microsoft.graph.authenticationMethodsPolicy

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-graph/json-schema/microsoft-graph-microsoft-graph-authentication-methods-policy-schema.json",
  "title": "microsoft.graph.authenticationMethodsPolicy",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-graph-authenticationmethodspolicy-authenticationmethodspolicy-api-openapi.yml#/components/schemas/microsoft.graph.authenticationMethodsPolicy",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "authenticationMethodsPolicy",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "description": {
          "type": [
            "string",
            "null"
          ],
          "description": "A description of the policy. Read-only."
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "The name of the policy. Read-only."
        },
        "lastModifiedDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "description": "The date and time of the last update to the policy. Read-only.",
          "format": "date-time"
        },
        "policyMigrationState": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.authenticationMethodsPolicyMigrationState"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "The state of migration of the authentication methods policy from the legacy multifactor authentication and self-service password reset (SSPR) policies. The possible values are: premigration - means the authentication methods policy is used for authentication only, legacy policies are respected. migrationInProgress - means the authentication methods policy is used for both authentication and SSPR, legacy policies are respected. migrationComplete - means the authentication methods policy is used for authentication and SSPR, legacy policies are ignored. unknownFutureValue - Evolvable enumeration sentinel value. Do not use."
        },
        "policyVersion": {
          "type": [
            "string",
            "null"
          ],
          "description": "The version of the policy in use. Read-only."
        },
        "reconfirmationInDays": {
          "maximum": 2147483647,
          "minimum": -2147483648,
          "type": [
            "number",
            "null"
          ],
          "format": "int32"
        },
        "registrationEnforcement": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.registrationEnforcement"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Enforce registration at sign-in time. This property can be used to remind users to set up targeted authentication methods."
        },
        "authenticationMethodConfigurations": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.authenticationMethodConfiguration"
          },
          "description": "Represents the settings for each authentication method. Automatically expanded on GET /policies/authenticationMethodsPolicy.",
          "x-ms-navigationProperty": true
        },
        "@odata.type": {
          "type": "string"
        }
      }
    }
  ],
  "x-ms-discriminator-value": "#microsoft.graph.authenticationMethodsPolicy",
  "$defs": {
    "microsoft.graph.advancedConfigState": {
      "title": "advancedConfigState",
      "enum": [
        "default",
        "enabled",
        "disabled",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationMethodConfiguration": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationMethodConfiguration",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "excludeTargets": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.excludeTarget"
              },
              "description": "Groups of users that are excluded from a policy."
            },
            "state": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.authenticationMethodState"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "The state of the policy. The possible values are: enabled, disabled."
            },
            "@odata.type": {
              "type": "string"
            }
          }
        }
      ]
    },
    "microsoft.graph.authenticationMethodState": {
      "title": "authenticationMethodState",
      "enum": [
        "enabled",
        "disabled"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationMethodTargetType": {
      "title": "authenticationMethodTargetType",
      "enum": [
        "user",
        "group",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationMethodsPolicyMigrationState": {
      "title": "authenticationMethodsPolicyMigrationState",
      "enum": [
        "preMigration",
        "migrationInProgress",
        "migrationComplete",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationMethodsRegistrationCampaign": {
      "title": "authenticationMethodsRegistrationCampaign",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "excludeTargets": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.excludeTarget"
          },
          "description": "Users and groups of users that are excluded from being prompted to set up the authentication method."
        },
        "includeTargets": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.authenticationMethodsRegistrationCampaignIncludeTarget"
          },
          "description": "Users and groups of users that are prompted to set up the authentication method."
        },
        "snoozeDurationInDays": {
          "maximum": 2147483647,
          "minimum": -2147483648,
          "type": "number",
          "description": "Specifies the number of days that the user sees a prompt again if they select 'Not now' and snoozes the prompt. Minimum: 0 days. Maximum: 14 days. If the value is '0', the user is prompted during every MFA attempt.",
          "format": "int32"
        },
        "state": {
          "$ref": "#/$defs/microsoft.graph.advancedConfigState"
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.authenticationMethodsRegistrationCampaignIncludeTarget": {
      "title": "authenticationMethodsRegistrationCampaignIncludeTarget",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The object identifier of a Microsoft Entra user or group."
        },
        "targetedAuthenticationMethod": {
          "type": [
            "string",
            "null"
          ],
          "description": "The authentication method that the user is prompted to register. The value must be microsoftAuthenticator."
        },
        "targetType": {
          "$ref": "#/$defs/microsoft.graph.authenticationMethodTargetType"
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.excludeTarget": {
      "title": "excludeTarget",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The object identifier of a Microsoft Entra user or group."
        },
        "targetType": {
          "$ref": "#/$defs/microsoft.graph.authenticationMethodTargetType"
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.registrationEnforcement": {
      "title": "registrationEnforcement",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "authenticationMethodsRegistrationCampaign": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.authenticationMethodsRegistrationCampaign"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Run campaigns to remind users to set up targeted authentication methods."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    }
  }
}