microsoft.graph.permissionGrantPolicy

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-permission-grant-policy-schema.json",
  "title": "microsoft.graph.permissionGrantPolicy",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-policies-permissiongrantpolicy-api-openapi.yml#/components/schemas/microsoft.graph.permissionGrantPolicy",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.policyBase"
    },
    {
      "title": "permissionGrantPolicy",
      "type": "object",
      "properties": {
        "excludes": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.permissionGrantConditionSet"
          },
          "description": "Condition sets that are excluded in this permission grant policy. Automatically expanded on GET.",
          "x-ms-navigationProperty": true
        },
        "includes": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.permissionGrantConditionSet"
          },
          "description": "Condition sets that are included in this permission grant policy. Automatically expanded on GET.",
          "x-ms-navigationProperty": true
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.directoryObject": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "directoryObject",
          "type": "object",
          "properties": {
            "deletedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "Date and time when this object was deleted. Always null when the object hasn't been deleted.",
              "format": "date-time"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.permissionGrantConditionSet": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "permissionGrantConditionSet",
          "type": "object",
          "properties": {
            "clientApplicationIds": {
              "type": "array",
              "items": {
                "type": [
                  "string",
                  "null"
                ]
              },
              "description": "A list of appId values for the client applications to match with, or a list with the single value all to match any client application. Default is the single value all."
            },
            "clientApplicationPublisherIds": {
              "type": "array",
              "items": {
                "type": [
                  "string",
                  "null"
                ]
              },
              "description": "A list of Microsoft Partner Network (MPN) IDs for verified publishers of the client application, or a list with the single value all to match with client apps from any publisher. Default is the single value all."
            },
            "clientApplicationsFromVerifiedPublisherOnly": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Set to true to only match on client applications with a verified publisher. Set to false to match on any client app, even if it doesn't have a verified publisher. Default is false."
            },
            "clientApplicationTenantIds": {
              "type": "array",
              "items": {
                "type": [
                  "string",
                  "null"
                ]
              },
              "description": "A list of Microsoft Entra tenant IDs in which the client application is registered, or a list with the single value all to match with client apps registered in any tenant. Default is the single value all."
            },
            "permissionClassification": {
              "type": [
                "string",
                "null"
              ],
              "description": "The permission classification for the permission being granted, or all to match with any permission classification (including permissions that aren't classified). Default is all."
            },
            "permissions": {
              "type": "array",
              "items": {
                "type": [
                  "string",
                  "null"
                ]
              },
              "description": "The list of id values for the specific permissions to match with, or a list with the single value all to match with any permission. The id of delegated permissions can be found in the oauth2PermissionScopes property of the API's servicePrincipal object. The id of application permissions can be found in the appRoles property of the API's servicePrincipal object. The id of resource-specific application permissions can be found in the resourceSpecificApplicationPermissions property of the API's servicePrincipal object. Default is the single value all."
            },
            "permissionType": {
              "$ref": "#/$defs/microsoft.graph.permissionType"
            },
            "resourceApplication": {
              "type": [
                "string",
                "null"
              ],
              "description": "The appId of the resource application (for example the API) for which a permission is being granted, or any to match with any resource application or API. Default is any."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.permissionType": {
      "title": "permissionType",
      "enum": [
        "delegatedUserConsentable",
        "delegated",
        "application"
      ],
      "type": "string"
    },
    "microsoft.graph.policyBase": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.directoryObject"
        },
        {
          "title": "policyBase",
          "type": "object",
          "properties": {
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "Description for this policy. Required."
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "Display name for this policy. Required."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    }
  }
}