microsoft.graph.auditLogRoot

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-graph/json-schema/microsoft-graph-microsoft-graph-audit-log-root-schema.json",
  "title": "microsoft.graph.auditLogRoot",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-graph-auditlogs-auditlogroot-api-openapi.yml#/components/schemas/microsoft.graph.auditLogRoot",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "auditLogRoot",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "directoryAudits": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.directoryAudit"
          },
          "x-ms-navigationProperty": true
        },
        "provisioning": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.provisioningObjectSummary"
          },
          "x-ms-navigationProperty": true
        },
        "signIns": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.signIn"
          },
          "x-ms-navigationProperty": true
        },
        "@odata.type": {
          "type": "string"
        }
      }
    }
  ],
  "x-ms-discriminator-value": "#microsoft.graph.auditLogRoot",
  "$defs": {
    "ReferenceNumeric": {
      "enum": [
        "-INF",
        "INF",
        "NaN"
      ],
      "type": [
        "string",
        "null"
      ]
    },
    "microsoft.graph.appIdentity": {
      "title": "appIdentity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "appId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the unique ID representing application in Microsoft Entra ID."
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the application name displayed in the Microsoft Entra admin center."
        },
        "servicePrincipalId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the unique ID for the service principal in Microsoft Entra ID."
        },
        "servicePrincipalName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the Service Principal Name is the Application name in the tenant."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.appliedConditionalAccessPolicy": {
      "title": "appliedConditionalAccessPolicy",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the name of the conditional access policy (example: 'Require MFA for Salesforce')."
        },
        "enforcedGrantControls": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "Refers to the grant controls enforced by the conditional access policy (example: 'Require multifactor authentication')."
        },
        "enforcedSessionControls": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "Refers to the session controls enforced by the conditional access policy (example: 'Require app enforced controls')."
        },
        "id": {
          "type": [
            "string",
            "null"
          ],
          "description": "An identifier of the conditional access policy. Supports $filter (eq)."
        },
        "result": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.appliedConditionalAccessPolicyResult"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Indicates the result of the CA policy that was triggered. The possible values are: success, failure, notApplied (policy isn't applied because policy conditions weren't met), notEnabled (This is due to the policy in a disabled state), unknown, unknownFutureValue, reportOnlySuccess, reportOnlyFailure, reportOnlyNotApplied, reportOnlyInterrupted. Use the Prefer: include-unknown-enum-members request header to get the following values in this evolvable enum: reportOnlySuccess, reportOnlyFailure, reportOnlyNotApplied, reportOnlyInterrupted."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.appliedConditionalAccessPolicyResult": {
      "title": "appliedConditionalAccessPolicyResult",
      "enum": [
        "success",
        "failure",
        "notApplied",
        "notEnabled",
        "unknown",
        "unknownFutureValue",
        "reportOnlySuccess",
        "reportOnlyFailure",
        "reportOnlyNotApplied",
        "reportOnlyInterrupted"
      ],
      "type": "string"
    },
    "microsoft.graph.auditActivityInitiator": {
      "title": "auditActivityInitiator",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "app": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.appIdentity"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "If the resource initiating the activity is an app, this property indicates all the app related information like appId and name."
        },
        "user": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.userIdentity"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "If the resource initiating the activity is a user, this property Indicates all the user related information like user ID and userPrincipalName."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.conditionalAccessStatus": {
      "title": "conditionalAccessStatus",
      "enum": [
        "success",
        "failure",
        "notApplied",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.detailsInfo": {
      "title": "detailsInfo",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.deviceDetail": {
      "title": "deviceDetail",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "browser": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the browser information of the used in the sign-in. Populated for devices registered in Microsoft Entra."
        },
        "deviceId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the unique ID of the device used in the sign-in. Populated for devices registered in Microsoft Entra."
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the name of the device used in the sign-in. Populated for devices registered in Microsoft Entra."
        },
        "isCompliant": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates whether the device is compliant or not."
        },
        "isManaged": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates if the device is managed or not."
        },
        "operatingSystem": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the OS name and version used in the sign-in."
        },
        "trustType": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates information on whether the device used in the sign-in is workplace-joined, Microsoft Entra-joined, domain-joined."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.directoryAudit": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "directoryAudit",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "activityDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "Indicates the date and time the activity was performed. The Timestamp type is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Supports $filter (eq, ge, le) and $orderby.",
              "format": "date-time"
            },
            "activityDisplayName": {
              "type": "string",
              "description": "Indicates the activity name or the operation name (examples: 'Create User' and 'Add member to group'). For a list of activities logged, refer to Microsoft Entra audit log categories and activities. Supports $filter (eq, startswith)."
            },
            "additionalDetails": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.keyValue"
              },
              "description": "Indicates additional details on the activity."
            },
            "category": {
              "type": "string",
              "description": "Indicates which resource category that's targeted by the activity. For example: UserManagement, GroupManagement, ApplicationManagement, RoleManagement. For a list of categories for activities logged, refer to Microsoft Entra audit log categories and activities."
            },
            "correlationId": {
              "type": [
                "string",
                "null"
              ],
              "description": "Indicates a unique ID that helps correlate activities that span across various services. Can be used to trace logs across services. Supports $filter (eq)."
            },
            "initiatedBy": {
              "$ref": "#/$defs/microsoft.graph.auditActivityInitiator"
            },
            "loggedByService": {
              "type": [
                "string",
                "null"
              ],
              "description": "Indicates information on which service initiated the activity (For example: Self-service Password Management, Core Directory, B2C, Invited Users, Microsoft Identity Manager, Privileged Identity Management. Supports $filter (eq)."
            },
            "operationType": {
              "type": [
                "string",
                "null"
              ],
              "description": "Indicates the type of operation that was performed. The possible values include but are not limited to the following: Add, Assign, Update, Unassign, and Delete."
            },
            "result": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.operationResult"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Indicates the result of the activity. The possible values are: success, failure, timeout, unknownFutureValue."
            },
            "resultReason": {
              "type": [
                "string",
                "null"
              ],
              "description": "Indicates the reason for failure if the result is failure or timeout."
            },
            "targetResources": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.targetResource"
              },
              "description": "Indicates information on which resource was changed due to the activity. Target Resource Type can be User, Device, Directory, App, Role, Group, Policy or Other. Supports $filter (eq) for id and displayName; and $filter (startswith) for displayName."
            },
            "@odata.type": {
              "type": "string"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.directoryAudit"
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.geoCoordinates": {
      "title": "geoCoordinates",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "altitude": {
          "oneOf": [
            {
              "type": [
                "number",
                "null"
              ],
              "format": "double"
            },
            {
              "type": [
                "string",
                "null"
              ]
            },
            {
              "$ref": "#/$defs/ReferenceNumeric"
            }
          ],
          "description": "Optional. The altitude (height), in feet,  above sea level for the item. Read-only."
        },
        "latitude": {
          "oneOf": [
            {
              "type": [
                "number",
                "null"
              ],
              "format": "double"
            },
            {
              "type": [
                "string",
                "null"
              ]
            },
            {
              "$ref": "#/$defs/ReferenceNumeric"
            }
          ],
          "description": "Optional. The latitude, in decimal, for the item. Read-only."
        },
        "longitude": {
          "oneOf": [
            {
              "type": [
                "number",
                "null"
              ],
              "format": "double"
            },
            {
              "type": [
                "string",
                "null"
              ]
            },
            {
              "$ref": "#/$defs/ReferenceNumeric"
            }
          ],
          "description": "Optional. The longitude, in decimal, for the item. Read-only."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.groupType": {
      "title": "groupType",
      "enum": [
        "unifiedGroups",
        "azureAD",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.identity": {
      "title": "identity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta."
        },
        "id": {
          "type": [
            "string",
            "null"
          ],
          "description": "Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.initiator": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.identity"
        },
        {
          "title": "initiator",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "initiatorType": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.initiatorType"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Type of initiator. The possible values are: user, application, system, unknownFutureValue."
            },
            "@odata.type": {
              "type": "string",
              "default": "#microsoft.graph.initiator"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.initiator"
    },
    "microsoft.graph.initiatorType": {
      "title": "initiatorType",
      "enum": [
        "user",
        "application",
        "system",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.keyValue": {
      "title": "keyValue",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "key": {
          "type": [
            "string",
            "null"
          ],
          "description": "Key for the key-value pair."
        },
        "value": {
          "type": [
            "string",
            "null"
          ],
          "description": "Value for the key-value pair."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.modifiedProperty": {
      "title": "modifiedProperty",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the property name of the target attribute that was changed."
        },
        "newValue": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the updated value for the propery."
        },
        "oldValue": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the previous value (before the update) for the property."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.operationResult": {
      "title": "operationResult",
      "enum": [
        "success",
        "failure",
        "timeout",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.provisionedIdentity": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.identity"
        },
        {
          "title": "provisionedIdentity",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "details": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.detailsInfo"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of the identity."
            },
            "identityType": {
              "type": [
                "string",
                "null"
              ],
              "description": "Type of identity that has been provisioned, such as 'user' or 'group'. Supports $filter (eq, contains)."
            },
            "@odata.type": {
              "type": "string",
              "default": "#microsoft.graph.provisionedIdentity"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.provisionedIdentity"
    },
    "microsoft.graph.provisioningAction": {
      "title": "provisioningAction",
      "enum": [
        "other",
        "create",
        "delete",
        "disable",
        "update",
        "stagedDelete",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.provisioningErrorInfo": {
      "title": "provisioningErrorInfo",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "additionalDetails": {
          "type": [
            "string",
            "null"
          ],
          "description": "Additional details if there's error."
        },
        "errorCategory": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.provisioningStatusErrorCategory"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Categorizes the error code. Possible values are failure, nonServiceFailure, success, unknownFutureValue"
        },
        "errorCode": {
          "type": [
            "string",
            "null"
          ],
          "description": "Unique error code if any occurred. Learn more"
        },
        "reason": {
          "type": [
            "string",
            "null"
          ],
          "description": "Summarizes the status and describes why the status happened."
        },
        "recommendedAction": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides the resolution for the corresponding error."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.provisioningObjectSummary": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "provisioningObjectSummary",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "activityDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "Represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.  SUpports $filter (eq, gt, lt) and orderby.",
              "format": "date-time"
            },
            "changeId": {
              "type": [
                "string",
                "null"
              ],
              "description": "Unique ID of this change in this cycle. Supports $filter (eq, contains)."
            },
            "cycleId": {
              "type": [
                "string",
                "null"
              ],
              "description": "Unique ID per job iteration. Supports $filter (eq, contains)."
            },
            "durationInMilliseconds": {
              "maximum": 2147483647,
              "minimum": -2147483648,
              "type": [
                "number",
                "null"
              ],
              "description": "Indicates how long this provisioning action took to finish. Measured in milliseconds.",
              "format": "int32"
            },
            "initiatedBy": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.initiator"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of who initiated this provisioning. Supports $filter (eq, contains)."
            },
            "jobId": {
              "type": [
                "string",
                "null"
              ],
              "description": "The unique ID for the whole provisioning job. Supports $filter (eq, contains)."
            },
            "modifiedProperties": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.modifiedProperty"
              },
              "description": "Details of each property that was modified in this provisioning action on this object."
            },
            "provisioningAction": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisioningAction"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Indicates the activity name or the operation name. The possible values are: create, update, delete, stageddelete, disable, other and unknownFutureValue. For a list of activities logged, refer to Microsoft Entra activity list. Supports $filter (eq, contains)."
            },
            "provisioningStatusInfo": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisioningStatusInfo"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of provisioning status."
            },
            "provisioningSteps": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.provisioningStep"
              },
              "description": "Details of each step in provisioning."
            },
            "servicePrincipal": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisioningServicePrincipal"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Represents the service principal used for provisioning. Supports $filter (eq) for id and name."
            },
            "sourceIdentity": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisionedIdentity"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of source object being provisioned. Supports $filter (eq, contains) for identityType, id, and displayName."
            },
            "sourceSystem": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisioningSystem"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of source system of the object being provisioned. Supports $filter (eq, contains) for displayName."
            },
            "targetIdentity": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisionedIdentity"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of target object being provisioned. Supports $filter (eq, contains) for identityType, id, and displayName."
            },
            "targetSystem": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisioningSystem"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of target system of the object being provisioned. Supports $filter (eq, contains) for displayName."
            },
            "tenantId": {
              "type": [
                "string",
                "null"
              ],
              "description": "Unique Microsoft Entra tenant ID. Supports $filter (eq, contains)."
            },
            "@odata.type": {
              "type": "string"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.provisioningObjectSummary"
    },
    "microsoft.graph.provisioningResult": {
      "title": "provisioningResult",
      "enum": [
        "success",
        "failure",
        "skipped",
        "warning",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.provisioningServicePrincipal": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.identity"
        },
        {
          "title": "provisioningServicePrincipal",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "@odata.type": {
              "type": "string",
              "default": "#microsoft.graph.provisioningServicePrincipal"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.provisioningServicePrincipal"
    },
    "microsoft.graph.provisioningStatusErrorCategory": {
      "title": "provisioningStatusErrorCategory",
      "enum": [
        "failure",
        "nonServiceFailure",
        "success",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.provisioningStatusInfo": {
      "title": "provisioningStatusInfo",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "errorInformation": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.provisioningErrorInfo"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "If status isn't success/ skipped details for the error are contained in this."
        },
        "status": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.provisioningResult"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "The possible values are: success, warning, failure, skipped, unknownFutureValue."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.provisioningStep": {
      "title": "provisioningStep",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "description": {
          "type": [
            "string",
            "null"
          ],
          "description": "Summary of what occurred during the step."
        },
        "details": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.detailsInfo"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Details of what occurred during the step."
        },
        "name": {
          "type": [
            "string",
            "null"
          ],
          "description": "Name of the step."
        },
        "provisioningStepType": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.provisioningStepType"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Type of step. The possible values are: import, scoping, matching, processing, referenceResolution, export, unknownFutureValue."
        },
        "status": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.provisioningResult"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Status of the step. The possible values are: success, warning,  failure, skipped, unknownFutureValue."
        },
        "@odata.type": {
          "type": "string"
        }
    

# --- truncated at 32 KB (50 KB total) ---
# Full source: https://artifacts.apis.io/microsoft-graph/json-schema/microsoft-graph-microsoft-graph-audit-log-root-schema.json