openapi: 3.1.0
info:
title: Microsoft Graph Admin Admin.admin identityGovernance.identityGovernance API
description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.
This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,
site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,
SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
version: 1.0.0
contact:
name: Microsoft Graph API Support
url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
description: Microsoft Graph API v1.0 endpoint
tags:
- name: identityGovernance.identityGovernance
paths:
/identityGovernance:
description: Provides operations to manage the identityGovernance singleton.
get:
tags:
- identityGovernance.identityGovernance
summary: Microsoft Graph Get identityGovernance
operationId: identityGovernance.identityGovernance.GetIdentityGovernance
parameters:
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
description: Retrieved entity
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.identityGovernance'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
patch:
tags:
- identityGovernance.identityGovernance
summary: Microsoft Graph Update identityGovernance
operationId: identityGovernance.identityGovernance.UpdateIdentityGovernance
requestBody:
description: New property values
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.identityGovernance'
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.identityGovernance'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
components:
schemas:
microsoft.graph.richLongRunningOperation:
allOf:
- $ref: '#/components/schemas/microsoft.graph.longRunningOperation'
- title: richLongRunningOperation
required:
- '@odata.type'
type: object
properties:
error:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.publicError'
- type: object
nullable: true
description: Error that caused the operation to fail.
percentageComplete:
maximum: 2147483647
minimum: -2147483648
type: number
description: A value between 0 and 100 that indicates the progress of the operation.
format: int32
nullable: true
resourceId:
type: string
description: The unique identifier for the result.
nullable: true
type:
type: string
description: The type of the operation.
nullable: true
'@odata.type':
type: string
description: The status of a long-running operation.
x-ms-discriminator-value: '#microsoft.graph.richLongRunningOperation'
microsoft.graph.workbookWorksheet:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: workbookWorksheet
required:
- '@odata.type'
type: object
properties:
name:
type: string
description: The display name of the worksheet.
nullable: true
position:
maximum: 2147483647
minimum: -2147483648
type: number
description: The zero-based position of the worksheet within the workbook.
format: int32
visibility:
type: string
description: 'The visibility of the worksheet. The possible values are: Visible, Hidden, VeryHidden.'
charts:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookChart'
description: The list of charts that are part of the worksheet. Read-only.
x-ms-navigationProperty: true
names:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookNamedItem'
description: The list of names that are associated with the worksheet. Read-only.
x-ms-navigationProperty: true
pivotTables:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookPivotTable'
description: The list of piot tables that are part of the worksheet.
x-ms-navigationProperty: true
protection:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.workbookWorksheetProtection'
- type: object
nullable: true
description: The sheet protection object for a worksheet. Read-only.
x-ms-navigationProperty: true
tables:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookTable'
description: The list of tables that are part of the worksheet. Read-only.
x-ms-navigationProperty: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.workbookWorksheet'
microsoft.graph.accessPackageSubject:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: accessPackageSubject
required:
- '@odata.type'
type: object
properties:
displayName:
type: string
description: The display name of the subject.
nullable: true
email:
type: string
description: The email address of the subject.
nullable: true
objectId:
type: string
description: The object identifier of the subject. null if the subject isn't yet a user in the tenant.
nullable: true
onPremisesSecurityIdentifier:
type: string
description: A string representation of the principal's security identifier, if known, or null if the subject doesn't have a security identifier.
nullable: true
principalName:
type: string
description: The principal name, if known, of the subject.
nullable: true
subjectType:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.accessPackageSubjectType'
- type: object
nullable: true
description: 'The resource type of the subject. The possible values are: notSpecified, user, servicePrincipal, unknownFutureValue.'
connectedOrganization:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.connectedOrganization'
- type: object
nullable: true
description: The connected organization of the subject. Read-only. Nullable.
x-ms-navigationProperty: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.accessPackageSubject'
microsoft.graph.teamworkHostedContent:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: teamworkHostedContent
required:
- '@odata.type'
type: object
properties:
contentBytes:
type: string
description: Write only. Bytes for the hosted content (such as images).
format: base64url
nullable: true
contentType:
type: string
description: Write only. Content type. such as image/png, image/jpg.
nullable: true
'@odata.type':
type: string
discriminator:
propertyName: '@odata.type'
mapping:
'#microsoft.graph.chatMessageHostedContent': '#/components/schemas/microsoft.graph.chatMessageHostedContent'
microsoft.graph.profilePhoto:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: profilePhoto
required:
- '@odata.type'
type: object
properties:
height:
maximum: 2147483647
minimum: -2147483648
type: number
description: The height of the photo. Read-only.
format: int32
nullable: true
width:
maximum: 2147483647
minimum: -2147483648
type: number
description: The width of the photo. Read-only.
format: int32
nullable: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.profilePhoto'
microsoft.graph.phoneType:
title: phoneType
enum:
- home
- business
- mobile
- other
- assistant
- homeFax
- businessFax
- otherFax
- pager
- radio
type: string
microsoft.graph.objectIdentity:
title: objectIdentity
required:
- '@odata.type'
type: object
properties:
issuer:
type: string
description: Specifies the issuer of the identity, for example facebook.com. 512 character limit. For local accounts (where signInType isn't federated), this property is the local default domain name for the tenant, for example contoso.com. For guests from other Microsoft Entra organizations, this is the domain of the federated organization, for example contoso.com. For more information about filtering behavior for this property, see Filtering on the identities property of a user.
nullable: true
issuerAssignedId:
type: string
description: 'Specifies the unique identifier assigned to the user by the issuer. 64 character limit. The combination of issuer and issuerAssignedId must be unique within the organization. Represents the sign-in name for the user, when signInType is set to emailAddress or userName (also known as local accounts).When signInType is set to: emailAddress (or a custom string that starts with emailAddress like emailAddress1), issuerAssignedId must be a valid email addressuserName, issuerAssignedId must begin with an alphabetical character or number, and can only contain alphanumeric characters and the following symbols: - or _ For more information about filtering behavior for this property, see Filtering on the identities property of a user.'
nullable: true
signInType:
type: string
description: Specifies the user sign-in types in your directory, such as emailAddress, userName, federated, or userPrincipalName. federated represents a unique identifier for a user from an issuer that can be in any format chosen by the issuer. Setting or updating a userPrincipalName identity updates the value of the userPrincipalName property on the user object. The validations performed on the userPrincipalName property on the user object, for example, verified domains and acceptable characters, are performed when setting or updating a userPrincipalName identity. Extra validation is enforced on issuerAssignedId when the sign-in type is set to emailAddress or userName. This property can also be set to any custom string. For more information about filtering behavior for this property, see Filtering on the identities property of a user.
nullable: true
'@odata.type':
type: string
microsoft.graph.managedAppRegistration:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: managedAppRegistration
required:
- '@odata.type'
type: object
properties:
appIdentifier:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.mobileAppIdentifier'
- type: object
nullable: true
description: The app package Identifier
applicationVersion:
type: string
description: App version
nullable: true
createdDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: Date and time of creation
format: date-time
deviceName:
type: string
description: Host device name
nullable: true
deviceTag:
type: string
description: App management SDK generated tag, which helps relate apps hosted on the same device. Not guaranteed to relate apps in all conditions.
nullable: true
deviceType:
type: string
description: Host device type
nullable: true
flaggedReasons:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppFlaggedReason'
description: Zero or more reasons an app registration is flagged. E.g. app running on rooted device
lastSyncDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: Date and time of last the app synced with management service.
format: date-time
managementSdkVersion:
type: string
description: App management SDK version
nullable: true
platformVersion:
type: string
description: Operating System version
nullable: true
userId:
type: string
description: The user Id to who this app registration belongs.
nullable: true
version:
type: string
description: Version of the entity.
nullable: true
appliedPolicies:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppPolicy'
description: Zero or more policys already applied on the registered app when it last synchronized with managment service.
x-ms-navigationProperty: true
intendedPolicies:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppPolicy'
description: Zero or more policies admin intended for the app as of now.
x-ms-navigationProperty: true
operations:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppOperation'
description: Zero or more long running operations triggered on the app registration.
x-ms-navigationProperty: true
'@odata.type':
type: string
description: The ManagedAppEntity is the base entity type for all other entity types under app management workflow.
discriminator:
propertyName: '@odata.type'
mapping:
'#microsoft.graph.androidManagedAppRegistration': '#/components/schemas/microsoft.graph.androidManagedAppRegistration'
'#microsoft.graph.iosManagedAppRegistration': '#/components/schemas/microsoft.graph.iosManagedAppRegistration'
microsoft.graph.termColumn:
title: termColumn
required:
- '@odata.type'
type: object
properties:
allowMultipleValues:
type: boolean
description: Specifies whether the column allows more than one value.
nullable: true
showFullyQualifiedName:
type: boolean
description: Specifies whether to display the entire term path or only the term label.
nullable: true
parentTerm:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.termStore.term'
- type: object
nullable: true
x-ms-navigationProperty: true
termSet:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.termStore.set'
- type: object
nullable: true
x-ms-navigationProperty: true
'@odata.type':
type: string
microsoft.graph.accessPackageAutomaticRequestSettings:
title: accessPackageAutomaticRequestSettings
required:
- '@odata.type'
type: object
properties:
gracePeriodBeforeAccessRemoval:
pattern: ^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$
type: string
description: The duration for which access must be retained before the target's access is revoked once they leave the allowed target scope.
format: duration
nullable: true
removeAccessWhenTargetLeavesAllowedTargets:
type: boolean
description: Indicates whether automatic assignment must be removed for targets who move out of the allowed target scope.
nullable: true
requestAccessForAllowedTargets:
type: boolean
description: If set to true, automatic assignments will be created for targets in the allowed target scope.
nullable: true
'@odata.type':
type: string
microsoft.graph.shared:
title: shared
required:
- '@odata.type'
type: object
properties:
owner:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.identitySet'
- type: object
nullable: true
description: The identity of the owner of the shared item. Read-only.
scope:
type: string
description: 'Indicates the scope of how the item is shared. The possible values are: anonymous, organization, or users. Read-only.'
nullable: true
sharedBy:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.identitySet'
- type: object
nullable: true
description: The identity of the user who shared the item. Read-only.
sharedDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: The UTC date and time when the item was shared. Read-only.
format: date-time
nullable: true
'@odata.type':
type: string
microsoft.graph.settingValue:
title: settingValue
required:
- '@odata.type'
type: object
properties:
name:
type: string
description: Name of the setting (as defined by the groupSettingTemplate).
nullable: true
value:
type: string
description: Value of the setting.
nullable: true
'@odata.type':
type: string
microsoft.graph.managementAgentType:
title: managementAgentType
enum:
- eas
- mdm
- easMdm
- intuneClient
- easIntuneClient
- configurationManagerClient
- configurationManagerClientMdm
- configurationManagerClientMdmEas
- unknown
- jamf
- googleCloudDevicePolicyController
- microsoft365ManagedMdm
- msSense
type: string
x-ms-enum:
name: managementAgentType
modelAsString: false
values:
- value: eas
description: The device is managed by Exchange server.
name: eas
- value: mdm
description: The device is managed by Intune MDM.
name: mdm
- value: easMdm
description: The device is managed by both Exchange server and Intune MDM.
name: easMdm
- value: intuneClient
description: Intune client managed.
name: intuneClient
- value: easIntuneClient
description: The device is EAS and Intune client dual managed.
name: easIntuneClient
- value: configurationManagerClient
description: The device is managed by Configuration Manager.
name: configurationManagerClient
- value: configurationManagerClientMdm
description: The device is managed by Configuration Manager and MDM.
name: configurationManagerClientMdm
- value: configurationManagerClientMdmEas
description: The device is managed by Configuration Manager, MDM and Eas.
name: configurationManagerClientMdmEas
- value: unknown
description: Unknown management agent type.
name: unknown
- value: jamf
description: The device attributes are fetched from Jamf.
name: jamf
- value: googleCloudDevicePolicyController
description: The device is managed by Google's CloudDPC.
name: googleCloudDevicePolicyController
- value: microsoft365ManagedMdm
description: This device is managed by Microsoft 365 through Intune.
name: microsoft365ManagedMdm
microsoft.graph.userConsentRequest:
allOf:
- $ref: '#/components/schemas/microsoft.graph.request'
- title: userConsentRequest
required:
- '@odata.type'
type: object
properties:
reason:
type: string
description: The user's justification for requiring access to the app. Supports $filter (eq only) and $orderby.
nullable: true
approval:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.approval'
- type: object
nullable: true
description: Approval decisions associated with a request.
x-ms-navigationProperty: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.userConsentRequest'
microsoft.graph.privilegedAccessScheduleInstance:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: privilegedAccessScheduleInstance
required:
- '@odata.type'
type: object
properties:
endDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: When the schedule instance ends. Required.
format: date-time
nullable: true
startDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: When this instance starts. Required.
format: date-time
nullable: true
'@odata.type':
type: string
discriminator:
propertyName: '@odata.type'
mapping:
'#microsoft.graph.privilegedAccessGroupAssignmentScheduleInstance': '#/components/schemas/microsoft.graph.privilegedAccessGroupAssignmentScheduleInstance'
'#microsoft.graph.privilegedAccessGroupEligibilityScheduleInstance': '#/components/schemas/microsoft.graph.privilegedAccessGroupEligibilityScheduleInstance'
microsoft.graph.workbookCommentReply:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: workbookCommentReply
required:
- '@odata.type'
type: object
properties:
content:
type: string
description: The content of the reply.
nullable: true
contentType:
type: string
description: The content type for the reply.
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.workbookCommentReply'
microsoft.graph.singleValueLegacyExtendedProperty:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: singleValueLegacyExtendedProperty
required:
- '@odata.type'
type: object
properties:
value:
type: string
description: A property value.
nullable: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.singleValueLegacyExtendedProperty'
microsoft.graph.onPremisesExtensionAttributes:
title: onPremisesExtensionAttributes
required:
- '@odata.type'
type: object
properties:
extensionAttribute1:
type: string
description: First customizable extension attribute.
nullable: true
extensionAttribute10:
type: string
description: Tenth customizable extension attribute.
nullable: true
extensionAttribute11:
type: string
description: Eleventh customizable extension attribute.
nullable: true
extensionAttribute12:
type: string
description: Twelfth customizable extension attribute.
nullable: true
extensionAttribute13:
type: string
description: Thirteenth customizable extension attribute.
nullable: true
extensionAttribute14:
type: string
description: Fourteenth customizable extension attribute.
nullable: true
extensionAttribute15:
type: string
description: Fifteenth customizable extension attribute.
nullable: true
extensionAttribute2:
type: string
description: Second customizable extension attribute.
nullable: true
extensionAttribute3:
type: string
description: Third customizable extension attribute.
nullable: true
extensionAttribute4:
type: string
description: Fourth customizable extension attribute.
nullable: true
extensionAttribute5:
type: string
description: Fifth customizable extension attribute.
nullable: true
extensionAttribute6:
type: string
description: Sixth customizable extension attribute.
nullable: true
extensionAttribute7:
type: string
description: Seventh customizable extension attribute.
nullable: true
extensionAttribute8:
type: string
description: Eighth customizable extension attribute.
nullable: true
extensionAttribute9:
type: string
description: Ninth customizable extension attribute.
nullable: true
'@odata.type':
type: string
microsoft.graph.workbookChartLegendFormat:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: workbookChartLegendFormat
required:
- '@odata.type'
type: object
properties:
fill:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.workbookChartFill'
- type: object
nullable: true
description: Represents the fill format of an object, which includes background formating information. Read-only.
x-ms-navigationProperty: true
font:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.workbookChartFont'
- type: object
nullable: true
description: Represents the font attributes such as font name, font size, color, etc. of a chart legend. Read-only.
x-ms-navigationProperty: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.workbookChartLegendFormat'
microsoft.graph.responseType:
title: responseType
enum:
- none
- organizer
- tentativelyAccepted
- accepted
- declined
- notResponded
type: string
microsoft.graph.identityGovernance.taskDefinition:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: taskDefinition
required:
- '@odata.type'
type: object
properties:
category:
$ref: '#/components/schemas/microsoft.graph.identityGovernance.lifecycleTaskCategory'
continueOnError:
type: boolean
description: Defines if the workflow will continue if the task has an error.
description:
type: string
description: The description of the taskDefinition.
nullable: true
displayName:
type: string
description: The display name of the taskDefinition.Supports $filter(eq, ne) and $orderby.
parameters:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.identityGovernance.parameter'
description: The parameters that must be supplied when creating a workflow task object.Supports $filter(any).
version:
maximum: 2147483647
minimum: -2147483648
type: number
description: The version number of the taskDefinition. New records are pushed when we add support for new parameters.Supports $filter(ge, gt, le, lt, eq, ne) and $orderby.
format: int32
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.identityGovernance.taskDefinition'
microsoft.graph.termStore.store:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: store
required:
- '@odata.type'
type: object
properties:
defaultLanguageTag:
type: string
description: Default language of the term store.
languageTags:
type: array
items:
type: string
description: List of languages for the term store.
groups:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.termStore.group'
description: Collection of all groups available in the term store.
x-ms-navigationProperty: true
sets:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.termStore.set'
description: Collection of all sets available in the term store. This relationship can only be used to load a specific term set.
x-ms-navigationProperty: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.termStore.store'
microsoft.graph.deviceConfigurationState:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: deviceConfigurationState
required:
- '@odata.type'
type: object
properties:
displayName:
type: string
description: The name of the policy for this policyBase
nullable: true
platformType:
$ref: '#/components/schemas/microsoft.graph.policyPlatformType'
settingCount:
maximum: 2147483647
minimum: -2147483648
type: number
description: Count of how many setting a policy holds
format: int32
settingStates:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.deviceConfigurationSettingState'
state:
$ref: '#/components/schemas/microsoft.graph.complianceStatus'
version:
maximum: 2147483647
minimum: -2147483648
type: number
description: The version of the policy
format: int32
'@odata.t
# --- truncated at 32 KB (1195 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-identitygovernance-identitygovernance-api-openapi.yml