openapi: 3.1.0
info:
title: Microsoft Graph Admin Admin.admin policies.policyRoot API
description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.
This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,
site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,
SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
version: 1.0.0
contact:
name: Microsoft Graph API Support
url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
description: Microsoft Graph API v1.0 endpoint
tags:
- name: policies.policyRoot
x-ms-docs-toc-type: page
paths:
/policies:
description: Provides operations to manage the policyRoot singleton.
get:
tags:
- policies.policyRoot
summary: Microsoft Graph Get policies
operationId: policies.policyRoot.GetPolicyRoot
parameters:
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
description: Retrieved entity
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.policyRoot'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
patch:
tags:
- policies.policyRoot
summary: Microsoft Graph Update policies
operationId: policies.policyRoot.UpdatePolicyRoot
requestBody:
description: New property values
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.policyRoot'
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.policyRoot'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
components:
schemas:
microsoft.graph.unifiedRoleManagementPolicyRule:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: unifiedRoleManagementPolicyRule
required:
- '@odata.type'
type: object
properties:
target:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.unifiedRoleManagementPolicyRuleTarget'
- type: object
nullable: true
description: Defines details of scope that's targeted by role management policy rule. The details can include the principal type, the role assignment type, and actions affecting a role. Supports $filter (eq, ne).
'@odata.type':
type: string
discriminator:
propertyName: '@odata.type'
mapping:
'#microsoft.graph.unifiedRoleManagementPolicyApprovalRule': '#/components/schemas/microsoft.graph.unifiedRoleManagementPolicyApprovalRule'
'#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule': '#/components/schemas/microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule'
'#microsoft.graph.unifiedRoleManagementPolicyEnablementRule': '#/components/schemas/microsoft.graph.unifiedRoleManagementPolicyEnablementRule'
'#microsoft.graph.unifiedRoleManagementPolicyExpirationRule': '#/components/schemas/microsoft.graph.unifiedRoleManagementPolicyExpirationRule'
'#microsoft.graph.unifiedRoleManagementPolicyNotificationRule': '#/components/schemas/microsoft.graph.unifiedRoleManagementPolicyNotificationRule'
microsoft.graph.filterMode:
title: filterMode
enum:
- include
- exclude
type: string
microsoft.graph.unifiedRoleManagementPolicyRuleTarget:
title: unifiedRoleManagementPolicyRuleTarget
required:
- '@odata.type'
type: object
properties:
caller:
type: string
description: 'The type of caller that''s the target of the policy rule. Allowed values are: None, Admin, EndUser.'
nullable: true
enforcedSettings:
type: array
items:
type: string
nullable: true
description: The list of role settings that are enforced and cannot be overridden by child scopes. Use All for all settings.
inheritableSettings:
type: array
items:
type: string
nullable: true
description: The list of role settings that can be inherited by child scopes. Use All for all settings.
level:
type: string
description: 'The role assignment type that''s the target of policy rule. Allowed values are: Eligibility, Assignment.'
nullable: true
operations:
type: array
items:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.unifiedRoleManagementPolicyRuleTargetOperations'
- type: object
nullable: true
description: 'The role management operations that are the target of the policy rule. Allowed values are: All, Activate, Deactivate, Assign, Update, Remove, Extend, Renew.'
targetObjects:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.directoryObject'
x-ms-navigationProperty: true
'@odata.type':
type: string
microsoft.graph.permissionGrantPolicy:
allOf:
- $ref: '#/components/schemas/microsoft.graph.policyBase'
- title: permissionGrantPolicy
required:
- '@odata.type'
type: object
properties:
excludes:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.permissionGrantConditionSet'
description: Condition sets that are excluded in this permission grant policy. Automatically expanded on GET.
x-ms-navigationProperty: true
includes:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.permissionGrantConditionSet'
description: Condition sets that are included in this permission grant policy. Automatically expanded on GET.
x-ms-navigationProperty: true
'@odata.type':
type: string
default: '#microsoft.graph.permissionGrantPolicy'
x-ms-discriminator-value: '#microsoft.graph.permissionGrantPolicy'
microsoft.graph.conditionalAccessPolicyState:
title: conditionalAccessPolicyState
enum:
- enabled
- disabled
- enabledForReportingButNotEnforced
type: string
microsoft.graph.appManagementApplicationConfiguration:
allOf:
- $ref: '#/components/schemas/microsoft.graph.appManagementConfiguration'
- title: appManagementApplicationConfiguration
required:
- '@odata.type'
type: object
properties:
'@odata.type':
type: string
default: '#microsoft.graph.appManagementApplicationConfiguration'
x-ms-discriminator-value: '#microsoft.graph.appManagementApplicationConfiguration'
microsoft.graph.appManagementRestrictionState:
title: appManagementRestrictionState
enum:
- enabled
- disabled
- unknownFutureValue
type: string
microsoft.graph.stsPolicy:
allOf:
- $ref: '#/components/schemas/microsoft.graph.policyBase'
- title: stsPolicy
required:
- '@odata.type'
type: object
properties:
definition:
type: array
items:
type: string
description: A string collection containing a JSON string that defines the rules and settings for a policy. The syntax for the definition differs for each derived policy type. Required.
isOrganizationDefault:
type: boolean
description: If set to true, activates this policy. There can be many policies for the same policy type, but only one can be activated as the organization default. Optional, default value is false.
nullable: true
appliesTo:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.directoryObject'
x-ms-navigationProperty: true
'@odata.type':
type: string
default: '#microsoft.graph.stsPolicy'
discriminator:
propertyName: '@odata.type'
mapping:
'#microsoft.graph.activityBasedTimeoutPolicy': '#/components/schemas/microsoft.graph.activityBasedTimeoutPolicy'
'#microsoft.graph.claimsMappingPolicy': '#/components/schemas/microsoft.graph.claimsMappingPolicy'
'#microsoft.graph.homeRealmDiscoveryPolicy': '#/components/schemas/microsoft.graph.homeRealmDiscoveryPolicy'
'#microsoft.graph.tokenIssuancePolicy': '#/components/schemas/microsoft.graph.tokenIssuancePolicy'
'#microsoft.graph.tokenLifetimePolicy': '#/components/schemas/microsoft.graph.tokenLifetimePolicy'
microsoft.graph.conditionalAccessGrantControl:
title: conditionalAccessGrantControl
enum:
- block
- mfa
- compliantDevice
- domainJoinedDevice
- approvedApplication
- compliantApplication
- passwordChange
- unknownFutureValue
type: string
microsoft.graph.unifiedRoleManagementPolicyAssignment:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: unifiedRoleManagementPolicyAssignment
required:
- '@odata.type'
type: object
properties:
policyId:
type: string
description: The id of the policy. Inherited from entity.
roleDefinitionId:
type: string
description: For Microsoft Entra roles policy, it's the identifier of the role definition object where the policy applies. For PIM for Groups membership and ownership, it's either member or owner. Supports $filter (eq).
nullable: true
scopeId:
type: string
description: The identifier of the scope where the policy is assigned. Can be / for the tenant or a group ID. Required.
scopeType:
type: string
description: The type of the scope where the policy is assigned. One of Directory, DirectoryRole, Group. Required.
policy:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.unifiedRoleManagementPolicy'
- type: object
nullable: true
description: The policy that's associated with a policy assignment. Supports $expand and a nested $expand of the rules and effectiveRules relationships for the policy.
x-ms-navigationProperty: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.unifiedRoleManagementPolicyAssignment'
microsoft.graph.permissionGrantConditionSet:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: permissionGrantConditionSet
required:
- '@odata.type'
type: object
properties:
clientApplicationIds:
type: array
items:
type: string
nullable: true
description: A list of appId values for the client applications to match with, or a list with the single value all to match any client application. Default is the single value all.
clientApplicationPublisherIds:
type: array
items:
type: string
nullable: true
description: A list of Microsoft Partner Network (MPN) IDs for verified publishers of the client application, or a list with the single value all to match with client apps from any publisher. Default is the single value all.
clientApplicationsFromVerifiedPublisherOnly:
type: boolean
description: Set to true to only match on client applications with a verified publisher. Set to false to match on any client app, even if it doesn't have a verified publisher. Default is false.
nullable: true
clientApplicationTenantIds:
type: array
items:
type: string
nullable: true
description: A list of Microsoft Entra tenant IDs in which the client application is registered, or a list with the single value all to match with client apps registered in any tenant. Default is the single value all.
permissionClassification:
type: string
description: The permission classification for the permission being granted, or all to match with any permission classification (including permissions that aren't classified). Default is all.
nullable: true
permissions:
type: array
items:
type: string
nullable: true
description: The list of id values for the specific permissions to match with, or a list with the single value all to match with any permission. The id of delegated permissions can be found in the oauth2PermissionScopes property of the API's servicePrincipal object. The id of application permissions can be found in the appRoles property of the API's servicePrincipal object. The id of resource-specific application permissions can be found in the resourceSpecificApplicationPermissions property of the API's servicePrincipal object. Default is the single value all.
permissionType:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.permissionType'
- type: object
nullable: true
description: 'The permission type of the permission being granted. Possible values: application for application permissions (for example app roles), or delegated for delegated permissions. The value delegatedUserConsentable indicates delegated permissions that haven''t been configured by the API publisher to require admin consent—this value may be used in built-in permission grant policies, but can''t be used in custom permission grant policies. Required.'
resourceApplication:
type: string
description: The appId of the resource application (for example the API) for which a permission is being granted, or any to match with any resource application or API. Default is any.
nullable: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.permissionGrantConditionSet'
microsoft.graph.crossTenantAccessPolicyConfigurationDefault:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: crossTenantAccessPolicyConfigurationDefault
required:
- '@odata.type'
type: object
properties:
automaticUserConsentSettings:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.inboundOutboundPolicyConfiguration'
- type: object
nullable: true
description: Determines the default configuration for automatic user consent settings. The inboundAllowed and outboundAllowed properties are always false and can't be updated in the default configuration. Read-only.
b2bCollaborationInbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your default configuration for users from other organizations accessing your resources via Microsoft Entra B2B collaboration.
b2bCollaborationOutbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your default configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B collaboration.
b2bDirectConnectInbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your default configuration for users from other organizations accessing your resources via Microsoft Entra B2B direct connect.
b2bDirectConnectOutbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your default configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B direct connect.
inboundTrust:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyInboundTrust'
- type: object
nullable: true
description: Determines the default configuration for trusting other Conditional Access claims from external Microsoft Entra organizations.
invitationRedemptionIdentityProviderConfiguration:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.defaultInvitationRedemptionIdentityProviderConfiguration'
- type: object
nullable: true
description: Defines the priority order based on which an identity provider is selected during invitation redemption for a guest user.
isServiceDefault:
type: boolean
description: If true, the default configuration is set to the system default configuration. If false, the default settings are customized.
nullable: true
tenantRestrictions:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyTenantRestrictions'
- type: object
nullable: true
description: Defines the default tenant restrictions configuration for users in your organization who access an external organization on your network or devices.
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.crossTenantAccessPolicyConfigurationDefault'
microsoft.graph.conditionalAccessDevicePlatform:
title: conditionalAccessDevicePlatform
enum:
- android
- iOS
- windows
- windowsPhone
- macOS
- all
- unknownFutureValue
- linux
type: string
microsoft.graph.crossTenantAccessPolicyConfigurationPartner:
title: crossTenantAccessPolicyConfigurationPartner
required:
- '@odata.type'
type: object
properties:
automaticUserConsentSettings:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.inboundOutboundPolicyConfiguration'
- type: object
nullable: true
description: Determines the partner-specific configuration for automatic user consent settings. Unless specifically configured, the inboundAllowed and outboundAllowed properties are null and inherit from the default settings, which is always false.
b2bCollaborationInbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your partner-specific configuration for users from other organizations accessing your resources via Microsoft Entra B2B collaboration.
b2bCollaborationOutbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B collaboration.
b2bDirectConnectInbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your partner-specific configuration for users from other organizations accessing your resources via Azure B2B direct connect.
b2bDirectConnectOutbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B direct connect.
inboundTrust:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyInboundTrust'
- type: object
nullable: true
description: Determines the partner-specific configuration for trusting other Conditional Access claims from external Microsoft Entra organizations.
isInMultiTenantOrganization:
type: boolean
description: Identifies whether a tenant is a member of a multitenant organization.
nullable: true
isServiceProvider:
type: boolean
description: Identifies whether the partner-specific configuration is a Cloud Service Provider for your organization.
nullable: true
tenantId:
type: string
description: The tenant identifier for the partner Microsoft Entra organization. Read-only. Key.
tenantRestrictions:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyTenantRestrictions'
- type: object
nullable: true
description: Defines the partner-specific tenant restrictions configuration for users in your organization who access a partner organization using partner supplied identities on your network or devices.
identitySynchronization:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantIdentitySyncPolicyPartner'
- type: object
nullable: true
description: Defines the cross-tenant policy for the synchronization of users from a partner tenant. Use this user synchronization policy to streamline collaboration between users in a multitenant organization by automating the creation, update, and deletion of users from one tenant to another.
x-ms-navigationProperty: true
'@odata.type':
type: string
microsoft.graph.multiTenantOrganizationPartnerConfigurationTemplate:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: multiTenantOrganizationPartnerConfigurationTemplate
required:
- '@odata.type'
type: object
properties:
automaticUserConsentSettings:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.inboundOutboundPolicyConfiguration'
- type: object
nullable: true
description: Determines the partner-specific configuration for automatic user consent settings. Unless configured, the inboundAllowed and outboundAllowed properties are null and inherit from the default settings, which is always false.
b2bCollaborationInbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your partner-specific configuration for users from other organizations accessing your resources via Microsoft Entra B2B collaboration.
b2bCollaborationOutbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B collaboration.
b2bDirectConnectInbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your partner-specific configuration for users from other organizations accessing your resources via Azure B2B direct connect.
b2bDirectConnectOutbound:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyB2BSetting'
- type: object
nullable: true
description: Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B direct connect.
inboundTrust:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyInboundTrust'
- type: object
nullable: true
description: Determines the partner-specific configuration for trusting other Conditional Access claims from external Microsoft Entra organizations.
templateApplicationLevel:
$ref: '#/components/schemas/microsoft.graph.templateApplicationLevel'
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.multiTenantOrganizationPartnerConfigurationTemplate'
microsoft.graph.conditionalAccessExternalTenantsMembershipKind:
title: conditionalAccessExternalTenantsMembershipKind
enum:
- all
- enumerated
- unknownFutureValue
type: string
microsoft.graph.crossTenantAccessPolicyTargetConfiguration:
title: crossTenantAccessPolicyTargetConfiguration
required:
- '@odata.type'
type: object
properties:
accessType:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyTargetConfigurationAccessType'
- type: object
nullable: true
description: 'Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.'
targets:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.crossTenantAccessPolicyTarget'
description: Specifies whether to target users, groups, or applications with this rule.
'@odata.type':
type: string
microsoft.graph.conditionalAccessInsiderRiskLevels:
title: conditionalAccessInsiderRiskLevels
enum:
- minor
- moderate
- elevated
- unknownFutureValue
type: string
x-ms-enum-flags:
isFlags: true
microsoft.graph.identity:
title: identity
required:
- '@odata.type'
type: object
properties:
displayName:
type: string
description: The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta.
nullable: true
id:
type: string
description: Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review.
nullable: true
'@odata.type':
type: string
discriminator:
propertyName: '@odata.type'
mapping:
'#microsoft.graph.azureCommunicationServicesUserIdentity': '#/components/schemas/microsoft.graph.azureCommunicationServicesUserIdentity'
'#microsoft.graph.communicationsApplicationIdentity': '#/components/schemas/microsoft.graph.communicationsApplicationIdentity'
'#microsoft.graph.communicationsApplicationInstanceIdentity': '#/components/schemas/microsoft.graph.communicationsApplicationInstanceIdentity'
'#microsoft.graph.communicationsEncryptedIdentity': '#/components/schemas/microsoft.graph.communicationsEncryptedIdentity'
'#microsoft.graph.communicationsGuestIdentity': '#/components/schemas/microsoft.graph.communicationsGuestIdentity'
'#microsoft.graph.communicationsPhoneIdentity': '#/components/schemas/microsoft.graph.communicationsPhoneIdentity'
'#microsoft.graph.communicationsUserIdentity': '#/components/schemas/microsoft.graph.communicationsUserIdentity'
'#microsoft.graph.emailIdentity': '#/components/schemas/microsoft.graph.emailIdentity'
'#microsoft.graph.initiator': '#/components/schemas/microsoft.graph.initiator'
'#microsoft.graph.provisionedIdentity': '#/components/schemas/microsoft.graph.provisionedIdentity'
'#microsoft.graph.provisioningServicePrincipal': '#/components/schemas/microsoft.graph.provisioningServicePrincipal'
'#microsoft.graph.provisioningSystem': '#/components/schemas/microsoft.graph.provisioningSystem'
'#microsoft.graph.servicePrincipalIdentity': '#/components/schemas/microsoft.graph.servicePrincipalIdentity'
'#microsoft.graph.sharePointIdentity': '#/components/schemas/microsoft.graph.sharePointIdentity'
'#microsoft.graph.teamworkApplicationIdentity': '#/components/schemas/microsoft.graph.teamworkApplicationIdentity'
'#microsoft.graph.teamworkConversationIdentity': '#/components/schemas/microsoft.graph.teamworkConversationIdentity'
'#microsoft.graph.teamworkTagIdentity': '#/components/schemas/microsoft.graph.teamworkTagIdentity'
'#microsoft.graph.teamworkUserIdentity': '#/components/schemas/microsoft.graph.teamworkUserIdentity'
'#microsoft.graph.userIdentity': '#/components/schemas/microsoft.graph.userIdentity'
'#microsoft.graph.callRecords.userIdentity': '#/components/schemas/microsoft.graph.callRecords.userIdentity'
microsoft.graph.signInFrequencySessionControl:
allOf:
- $ref: '#/components/schemas/microsoft.graph.conditionalAccessSessionControl'
- title: signInFrequencySessionControl
required:
- '@odata.type'
type: object
properties:
authenticationType:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.signInFrequencyAuthenticationType'
- type: object
nullable: true
description: The possible values are primaryAndSecondaryAuthentication, secondaryAuthentication, unknownFutureValue. This property isn't required when using frequencyInterval with the value of timeBased.
frequencyInterval:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.signInFrequencyInterval'
- type: object
nullable: true
description: The possible values are timeBased, everyTime, unknownFutureValue. Sign-in frequency of everyTime is available for risky users, risky sign-ins, and Intune device enrollment. For more information, see Require reauthentication every time.
type:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.signinFrequencyType'
- type: object
nullable: true
description: 'The possible values are: days, hours.'
value:
maximum: 2147483647
minimum: -2147483648
type: number
description: The number of days or hours.
format: int32
nullable: true
'@odata.type':
type: string
default: '#microsoft.graph.signInFrequencySessionControl'
x-ms-discriminator-value: '#microsoft.graph.signInFrequencySessionControl'
microsoft.graph.customAppManagementConfiguration:
allOf:
- $ref: '#/component
# --- truncated at 32 KB (245 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-policies-policyroot-api-openapi.yml