{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-authentication-methods-policy-schema.json",
  "title": "microsoft.graph.authenticationMethodsPolicy",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-policies-authenticationmethodspolicy-api-openapi.yml#/components/schemas/microsoft.graph.authenticationMethodsPolicy",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "authenticationMethodsPolicy",
      "type": "object",
      "properties": {
        "description": {
          "type": [
            "string",
            "null"
          ],
          "description": "A description of the policy. Read-only."
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "The name of the policy. Read-only."
        },
        "lastModifiedDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "description": "The date and time of the last update to the policy. Read-only.",
          "format": "date-time"
        },
        "policyMigrationState": {
          "$ref": "#/$defs/microsoft.graph.authenticationMethodsPolicyMigrationState"
        },
        "policyVersion": {
          "type": [
            "string",
            "null"
          ],
          "description": "The version of the policy in use. Read-only."
        },
        "reconfirmationInDays": {
          "maximum": 2147483647,
          "minimum": -2147483648,
          "type": [
            "number",
            "null"
          ],
          "format": "int32"
        },
        "registrationEnforcement": {
          "$ref": "#/$defs/microsoft.graph.registrationEnforcement"
        },
        "authenticationMethodConfigurations": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.authenticationMethodConfiguration"
          },
          "description": "Represents the settings for each authentication method. Automatically expanded on GET /policies/authenticationMethodsPolicy.",
          "x-ms-navigationProperty": true
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.advancedConfigState": {
      "title": "advancedConfigState",
      "enum": [
        "default",
        "enabled",
        "disabled",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationMethodConfiguration": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationMethodConfiguration",
          "type": "object",
          "properties": {
            "excludeTargets": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.excludeTarget"
              },
              "description": "Groups of users that are excluded from a policy."
            },
            "state": {
              "$ref": "#/$defs/microsoft.graph.authenticationMethodState"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationMethodState": {
      "title": "authenticationMethodState",
      "enum": [
        "enabled",
        "disabled"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationMethodTargetType": {
      "title": "authenticationMethodTargetType",
      "enum": [
        "user",
        "group",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationMethodsPolicyMigrationState": {
      "title": "authenticationMethodsPolicyMigrationState",
      "enum": [
        "preMigration",
        "migrationInProgress",
        "migrationComplete",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationMethodsRegistrationCampaign": {
      "title": "authenticationMethodsRegistrationCampaign",
      "type": "object",
      "properties": {
        "excludeTargets": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.excludeTarget"
          },
          "description": "Users and groups of users that are excluded from being prompted to set up the authentication method."
        },
        "includeTargets": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.authenticationMethodsRegistrationCampaignIncludeTarget"
          },
          "description": "Users and groups of users that are prompted to set up the authentication method."
        },
        "snoozeDurationInDays": {
          "maximum": 2147483647,
          "minimum": -2147483648,
          "type": "number",
          "description": "Specifies the number of days that the user sees a prompt again if they select 'Not now' and snoozes the prompt. Minimum: 0 days. Maximum: 14 days. If the value is '0', the user is prompted during every MFA attempt.",
          "format": "int32"
        },
        "state": {
          "$ref": "#/$defs/microsoft.graph.advancedConfigState"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.authenticationMethodsRegistrationCampaignIncludeTarget": {
      "title": "authenticationMethodsRegistrationCampaignIncludeTarget",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The object identifier of a Microsoft Entra user or group."
        },
        "targetedAuthenticationMethod": {
          "type": [
            "string",
            "null"
          ],
          "description": "The authentication method that the user is prompted to register. The value can be Fido2 or microsoftAuthenticator."
        },
        "targetType": {
          "$ref": "#/$defs/microsoft.graph.authenticationMethodTargetType"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.excludeTarget": {
      "title": "excludeTarget",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The object identifier of a Microsoft Entra user or group."
        },
        "targetType": {
          "$ref": "#/$defs/microsoft.graph.authenticationMethodTargetType"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.registrationEnforcement": {
      "title": "registrationEnforcement",
      "type": "object",
      "properties": {
        "authenticationMethodsRegistrationCampaign": {
          "$ref": "#/$defs/microsoft.graph.authenticationMethodsRegistrationCampaign"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  }
}