microsoft.graph.conditionalAccessPolicy

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-conditional-access-policy-schema.json",
  "title": "microsoft.graph.conditionalAccessPolicy",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-identity-conditionalaccessroot-api-openapi.yml#/components/schemas/microsoft.graph.conditionalAccessPolicy",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.policyDeletableItem"
    },
    {
      "title": "conditionalAccessPolicy",
      "type": "object",
      "properties": {
        "conditions": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessConditionSet"
        },
        "createdDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "description": "The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.",
          "format": "date-time"
        },
        "description": {
          "type": [
            "string",
            "null"
          ]
        },
        "displayName": {
          "type": "string",
          "description": "Specifies a display name for the conditionalAccessPolicy object."
        },
        "grantControls": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessGrantControls"
        },
        "id": {
          "type": "string",
          "description": "Specifies the identifier of a conditionalAccessPolicy object. Read-only."
        },
        "modifiedDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "description": "The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.",
          "format": "date-time"
        },
        "sessionControls": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessSessionControls"
        },
        "state": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessPolicyState"
        },
        "templateId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Specifies the unique identifier of a Conditional Access template. Inherited from entity."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.applicationEnforcedRestrictionsSessionControl": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessSessionControl"
        },
        {
          "title": "applicationEnforcedRestrictionsSessionControl",
          "type": "object",
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationCombinationConfiguration": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationCombinationConfiguration",
          "type": "object",
          "properties": {
            "appliesToCombinations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationMethodModes"
              },
              "description": "Which authentication method combinations this configuration applies to. Must be an allowedCombinations object, part of the authenticationStrengthPolicy. The only possible value for fido2combinationConfigurations is 'fido2'."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationMethodModes": {
      "title": "authenticationMethodModes",
      "enum": [
        "password",
        "voice",
        "hardwareOath",
        "softwareOath",
        "sms",
        "fido2",
        "windowsHelloForBusiness",
        "microsoftAuthenticatorPush",
        "deviceBasedPush",
        "temporaryAccessPassOneTime",
        "temporaryAccessPassMultiUse",
        "email",
        "x509CertificateSingleFactor",
        "x509CertificateMultiFactor",
        "federatedSingleFactor",
        "federatedMultiFactor",
        "unknownFutureValue",
        "qrCodePin"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.authenticationStrengthPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationStrengthPolicy",
          "type": "object",
          "properties": {
            "allowedCombinations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationMethodModes"
              },
              "description": "A collection of authentication method modes that are required be used to satify this authentication strength."
            },
            "createdDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "The datetime when this policy was created.",
              "format": "date-time"
            },
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "The human-readable description of this policy."
            },
            "displayName": {
              "type": "string",
              "description": "The human-readable display name of this policy. Supports $filter (eq, ne, not , and in)."
            },
            "modifiedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "The datetime when this policy was last modified.",
              "format": "date-time"
            },
            "policyType": {
              "$ref": "#/$defs/microsoft.graph.authenticationStrengthPolicyType"
            },
            "requirementsSatisfied": {
              "$ref": "#/$defs/microsoft.graph.authenticationStrengthRequirements"
            },
            "combinationConfigurations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationCombinationConfiguration"
              },
              "description": "Settings that may be used to require specific types or instances of an authentication method to be used when authenticating with a specified combination of authentication methods.",
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationStrengthPolicyType": {
      "title": "authenticationStrengthPolicyType",
      "enum": [
        "builtIn",
        "custom",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationStrengthRequirements": {
      "title": "authenticationStrengthRequirements",
      "enum": [
        "none",
        "mfa",
        "unknownFutureValue"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.cloudAppSecuritySessionControl": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessSessionControl"
        },
        {
          "title": "cloudAppSecuritySessionControl",
          "type": "object",
          "properties": {
            "cloudAppSecurityType": {
              "$ref": "#/$defs/microsoft.graph.cloudAppSecuritySessionControlType"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.cloudAppSecuritySessionControlType": {
      "title": "cloudAppSecuritySessionControlType",
      "enum": [
        "mcasConfigured",
        "monitorOnly",
        "blockDownloads",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessApplications": {
      "title": "conditionalAccessApplications",
      "type": "object",
      "properties": {
        "applicationFilter": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessFilter"
        },
        "excludeApplications": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Can be one of the following:  The list of client IDs (appId) explicitly excluded from the policy. Office365 - For the list of apps included in Office365, see Apps included in Conditional Access Office 365 app suite  MicrosoftAdminPortals - For more information, see Conditional Access Target resources: Microsoft Admin Portals"
        },
        "includeApplications": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Can be one of the following:  The list of client IDs (appId) the policy applies to, unless explicitly excluded (in excludeApplications)  All  Office365 - For the list of apps included in Office365, see Apps included in Conditional Access Office 365 app suite  MicrosoftAdminPortals - For more information, see Conditional Access Target resources: Microsoft Admin Portals"
        },
        "includeAuthenticationContextClassReferences": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "includeUserActions": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "User actions to include. Supported values are urn:user:registersecurityinfo and urn:user:registerdevice"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessAuthenticationFlows": {
      "title": "conditionalAccessAuthenticationFlows",
      "type": "object",
      "properties": {
        "transferMethods": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessTransferMethods"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessClientApp": {
      "title": "conditionalAccessClientApp",
      "enum": [
        "all",
        "browser",
        "mobileAppsAndDesktopClients",
        "exchangeActiveSync",
        "easSupported",
        "other",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessClientApplications": {
      "title": "conditionalAccessClientApplications",
      "type": "object",
      "properties": {
        "excludeServicePrincipals": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Service principal IDs excluded from the policy scope."
        },
        "includeServicePrincipals": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Service principal IDs included in the policy scope, or ServicePrincipalsInMyTenant."
        },
        "servicePrincipalFilter": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessFilter"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessConditionSet": {
      "title": "conditionalAccessConditionSet",
      "type": "object",
      "properties": {
        "applications": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessApplications"
        },
        "authenticationFlows": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessAuthenticationFlows"
        },
        "clientApplications": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessClientApplications"
        },
        "clientAppTypes": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.conditionalAccessClientApp"
          },
          "description": "Client application types included in the policy. The possible values are: all, browser, mobileAppsAndDesktopClients, exchangeActiveSync, easSupported, other. Required.  The easUnsupported enumeration member will be deprecated in favor of exchangeActiveSync, which includes EAS supported and unsupported platforms."
        },
        "devices": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessDevices"
        },
        "insiderRiskLevels": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessInsiderRiskLevels"
        },
        "locations": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessLocations"
        },
        "platforms": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessPlatforms"
        },
        "servicePrincipalRiskLevels": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.riskLevel"
          },
          "description": "Service principal risk levels included in the policy. The possible values are: low, medium, high, none, unknownFutureValue."
        },
        "signInRiskLevels": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.riskLevel"
          },
          "description": "Sign-in risk levels included in the policy. The possible values are: low, medium, high, hidden, none, unknownFutureValue. Required."
        },
        "userRiskLevels": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.riskLevel"
          },
          "description": "User risk levels included in the policy. The possible values are: low, medium, high, hidden, none, unknownFutureValue. Required."
        },
        "users": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessUsers"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessDevicePlatform": {
      "title": "conditionalAccessDevicePlatform",
      "enum": [
        "android",
        "iOS",
        "windows",
        "windowsPhone",
        "macOS",
        "all",
        "unknownFutureValue",
        "linux"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessDevices": {
      "title": "conditionalAccessDevices",
      "type": "object",
      "properties": {
        "deviceFilter": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessFilter"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessExternalTenants": {
      "title": "conditionalAccessExternalTenants",
      "type": "object",
      "properties": {
        "membershipKind": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessExternalTenantsMembershipKind"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessExternalTenantsMembershipKind": {
      "title": "conditionalAccessExternalTenantsMembershipKind",
      "enum": [
        "all",
        "enumerated",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessFilter": {
      "title": "conditionalAccessFilter",
      "type": "object",
      "properties": {
        "mode": {
          "$ref": "#/$defs/microsoft.graph.filterMode"
        },
        "rule": {
          "type": "string",
          "description": "Rule syntax is similar to that used for membership rules for groups in Microsoft Entra ID. For details, see rules with multiple expressions"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessGrantControl": {
      "title": "conditionalAccessGrantControl",
      "enum": [
        "block",
        "mfa",
        "compliantDevice",
        "domainJoinedDevice",
        "approvedApplication",
        "compliantApplication",
        "passwordChange",
        "unknownFutureValue",
        "riskRemediation"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessGrantControls": {
      "title": "conditionalAccessGrantControls",
      "type": "object",
      "properties": {
        "builtInControls": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.conditionalAccessGrantControl"
          },
          "description": "List of values of built-in controls required by the policy. Possible values: block, mfa, compliantDevice, domainJoinedDevice, approvedApplication, compliantApplication, passwordChange, unknownFutureValue, riskRemediation.  Use the Prefer: include-unknown-enum-members request header to get the following value in this evolvable enum: riskRemediation."
        },
        "customAuthenticationFactors": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "List of custom controls IDs required by the policy. For more information, see Custom controls."
        },
        "operator": {
          "type": [
            "string",
            "null"
          ],
          "description": "Defines the relationship of the grant controls. Possible values: AND, OR."
        },
        "termsOfUse": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "List of terms of use IDs required by the policy."
        },
        "authenticationStrength": {
          "$ref": "#/$defs/microsoft.graph.authenticationStrengthPolicy"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessGuestOrExternalUserTypes": {
      "title": "conditionalAccessGuestOrExternalUserTypes",
      "enum": [
        "none",
        "internalGuest",
        "b2bCollaborationGuest",
        "b2bCollaborationMember",
        "b2bDirectConnectUser",
        "otherExternalUser",
        "serviceProvider",
        "unknownFutureValue"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.conditionalAccessGuestsOrExternalUsers": {
      "title": "conditionalAccessGuestsOrExternalUsers",
      "type": "object",
      "properties": {
        "externalTenants": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessExternalTenants"
        },
        "guestOrExternalUserTypes": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessGuestOrExternalUserTypes"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessInsiderRiskLevels": {
      "title": "conditionalAccessInsiderRiskLevels",
      "enum": [
        "minor",
        "moderate",
        "elevated",
        "unknownFutureValue"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.conditionalAccessLocations": {
      "title": "conditionalAccessLocations",
      "type": "object",
      "properties": {
        "excludeLocations": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Location IDs excluded from scope of policy."
        },
        "includeLocations": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Location IDs in scope of policy unless explicitly excluded, All, or AllTrusted."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessPlatforms": {
      "title": "conditionalAccessPlatforms",
      "type": "object",
      "properties": {
        "excludePlatforms": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.conditionalAccessDevicePlatform"
          },
          "description": "The possible values are: android, iOS, windows, windowsPhone, macOS, linux, all, unknownFutureValue."
        },
        "includePlatforms": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.conditionalAccessDevicePlatform"
          },
          "description": "The possible values are: android, iOS, windows, windowsPhone, macOS, linux, all, unknownFutureValue."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessPolicyState": {
      "title": "conditionalAccessPolicyState",
      "enum": [
        "enabled",
        "disabled",
        "enabledForReportingButNotEnforced"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessSessionControl": {
      "title": "conditionalAccessSessionControl",
      "type": "object",
      "properties": {
        "isEnabled": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Specifies whether the session control is enabled."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessSessionControls": {
      "title": "conditionalAccessSessionControls",
      "type": "object",
      "properties": {
        "applicationEnforcedRestrictions": {
          "$ref": "#/$defs/microsoft.graph.applicationEnforcedRestrictionsSessionControl"
        },
        "cloudAppSecurity": {
          "$ref": "#/$defs/microsoft.graph.cloudAppSecuritySessionControl"
        },
        "disableResilienceDefaults": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Session control that determines whether it is acceptable for Microsoft Entra ID to extend existing sessions based on information collected prior to an outage or not."
        },
        "persistentBrowser": {
          "$ref": "#/$defs/microsoft.graph.persistentBrowserSessionControl"
        },
        "secureSignInSession": {
          "$ref": "#/$defs/microsoft.graph.secureSignInSessionControl"
        },
        "signInFrequency": {
          "$ref": "#/$defs/microsoft.graph.signInFrequencySessionControl"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessTransferMethods": {
      "title": "conditionalAccessTransferMethods",
      "enum": [
        "none",
        "deviceCodeFlow",
        "authenticationTransfer",
        "unknownFutureValue"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.conditionalAccessUsers": {
      "title": "conditionalAccessUsers",
      "type": "object",
      "properties": {
        "excludeGroups": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Group IDs excluded from scope of policy."
        },
        "excludeGuestsOrExternalUsers": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessGuestsOrExternalUsers"
        },
        "excludeRoles": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Role IDs excluded from scope of policy."
        },
        "excludeUsers": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "User IDs excluded from scope of policy and/or GuestsOrExternalUsers."
        },
        "includeGroups": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Group IDs in scope of policy unless explicitly excluded."
        },
        "includeGuestsOrExternalUsers": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessGuestsOrExternalUsers"
        },
        "includeRoles": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Role IDs in scope of policy unless explicitly excluded."
        },
        "includeUsers": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "User IDs in scope of policy unless explicitly excluded, None, All, or GuestsOrExternalUsers."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.filterMode": {
      "title": "filterMode",
      "enum": [
        "include",
        "exclude"
      ],
      "type": "string"
    },
    "microsoft.graph.persistentBrowserSessionControl": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessSessionControl"
        },
        {
          "title": "persistentBrowserSessionControl",
          "type": "object",
          "properties": {
            "mode": {
              "$ref": "#/$defs/microsoft.graph.persistentBrowserSessionMode"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.persistentBrowserSessionMode": {
      "title": "persistentBrowserSessionMode",
      "enum": [
        "always",
        "never"
      ],
      "type": "string"
    },
    "microsoft.graph.policyDeletableItem": {
      "title": "policyDeletableItem",
      "type": "object",
      "properties": {
        "deletedDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "format": "date-time"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.riskLevel": {
      "title": "riskLevel",
      "enum": [
        "low",
        "medium",
        "high",
        "hidden",
        "none",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.secureSignInSessionControl": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessSessionControl"
        },
        {
          "title": "secureSignInSessionControl",
          "type": "object",
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.signInFrequencyAuthenticationType": {
      "title": "signInFrequencyAuthenticationType",
      "enum": [
        "primaryAndSecondaryAuthentication",
        "secondaryAuthentication",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.signInFrequencyInterval": {
      "title": "signInFrequencyInterval",
      "enum": [
        "timeBased",
        "everyTime",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.signInFrequencySessionControl": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessSessionControl"
        },
        {
          "title": "signInFrequencySessionControl",
          "type": "object",
          "properties": {
            "authenticationType": {
              "$ref": "#/$defs/microsoft.graph.signInFrequencyAuthenticationType"
            },
            "frequencyInterval": {
              "$ref": "#/$defs/microsoft.graph.signInFrequencyInterval"
            },
            "type": {
              "$ref": "#/$defs/microsoft.graph.signinFrequencyType"
            },
            "value": {
              "maximum": 2147483647,
              "minimum": -2147483648,
              "type": [
                "number",
                "null"
              ],
              "description": "The number of days or hours.",
              "format": "int32"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.signinFrequencyType": {
      "title": "signinFrequencyType",
      "enum": [
        "days",
        "hours"
      ],
      "type": "string"
    }
  }
}