openapi: 3.1.0
info:
title: Microsoft Graph Admin Admin.admin Security.security API
description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.
This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,
site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,
SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
version: 1.0.0
contact:
name: Microsoft Graph API Support
url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
description: Microsoft Graph API v1.0 endpoint
tags:
- name: Security.security
x-ms-docs-toc-type: page
paths:
/security:
description: Provides operations to manage the security singleton.
get:
tags:
- Security.security
summary: Microsoft Graph Get security
operationId: security.security.GetSecurity
parameters:
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
description: Retrieved entity
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.security'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
patch:
tags:
- Security.security
summary: Microsoft Graph Update security
operationId: security.security.UpdateSecurity
requestBody:
description: New property values
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.security'
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.security'
4XX:
$ref: '#/components/responses/error'
5XX:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
components:
schemas:
microsoft.graph.richLongRunningOperation:
allOf:
- $ref: '#/components/schemas/microsoft.graph.longRunningOperation'
- title: richLongRunningOperation
required:
- '@odata.type'
type: object
properties:
error:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.publicError'
- type: object
nullable: true
description: Error that caused the operation to fail.
percentageComplete:
maximum: 2147483647
minimum: -2147483648
type: number
description: A value between 0 and 100 that indicates the progress of the operation.
format: int32
nullable: true
resourceId:
type: string
description: The unique identifier for the result.
nullable: true
type:
type: string
description: The type of the operation.
nullable: true
'@odata.type':
type: string
description: The status of a long-running operation.
x-ms-discriminator-value: '#microsoft.graph.richLongRunningOperation'
microsoft.graph.workbookWorksheet:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: workbookWorksheet
required:
- '@odata.type'
type: object
properties:
name:
type: string
description: The display name of the worksheet.
nullable: true
position:
maximum: 2147483647
minimum: -2147483648
type: number
description: The zero-based position of the worksheet within the workbook.
format: int32
visibility:
type: string
description: 'The visibility of the worksheet. The possible values are: Visible, Hidden, VeryHidden.'
charts:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookChart'
description: The list of charts that are part of the worksheet. Read-only.
x-ms-navigationProperty: true
names:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookNamedItem'
description: The list of names that are associated with the worksheet. Read-only.
x-ms-navigationProperty: true
pivotTables:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookPivotTable'
description: The list of piot tables that are part of the worksheet.
x-ms-navigationProperty: true
protection:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.workbookWorksheetProtection'
- type: object
nullable: true
description: The sheet protection object for a worksheet. Read-only.
x-ms-navigationProperty: true
tables:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.workbookTable'
description: The list of tables that are part of the worksheet. Read-only.
x-ms-navigationProperty: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.workbookWorksheet'
microsoft.graph.emailIdentity:
allOf:
- $ref: '#/components/schemas/microsoft.graph.identity'
- title: emailIdentity
required:
- '@odata.type'
type: object
properties:
email:
type: string
description: Email address of the user.
nullable: true
'@odata.type':
type: string
default: '#microsoft.graph.emailIdentity'
x-ms-discriminator-value: '#microsoft.graph.emailIdentity'
microsoft.graph.phoneType:
title: phoneType
enum:
- home
- business
- mobile
- other
- assistant
- homeFax
- businessFax
- otherFax
- pager
- radio
type: string
microsoft.graph.profilePhoto:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: profilePhoto
required:
- '@odata.type'
type: object
properties:
height:
maximum: 2147483647
minimum: -2147483648
type: number
description: The height of the photo. Read-only.
format: int32
nullable: true
width:
maximum: 2147483647
minimum: -2147483648
type: number
description: The width of the photo. Read-only.
format: int32
nullable: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.profilePhoto'
microsoft.graph.teamworkHostedContent:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: teamworkHostedContent
required:
- '@odata.type'
type: object
properties:
contentBytes:
type: string
description: Write only. Bytes for the hosted content (such as images).
format: base64url
nullable: true
contentType:
type: string
description: Write only. Content type. such as image/png, image/jpg.
nullable: true
'@odata.type':
type: string
discriminator:
propertyName: '@odata.type'
mapping:
'#microsoft.graph.chatMessageHostedContent': '#/components/schemas/microsoft.graph.chatMessageHostedContent'
microsoft.graph.objectIdentity:
title: objectIdentity
required:
- '@odata.type'
type: object
properties:
issuer:
type: string
description: Specifies the issuer of the identity, for example facebook.com. 512 character limit. For local accounts (where signInType isn't federated), this property is the local default domain name for the tenant, for example contoso.com. For guests from other Microsoft Entra organizations, this is the domain of the federated organization, for example contoso.com. For more information about filtering behavior for this property, see Filtering on the identities property of a user.
nullable: true
issuerAssignedId:
type: string
description: 'Specifies the unique identifier assigned to the user by the issuer. 64 character limit. The combination of issuer and issuerAssignedId must be unique within the organization. Represents the sign-in name for the user, when signInType is set to emailAddress or userName (also known as local accounts).When signInType is set to: emailAddress (or a custom string that starts with emailAddress like emailAddress1), issuerAssignedId must be a valid email addressuserName, issuerAssignedId must begin with an alphabetical character or number, and can only contain alphanumeric characters and the following symbols: - or _ For more information about filtering behavior for this property, see Filtering on the identities property of a user.'
nullable: true
signInType:
type: string
description: Specifies the user sign-in types in your directory, such as emailAddress, userName, federated, or userPrincipalName. federated represents a unique identifier for a user from an issuer that can be in any format chosen by the issuer. Setting or updating a userPrincipalName identity updates the value of the userPrincipalName property on the user object. The validations performed on the userPrincipalName property on the user object, for example, verified domains and acceptable characters, are performed when setting or updating a userPrincipalName identity. Extra validation is enforced on issuerAssignedId when the sign-in type is set to emailAddress or userName. This property can also be set to any custom string. For more information about filtering behavior for this property, see Filtering on the identities property of a user.
nullable: true
'@odata.type':
type: string
microsoft.graph.security.filePlanReference:
allOf:
- $ref: '#/components/schemas/microsoft.graph.security.filePlanDescriptorBase'
- title: filePlanReference
required:
- '@odata.type'
type: object
properties:
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.security.filePlanReference'
microsoft.graph.managedAppRegistration:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: managedAppRegistration
required:
- '@odata.type'
type: object
properties:
appIdentifier:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.mobileAppIdentifier'
- type: object
nullable: true
description: The app package Identifier
applicationVersion:
type: string
description: App version
nullable: true
createdDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: Date and time of creation
format: date-time
deviceName:
type: string
description: Host device name
nullable: true
deviceTag:
type: string
description: App management SDK generated tag, which helps relate apps hosted on the same device. Not guaranteed to relate apps in all conditions.
nullable: true
deviceType:
type: string
description: Host device type
nullable: true
flaggedReasons:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppFlaggedReason'
description: Zero or more reasons an app registration is flagged. E.g. app running on rooted device
lastSyncDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: Date and time of last the app synced with management service.
format: date-time
managementSdkVersion:
type: string
description: App management SDK version
nullable: true
platformVersion:
type: string
description: Operating System version
nullable: true
userId:
type: string
description: The user Id to who this app registration belongs.
nullable: true
version:
type: string
description: Version of the entity.
nullable: true
appliedPolicies:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppPolicy'
description: Zero or more policys already applied on the registered app when it last synchronized with managment service.
x-ms-navigationProperty: true
intendedPolicies:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppPolicy'
description: Zero or more policies admin intended for the app as of now.
x-ms-navigationProperty: true
operations:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.managedAppOperation'
description: Zero or more long running operations triggered on the app registration.
x-ms-navigationProperty: true
'@odata.type':
type: string
description: The ManagedAppEntity is the base entity type for all other entity types under app management workflow.
discriminator:
propertyName: '@odata.type'
mapping:
'#microsoft.graph.androidManagedAppRegistration': '#/components/schemas/microsoft.graph.androidManagedAppRegistration'
'#microsoft.graph.iosManagedAppRegistration': '#/components/schemas/microsoft.graph.iosManagedAppRegistration'
microsoft.graph.termColumn:
title: termColumn
required:
- '@odata.type'
type: object
properties:
allowMultipleValues:
type: boolean
description: Specifies whether the column allows more than one value.
nullable: true
showFullyQualifiedName:
type: boolean
description: Specifies whether to display the entire term path or only the term label.
nullable: true
parentTerm:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.termStore.term'
- type: object
nullable: true
x-ms-navigationProperty: true
termSet:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.termStore.set'
- type: object
nullable: true
x-ms-navigationProperty: true
'@odata.type':
type: string
microsoft.graph.logonType:
title: logonType
enum:
- unknown
- interactive
- remoteInteractive
- network
- batch
- service
- unknownFutureValue
type: string
microsoft.graph.resultInfo:
title: resultInfo
required:
- '@odata.type'
type: object
properties:
code:
maximum: 2147483647
minimum: -2147483648
type: number
description: The result code.
format: int32
message:
type: string
description: The message.
nullable: true
subcode:
maximum: 2147483647
minimum: -2147483648
type: number
description: The result subcode.
format: int32
'@odata.type':
type: string
microsoft.graph.shared:
title: shared
required:
- '@odata.type'
type: object
properties:
owner:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.identitySet'
- type: object
nullable: true
description: The identity of the owner of the shared item. Read-only.
scope:
type: string
description: 'Indicates the scope of how the item is shared. The possible values are: anonymous, organization, or users. Read-only.'
nullable: true
sharedBy:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.identitySet'
- type: object
nullable: true
description: The identity of the user who shared the item. Read-only.
sharedDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: The UTC date and time when the item was shared. Read-only.
format: date-time
nullable: true
'@odata.type':
type: string
microsoft.graph.security.userSource:
allOf:
- $ref: '#/components/schemas/microsoft.graph.security.dataSource'
- title: userSource
required:
- '@odata.type'
type: object
properties:
email:
type: string
description: Email address of the user's mailbox.
includedSources:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.security.sourceType'
- type: object
nullable: true
description: 'Specifies which sources are included in this group. The possible values are: mailbox, site.'
siteWebUrl:
type: string
description: The URL of the user's OneDrive for Business site. Read-only.
nullable: true
'@odata.type':
type: string
default: '#microsoft.graph.security.userSource'
x-ms-discriminator-value: '#microsoft.graph.security.userSource'
microsoft.graph.settingValue:
title: settingValue
required:
- '@odata.type'
type: object
properties:
name:
type: string
description: Name of the setting (as defined by the groupSettingTemplate).
nullable: true
value:
type: string
description: Value of the setting.
nullable: true
'@odata.type':
type: string
microsoft.graph.managementAgentType:
title: managementAgentType
enum:
- eas
- mdm
- easMdm
- intuneClient
- easIntuneClient
- configurationManagerClient
- configurationManagerClientMdm
- configurationManagerClientMdmEas
- unknown
- jamf
- googleCloudDevicePolicyController
- microsoft365ManagedMdm
- msSense
type: string
x-ms-enum:
name: managementAgentType
modelAsString: false
values:
- value: eas
description: The device is managed by Exchange server.
name: eas
- value: mdm
description: The device is managed by Intune MDM.
name: mdm
- value: easMdm
description: The device is managed by both Exchange server and Intune MDM.
name: easMdm
- value: intuneClient
description: Intune client managed.
name: intuneClient
- value: easIntuneClient
description: The device is EAS and Intune client dual managed.
name: easIntuneClient
- value: configurationManagerClient
description: The device is managed by Configuration Manager.
name: configurationManagerClient
- value: configurationManagerClientMdm
description: The device is managed by Configuration Manager and MDM.
name: configurationManagerClientMdm
- value: configurationManagerClientMdmEas
description: The device is managed by Configuration Manager, MDM and Eas.
name: configurationManagerClientMdmEas
- value: unknown
description: Unknown management agent type.
name: unknown
- value: jamf
description: The device attributes are fetched from Jamf.
name: jamf
- value: googleCloudDevicePolicyController
description: The device is managed by Google's CloudDPC.
name: googleCloudDevicePolicyController
- value: microsoft365ManagedMdm
description: This device is managed by Microsoft 365 through Intune.
name: microsoft365ManagedMdm
microsoft.graph.security.hostPortComponent:
title: hostPortComponent
required:
- '@odata.type'
type: object
properties:
firstSeenDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: The first date and time when Microsoft Defender Threat Intelligence observed the hostPortComponent. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z.
format: date-time
nullable: true
isRecent:
type: boolean
description: Indicates whether this hostPortComponent is recent, which is determined by whether the hostPortComponent was observed either at the same time or after the latest hostPortBanner in the scan history, or within two days of the latest scan of the hostPort when there are no hostPortBanners in the scan history.
nullable: true
lastSeenDateTime:
pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
type: string
description: The last date and time when Microsoft Defender Threat Intelligence observed the hostPortComponent. The timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is 2014-01-01T00:00:00Z.
format: date-time
nullable: true
component:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.security.hostComponent'
- type: object
nullable: true
x-ms-navigationProperty: true
'@odata.type':
type: string
microsoft.graph.assignedTrainingInfo:
title: assignedTrainingInfo
required:
- '@odata.type'
type: object
properties:
assignedUserCount:
maximum: 2147483647
minimum: -2147483648
type: number
description: Number of users who were assigned the training in an attack simulation and training campaign.
format: int32
nullable: true
completedUserCount:
maximum: 2147483647
minimum: -2147483648
type: number
description: Number of users who completed the training in an attack simulation and training campaign.
format: int32
nullable: true
displayName:
type: string
description: Display name of the training in an attack simulation and training campaign.
nullable: true
'@odata.type':
type: string
microsoft.graph.endUserNotificationPreference:
title: endUserNotificationPreference
enum:
- unknown
- microsoft
- custom
- unknownFutureValue
type: string
microsoft.graph.security.healthIssueStatus:
title: healthIssueStatus
enum:
- open
- closed
- suppressed
- unknownFutureValue
type: string
microsoft.graph.workbookCommentReply:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: workbookCommentReply
required:
- '@odata.type'
type: object
properties:
content:
type: string
description: The content of the reply.
nullable: true
contentType:
type: string
description: The content type for the reply.
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.workbookCommentReply'
microsoft.graph.singleValueLegacyExtendedProperty:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: singleValueLegacyExtendedProperty
required:
- '@odata.type'
type: object
properties:
value:
type: string
description: A property value.
nullable: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.singleValueLegacyExtendedProperty'
microsoft.graph.onPremisesExtensionAttributes:
title: onPremisesExtensionAttributes
required:
- '@odata.type'
type: object
properties:
extensionAttribute1:
type: string
description: First customizable extension attribute.
nullable: true
extensionAttribute10:
type: string
description: Tenth customizable extension attribute.
nullable: true
extensionAttribute11:
type: string
description: Eleventh customizable extension attribute.
nullable: true
extensionAttribute12:
type: string
description: Twelfth customizable extension attribute.
nullable: true
extensionAttribute13:
type: string
description: Thirteenth customizable extension attribute.
nullable: true
extensionAttribute14:
type: string
description: Fourteenth customizable extension attribute.
nullable: true
extensionAttribute15:
type: string
description: Fifteenth customizable extension attribute.
nullable: true
extensionAttribute2:
type: string
description: Second customizable extension attribute.
nullable: true
extensionAttribute3:
type: string
description: Third customizable extension attribute.
nullable: true
extensionAttribute4:
type: string
description: Fourth customizable extension attribute.
nullable: true
extensionAttribute5:
type: string
description: Fifth customizable extension attribute.
nullable: true
extensionAttribute6:
type: string
description: Sixth customizable extension attribute.
nullable: true
extensionAttribute7:
type: string
description: Seventh customizable extension attribute.
nullable: true
extensionAttribute8:
type: string
description: Eighth customizable extension attribute.
nullable: true
extensionAttribute9:
type: string
description: Ninth customizable extension attribute.
nullable: true
'@odata.type':
type: string
microsoft.graph.security.incidentStatus:
title: incidentStatus
enum:
- active
- resolved
- inProgress
- redirected
- unknownFutureValue
- awaitingAction
type: string
microsoft.graph.workbookChartLegendFormat:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: workbookChartLegendFormat
required:
- '@odata.type'
type: object
properties:
fill:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.workbookChartFill'
- type: object
nullable: true
description: Represents the fill format of an object, which includes background formating information. Read-only.
x-ms-navigationProperty: true
font:
anyOf:
- $ref: '#/components/schemas/microsoft.graph.workbookChartFont'
- type: object
nullable: true
description: Represents the font attributes such as font name, font size, color, etc. of a chart legend. Read-only.
x-ms-navigationProperty: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.workbookChartLegendFormat'
microsoft.graph.responseType:
title: responseType
enum:
- none
- organizer
- tentativelyAccepted
- accepted
- declined
- notResponded
type: string
microsoft.graph.security.investigationState:
title: investigationState
enum:
- unknown
- terminated
- successfullyRemediated
- benign
- failed
- partiallyRemediated
- running
- pendingApproval
- pendingResource
- queued
- innerFailure
- preexistingAlert
- unsupportedOs
- unsupportedAlertType
- suppressedAlert
- partiallyInvestigated
- terminatedByUser
- terminatedBySystem
- unknownFutureValue
type: string
microsoft.graph.termStore.store:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: store
required:
- '@odata.type'
type: object
properties:
defaultLanguageTag:
type: string
description: Default language of the term store.
languageTags:
type: array
items:
type: string
description: List of languages for the term store.
groups:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.termStore.group'
description: Collection of all groups available in the term store.
x-ms-navigationProperty: true
sets:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.termStore.set'
description: Collection of all sets available in the term store. This relationship can only be used to load a specific term set.
x-ms-navigationProperty: true
'@odata.type':
type: string
x-ms-discriminator-value: '#microsoft.graph.termStore.store'
microsoft.graph.deviceConfigurationState:
allOf:
- $ref: '#/components/schemas/microsoft.graph.entity'
- title: deviceConfigurationState
required:
- '@odata.type'
type: object
properties:
displayName:
type: string
description: The name of the policy for this policyBase
nullable: true
platformType:
$ref: '#/components/schemas/microsoft.graph.policyPlatformType'
settingCount:
maximum: 2147483647
minimum: -2147483648
type: number
description: Count of how many setting a policy holds
format: int32
settingStates:
type: array
items:
$ref: '#/components/schemas/microsoft.graph.deviceConfigurationSettingState'
state:
$ref: '#/components/schemas/microsoft.graph.complianceStatus'
version:
maximum: 2147483647
minimum: -2147483648
type: number
description: The version of the policy
format: int32
'@odata.type':
type: string
description: Support for this Entity is being depr
# --- truncated at 32 KB (1318 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-security-security-api-openapi.yml