microsoft.graph.policyRoot

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-policy-root-schema.json",
  "title": "microsoft.graph.policyRoot",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-policies-policyroot-api-openapi.yml#/components/schemas/microsoft.graph.policyRoot",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "policyRoot",
      "type": "object",
      "properties": {
        "activityBasedTimeoutPolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.activityBasedTimeoutPolicy"
          },
          "description": "The policy that controls the idle time out for web sessions for applications.",
          "x-ms-navigationProperty": true
        },
        "adminConsentRequestPolicy": {
          "$ref": "#/$defs/microsoft.graph.adminConsentRequestPolicy"
        },
        "appManagementPolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.appManagementPolicy"
          },
          "description": "The policies that enforce app management restrictions for specific applications and service principals, overriding the defaultAppManagementPolicy.",
          "x-ms-navigationProperty": true
        },
        "authenticationFlowsPolicy": {
          "$ref": "#/$defs/microsoft.graph.authenticationFlowsPolicy"
        },
        "authenticationMethodsPolicy": {
          "$ref": "#/$defs/microsoft.graph.authenticationMethodsPolicy"
        },
        "authenticationStrengthPolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.authenticationStrengthPolicy"
          },
          "description": "The authentication method combinations that are to be used in scenarios defined by Microsoft Entra Conditional Access.",
          "x-ms-navigationProperty": true
        },
        "authorizationPolicy": {
          "$ref": "#/$defs/microsoft.graph.authorizationPolicy"
        },
        "claimsMappingPolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.claimsMappingPolicy"
          },
          "description": "The claim-mapping policies for WS-Fed, SAML, OAuth 2.0, and OpenID Connect protocols, for tokens issued to a specific application.",
          "x-ms-navigationProperty": true
        },
        "conditionalAccessPolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.conditionalAccessPolicy"
          },
          "description": "The custom rules that define an access scenario.",
          "x-ms-navigationProperty": true
        },
        "crossTenantAccessPolicy": {
          "$ref": "#/$defs/microsoft.graph.crossTenantAccessPolicy"
        },
        "defaultAppManagementPolicy": {
          "$ref": "#/$defs/microsoft.graph.tenantAppManagementPolicy"
        },
        "deviceRegistrationPolicy": {
          "$ref": "#/$defs/microsoft.graph.deviceRegistrationPolicy"
        },
        "featureRolloutPolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.featureRolloutPolicy"
          },
          "description": "The feature rollout policy associated with a directory object.",
          "x-ms-navigationProperty": true
        },
        "federatedTokenValidationPolicy": {
          "$ref": "#/$defs/microsoft.graph.federatedTokenValidationPolicy"
        },
        "homeRealmDiscoveryPolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.homeRealmDiscoveryPolicy"
          },
          "description": "The policy to control Microsoft Entra authentication behavior for federated users.",
          "x-ms-navigationProperty": true
        },
        "identitySecurityDefaultsEnforcementPolicy": {
          "$ref": "#/$defs/microsoft.graph.identitySecurityDefaultsEnforcementPolicy"
        },
        "ownerlessGroupPolicy": {
          "$ref": "#/$defs/microsoft.graph.ownerlessGroupPolicy"
        },
        "permissionGrantPolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.permissionGrantPolicy"
          },
          "description": "The policy that specifies the conditions under which consent can be granted.",
          "x-ms-navigationProperty": true
        },
        "roleManagementPolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.unifiedRoleManagementPolicy"
          },
          "description": "Specifies the various policies associated with scopes and roles.",
          "x-ms-navigationProperty": true
        },
        "roleManagementPolicyAssignments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.unifiedRoleManagementPolicyAssignment"
          },
          "description": "The assignment of a role management policy to a role definition object.",
          "x-ms-navigationProperty": true
        },
        "tokenIssuancePolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.tokenIssuancePolicy"
          },
          "description": "The policy that specifies the characteristics of SAML tokens issued by Microsoft Entra ID.",
          "x-ms-navigationProperty": true
        },
        "tokenLifetimePolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.tokenLifetimePolicy"
          },
          "description": "The policy that controls the lifetime of a JWT access token, an ID token, or a SAML 1.1/2.0 token issued by Microsoft Entra ID.",
          "x-ms-navigationProperty": true
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.accessReviewReviewerScope": {
      "title": "accessReviewReviewerScope",
      "type": "object",
      "properties": {
        "query": {
          "type": [
            "string",
            "null"
          ],
          "description": "The query specifying who will be the reviewer."
        },
        "queryRoot": {
          "type": [
            "string",
            "null"
          ],
          "description": "In the scenario where reviewers need to be specified dynamically, this property is used to indicate the relative source of the query. This property is only required if a relative query, for example, ./manager, is specified. Possible value: decisions."
        },
        "queryType": {
          "type": [
            "string",
            "null"
          ],
          "description": "The type of query. Examples include MicrosoftGraph and ARM."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.activityBasedTimeoutPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.stsPolicy"
        },
        {
          "title": "activityBasedTimeoutPolicy",
          "type": "object",
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.adminConsentRequestPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "adminConsentRequestPolicy",
          "type": "object",
          "properties": {
            "isEnabled": {
              "type": "boolean",
              "description": "Specifies whether the admin consent request feature is enabled or disabled. Required."
            },
            "notifyReviewers": {
              "type": "boolean",
              "description": "Specifies whether reviewers will receive notifications. Required."
            },
            "remindersEnabled": {
              "type": "boolean",
              "description": "Specifies whether reviewers will receive reminder emails. Required."
            },
            "requestDurationInDays": {
              "maximum": 2147483647,
              "minimum": -2147483648,
              "type": "number",
              "description": "Specifies the duration the request is active before it automatically expires if no decision is applied.",
              "format": "int32"
            },
            "reviewers": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.accessReviewReviewerScope"
              },
              "description": "The list of reviewers for the admin consent. Required."
            },
            "version": {
              "maximum": 2147483647,
              "minimum": -2147483648,
              "type": "number",
              "description": "Specifies the version of this policy. When the policy is updated, this version is updated. Read-only.",
              "format": "int32"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.advancedConfigState": {
      "title": "advancedConfigState",
      "enum": [
        "default",
        "enabled",
        "disabled",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.allowInvitesFrom": {
      "title": "allowInvitesFrom",
      "enum": [
        "none",
        "adminsAndGuestInviters",
        "adminsGuestInvitersAndAllMembers",
        "everyone",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.appCredentialRestrictionType": {
      "title": "appCredentialRestrictionType",
      "enum": [
        "passwordAddition",
        "passwordLifetime",
        "symmetricKeyAddition",
        "symmetricKeyLifetime",
        "customPasswordAddition",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.appKeyCredentialRestrictionType": {
      "title": "appKeyCredentialRestrictionType",
      "enum": [
        "asymmetricKeyLifetime",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.appManagementApplicationConfiguration": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.appManagementConfiguration"
        },
        {
          "title": "appManagementApplicationConfiguration",
          "type": "object",
          "properties": {
            "identifierUris": {
              "$ref": "#/$defs/microsoft.graph.identifierUriConfiguration"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.appManagementConfiguration": {
      "title": "appManagementConfiguration",
      "type": "object",
      "properties": {
        "keyCredentials": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.keyCredentialConfiguration"
          },
          "description": "Collection of keyCredential restrictions settings to be applied to an application or service principal."
        },
        "passwordCredentials": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.passwordCredentialConfiguration"
          },
          "description": "Collection of password restrictions settings to be applied to an application or service principal."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.appManagementPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.policyBase"
        },
        {
          "title": "appManagementPolicy",
          "type": "object",
          "properties": {
            "isEnabled": {
              "type": "boolean",
              "description": "Denotes whether the policy is enabled."
            },
            "restrictions": {
              "$ref": "#/$defs/microsoft.graph.customAppManagementConfiguration"
            },
            "appliesTo": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.directoryObject"
              },
              "description": "Collection of applications and service principals to which the policy is applied.",
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.appManagementPolicyActorExemptions": {
      "title": "appManagementPolicyActorExemptions",
      "type": "object",
      "properties": {
        "customSecurityAttributes": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.customSecurityAttributeExemption"
          },
          "description": "The collection of customSecurityAttributeExemption to exempt from the policy enforcement. Limit of 5."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.appManagementRestrictionState": {
      "title": "appManagementRestrictionState",
      "enum": [
        "enabled",
        "disabled",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.appManagementServicePrincipalConfiguration": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.appManagementConfiguration"
        },
        {
          "title": "appManagementServicePrincipalConfiguration",
          "type": "object",
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.applicationEnforcedRestrictionsSessionControl": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessSessionControl"
        },
        {
          "title": "applicationEnforcedRestrictionsSessionControl",
          "type": "object",
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationCombinationConfiguration": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationCombinationConfiguration",
          "type": "object",
          "properties": {
            "appliesToCombinations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationMethodModes"
              },
              "description": "Which authentication method combinations this configuration applies to. Must be an allowedCombinations object, part of the authenticationStrengthPolicy. The only possible value for fido2combinationConfigurations is 'fido2'."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationFlowsPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationFlowsPolicy",
          "type": "object",
          "properties": {
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "Inherited property. A description of the policy. Optional. Read-only."
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "Inherited property. The human-readable name of the policy. Optional. Read-only."
            },
            "selfServiceSignUp": {
              "$ref": "#/$defs/microsoft.graph.selfServiceSignUpAuthenticationFlowConfiguration"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationMethodConfiguration": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationMethodConfiguration",
          "type": "object",
          "properties": {
            "excludeTargets": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.excludeTarget"
              },
              "description": "Groups of users that are excluded from a policy."
            },
            "state": {
              "$ref": "#/$defs/microsoft.graph.authenticationMethodState"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationMethodModes": {
      "title": "authenticationMethodModes",
      "enum": [
        "password",
        "voice",
        "hardwareOath",
        "softwareOath",
        "sms",
        "fido2",
        "windowsHelloForBusiness",
        "microsoftAuthenticatorPush",
        "deviceBasedPush",
        "temporaryAccessPassOneTime",
        "temporaryAccessPassMultiUse",
        "email",
        "x509CertificateSingleFactor",
        "x509CertificateMultiFactor",
        "federatedSingleFactor",
        "federatedMultiFactor",
        "unknownFutureValue",
        "qrCodePin"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.authenticationMethodState": {
      "title": "authenticationMethodState",
      "enum": [
        "enabled",
        "disabled"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationMethodTargetType": {
      "title": "authenticationMethodTargetType",
      "enum": [
        "user",
        "group",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationMethodsPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationMethodsPolicy",
          "type": "object",
          "properties": {
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "A description of the policy. Read-only."
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "The name of the policy. Read-only."
            },
            "lastModifiedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The date and time of the last update to the policy. Read-only.",
              "format": "date-time"
            },
            "policyMigrationState": {
              "$ref": "#/$defs/microsoft.graph.authenticationMethodsPolicyMigrationState"
            },
            "policyVersion": {
              "type": [
                "string",
                "null"
              ],
              "description": "The version of the policy in use. Read-only."
            },
            "reconfirmationInDays": {
              "maximum": 2147483647,
              "minimum": -2147483648,
              "type": [
                "number",
                "null"
              ],
              "format": "int32"
            },
            "registrationEnforcement": {
              "$ref": "#/$defs/microsoft.graph.registrationEnforcement"
            },
            "authenticationMethodConfigurations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationMethodConfiguration"
              },
              "description": "Represents the settings for each authentication method. Automatically expanded on GET /policies/authenticationMethodsPolicy.",
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationMethodsPolicyMigrationState": {
      "title": "authenticationMethodsPolicyMigrationState",
      "enum": [
        "preMigration",
        "migrationInProgress",
        "migrationComplete",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationMethodsRegistrationCampaign": {
      "title": "authenticationMethodsRegistrationCampaign",
      "type": "object",
      "properties": {
        "excludeTargets": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.excludeTarget"
          },
          "description": "Users and groups of users that are excluded from being prompted to set up the authentication method."
        },
        "includeTargets": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.authenticationMethodsRegistrationCampaignIncludeTarget"
          },
          "description": "Users and groups of users that are prompted to set up the authentication method."
        },
        "snoozeDurationInDays": {
          "maximum": 2147483647,
          "minimum": -2147483648,
          "type": "number",
          "description": "Specifies the number of days that the user sees a prompt again if they select 'Not now' and snoozes the prompt. Minimum: 0 days. Maximum: 14 days. If the value is '0', the user is prompted during every MFA attempt.",
          "format": "int32"
        },
        "state": {
          "$ref": "#/$defs/microsoft.graph.advancedConfigState"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.authenticationMethodsRegistrationCampaignIncludeTarget": {
      "title": "authenticationMethodsRegistrationCampaignIncludeTarget",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The object identifier of a Microsoft Entra user or group."
        },
        "targetedAuthenticationMethod": {
          "type": [
            "string",
            "null"
          ],
          "description": "The authentication method that the user is prompted to register. The value can be Fido2 or microsoftAuthenticator."
        },
        "targetType": {
          "$ref": "#/$defs/microsoft.graph.authenticationMethodTargetType"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.authenticationStrengthPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationStrengthPolicy",
          "type": "object",
          "properties": {
            "allowedCombinations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationMethodModes"
              },
              "description": "A collection of authentication method modes that are required be used to satify this authentication strength."
            },
            "createdDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "The datetime when this policy was created.",
              "format": "date-time"
            },
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "The human-readable description of this policy."
            },
            "displayName": {
              "type": "string",
              "description": "The human-readable display name of this policy. Supports $filter (eq, ne, not , and in)."
            },
            "modifiedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "The datetime when this policy was last modified.",
              "format": "date-time"
            },
            "policyType": {
              "$ref": "#/$defs/microsoft.graph.authenticationStrengthPolicyType"
            },
            "requirementsSatisfied": {
              "$ref": "#/$defs/microsoft.graph.authenticationStrengthRequirements"
            },
            "combinationConfigurations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationCombinationConfiguration"
              },
              "description": "Settings that may be used to require specific types or instances of an authentication method to be used when authenticating with a specified combination of authentication methods.",
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationStrengthPolicyType": {
      "title": "authenticationStrengthPolicyType",
      "enum": [
        "builtIn",
        "custom",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationStrengthRequirements": {
      "title": "authenticationStrengthRequirements",
      "enum": [
        "none",
        "mfa",
        "unknownFutureValue"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.authorizationPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.policyBase"
        },
        {
          "title": "authorizationPolicy",
          "type": "object",
          "properties": {
            "allowedToSignUpEmailBasedSubscriptions": {
              "type": "boolean",
              "description": "Indicates whether users can sign up for email based subscriptions."
            },
            "allowedToUseSSPR": {
              "type": "boolean",
              "description": "Indicates whether administrators of the tenant can use the Self-Service Password Reset (SSPR). For more information, see Self-service password reset for administrators."
            },
            "allowEmailVerifiedUsersToJoinOrganization": {
              "type": "boolean",
              "description": "Indicates whether a user can join the tenant by email validation."
            },
            "allowInvitesFrom": {
              "$ref": "#/$defs/microsoft.graph.allowInvitesFrom"
            },
            "allowUserConsentForRiskyApps": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Indicates whether user consent for risky apps is allowed. We recommend keeping allowUserConsentForRiskyApps as false. Default value is false."
            },
            "blockMsolPowerShell": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "To disable the use of MSOL PowerShell, set this property to true. This also disables user-based access to the legacy service endpoint used by MSOL PowerShell. This doesn't affect Microsoft Entra Connect or Microsoft Graph."
            },
            "defaultUserRolePermissions": {
              "$ref": "#/$defs/microsoft.graph.defaultUserRolePermissions"
            },
            "guestUserRoleId": {
              "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
              "type": [
                "string",
                "null"
              ],
              "description": "Represents role templateId for the role that should be granted to guests. Currently following roles are supported:  User (a0b1b346-4d3e-4e8b-98f8-753987be4970), Guest User (10dae51f-b6af-4016-8d66-8c2a99b929b3), and Restricted Guest User (2af84b1e-32c8-42b7-82bc-daa82404023b).",
              "format": "uuid"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.azureADJoinPolicy": {
      "title": "azureADJoinPolicy",
      "type": "object",
      "properties": {
        "allowedToJoin": {
          "$ref": "#/$defs/microsoft.graph.deviceRegistrationMembership"
        },
        "isAdminConfigurable": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Determines if administrators can modify this policy."
        },
        "localAdmins": {
          "$ref": "#/$defs/microsoft.graph.localAdminSettings"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.azureADRegistrationPolicy": {
      "title": "azureADRegistrationPolicy",
      "type": "object",
      "properties": {
        "allowedToRegister": {
          "$ref": "#/$defs/microsoft.graph.deviceRegistrationMembership"
        },
        "isAdminConfigurable": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Determines if administrators can modify this policy."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.b2bIdentityProvidersType": {
      "title": "b2bIdentityProvidersType",
      "enum": [
        "azureActiveDirectory",
        "externalFederation",
        "socialIdentityProviders",
        "emailOneTimePasscode",
        "microsoftAccount",
        "defaultConfiguredIdp",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.claimsMappingPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.stsPolicy"
        },
        {
          "title": "claimsMappingPolicy",
          "type": "object",
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.cloudAppSecuritySessionControl": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessSessionControl"
        },
        {
          "title": "cloudAppSecuritySessionControl",
          "type": "object",
          "properties": {
            "cloudAppSecurityType": {
              "$ref": "#/$defs/microsoft.graph.cloudAppSecuritySessionControlType"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.cloudAppSecuritySessionControlType": {
      "title": "cloudAppSecuritySessionControlType",
      "enum": [
        "mcasConfigured",
        "monitorOnly",
        "blockDownloads",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessApplications": {
      "title": "conditionalAccessApplications",
      "type": "object",
      "properties": {
        "applicationFilter": {
          "$ref": "#/$defs/microsoft.graph.conditionalAccessFilter"
        },
        "excludeApplications": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Can be one of the following:  The list of client IDs (appId) explicitly excluded from the policy. Office365 - For the list of apps included in Office365, see Apps included in Conditional Access Office 365 app suite  MicrosoftAdminPortals - For more information, see Conditional Access Target resources: Microsoft Admin Portals"
        },
        "includeApplications": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Can be one of the following:  The list of client IDs (appId) the policy applies to, unless explicitly excluded (in excludeApplications)  All  Office365 - For the list of apps included in Office365, see Apps included in Conditional Access Office 365 app suite  MicrosoftAdminPortals - For more information, see Conditional Access Target resources: Microsoft Admin Portals"
        },
        "includeAuthenticationContextClassReferences": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "includeUserActions": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "User actions to include. Supported values are urn:user:registersecurityinfo and urn:user:registerdevice"
        }
      },
      "additionalProperties": {
        "type"

# --- truncated at 32 KB (109 KB total) ---
# Full source: https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-policy-root-schema.json