microsoft.graph.deviceRegistrationPolicy

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-device-registration-policy-schema.json",
  "title": "microsoft.graph.deviceRegistrationPolicy",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-policies-deviceregistrationpolicy-api-openapi.yml#/components/schemas/microsoft.graph.deviceRegistrationPolicy",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "deviceRegistrationPolicy",
      "type": "object",
      "properties": {
        "azureADJoin": {
          "$ref": "#/$defs/microsoft.graph.azureADJoinPolicy"
        },
        "azureADRegistration": {
          "$ref": "#/$defs/microsoft.graph.azureADRegistrationPolicy"
        },
        "description": {
          "type": [
            "string",
            "null"
          ],
          "description": "The description of the device registration policy. Always set to Tenant-wide policy that manages intial provisioning controls using quota restrictions, additional authentication and authorization checks. Read-only."
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "The name of the device registration policy. Always set to Device Registration Policy. Read-only."
        },
        "localAdminPassword": {
          "$ref": "#/$defs/microsoft.graph.localAdminPasswordSettings"
        },
        "multiFactorAuthConfiguration": {
          "$ref": "#/$defs/microsoft.graph.multiFactorAuthConfiguration"
        },
        "userDeviceQuota": {
          "maximum": 2147483647,
          "minimum": -2147483648,
          "type": "number",
          "description": "Specifies the maximum number of devices that a user can have within your organization before blocking new device registrations. The default value is set to 50. If this property isn't specified during the policy update operation, it's automatically reset to 0 to indicate that users aren't allowed to join any devices.",
          "format": "int32"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.azureADJoinPolicy": {
      "title": "azureADJoinPolicy",
      "type": "object",
      "properties": {
        "allowedToJoin": {
          "$ref": "#/$defs/microsoft.graph.deviceRegistrationMembership"
        },
        "isAdminConfigurable": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Determines if administrators can modify this policy."
        },
        "localAdmins": {
          "$ref": "#/$defs/microsoft.graph.localAdminSettings"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.azureADRegistrationPolicy": {
      "title": "azureADRegistrationPolicy",
      "type": "object",
      "properties": {
        "allowedToRegister": {
          "$ref": "#/$defs/microsoft.graph.deviceRegistrationMembership"
        },
        "isAdminConfigurable": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Determines if administrators can modify this policy."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.deviceRegistrationMembership": {
      "title": "deviceRegistrationMembership",
      "type": "object",
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.localAdminPasswordSettings": {
      "title": "localAdminPasswordSettings",
      "type": "object",
      "properties": {
        "isEnabled": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Specifies whether LAPS is enabled. The default value is false. An admin can set it to true to enable Local Admin Password Solution (LAPS) within their organization."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.localAdminSettings": {
      "title": "localAdminSettings",
      "type": "object",
      "properties": {
        "enableGlobalAdmins": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates whether global administrators are local administrators on all Microsoft Entra-joined devices. This setting only applies to future registrations. Default is true."
        },
        "registeringUsers": {
          "$ref": "#/$defs/microsoft.graph.deviceRegistrationMembership"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.multiFactorAuthConfiguration": {
      "title": "multiFactorAuthConfiguration",
      "enum": [
        "notRequired",
        "required",
        "unknownFutureValue"
      ],
      "type": "string"
    }
  }
}