Microsoft Graph · Schema
microsoft.graph.mdmWindowsInformationProtectionPolicy
Microsoft GraphAzure ADCollaborationContactsDocumentsEmailGraphIdentityMicrosoftOffice 365PresentationsProductivitySpreadsheetsT1Task
Properties
| Name | Type | Description |
|---|---|---|
| id | string | The unique identifier for an entity. Read-only. |
| @odata.type | string | |
| createdDateTime | string | The date and time the policy was created. |
| description | stringnull | The policy's description. |
| displayName | string | Policy display name. |
| lastModifiedDateTime | string | Last time the policy was modified. |
| version | stringnull | Version of the entity. |
| azureRightsManagementServicesAllowed | boolean | Specifies whether to allow Azure RMS encryption for WIP |
| dataRecoveryCertificate | object | Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent(DRA) certificate for encrypting file system(EFS) |
| enforcementLevel | object | |
| enterpriseDomain | stringnull | Primary enterprise domain |
| enterpriseInternalProxyServers | array | This is the comma-separated list of internal proxy servers. For example, '157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59'. These proxies have been configured by the admin to |
| enterpriseIPRanges | array | Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be |
| enterpriseIPRangesAreAuthoritative | boolean | Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. Default is false |
| enterpriseNetworkDomainNames | array | This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations wil |
| enterpriseProtectedDomainNames | array | List of enterprise domains to be protected |
| enterpriseProxiedDomains | array | Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, |
| enterpriseProxyServers | array | This is a list of proxy servers. Any server not on this list is considered non-enterprise |
| enterpriseProxyServersAreAuthoritative | boolean | Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. Default is false |
| exemptApps | array | Exempt applications can also access enterprise data, but the data handled by those applications are not protected. This is because some critical enterprise applications may have compatibility problems |
| iconsVisible | boolean | Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles in the Start menu. Starting in Windows 10, version 1703 this setting also configures th |
| indexingEncryptedStoresOrItemsBlocked | boolean | This switch is for the Windows Search Indexer, to allow or disallow indexing of items |
| isAssigned | boolean | Indicates if the policy is deployed to any inclusion groups or not. |
| neutralDomainResources | array | List of domain names that can used for work or personal resource |
| protectedApps | array | Protected applications can access enterprise data and the data handled by those applications are protected with encryption |
| protectionUnderLockConfigRequired | boolean | Specifies whether the protection under lock feature (also known as encrypt under pin) should be configured |
| revokeOnUnenrollDisabled | boolean | This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 1 (Don't revoke keys), the keys will not be revoked and the user will continue to hav |
| rightsManagementServicesTemplateId | stringnull | TemplateID GUID to use for RMS encryption. The RMS template allows the IT admin to configure the details about who has access to RMS-protected file and how long they have access |
| smbAutoEncryptedFileExtensions | array | Specifies a list of file extensions, so that files with these extensions are encrypted when copying from an SMB share within the corporate boundary |
| assignments | array | Navigation property to list of security groups targeted for policy. |
| exemptAppLockerFiles | array | Another way to input exempt apps through xml files |
| protectedAppLockerFiles | array | Another way to input protected apps through xml files |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://artifacts.apis.io/microsoft-graph/json-schema/microsoft-graph-microsoft-graph-mdm-windows-information-protection-policy-schema.json",
"title": "microsoft.graph.mdmWindowsInformationProtectionPolicy",
"x-generated": "2026-11-04",
"x-method": "derived",
"x-generator": "derive-json-schema.py",
"x-source": "openapi/microsoft-graph-deviceappmanagement-mdmwindowsinformationprotectionpolicy-api-openapi.yml#/components/schemas/microsoft.graph.mdmWindowsInformationProtectionPolicy",
"allOf": [
{
"$ref": "#/$defs/microsoft.graph.windowsInformationProtection"
},
{
"title": "mdmWindowsInformationProtectionPolicy",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"@odata.type": {
"type": "string",
"default": "#microsoft.graph.mdmWindowsInformationProtectionPolicy"
}
},
"description": "Policy for Windows information protection with MDM"
}
],
"x-ms-discriminator-value": "#microsoft.graph.mdmWindowsInformationProtectionPolicy",
"$defs": {
"microsoft.graph.deviceAndAppManagementAssignmentTarget": {
"title": "deviceAndAppManagementAssignmentTarget",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"@odata.type": {
"type": "string"
}
},
"description": "Base type for assignment targets."
},
"microsoft.graph.entity": {
"title": "entity",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The unique identifier for an entity. Read-only."
},
"@odata.type": {
"type": "string"
}
}
},
"microsoft.graph.ipRange": {
"title": "ipRange",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"@odata.type": {
"type": "string"
}
}
},
"microsoft.graph.managedAppPolicy": {
"allOf": [
{
"$ref": "#/$defs/microsoft.graph.entity"
},
{
"title": "managedAppPolicy",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"createdDateTime": {
"pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
"type": "string",
"description": "The date and time the policy was created.",
"format": "date-time"
},
"description": {
"type": [
"string",
"null"
],
"description": "The policy's description."
},
"displayName": {
"type": "string",
"description": "Policy display name."
},
"lastModifiedDateTime": {
"pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
"type": "string",
"description": "Last time the policy was modified.",
"format": "date-time"
},
"version": {
"type": [
"string",
"null"
],
"description": "Version of the entity."
},
"@odata.type": {
"type": "string"
}
},
"description": "The ManagedAppPolicy resource represents a base type for platform specific policies."
}
]
},
"microsoft.graph.proxiedDomain": {
"title": "proxiedDomain",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"ipAddressOrFQDN": {
"type": "string",
"description": "The IP address or FQDN"
},
"proxy": {
"type": [
"string",
"null"
],
"description": "Proxy IP or FQDN"
},
"@odata.type": {
"type": "string"
}
},
"description": "Proxied Domain"
},
"microsoft.graph.targetedManagedAppPolicyAssignment": {
"allOf": [
{
"$ref": "#/$defs/microsoft.graph.entity"
},
{
"title": "targetedManagedAppPolicyAssignment",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"target": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.deviceAndAppManagementAssignmentTarget"
},
{
"type": [
"object",
"null"
]
}
],
"description": "Identifier for deployment to a group or app"
},
"@odata.type": {
"type": "string"
}
},
"description": "The type for deployment of groups or apps."
}
],
"x-ms-discriminator-value": "#microsoft.graph.targetedManagedAppPolicyAssignment"
},
"microsoft.graph.windowsInformationProtection": {
"allOf": [
{
"$ref": "#/$defs/microsoft.graph.managedAppPolicy"
},
{
"title": "windowsInformationProtection",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"azureRightsManagementServicesAllowed": {
"type": "boolean",
"description": "Specifies whether to allow Azure RMS encryption for WIP"
},
"dataRecoveryCertificate": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionDataRecoveryCertificate"
},
{
"type": [
"object",
"null"
]
}
],
"description": "Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent(DRA) certificate for encrypting file system(EFS)"
},
"enforcementLevel": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionEnforcementLevel"
},
"enterpriseDomain": {
"type": [
"string",
"null"
],
"description": "Primary enterprise domain"
},
"enterpriseInternalProxyServers": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionResourceCollection"
},
"description": "This is the comma-separated list of internal proxy servers. For example, '157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59'. These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the EnterpriseProxiedDomains policy to force traffic to the matched domains through these proxies"
},
"enterpriseIPRanges": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionIPRangeCollection"
},
"description": "Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to"
},
"enterpriseIPRangesAreAuthoritative": {
"type": "boolean",
"description": "Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. Default is false"
},
"enterpriseNetworkDomainNames": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionResourceCollection"
},
"description": "This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to"
},
"enterpriseProtectedDomainNames": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionResourceCollection"
},
"description": "List of enterprise domains to be protected"
},
"enterpriseProxiedDomains": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionProxiedDomainCollection"
},
"description": "Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the EnterpriseInternalProxyServers policy"
},
"enterpriseProxyServers": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionResourceCollection"
},
"description": "This is a list of proxy servers. Any server not on this list is considered non-enterprise"
},
"enterpriseProxyServersAreAuthoritative": {
"type": "boolean",
"description": "Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. Default is false"
},
"exemptApps": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionApp"
},
"description": "Exempt applications can also access enterprise data, but the data handled by those applications are not protected. This is because some critical enterprise applications may have compatibility problems with encrypted data."
},
"iconsVisible": {
"type": "boolean",
"description": "Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles in the Start menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the WIP icon in the title bar of a WIP-protected app"
},
"indexingEncryptedStoresOrItemsBlocked": {
"type": "boolean",
"description": "This switch is for the Windows Search Indexer, to allow or disallow indexing of items"
},
"isAssigned": {
"type": "boolean",
"description": "Indicates if the policy is deployed to any inclusion groups or not."
},
"neutralDomainResources": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionResourceCollection"
},
"description": "List of domain names that can used for work or personal resource"
},
"protectedApps": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionApp"
},
"description": "Protected applications can access enterprise data and the data handled by those applications are protected with encryption"
},
"protectionUnderLockConfigRequired": {
"type": "boolean",
"description": "Specifies whether the protection under lock feature (also known as encrypt under pin) should be configured"
},
"revokeOnUnenrollDisabled": {
"type": "boolean",
"description": "This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 1 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after unenrollment. If the keys are not revoked, there will be no revoked file cleanup subsequently."
},
"rightsManagementServicesTemplateId": {
"pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
"type": [
"string",
"null"
],
"description": "TemplateID GUID to use for RMS encryption. The RMS template allows the IT admin to configure the details about who has access to RMS-protected file and how long they have access",
"format": "uuid"
},
"smbAutoEncryptedFileExtensions": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionResourceCollection"
},
"description": "Specifies a list of file extensions, so that files with these extensions are encrypted when copying from an SMB share within the corporate boundary"
},
"assignments": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.targetedManagedAppPolicyAssignment"
},
"description": "Navigation property to list of security groups targeted for policy.",
"x-ms-navigationProperty": true
},
"exemptAppLockerFiles": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionAppLockerFile"
},
"description": "Another way to input exempt apps through xml files",
"x-ms-navigationProperty": true
},
"protectedAppLockerFiles": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.windowsInformationProtectionAppLockerFile"
},
"description": "Another way to input protected apps through xml files",
"x-ms-navigationProperty": true
},
"@odata.type": {
"type": "string",
"default": "#microsoft.graph.windowsInformationProtection"
}
},
"description": "Policy for Windows information protection to configure detailed management settings"
}
]
},
"microsoft.graph.windowsInformationProtectionApp": {
"title": "windowsInformationProtectionApp",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"denied": {
"type": "boolean",
"description": "If true, app is denied protection or exemption."
},
"description": {
"type": [
"string",
"null"
],
"description": "The app's description."
},
"displayName": {
"type": "string",
"description": "App display name."
},
"productName": {
"type": [
"string",
"null"
],
"description": "The product name."
},
"publisherName": {
"type": [
"string",
"null"
],
"description": "The publisher name"
},
"@odata.type": {
"type": "string"
}
},
"description": "App for Windows information protection"
},
"microsoft.graph.windowsInformationProtectionAppLockerFile": {
"allOf": [
{
"$ref": "#/$defs/microsoft.graph.entity"
},
{
"title": "windowsInformationProtectionAppLockerFile",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"displayName": {
"type": [
"string",
"null"
],
"description": "The friendly name"
},
"file": {
"type": [
"string",
"null"
],
"description": "File as a byte array",
"format": "base64url"
},
"fileHash": {
"type": [
"string",
"null"
],
"description": "SHA256 hash of the file"
},
"version": {
"type": [
"string",
"null"
],
"description": "Version of the entity."
},
"@odata.type": {
"type": "string"
}
},
"description": "Windows Information Protection AppLocker File"
}
],
"x-ms-discriminator-value": "#microsoft.graph.windowsInformationProtectionAppLockerFile"
},
"microsoft.graph.windowsInformationProtectionDataRecoveryCertificate": {
"title": "windowsInformationProtectionDataRecoveryCertificate",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"certificate": {
"type": [
"string",
"null"
],
"description": "Data recovery Certificate",
"format": "base64url"
},
"description": {
"type": [
"string",
"null"
],
"description": "Data recovery Certificate description"
},
"expirationDateTime": {
"pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
"type": "string",
"description": "Data recovery Certificate expiration datetime",
"format": "date-time"
},
"subjectName": {
"type": [
"string",
"null"
],
"description": "Data recovery Certificate subject name"
},
"@odata.type": {
"type": "string"
}
},
"description": "Windows Information Protection DataRecoveryCertificate"
},
"microsoft.graph.windowsInformationProtectionEnforcementLevel": {
"title": "windowsInformationProtectionEnforcementLevel",
"enum": [
"noProtection",
"encryptAndAuditOnly",
"encryptAuditAndPrompt",
"encryptAuditAndBlock"
],
"type": "string",
"description": "Possible values for WIP Protection enforcement levels",
"x-ms-enum": {
"name": "windowsInformationProtectionEnforcementLevel",
"modelAsString": false,
"values": [
{
"value": "noProtection",
"description": "No protection enforcement",
"name": "noProtection"
},
{
"value": "encryptAndAuditOnly",
"description": "Encrypt and Audit only",
"name": "encryptAndAuditOnly"
},
{
"value": "encryptAuditAndPrompt",
"description": "Encrypt, Audit and Prompt",
"name": "encryptAuditAndPrompt"
},
{
"value": "encryptAuditAndBlock",
"description": "Encrypt, Audit and Block",
"name": "encryptAuditAndBlock"
}
]
}
},
"microsoft.graph.windowsInformationProtectionIPRangeCollection": {
"title": "windowsInformationProtectionIPRangeCollection",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"displayName": {
"type": "string",
"description": "Display name"
},
"ranges": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.ipRange"
},
"description": "Collection of ip ranges"
},
"@odata.type": {
"type": "string"
}
},
"description": "Windows Information Protection IP Range Collection"
},
"microsoft.graph.windowsInformationProtectionProxiedDomainCollection": {
"title": "windowsInformationProtectionProxiedDomainCollection",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"displayName": {
"type": "string",
"description": "Display name"
},
"proxiedDomains": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.proxiedDomain"
},
"description": "Collection of proxied domains"
},
"@odata.type": {
"type": "string"
}
},
"description": "Windows Information Protection Proxied Domain Collection"
},
"microsoft.graph.windowsInformationProtectionResourceCollection": {
"title": "windowsInformationProtectionResourceCollection",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"displayName": {
"type": "string",
"description": "Display name"
},
"resources": {
"type": "array",
"items": {
"type": [
"string",
"null"
]
},
"description": "Collection of resources"
},
"@odata.type": {
"type": "string"
}
},
"description": "Windows Information Protection Resource Collection"
}
}
}Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/microsoft-graph-microsoft-graph-mdm-windows-information-protection-policy"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.