{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-authentication-strength-policy-schema.json",
  "title": "microsoft.graph.authenticationStrengthPolicy",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-identity-conditionalaccessroot-api-openapi.yml#/components/schemas/microsoft.graph.authenticationStrengthPolicy",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "authenticationStrengthPolicy",
      "type": "object",
      "properties": {
        "allowedCombinations": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.authenticationMethodModes"
          },
          "description": "A collection of authentication method modes that are required be used to satify this authentication strength."
        },
        "createdDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": "string",
          "description": "The datetime when this policy was created.",
          "format": "date-time"
        },
        "description": {
          "type": [
            "string",
            "null"
          ],
          "description": "The human-readable description of this policy."
        },
        "displayName": {
          "type": "string",
          "description": "The human-readable display name of this policy. Supports $filter (eq, ne, not , and in)."
        },
        "modifiedDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": "string",
          "description": "The datetime when this policy was last modified.",
          "format": "date-time"
        },
        "policyType": {
          "$ref": "#/$defs/microsoft.graph.authenticationStrengthPolicyType"
        },
        "requirementsSatisfied": {
          "$ref": "#/$defs/microsoft.graph.authenticationStrengthRequirements"
        },
        "combinationConfigurations": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.authenticationCombinationConfiguration"
          },
          "description": "Settings that may be used to require specific types or instances of an authentication method to be used when authenticating with a specified combination of authentication methods.",
          "x-ms-navigationProperty": true
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.authenticationCombinationConfiguration": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "authenticationCombinationConfiguration",
          "type": "object",
          "properties": {
            "appliesToCombinations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.authenticationMethodModes"
              },
              "description": "Which authentication method combinations this configuration applies to. Must be an allowedCombinations object, part of the authenticationStrengthPolicy. The only possible value for fido2combinationConfigurations is 'fido2'."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.authenticationMethodModes": {
      "title": "authenticationMethodModes",
      "enum": [
        "password",
        "voice",
        "hardwareOath",
        "softwareOath",
        "sms",
        "fido2",
        "windowsHelloForBusiness",
        "microsoftAuthenticatorPush",
        "deviceBasedPush",
        "temporaryAccessPassOneTime",
        "temporaryAccessPassMultiUse",
        "email",
        "x509CertificateSingleFactor",
        "x509CertificateMultiFactor",
        "federatedSingleFactor",
        "federatedMultiFactor",
        "unknownFutureValue",
        "qrCodePin"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.authenticationStrengthPolicyType": {
      "title": "authenticationStrengthPolicyType",
      "enum": [
        "builtIn",
        "custom",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.authenticationStrengthRequirements": {
      "title": "authenticationStrengthRequirements",
      "enum": [
        "none",
        "mfa",
        "unknownFutureValue"
      ],
      "type": "string",
      "x-ms-enum-flags": {
        "isFlags": true
      }
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  }
}