microsoft.graph.identityContainer

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-identity-container-schema.json",
  "title": "microsoft.graph.identityContainer",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-identity-identitycontainer-api-openapi.yml#/components/schemas/microsoft.graph.identityContainer",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "identityContainer",
      "type": "object",
      "properties": {
        "apiConnectors": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.identityApiConnector"
          },
          "description": "Represents entry point for API connectors.",
          "x-ms-navigationProperty": true
        },
        "authenticationEventListeners": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.authenticationEventListener"
          },
          "description": "Represents listeners for custom authentication extension events in Azure AD for workforce and customers.",
          "x-ms-navigationProperty": true
        },
        "authenticationEventsFlows": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.authenticationEventsFlow"
          },
          "description": "Represents the entry point for self-service sign-up and sign-in user flows in both Microsoft Entra workforce and external tenants.",
          "x-ms-navigationProperty": true
        },
        "b2xUserFlows": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.b2xIdentityUserFlow"
          },
          "description": "Represents entry point for B2X/self-service sign-up identity userflows.",
          "x-ms-navigationProperty": true
        },
        "conditionalAccess": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessRoot"
        },
        "customAuthenticationExtensions": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.customAuthenticationExtension"
          },
          "description": "Represents custom extensions to authentication flows in Azure AD for workforce and customers.",
          "x-ms-navigationProperty": true
        },
        "identityProviders": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.identityProviderBase"
          },
          "x-ms-navigationProperty": true
        },
        "riskPrevention": {
          "$ref": "#/$defs/microsoft.graph.riskPreventionContainer"
        },
        "userFlowAttributes": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.identityUserFlowAttribute"
          },
          "description": "Represents entry point for identity userflow attributes.",
          "x-ms-navigationProperty": true
        },
        "verifiedId": {
          "$ref": "#/$defs/microsoft.graph.identityVerifiedIdRoot"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.apiAuthenticationConfigurationBase": {
      "title": "apiAuthenticationConfigurationBase",
      "type": "object",
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.applicationEnforcedRestrictionsSessionControl": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessSessionControl"
        },
        {
          "title": "applicationEnforcedRestrictionsSessionControl",
          "type": "object",
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationCombinationConfiguration": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationCombinationConfiguration",
          "type": "object",
          "properties": {
            "appliesToCombinations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationMethodModes"
              },
              "description": "Which authentication method combinations this configuration applies to. Must be an allowedCombinations object, part of the authenticationStrengthPolicy. The only possible value for fido2combinationConfigurations is 'fido2'."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationConditionApplication": {
      "title": "authenticationConditionApplication",
      "type": "object",
      "properties": {
        "appId": {
          "type": "string",
          "description": "The identifier for an application corresponding to a condition which will trigger an authenticationEventListener."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.authenticationConditions": {
      "title": "authenticationConditions",
      "type": "object",
      "properties": {
        "applications": {
          "$ref": "#/$defs/microsoft.graph.authenticationConditionsApplications"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.authenticationConditionsApplications": {
      "title": "authenticationConditionsApplications",
      "type": "object",
      "properties": {
        "includeApplications": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.authenticationConditionApplication"
          },
          "x-ms-navigationProperty": true
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.authenticationContextClassReference": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationContextClassReference",
          "type": "object",
          "properties": {
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "A short explanation of the policies that are enforced by authenticationContextClassReference. This value should be used to provide secondary text to describe the authentication context class reference when building user-facing admin experiences. For example, a selection UX."
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "The display name is the friendly name of the authenticationContextClassReference object. This value should be used to identify the authentication context class reference when building user-facing admin experiences. For example, a selection UX."
            },
            "isAvailable": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Indicates whether the authenticationContextClassReference has been published by the security admin and is ready for use by apps. When it's set to false, it shouldn't be shown in authentication context selection UX, or used to protect app resources. It's shown and available for Conditional Access policy authoring. The default value is false.  Supports $filter (eq)."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationEventListener": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationEventListener",
          "type": "object",
          "properties": {
            "authenticationEventsFlowId": {
              "type": [
                "string",
                "null"
              ],
              "description": "The identifier of the authenticationEventsFlow object."
            },
            "conditions": {
              "$ref": "#/$defs/microsoft.graph.authenticationConditions"
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "The display name of the listener."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationEventsFlow": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationEventsFlow",
          "type": "object",
          "properties": {
            "conditions": {
              "$ref": "#/$defs/microsoft.graph.authenticationConditions"
            },
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "The description of the events policy."
            },
            "displayName": {
              "type": "string",
              "description": "Required. The display name for the events policy."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationMethodModeDetail": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationMethodModeDetail",
          "type": "object",
          "properties": {
            "authenticationMethod": {
              "$ref": "#/$defs/microsoft.graph.baseAuthenticationMethod"
            },
            "displayName": {
              "type": "string",
              "description": "The display name of this mode"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationMethodModes": {
      "title": "authenticationMethodModes",
      "enum": [
        "password",
        "voice",
        "hardwareOath",
        "softwareOath",
        "sms",
        "fido2",
        "windowsHelloForBusiness",
        "microsoftAuthenticatorPush",
        "deviceBasedPush",
        "temporaryAccessPassOneTime",
        "temporaryAccessPassMultiUse",
        "email",
        "x509CertificateSingleFactor",
        "x509CertificateMultiFactor",
        "federatedSingleFactor",
        "federatedMultiFactor",
        "unknownFutureValue",
        "qrCodePin"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.authenticationStrengthPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationStrengthPolicy",
          "type": "object",
          "properties": {
            "allowedCombinations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationMethodModes"
              },
              "description": "A collection of authentication method modes that are required be used to satify this authentication strength."
            },
            "createdDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "The datetime when this policy was created.",
              "format": "date-time"
            },
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "The human-readable description of this policy."
            },
            "displayName": {
              "type": "string",
              "description": "The human-readable display name of this policy. Supports $filter (eq, ne, not , and in)."
            },
            "modifiedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "The datetime when this policy was last modified.",
              "format": "date-time"
            },
            "policyType": {
              "$ref": "#/$defs/microsoft.graph.authenticationStrengthPolicyType"
            },
            "requirementsSatisfied": {
              "$ref": "#/$defs/microsoft.graph.authenticationStrengthRequirements"
            },
            "combinationConfigurations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationCombinationConfiguration"
              },
              "description": "Settings that may be used to require specific types or instances of an authentication method to be used when authenticating with a specified combination of authentication methods.",
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationStrengthPolicyType": {
      "title": "authenticationStrengthPolicyType",
      "enum": [
        "builtIn",
        "custom",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationStrengthRequirements": {
      "title": "authenticationStrengthRequirements",
      "enum": [
        "none",
        "mfa",
        "unknownFutureValue"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.authenticationStrengthRoot": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationStrengthRoot",
          "type": "object",
          "properties": {
            "combinations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationMethodModes"
              }
            },
            "authenticationMethodModes": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationMethodModeDetail"
              },
              "description": "Names and descriptions of all valid authentication method modes in the system.",
              "x-ms-navigationProperty": true
            },
            "policies": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationStrengthPolicy"
              },
              "description": "A collection of authentication strength policies that exist for this tenant, including both built-in and custom policies.",
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.b2xIdentityUserFlow": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.identityUserFlow"
        },
        {
          "title": "b2xIdentityUserFlow",
          "type": "object",
          "properties": {
            "apiConnectorConfiguration": {
              "$ref": "#/$defs/microsoft.graph.userFlowApiConnectorConfiguration"
            },
            "identityProviders": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.identityProvider"
              },
              "description": "The identity providers included in the user flow.",
              "x-ms-navigationProperty": true
            },
            "languages": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.userFlowLanguageConfiguration"
              },
              "description": "The languages supported for customization within the user flow. Language customization is enabled by default in self-service sign-up user flow. You can't create custom languages in self-service sign-up user flows.",
              "x-ms-navigationProperty": true
            },
            "userAttributeAssignments": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.identityUserFlowAttributeAssignment"
              },
              "description": "The user attribute assignments included in the user flow.",
              "x-ms-navigationProperty": true
            },
            "userFlowIdentityProviders": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.identityProviderBase"
              },
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.baseAuthenticationMethod": {
      "title": "baseAuthenticationMethod",
      "enum": [
        "password",
        "voice",
        "hardwareOath",
        "softwareOath",
        "sms",
        "fido2",
        "windowsHelloForBusiness",
        "microsoftAuthenticator",
        "temporaryAccessPass",
        "email",
        "x509Certificate",
        "federation",
        "unknownFutureValue",
        "qrCodePin"
      ],
      "type": "string"
    },
    "microsoft.graph.caPoliciesDeletableRoot": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "caPoliciesDeletableRoot",
          "type": "object",
          "properties": {
            "namedLocations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.namedLocation"
              },
              "x-ms-navigationProperty": true
            },
            "policies": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.conditionalAccessPolicy"
              },
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.claimBinding": {
      "title": "claimBinding",
      "type": "object",
      "properties": {
        "matchConfidenceLevel": {
          "$ref": "#/$defs/microsoft.graph.matchConfidenceLevel"
        },
        "sourceAttribute": {
          "type": "string",
          "description": "Source attribute name from the source system, for example a directory attribute."
        },
        "verifiedIdClaim": {
          "type": "string",
          "description": "Verified ID claim name or path, for example vc.credentialSubject.firstName."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.claimBindingSource": {
      "title": "claimBindingSource",
      "enum": [
        "directory",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.claimValidation": {
      "title": "claimValidation",
      "type": "object",
      "properties": {
        "customExtensionId": {
          "type": "string",
          "description": "The identifier of a custom extension for claim validation."
        },
        "isEnabled": {
          "type": "boolean",
          "description": "Indicates whether claim validation is enabled."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.cloudAppSecuritySessionControl": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessSessionControl"
        },
        {
          "title": "cloudAppSecuritySessionControl",
          "type": "object",
          "properties": {
            "cloudAppSecurityType": {
              "$ref": "#/$defs/microsoft.graph.cloudAppSecuritySessionControlType"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.cloudAppSecuritySessionControlType": {
      "title": "cloudAppSecuritySessionControlType",
      "enum": [
        "mcasConfigured",
        "monitorOnly",
        "blockDownloads",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessApplications": {
      "title": "conditionalAccessApplications",
      "type": "object",
      "properties": {
        "applicationFilter": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessFilter"
        },
        "excludeApplications": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Can be one of the following:  The list of client IDs (appId) explicitly excluded from the policy. Office365 - For the list of apps included in Office365, see Apps included in Conditional Access Office 365 app suite  MicrosoftAdminPortals - For more information, see Conditional Access Target resources: Microsoft Admin Portals"
        },
        "includeApplications": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Can be one of the following:  The list of client IDs (appId) the policy applies to, unless explicitly excluded (in excludeApplications)  All  Office365 - For the list of apps included in Office365, see Apps included in Conditional Access Office 365 app suite  MicrosoftAdminPortals - For more information, see Conditional Access Target resources: Microsoft Admin Portals"
        },
        "includeAuthenticationContextClassReferences": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "includeUserActions": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "User actions to include. Supported values are urn:user:registersecurityinfo and urn:user:registerdevice"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessAuthenticationFlows": {
      "title": "conditionalAccessAuthenticationFlows",
      "type": "object",
      "properties": {
        "transferMethods": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessTransferMethods"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessClientApp": {
      "title": "conditionalAccessClientApp",
      "enum": [
        "all",
        "browser",
        "mobileAppsAndDesktopClients",
        "exchangeActiveSync",
        "easSupported",
        "other",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessClientApplications": {
      "title": "conditionalAccessClientApplications",
      "type": "object",
      "properties": {
        "excludeServicePrincipals": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Service principal IDs excluded from the policy scope."
        },
        "includeServicePrincipals": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Service principal IDs included in the policy scope, or ServicePrincipalsInMyTenant."
        },
        "servicePrincipalFilter": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessFilter"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessConditionSet": {
      "title": "conditionalAccessConditionSet",
      "type": "object",
      "properties": {
        "applications": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessApplications"
        },
        "authenticationFlows": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessAuthenticationFlows"
        },
        "clientApplications": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessClientApplications"
        },
        "clientAppTypes": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.conditionalAccessClientApp"
          },
          "description": "Client application types included in the policy. The possible values are: all, browser, mobileAppsAndDesktopClients, exchangeActiveSync, easSupported, other. Required.  The easUnsupported enumeration member will be deprecated in favor of exchangeActiveSync, which includes EAS supported and unsupported platforms."
        },
        "devices": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessDevices"
        },
        "insiderRiskLevels": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessInsiderRiskLevels"
        },
        "locations": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessLocations"
        },
        "platforms": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessPlatforms"
        },
        "servicePrincipalRiskLevels": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.riskLevel"
          },
          "description": "Service principal risk levels included in the policy. The possible values are: low, medium, high, none, unknownFutureValue."
        },
        "signInRiskLevels": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.riskLevel"
          },
          "description": "Sign-in risk levels included in the policy. The possible values are: low, medium, high, hidden, none, unknownFutureValue. Required."
        },
        "userRiskLevels": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.riskLevel"
          },
          "description": "User risk levels included in the policy. The possible values are: low, medium, high, hidden, none, unknownFutureValue. Required."
        },
        "users": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessUsers"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessDevicePlatform": {
      "title": "conditionalAccessDevicePlatform",
      "enum": [
        "android",
        "iOS",
        "windows",
        "windowsPhone",
        "macOS",
        "all",
        "unknownFutureValue",
        "linux"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessDevices": {
      "title": "conditionalAccessDevices",
      "type": "object",
      "properties": {
        "deviceFilter": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessFilter"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessExternalTenants": {
      "title": "conditionalAccessExternalTenants",
      "type": "object",
      "properties": {
        "membershipKind": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessExternalTenantsMembershipKind"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessExternalTenantsMembershipKind": {
      "title": "conditionalAccessExternalTenantsMembershipKind",
      "enum": [
        "all",
        "enumerated",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessFilter": {
      "title": "conditionalAccessFilter",
      "type": "object",
      "properties": {
        "mode": {
          "$ref": "#/$defs/microsoft.graph.filterMode"
        },
        "rule": {
          "type": "string",
          "description": "Rule syntax is similar to that used for membership rules for groups in Microsoft Entra ID. For details, see rules with multiple expressions"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessGrantControl": {
      "title": "conditionalAccessGrantControl",
      "enum": [
        "block",
        "mfa",
        "compliantDevice",
        "domainJoinedDevice",
        "approvedApplication",
        "compliantApplication",
        "passwordChange",
        "unknownFutureValue",
        "riskRemediation"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessGrantControls": {
      "title": "conditionalAccessGrantControls",
      "type": "object",
      "properties": {
        "builtInControls": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.conditionalAccessGrantControl"
          },
          "description": "List of values of built-in controls required by the policy. Possible values: block, mfa, compliantDevice, domainJoinedDevice, approvedApplication, compliantApplication, passwordChange, unknownFutureValue, riskRemediation.  Use the Prefer: include-unknown-enum-members request header to get the following value in this evolvable enum: riskRemediation."
        },
        "customAuthenticationFactors": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "List of custom controls IDs required by the policy. For more information, see Custom controls."
        },
        "operator": {
          "type": [
            "string",
            "null"
          ],
          "description": "Defines the relationship of the grant controls. Possible values: AND, OR."
        },
        "termsOfUse": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "List of terms of use IDs required by the policy."
        },
        "authenticationStrength": {
          "$ref": "#/$defs/microsoft.graph.authenticationStrengthPolicy"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessGuestOrExternalUserTypes": {
      "title": "conditionalAccessGuestOrExternalUserTypes",
      "enum": [
        "none",
        "internalGuest",
        "b2bCollaborationGuest",
        "b2bCollaborationMember",
        "b2bDirectConnectUser",
        "otherExternalUser",
        "serviceProvider",
        "unknownFutureValue"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.conditionalAccessGuestsOrExternalUsers": {
      "title": "conditionalAccessGuestsOrExternalUsers",
      "type": "object",
      "properties": {
        "externalTenants": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessExternalTenants"
        },
        "guestOrExternalUserTypes": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessGuestOrExternalUserTypes"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessInsiderRiskLevels": {
      "title": "conditionalAccessInsiderRiskLevels",
      "enum": [
        "minor",
        "moderate",
        "elevated",
        "unknownFutureValue"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.conditionalAccessLocations": {
      "title": "conditionalAccessLocations",
      "type": "object",
      "properties": {
        "excludeLocations": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Location IDs excluded from scope of policy."
        },
        "includeLocations": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Location IDs in scope of policy unless explicitly excluded, All, or AllTrusted."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.conditionalAccessPlatforms": {
      "title": "conditionalAccessPlatforms",
      "type": "object",
      "properties": {
        "excludePlatforms": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.conditionalAccessDevicePlatform"
          },
          "description": "The possible values are: android, iOS, windows, windowsPhone, macOS, linux, all, unknownFutureValue."
        },
        "includePlatforms": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.conditionalAccessDevicePlat

# --- truncated at 32 KB (75 KB total) ---
# Full source: https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-identity-container-schema.json