{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-tenant-app-management-policy-schema.json",
  "title": "microsoft.graph.tenantAppManagementPolicy",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-policies-tenantappmanagementpolicy-api-openapi.yml#/components/schemas/microsoft.graph.tenantAppManagementPolicy",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.policyBase"
    },
    {
      "title": "tenantAppManagementPolicy",
      "type": "object",
      "properties": {
        "applicationRestrictions": {
          "$ref": "#/$defs/microsoft.graph.appManagementApplicationConfiguration"
        },
        "isEnabled": {
          "type": "boolean",
          "description": "Denotes whether the policy is enabled. Default value is false."
        },
        "servicePrincipalRestrictions": {
          "$ref": "#/$defs/microsoft.graph.appManagementServicePrincipalConfiguration"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.appCredentialRestrictionType": {
      "title": "appCredentialRestrictionType",
      "enum": [
        "passwordAddition",
        "passwordLifetime",
        "symmetricKeyAddition",
        "symmetricKeyLifetime",
        "customPasswordAddition",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.appKeyCredentialRestrictionType": {
      "title": "appKeyCredentialRestrictionType",
      "enum": [
        "asymmetricKeyLifetime",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.appManagementApplicationConfiguration": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.appManagementConfiguration"
        },
        {
          "title": "appManagementApplicationConfiguration",
          "type": "object",
          "properties": {
            "identifierUris": {
              "$ref": "#/$defs/microsoft.graph.identifierUriConfiguration"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.appManagementConfiguration": {
      "title": "appManagementConfiguration",
      "type": "object",
      "properties": {
        "keyCredentials": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.keyCredentialConfiguration"
          },
          "description": "Collection of keyCredential restrictions settings to be applied to an application or service principal."
        },
        "passwordCredentials": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.passwordCredentialConfiguration"
          },
          "description": "Collection of password restrictions settings to be applied to an application or service principal."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.appManagementPolicyActorExemptions": {
      "title": "appManagementPolicyActorExemptions",
      "type": "object",
      "properties": {
        "customSecurityAttributes": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.customSecurityAttributeExemption"
          },
          "description": "The collection of customSecurityAttributeExemption to exempt from the policy enforcement. Limit of 5."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.appManagementRestrictionState": {
      "title": "appManagementRestrictionState",
      "enum": [
        "enabled",
        "disabled",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.appManagementServicePrincipalConfiguration": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.appManagementConfiguration"
        },
        {
          "title": "appManagementServicePrincipalConfiguration",
          "type": "object",
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.customSecurityAttributeComparisonOperator": {
      "title": "customSecurityAttributeComparisonOperator",
      "enum": [
        "equals",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.customSecurityAttributeExemption": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "customSecurityAttributeExemption",
          "type": "object",
          "properties": {
            "id": {
              "type": "string"
            },
            "operator": {
              "$ref": "#/$defs/microsoft.graph.customSecurityAttributeComparisonOperator"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.directoryObject": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "directoryObject",
          "type": "object",
          "properties": {
            "deletedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "Date and time when this object was deleted. Always null when the object hasn't been deleted.",
              "format": "date-time"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.identifierUriConfiguration": {
      "title": "identifierUriConfiguration",
      "type": "object",
      "properties": {
        "nonDefaultUriAddition": {
          "$ref": "#/$defs/microsoft.graph.identifierUriRestriction"
        },
        "uriAdditionWithoutUniqueTenantIdentifier": {
          "$ref": "#/$defs/microsoft.graph.identifierUriRestriction"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.identifierUriRestriction": {
      "title": "identifierUriRestriction",
      "type": "object",
      "properties": {
        "excludeActors": {
          "$ref": "#/$defs/microsoft.graph.appManagementPolicyActorExemptions"
        },
        "excludeAppsReceivingV2Tokens": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "If true, the restriction isn't enforced for applications that are configured to receive V2 tokens in Microsoft Entra ID; else, the restriction is enforced for those applications."
        },
        "excludeSaml": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "If true, the restriction isn't enforced for SAML applications in Microsoft Entra ID; else, the restriction is enforced for those applications."
        },
        "isStateSetByMicrosoft": {
          "type": "boolean",
          "description": "If true, Microsoft sets the identifierUriRestriction state. If false, the tenant modifies the identifierUriRestriction state. Read-only.",
          "readOnly": true
        },
        "restrictForAppsCreatedAfterDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "description": "Specifies the date from which the policy restriction applies to newly created applications. For existing applications, the enforcement date can be retroactively applied.",
          "format": "date-time"
        },
        "state": {
          "$ref": "#/$defs/microsoft.graph.appManagementRestrictionState"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.keyCredentialConfiguration": {
      "title": "keyCredentialConfiguration",
      "type": "object",
      "properties": {
        "excludeActors": {
          "$ref": "#/$defs/microsoft.graph.appManagementPolicyActorExemptions"
        },
        "maxLifetime": {
          "pattern": "^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$",
          "type": [
            "string",
            "null"
          ],
          "description": "String value that indicates the maximum lifetime for key expiration, defined as an ISO 8601 duration. For example, P4DT12H30M5S represents four days, 12 hours, 30 minutes, and five seconds. This property is required when restrictionType is set to asymmetricKeyLifetime.",
          "format": "duration"
        },
        "restrictForAppsCreatedAfterDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "description": "Specifies the date from which the policy restriction applies to newly created applications. For existing applications, the enforcement date can be retroactively applied.",
          "format": "date-time"
        },
        "restrictionType": {
          "$ref": "#/$defs/microsoft.graph.appKeyCredentialRestrictionType"
        },
        "state": {
          "$ref": "#/$defs/microsoft.graph.appManagementRestrictionState"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.passwordCredentialConfiguration": {
      "title": "passwordCredentialConfiguration",
      "type": "object",
      "properties": {
        "excludeActors": {
          "$ref": "#/$defs/microsoft.graph.appManagementPolicyActorExemptions"
        },
        "maxLifetime": {
          "pattern": "^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$",
          "type": [
            "string",
            "null"
          ],
          "description": "String value that indicates the maximum lifetime for password expiration, defined as an ISO 8601 duration. For example, P4DT12H30M5S represents four days, 12 hours, 30 minutes, and five seconds. This property is required when restrictionType is set to passwordLifetime.",
          "format": "duration"
        },
        "restrictForAppsCreatedAfterDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "description": "Specifies the date from which the policy restriction applies to newly created applications. For existing applications, the enforcement date can be retroactively applied.",
          "format": "date-time"
        },
        "restrictionType": {
          "$ref": "#/$defs/microsoft.graph.appCredentialRestrictionType"
        },
        "state": {
          "$ref": "#/$defs/microsoft.graph.appManagementRestrictionState"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.policyBase": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.directoryObject"
        },
        {
          "title": "policyBase",
          "type": "object",
          "properties": {
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "Description for this policy. Required."
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "Display name for this policy. Required."
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    }
  }
}