '#microsoft.graph.teamworkConversationIdentity': '#/components/schemas/microsoft.graph.teamworkConversationIdentity'
          '#microsoft.graph.teamworkTagIdentity': '#/components/schemas/microsoft.graph.teamworkTagIdentity'
          '#microsoft.graph.teamworkUserIdentity': '#/components/schemas/microsoft.graph.teamworkUserIdentity'
          '#microsoft.graph.userIdentity': '#/components/schemas/microsoft.graph.userIdentity'
          '#microsoft.graph.callRecords.userIdentity': '#/components/schemas/microsoft.graph.callRecords.userIdentity'
    microsoft.graph.certificateAuthorityType:
      title: certificateAuthorityType
      enum:
      - root
      - intermediate
      - unknownFutureValue
      type: string
    microsoft.graph.attributeSet:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: attributeSet
        required:
        - '@odata.type'
        type: object
        properties:
          description:
            type: string
            description: Description of the attribute set. Can be up to 128 characters long and include Unicode characters. Can be changed later.
            nullable: true
          maxAttributesPerSet:
            maximum: 2147483647
            minimum: -2147483648
            type: number
            description: Maximum number of custom security attributes that can be defined in this attribute set. Default value is null. If not specified, the administrator can add up to the maximum of 500 active attributes per tenant. Can be changed later.
            format: int32
            nullable: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.attributeSet'
    microsoft.graph.scopedRoleMembership:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: scopedRoleMembership
        required:
        - '@odata.type'
        type: object
        properties:
          administrativeUnitId:
            type: string
            description: Unique identifier for the administrative unit that the directory role is scoped to
          roleId:
            type: string
            description: Unique identifier for the directory role that the member is in.
          roleMemberInfo:
            $ref: '#/components/schemas/microsoft.graph.identity'
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.scopedRoleMembership'
    microsoft.graph.extension:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: extension
        required:
        - '@odata.type'
        type: object
        properties:
          '@odata.type':
            type: string
        discriminator:
          propertyName: '@odata.type'
          mapping:
            '#microsoft.graph.openTypeExtension': '#/components/schemas/microsoft.graph.openTypeExtension'
    microsoft.graph.ODataErrors.InnerError:
      title: InnerError
      required:
      - '@odata.type'
      type: object
      properties:
        request-id:
          type: string
          description: Request Id as tracked internally by the service
          nullable: true
        client-request-id:
          type: string
          description: Client request Id as sent by the client application.
          nullable: true
        date:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: Date when the error occured.
          format: date-time
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.customSecurityAttributeDefinition:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: customSecurityAttributeDefinition
        required:
        - '@odata.type'
        type: object
        properties:
          attributeSet:
            type: string
            description: Name of the attribute set. Case insensitive.
          description:
            type: string
            description: Description of the custom security attribute. Can be up to 128 characters long and include Unicode characters. Can be changed later.
            nullable: true
          isCollection:
            type: boolean
            description: Indicates whether multiple values can be assigned to the custom security attribute. Cannot be changed later. If type is set to Boolean, isCollection cannot be set to true.
          isSearchable:
            type: boolean
            description: Indicates whether custom security attribute values are indexed for searching on objects that are assigned attribute values. Cannot be changed later.
            nullable: true
          name:
            type: string
            description: Name of the custom security attribute. Must be unique within an attribute set. Can be up to 32 characters long and include Unicode characters. Cannot contain spaces or special characters. Cannot be changed later. Case insensitive.
          status:
            type: string
            description: 'Specifies whether the custom security attribute is active or deactivated. Acceptable values are: Available and Deprecated. Can be changed later.'
          type:
            type: string
            description: 'Data type for the custom security attribute values. Supported types are: Boolean, Integer, and String. Cannot be changed later.'
          usePreDefinedValuesOnly:
            type: boolean
            description: Indicates whether only predefined values can be assigned to the custom security attribute. If set to false, free-form values are allowed. Can later be changed from true to false, but cannot be changed from false to true. If type is set to Boolean, usePreDefinedValuesOnly cannot be set to true.
            nullable: true
          allowedValues:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.allowedValue'
            description: Values that are predefined for this custom security attribute. This navigation property is not returned by default and must be specified in an $expand query. For example, /directory/customSecurityAttributeDefinitions?$expand=allowedValues.
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.customSecurityAttributeDefinition'
    microsoft.graph.servicePlanInfo:
      title: servicePlanInfo
      required:
      - '@odata.type'
      type: object
      properties:
        appliesTo:
          type: string
          description: The object the service plan can be assigned to. The possible values are:User - service plan can be assigned to individual users.Company - service plan can be assigned to the entire tenant.
          nullable: true
        provisioningStatus:
          type: string
          description: The provisioning status of the service plan. The possible values are:Success - Service is fully provisioned.Disabled - Service is disabled.Error - The service plan isn't provisioned and is in an error state.PendingInput - The service isn't provisioned and is awaiting service confirmation.PendingActivation - The service is provisioned but requires explicit activation by an administrator (for example, Intune_O365 service plan)PendingProvisioning - Microsoft has added a new service to the product SKU and it isn't activated in the tenant.
          nullable: true
        servicePlanId:
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
          type: string
          description: The unique identifier of the service plan.
          format: uuid
          nullable: true
        servicePlanName:
          type: string
          description: The name of the service plan.
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.administrativeUnit:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.directoryObject'
      - title: administrativeUnit
        required:
        - '@odata.type'
        type: object
        properties:
          description:
            type: string
            description: An optional description for the administrative unit. Supports $filter (eq, ne, in, startsWith), $search.
            nullable: true
          displayName:
            type: string
            description: Display name for the administrative unit. Maximum length is 256 characters. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values), $search, and $orderby.
            nullable: true
          isMemberManagementRestricted:
            type: boolean
            description: true if members of this administrative unit should be treated as sensitive, which requires specific permissions to manage. If not set, the default value is null and the default behavior is false. Use this property to define administrative units with roles that don't inherit from tenant-level administrators, and where the management of individual member objects is limited to administrators scoped to a restricted management administrative unit. This property is immutable and can't be changed later.  For more information on how to work with restricted management administrative units, see Restricted management administrative units in Microsoft Entra ID.
            nullable: true
          membershipRule:
            type: string
            description: The dynamic membership rule for the administrative unit. For more information about the rules you can use for dynamic administrative units and dynamic groups, see Manage rules for dynamic membership groups in Microsoft Entra ID.
            nullable: true
          membershipRuleProcessingState:
            type: string
            description: Controls whether the dynamic membership rule is actively processed. Set to On to activate the dynamic membership rule, or Paused to stop updating membership dynamically.
            nullable: true
          membershipType:
            type: string
            description: 'Indicates the membership type for the administrative unit. The possible values are: dynamic, assigned. If not set, the default value is null and the default behavior is assigned.'
            nullable: true
          visibility:
            type: string
            description: Controls whether the administrative unit and its members are hidden or public. Can be set to HiddenMembership. If not set, the default value is null and the default behavior is public. When set to HiddenMembership, only members of the administrative unit can list other members of the administrative unit.
            nullable: true
          extensions:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.extension'
            description: The collection of open extensions defined for this administrative unit. Nullable.
            x-ms-navigationProperty: true
          members:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.directoryObject'
            description: Users and groups that are members of this administrative unit. Supports $expand.
            x-ms-navigationProperty: true
          scopedRoleMembers:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.scopedRoleMembership'
            description: Scoped-role members of this administrative unit.
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
            default: '#microsoft.graph.administrativeUnit'
      x-ms-discriminator-value: '#microsoft.graph.administrativeUnit'
    microsoft.graph.certificateAuthorityDetail:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.directoryObject'
      - title: certificateAuthorityDetail
        required:
        - '@odata.type'
        type: object
        properties:
          certificate:
            type: string
            description: The public key of the certificate authority.
            format: base64url
          certificateAuthorityType:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.certificateAuthorityType'
            - type: object
              nullable: true
            description: 'The type of certificate authority. The possible values are: root, intermediate, unknownFutureValue. Supports $filter (eq).'
          certificateRevocationListUrl:
            type: string
            description: The URL to check if the certificate is revoked.
            nullable: true
          createdDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: The date and time when the certificate authority was created.
            format: date-time
            nullable: true
          deltaCertificateRevocationListUrl:
            type: string
            nullable: true
          displayName:
            type: string
            description: The display name of the certificate authority.
            nullable: true
          expirationDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: The date and time when the certificate authority expires. Supports $filter (eq) and $orderby.
            format: date-time
          isIssuerHintEnabled:
            type: boolean
            description: Indicates whether the certificate picker presents the certificate authority to the user to use for authentication. Default value is false. Optional.
            nullable: true
          issuer:
            type: string
            description: The issuer of the certificate authority.
            nullable: true
          issuerSubjectKeyIdentifier:
            type: string
            description: The subject key identifier of certificate authority.
            nullable: true
          thumbprint:
            type: string
            description: The thumbprint of certificate authority certificate. Supports $filter (eq, startswith).
          '@odata.type':
            type: string
            default: '#microsoft.graph.certificateAuthorityDetail'
      x-ms-discriminator-value: '#microsoft.graph.certificateAuthorityDetail'
    microsoft.graph.onPremisesDirectorySynchronization:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: onPremisesDirectorySynchronization
        required:
        - '@odata.type'
        type: object
        properties:
          configuration:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.onPremisesDirectorySynchronizationConfiguration'
            - type: object
              nullable: true
            description: Consists of configurations that can be fine-tuned and impact the on-premises directory synchronization process for a tenant. Nullable.
          features:
            $ref: '#/components/schemas/microsoft.graph.onPremisesDirectorySynchronizationFeature'
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.onPremisesDirectorySynchronization'
    microsoft.graph.allowedValue:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: allowedValue
        required:
        - '@odata.type'
        type: object
        properties:
          isActive:
            type: boolean
            description: Indicates whether the predefined value is active or deactivated. If set to false, this predefined value can't be assigned to any other supported directory objects.
            nullable: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.allowedValue'
    microsoft.graph.onPremisesDirectorySynchronizationConfiguration:
      title: onPremisesDirectorySynchronizationConfiguration
      required:
      - '@odata.type'
      type: object
      properties:
        accidentalDeletionPrevention:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.onPremisesAccidentalDeletionPrevention'
          - type: object
            nullable: true
          description: Contains the accidental deletion prevention configuration for a tenant.
        '@odata.type':
          type: string
    microsoft.graph.directoryObject:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: directoryObject
        required:
        - '@odata.type'
        type: object
        properties:
          deletedDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: Date and time when this object was deleted. Always null when the object hasn't been deleted.
            format: date-time
            nullable: true
          '@odata.type':
            type: string
        discriminator:
          propertyName: '@odata.type'
          mapping:
            '#microsoft.graph.administrativeUnit': '#/components/schemas/microsoft.graph.administrativeUnit'
            '#microsoft.graph.application': '#/components/schemas/microsoft.graph.application'
            '#microsoft.graph.appRoleAssignment': '#/components/schemas/microsoft.graph.appRoleAssignment'
            '#microsoft.graph.certificateAuthorityDetail': '#/components/schemas/microsoft.graph.certificateAuthorityDetail'
            '#microsoft.graph.certificateBasedAuthPki': '#/components/schemas/microsoft.graph.certificateBasedAuthPki'
            '#microsoft.graph.contract': '#/components/schemas/microsoft.graph.contract'
            '#microsoft.graph.device': '#/components/schemas/microsoft.graph.device'
            '#microsoft.graph.directoryObjectPartnerReference': '#/components/schemas/microsoft.graph.directoryObjectPartnerReference'
            '#microsoft.graph.directoryRole': '#/components/schemas/microsoft.graph.directoryRole'
            '#microsoft.graph.directoryRoleTemplate': '#/components/schemas/microsoft.graph.directoryRoleTemplate'
            '#microsoft.graph.endpoint': '#/components/schemas/microsoft.graph.endpoint'
            '#microsoft.graph.extensionProperty': '#/components/schemas/microsoft.graph.extensionProperty'
            '#microsoft.graph.group': '#/components/schemas/microsoft.graph.group'
            '#microsoft.graph.groupSettingTemplate': '#/components/schemas/microsoft.graph.groupSettingTemplate'
            '#microsoft.graph.multiTenantOrganizationMember': '#/components/schemas/microsoft.graph.multiTenantOrganizationMember'
            '#microsoft.graph.organization': '#/components/schemas/microsoft.graph.organization'
            '#microsoft.graph.orgContact': '#/components/schemas/microsoft.graph.orgContact'
            '#microsoft.graph.policyBase': '#/components/schemas/microsoft.graph.policyBase'
            '#microsoft.graph.appManagementPolicy': '#/components/schemas/microsoft.graph.appManagementPolicy'
            '#microsoft.graph.authorizationPolicy': '#/components/schemas/microsoft.graph.authorizationPolicy'
            '#microsoft.graph.crossTenantAccessPolicy': '#/components/schemas/microsoft.graph.crossTenantAccessPolicy'
            '#microsoft.graph.identitySecurityDefaultsEnforcementPolicy': '#/components/schemas/microsoft.graph.identitySecurityDefaultsEnforcementPolicy'
            '#microsoft.graph.permissionGrantPolicy': '#/components/schemas/microsoft.graph.permissionGrantPolicy'
            '#microsoft.graph.stsPolicy': '#/components/schemas/microsoft.graph.stsPolicy'
            '#microsoft.graph.activityBasedTimeoutPolicy': '#/components/schemas/microsoft.graph.activityBasedTimeoutPolicy'
            '#microsoft.graph.claimsMappingPolicy': '#/components/schemas/microsoft.graph.claimsMappingPolicy'
            '#microsoft.graph.homeRealmDiscoveryPolicy': '#/components/schemas/microsoft.graph.homeRealmDiscoveryPolicy'
            '#microsoft.graph.tokenIssuancePolicy': '#/components/schemas/microsoft.graph.tokenIssuancePolicy'
            '#microsoft.graph.tokenLifetimePolicy': '#/components/schemas/microsoft.graph.tokenLifetimePolicy'
            '#microsoft.graph.tenantAppManagementPolicy': '#/components/schemas/microsoft.graph.tenantAppManagementPolicy'
            '#microsoft.graph.resourceSpecificPermissionGrant': '#/components/schemas/microsoft.graph.resourceSpecificPermissionGrant'
            '#microsoft.graph.servicePrincipal': '#/components/schemas/microsoft.graph.servicePrincipal'
            '#microsoft.graph.user': '#/components/schemas/microsoft.graph.user'
    microsoft.graph.ODataErrors.MainError:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
          x-ms-primary-error-message: true
        target:
          type: string
          nullable: true
        details:
          type: array
          items:
            $ref: '#/components/schemas/microsoft.graph.ODataErrors.ErrorDetails'
        innerError:
          $ref: '#/components/schemas/microsoft.graph.ODataErrors.InnerError'
    microsoft.graph.publicKeyInfrastructureRoot:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: publicKeyInfrastructureRoot
        required:
        - '@odata.type'
        type: object
        properties:
          certificateBasedAuthConfigurations:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.certificateBasedAuthPki'
            description: The collection of public key infrastructure instances for the certificate-based authentication feature for users.
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.publicKeyInfrastructureRoot'
    microsoft.graph.certificateBasedAuthPki:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.directoryObject'
      - title: certificateBasedAuthPki
        required:
        - '@odata.type'
        type: object
        properties:
          displayName:
            type: string
            description: The name of the object. Maximum length is 256 characters.
            nullable: true
          lastModifiedDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: The date and time when the object was created or last modified.
            format: date-time
          status:
            type: string
            description: The status of any asynchronous jobs runs on the object which can be upload or delete.
            nullable: true
          statusDetails:
            type: string
            description: The status details of the upload/deleted operation of PKI (Public Key Infrastructure).
            nullable: true
          certificateAuthorities:
            type: array
            items:
              $ref: '#/components/schemas/microsoft.graph.certificateAuthorityDetail'
            description: The collection of certificate authorities contained in this public key infrastructure resource.
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
            default: '#microsoft.graph.certificateBasedAuthPki'
      x-ms-discriminator-value: '#microsoft.graph.certificateBasedAuthPki'
    microsoft.graph.onPremisesDirectorySynchronizationFeature:
      title: onPremisesDirectorySynchronizationFeature
      required:
      - '@odata.type'
      type: object
      pro

# --- truncated at 32 KB (166 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-directory-directory-api-openapi.yml