Microsoft Graph · Schema
microsoft.graph.signIn
Microsoft GraphAzure ADCollaborationContactsDocumentsEmailGraphIdentityMicrosoftOffice 365PresentationsProductivitySpreadsheetsT1Task
Properties
| Name | Type | Description |
|---|---|---|
| id | string | The unique identifier for an entity. Read-only. |
| @odata.type | string | |
| appDisplayName | stringnull | App name displayed in the Microsoft Entra admin center. Supports $filter (eq, startsWith). |
| appId | stringnull | Unique GUID that represents the app ID in the Microsoft Entra ID. Supports $filter (eq). |
| appliedConditionalAccessPolicies | array | Provides a list of conditional access policies that the corresponding sign-in activity triggers. Apps need more Conditional Access-related privileges to read the details of this property. For more inf |
| clientAppUsed | stringnull | Identifies the client used for the sign-in activity. Modern authentication clients include Browser, modern clients. Legacy authentication clients include Exchange ActiveSync, IMAP, MAPI, SMTP, POP, an |
| conditionalAccessStatus | object | Reports status of an activated conditional access policy. The possible values are: success, failure, notApplied, and unknownFutureValue. Supports $filter (eq). |
| correlationId | stringnull | The request ID sent from the client when the sign-in is initiated. Used to troubleshoot sign-in activity. Supports $filter (eq). |
| createdDateTime | string | Date and time (UTC) the sign-in was initiated. Example: midnight on Jan 1, 2014 is reported as 2014-01-01T00:00:00Z. Supports $orderby, $filter (eq, le, and ge). |
| deviceDetail | object | Device information from where the sign-in occurred; includes device ID, operating system, and browser. Supports $filter (eq, startsWith) on browser and operatingSytem properties. |
| ipAddress | stringnull | IP address of the client used to sign in. Supports $filter (eq, startsWith). |
| isInteractive | booleannull | Indicates whether a sign-in is interactive. |
| location | object | Provides the city, state, and country code where the sign-in originated. Supports $filter (eq, startsWith) on city, state, and countryOrRegion properties. |
| resourceDisplayName | stringnull | Name of the resource the user signed into. Supports $filter (eq). |
| resourceId | stringnull | ID of the resource that the user signed into. Supports $filter (eq). |
| riskDetail | object | The reason behind a specific state of a risky user, sign-in, or a risk event. The value none means that Microsoft Entra risk detection did not flag the user or the sign-in as a risky event so far. Sup |
| riskEventTypes | array | |
| riskEventTypes_v2 | array | The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, l |
| riskLevelAggregated | object | Aggregated risk level. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection. Su |
| riskLevelDuringSignIn | object | Risk level during sign-in. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection |
| riskState | object | Reports status of the risky user, sign-in, or a risk event. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue. Supports $filter (eq) |
| status | object | Sign-in status. Includes the error code and description of the error (if a sign-in failure occurs). Supports $filter (eq) on errorCode property. |
| userDisplayName | stringnull | Display name of the user that initiated the sign-in. Supports $filter (eq, startsWith). |
| userId | string | ID of the user that initiated the sign-in. Supports $filter (eq). |
| userPrincipalName | stringnull | User principal name of the user that initiated the sign-in. This value is always in lowercase. For guest users whose values in the user object typically contain #EXT# before the domain part, this prop |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://artifacts.apis.io/microsoft-graph/json-schema/microsoft-graph-microsoft-graph-sign-in-schema.json",
"title": "microsoft.graph.signIn",
"x-generated": "2026-11-04",
"x-method": "derived",
"x-generator": "derive-json-schema.py",
"x-source": "openapi/microsoft-graph-auditlogs-signin-api-openapi.yml#/components/schemas/microsoft.graph.signIn",
"allOf": [
{
"$ref": "#/$defs/microsoft.graph.entity"
},
{
"title": "signIn",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"appDisplayName": {
"type": [
"string",
"null"
],
"description": "App name displayed in the Microsoft Entra admin center. Supports $filter (eq, startsWith)."
},
"appId": {
"type": [
"string",
"null"
],
"description": "Unique GUID that represents the app ID in the Microsoft Entra ID. Supports $filter (eq)."
},
"appliedConditionalAccessPolicies": {
"type": "array",
"items": {
"$ref": "#/$defs/microsoft.graph.appliedConditionalAccessPolicy"
},
"description": "Provides a list of conditional access policies that the corresponding sign-in activity triggers. Apps need more Conditional Access-related privileges to read the details of this property. For more information, see Permissions for viewing applied conditional access (CA) policies in sign-ins."
},
"clientAppUsed": {
"type": [
"string",
"null"
],
"description": "Identifies the client used for the sign-in activity. Modern authentication clients include Browser, modern clients. Legacy authentication clients include Exchange ActiveSync, IMAP, MAPI, SMTP, POP, and other clients. Supports $filter (eq)."
},
"conditionalAccessStatus": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.conditionalAccessStatus"
},
{
"type": [
"object",
"null"
]
}
],
"description": "Reports status of an activated conditional access policy. The possible values are: success, failure, notApplied, and unknownFutureValue. Supports $filter (eq)."
},
"correlationId": {
"type": [
"string",
"null"
],
"description": "The request ID sent from the client when the sign-in is initiated. Used to troubleshoot sign-in activity. Supports $filter (eq)."
},
"createdDateTime": {
"pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
"type": "string",
"description": "Date and time (UTC) the sign-in was initiated. Example: midnight on Jan 1, 2014 is reported as 2014-01-01T00:00:00Z. Supports $orderby, $filter (eq, le, and ge).",
"format": "date-time"
},
"deviceDetail": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.deviceDetail"
},
{
"type": [
"object",
"null"
]
}
],
"description": "Device information from where the sign-in occurred; includes device ID, operating system, and browser. Supports $filter (eq, startsWith) on browser and operatingSytem properties."
},
"ipAddress": {
"type": [
"string",
"null"
],
"description": "IP address of the client used to sign in. Supports $filter (eq, startsWith)."
},
"isInteractive": {
"type": [
"boolean",
"null"
],
"description": "Indicates whether a sign-in is interactive."
},
"location": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.signInLocation"
},
{
"type": [
"object",
"null"
]
}
],
"description": "Provides the city, state, and country code where the sign-in originated. Supports $filter (eq, startsWith) on city, state, and countryOrRegion properties."
},
"resourceDisplayName": {
"type": [
"string",
"null"
],
"description": "Name of the resource the user signed into. Supports $filter (eq)."
},
"resourceId": {
"type": [
"string",
"null"
],
"description": "ID of the resource that the user signed into. Supports $filter (eq)."
},
"riskDetail": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.riskDetail"
},
{
"type": [
"object",
"null"
]
}
],
"description": "The reason behind a specific state of a risky user, sign-in, or a risk event. The value none means that Microsoft Entra risk detection did not flag the user or the sign-in as a risky event so far. Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden."
},
"riskEventTypes": {
"type": "array",
"items": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.riskEventType"
},
{
"type": [
"object",
"null"
]
}
]
}
},
"riskEventTypes_v2": {
"type": "array",
"items": {
"type": [
"string",
"null"
]
},
"description": "The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic, or unknownFutureValue. Supports $filter (eq, startsWith)."
},
"riskLevelAggregated": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.riskLevel"
},
{
"type": [
"object",
"null"
]
}
],
"description": "Aggregated risk level. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection. Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden."
},
"riskLevelDuringSignIn": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.riskLevel"
},
{
"type": [
"object",
"null"
]
}
],
"description": "Risk level during sign-in. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection. Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden."
},
"riskState": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.riskState"
},
{
"type": [
"object",
"null"
]
}
],
"description": "Reports status of the risky user, sign-in, or a risk event. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue. Supports $filter (eq)."
},
"status": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.signInStatus"
},
{
"type": [
"object",
"null"
]
}
],
"description": "Sign-in status. Includes the error code and description of the error (if a sign-in failure occurs). Supports $filter (eq) on errorCode property."
},
"userDisplayName": {
"type": [
"string",
"null"
],
"description": "Display name of the user that initiated the sign-in. Supports $filter (eq, startsWith)."
},
"userId": {
"type": "string",
"description": "ID of the user that initiated the sign-in. Supports $filter (eq)."
},
"userPrincipalName": {
"type": [
"string",
"null"
],
"description": "User principal name of the user that initiated the sign-in. This value is always in lowercase. For guest users whose values in the user object typically contain #EXT# before the domain part, this property stores the value in both lowercase and the 'true' format. For example, while the user object stores AdeleVance_fabrikam.com#EXT#@contoso.com, the sign-in logs store adelevance@fabrikam.com. Supports $filter (eq, startsWith)."
},
"@odata.type": {
"type": "string"
}
}
}
],
"x-ms-discriminator-value": "#microsoft.graph.signIn",
"$defs": {
"ReferenceNumeric": {
"enum": [
"-INF",
"INF",
"NaN"
],
"type": [
"string",
"null"
]
},
"microsoft.graph.appliedConditionalAccessPolicy": {
"title": "appliedConditionalAccessPolicy",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"displayName": {
"type": [
"string",
"null"
],
"description": "Refers to the name of the conditional access policy (example: 'Require MFA for Salesforce')."
},
"enforcedGrantControls": {
"type": "array",
"items": {
"type": [
"string",
"null"
]
},
"description": "Refers to the grant controls enforced by the conditional access policy (example: 'Require multifactor authentication')."
},
"enforcedSessionControls": {
"type": "array",
"items": {
"type": [
"string",
"null"
]
},
"description": "Refers to the session controls enforced by the conditional access policy (example: 'Require app enforced controls')."
},
"id": {
"type": [
"string",
"null"
],
"description": "An identifier of the conditional access policy. Supports $filter (eq)."
},
"result": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.appliedConditionalAccessPolicyResult"
},
{
"type": [
"object",
"null"
]
}
],
"description": "Indicates the result of the CA policy that was triggered. The possible values are: success, failure, notApplied (policy isn't applied because policy conditions weren't met), notEnabled (This is due to the policy in a disabled state), unknown, unknownFutureValue, reportOnlySuccess, reportOnlyFailure, reportOnlyNotApplied, reportOnlyInterrupted. Use the Prefer: include-unknown-enum-members request header to get the following values in this evolvable enum: reportOnlySuccess, reportOnlyFailure, reportOnlyNotApplied, reportOnlyInterrupted."
},
"@odata.type": {
"type": "string"
}
}
},
"microsoft.graph.appliedConditionalAccessPolicyResult": {
"title": "appliedConditionalAccessPolicyResult",
"enum": [
"success",
"failure",
"notApplied",
"notEnabled",
"unknown",
"unknownFutureValue",
"reportOnlySuccess",
"reportOnlyFailure",
"reportOnlyNotApplied",
"reportOnlyInterrupted"
],
"type": "string"
},
"microsoft.graph.conditionalAccessStatus": {
"title": "conditionalAccessStatus",
"enum": [
"success",
"failure",
"notApplied",
"unknownFutureValue"
],
"type": "string"
},
"microsoft.graph.deviceDetail": {
"title": "deviceDetail",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"browser": {
"type": [
"string",
"null"
],
"description": "Indicates the browser information of the used in the sign-in. Populated for devices registered in Microsoft Entra."
},
"deviceId": {
"type": [
"string",
"null"
],
"description": "Refers to the unique ID of the device used in the sign-in. Populated for devices registered in Microsoft Entra."
},
"displayName": {
"type": [
"string",
"null"
],
"description": "Refers to the name of the device used in the sign-in. Populated for devices registered in Microsoft Entra."
},
"isCompliant": {
"type": [
"boolean",
"null"
],
"description": "Indicates whether the device is compliant or not."
},
"isManaged": {
"type": [
"boolean",
"null"
],
"description": "Indicates if the device is managed or not."
},
"operatingSystem": {
"type": [
"string",
"null"
],
"description": "Indicates the OS name and version used in the sign-in."
},
"trustType": {
"type": [
"string",
"null"
],
"description": "Indicates information on whether the device used in the sign-in is workplace-joined, Microsoft Entra-joined, domain-joined."
},
"@odata.type": {
"type": "string"
}
}
},
"microsoft.graph.entity": {
"title": "entity",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"id": {
"type": "string",
"description": "The unique identifier for an entity. Read-only."
},
"@odata.type": {
"type": "string"
}
}
},
"microsoft.graph.geoCoordinates": {
"title": "geoCoordinates",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"altitude": {
"oneOf": [
{
"type": [
"number",
"null"
],
"format": "double"
},
{
"type": [
"string",
"null"
]
},
{
"$ref": "#/$defs/ReferenceNumeric"
}
],
"description": "Optional. The altitude (height), in feet, above sea level for the item. Read-only."
},
"latitude": {
"oneOf": [
{
"type": [
"number",
"null"
],
"format": "double"
},
{
"type": [
"string",
"null"
]
},
{
"$ref": "#/$defs/ReferenceNumeric"
}
],
"description": "Optional. The latitude, in decimal, for the item. Read-only."
},
"longitude": {
"oneOf": [
{
"type": [
"number",
"null"
],
"format": "double"
},
{
"type": [
"string",
"null"
]
},
{
"$ref": "#/$defs/ReferenceNumeric"
}
],
"description": "Optional. The longitude, in decimal, for the item. Read-only."
},
"@odata.type": {
"type": "string"
}
}
},
"microsoft.graph.riskDetail": {
"title": "riskDetail",
"enum": [
"none",
"adminGeneratedTemporaryPassword",
"userPerformedSecuredPasswordChange",
"userPerformedSecuredPasswordReset",
"adminConfirmedSigninSafe",
"aiConfirmedSigninSafe",
"userPassedMFADrivenByRiskBasedPolicy",
"adminDismissedAllRiskForUser",
"adminConfirmedSigninCompromised",
"hidden",
"adminConfirmedUserCompromised",
"unknownFutureValue",
"m365DAdminDismissedDetection",
"adminConfirmedServicePrincipalCompromised",
"adminDismissedAllRiskForServicePrincipal",
"userChangedPasswordOnPremises",
"adminDismissedRiskForSignIn",
"adminConfirmedAccountSafe"
],
"type": "string"
},
"microsoft.graph.riskEventType": {
"title": "riskEventType",
"enum": [
"unlikelyTravel",
"anonymizedIPAddress",
"maliciousIPAddress",
"unfamiliarFeatures",
"malwareInfectedIPAddress",
"suspiciousIPAddress",
"leakedCredentials",
"investigationsThreatIntelligence",
"generic",
"adminConfirmedUserCompromised",
"mcasImpossibleTravel",
"mcasSuspiciousInboxManipulationRules",
"investigationsThreatIntelligenceSigninLinked",
"maliciousIPAddressValidCredentialsBlockedIP",
"unknownFutureValue"
],
"type": "string"
},
"microsoft.graph.riskLevel": {
"title": "riskLevel",
"enum": [
"low",
"medium",
"high",
"hidden",
"none",
"unknownFutureValue"
],
"type": "string"
},
"microsoft.graph.riskState": {
"title": "riskState",
"enum": [
"none",
"confirmedSafe",
"remediated",
"dismissed",
"atRisk",
"confirmedCompromised",
"unknownFutureValue"
],
"type": "string"
},
"microsoft.graph.signInLocation": {
"title": "signInLocation",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"city": {
"type": [
"string",
"null"
],
"description": "Provides the city where the sign-in originated and is determined using latitude/longitude information from the sign-in activity."
},
"countryOrRegion": {
"type": [
"string",
"null"
],
"description": "Provides the country code info (two letter code) where the sign-in originated. This is calculated using latitude/longitude information from the sign-in activity."
},
"geoCoordinates": {
"anyOf": [
{
"$ref": "#/$defs/microsoft.graph.geoCoordinates"
},
{
"type": [
"object",
"null"
]
}
],
"description": "Provides the latitude, longitude and altitude where the sign-in originated."
},
"state": {
"type": [
"string",
"null"
],
"description": "Provides the State where the sign-in originated. This is calculated using latitude/longitude information from the sign-in activity."
},
"@odata.type": {
"type": "string"
}
}
},
"microsoft.graph.signInStatus": {
"title": "signInStatus",
"required": [
"@odata.type"
],
"type": "object",
"properties": {
"additionalDetails": {
"type": [
"string",
"null"
],
"description": "Provides additional details on the sign-in activity"
},
"errorCode": {
"maximum": 2147483647,
"minimum": -2147483648,
"type": [
"number",
"null"
],
"description": "Provides the 5-6 digit error code that's generated during a sign-in failure. Check out the list of error codes and messages.",
"format": "int32"
},
"failureReason": {
"type": [
"string",
"null"
],
"description": "Provides the error message or the reason for failure for the corresponding sign-in activity. Check out the list of error codes and messages."
},
"@odata.type": {
"type": "string"
}
}
}
}
}Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/microsoft-graph-microsoft-graph-sign-in"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.