{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-graph/json-schema/microsoft-graph-microsoft-graph-audit-log-root-schema.json",
  "title": "microsoft.graph.auditLogRoot",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-graph-auditlogs-auditlogroot-api-openapi.yml#/components/schemas/microsoft.graph.auditLogRoot",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "auditLogRoot",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "directoryAudits": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.directoryAudit"
          },
          "x-ms-navigationProperty": true
        },
        "provisioning": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.provisioningObjectSummary"
          },
          "x-ms-navigationProperty": true
        },
        "signIns": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.signIn"
          },
          "x-ms-navigationProperty": true
        },
        "@odata.type": {
          "type": "string"
        }
      }
    }
  ],
  "x-ms-discriminator-value": "#microsoft.graph.auditLogRoot",
  "$defs": {
    "ReferenceNumeric": {
      "enum": [
        "-INF",
        "INF",
        "NaN"
      ],
      "type": [
        "string",
        "null"
      ]
    },
    "microsoft.graph.appIdentity": {
      "title": "appIdentity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "appId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the unique ID representing application in Microsoft Entra ID."
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the application name displayed in the Microsoft Entra admin center."
        },
        "servicePrincipalId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the unique ID for the service principal in Microsoft Entra ID."
        },
        "servicePrincipalName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the Service Principal Name is the Application name in the tenant."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.appliedConditionalAccessPolicy": {
      "title": "appliedConditionalAccessPolicy",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the name of the conditional access policy (example: 'Require MFA for Salesforce')."
        },
        "enforcedGrantControls": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "Refers to the grant controls enforced by the conditional access policy (example: 'Require multifactor authentication')."
        },
        "enforcedSessionControls": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "Refers to the session controls enforced by the conditional access policy (example: 'Require app enforced controls')."
        },
        "id": {
          "type": [
            "string",
            "null"
          ],
          "description": "An identifier of the conditional access policy. Supports $filter (eq)."
        },
        "result": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.appliedConditionalAccessPolicyResult"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Indicates the result of the CA policy that was triggered. The possible values are: success, failure, notApplied (policy isn't applied because policy conditions weren't met), notEnabled (This is due to the policy in a disabled state), unknown, unknownFutureValue, reportOnlySuccess, reportOnlyFailure, reportOnlyNotApplied, reportOnlyInterrupted. Use the Prefer: include-unknown-enum-members request header to get the following values in this evolvable enum: reportOnlySuccess, reportOnlyFailure, reportOnlyNotApplied, reportOnlyInterrupted."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.appliedConditionalAccessPolicyResult": {
      "title": "appliedConditionalAccessPolicyResult",
      "enum": [
        "success",
        "failure",
        "notApplied",
        "notEnabled",
        "unknown",
        "unknownFutureValue",
        "reportOnlySuccess",
        "reportOnlyFailure",
        "reportOnlyNotApplied",
        "reportOnlyInterrupted"
      ],
      "type": "string"
    },
    "microsoft.graph.auditActivityInitiator": {
      "title": "auditActivityInitiator",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "app": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.appIdentity"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "If the resource initiating the activity is an app, this property indicates all the app related information like appId and name."
        },
        "user": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.userIdentity"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "If the resource initiating the activity is a user, this property Indicates all the user related information like user ID and userPrincipalName."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.conditionalAccessStatus": {
      "title": "conditionalAccessStatus",
      "enum": [
        "success",
        "failure",
        "notApplied",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.detailsInfo": {
      "title": "detailsInfo",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.deviceDetail": {
      "title": "deviceDetail",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "browser": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the browser information of the used in the sign-in. Populated for devices registered in Microsoft Entra."
        },
        "deviceId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the unique ID of the device used in the sign-in. Populated for devices registered in Microsoft Entra."
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the name of the device used in the sign-in. Populated for devices registered in Microsoft Entra."
        },
        "isCompliant": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates whether the device is compliant or not."
        },
        "isManaged": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates if the device is managed or not."
        },
        "operatingSystem": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the OS name and version used in the sign-in."
        },
        "trustType": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates information on whether the device used in the sign-in is workplace-joined, Microsoft Entra-joined, domain-joined."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.directoryAudit": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "directoryAudit",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "activityDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "Indicates the date and time the activity was performed. The Timestamp type is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Supports $filter (eq, ge, le) and $orderby.",
              "format": "date-time"
            },
            "activityDisplayName": {
              "type": "string",
              "description": "Indicates the activity name or the operation name (examples: 'Create User' and 'Add member to group'). For a list of activities logged, refer to Microsoft Entra audit log categories and activities. Supports $filter (eq, startswith)."
            },
            "additionalDetails": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.keyValue"
              },
              "description": "Indicates additional details on the activity."
            },
            "category": {
              "type": "string",
              "description": "Indicates which resource category that's targeted by the activity. For example: UserManagement, GroupManagement, ApplicationManagement, RoleManagement. For a list of categories for activities logged, refer to Microsoft Entra audit log categories and activities."
            },
            "correlationId": {
              "type": [
                "string",
                "null"
              ],
              "description": "Indicates a unique ID that helps correlate activities that span across various services. Can be used to trace logs across services. Supports $filter (eq)."
            },
            "initiatedBy": {
              "$ref": "#/$defs/microsoft.graph.auditActivityInitiator"
            },
            "loggedByService": {
              "type": [
                "string",
                "null"
              ],
              "description": "Indicates information on which service initiated the activity (For example: Self-service Password Management, Core Directory, B2C, Invited Users, Microsoft Identity Manager, Privileged Identity Management. Supports $filter (eq)."
            },
            "operationType": {
              "type": [
                "string",
                "null"
              ],
              "description": "Indicates the type of operation that was performed. The possible values include but are not limited to the following: Add, Assign, Update, Unassign, and Delete."
            },
            "result": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.operationResult"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Indicates the result of the activity. The possible values are: success, failure, timeout, unknownFutureValue."
            },
            "resultReason": {
              "type": [
                "string",
                "null"
              ],
              "description": "Indicates the reason for failure if the result is failure or timeout."
            },
            "targetResources": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.targetResource"
              },
              "description": "Indicates information on which resource was changed due to the activity. Target Resource Type can be User, Device, Directory, App, Role, Group, Policy or Other. Supports $filter (eq) for id and displayName; and $filter (startswith) for displayName."
            },
            "@odata.type": {
              "type": "string"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.directoryAudit"
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.geoCoordinates": {
      "title": "geoCoordinates",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "altitude": {
          "oneOf": [
            {
              "type": [
                "number",
                "null"
              ],
              "format": "double"
            },
            {
              "type": [
                "string",
                "null"
              ]
            },
            {
              "$ref": "#/$defs/ReferenceNumeric"
            }
          ],
          "description": "Optional. The altitude (height), in feet,  above sea level for the item. Read-only."
        },
        "latitude": {
          "oneOf": [
            {
              "type": [
                "number",
                "null"
              ],
              "format": "double"
            },
            {
              "type": [
                "string",
                "null"
              ]
            },
            {
              "$ref": "#/$defs/ReferenceNumeric"
            }
          ],
          "description": "Optional. The latitude, in decimal, for the item. Read-only."
        },
        "longitude": {
          "oneOf": [
            {
              "type": [
                "number",
                "null"
              ],
              "format": "double"
            },
            {
              "type": [
                "string",
                "null"
              ]
            },
            {
              "$ref": "#/$defs/ReferenceNumeric"
            }
          ],
          "description": "Optional. The longitude, in decimal, for the item. Read-only."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.groupType": {
      "title": "groupType",
      "enum": [
        "unifiedGroups",
        "azureAD",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.identity": {
      "title": "identity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta."
        },
        "id": {
          "type": [
            "string",
            "null"
          ],
          "description": "Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.initiator": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.identity"
        },
        {
          "title": "initiator",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "initiatorType": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.initiatorType"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Type of initiator. The possible values are: user, application, system, unknownFutureValue."
            },
            "@odata.type": {
              "type": "string",
              "default": "#microsoft.graph.initiator"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.initiator"
    },
    "microsoft.graph.initiatorType": {
      "title": "initiatorType",
      "enum": [
        "user",
        "application",
        "system",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.keyValue": {
      "title": "keyValue",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "key": {
          "type": [
            "string",
            "null"
          ],
          "description": "Key for the key-value pair."
        },
        "value": {
          "type": [
            "string",
            "null"
          ],
          "description": "Value for the key-value pair."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.modifiedProperty": {
      "title": "modifiedProperty",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the property name of the target attribute that was changed."
        },
        "newValue": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the updated value for the propery."
        },
        "oldValue": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the previous value (before the update) for the property."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.operationResult": {
      "title": "operationResult",
      "enum": [
        "success",
        "failure",
        "timeout",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.provisionedIdentity": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.identity"
        },
        {
          "title": "provisionedIdentity",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "details": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.detailsInfo"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of the identity."
            },
            "identityType": {
              "type": [
                "string",
                "null"
              ],
              "description": "Type of identity that has been provisioned, such as 'user' or 'group'. Supports $filter (eq, contains)."
            },
            "@odata.type": {
              "type": "string",
              "default": "#microsoft.graph.provisionedIdentity"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.provisionedIdentity"
    },
    "microsoft.graph.provisioningAction": {
      "title": "provisioningAction",
      "enum": [
        "other",
        "create",
        "delete",
        "disable",
        "update",
        "stagedDelete",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.provisioningErrorInfo": {
      "title": "provisioningErrorInfo",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "additionalDetails": {
          "type": [
            "string",
            "null"
          ],
          "description": "Additional details if there's error."
        },
        "errorCategory": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.provisioningStatusErrorCategory"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Categorizes the error code. Possible values are failure, nonServiceFailure, success, unknownFutureValue"
        },
        "errorCode": {
          "type": [
            "string",
            "null"
          ],
          "description": "Unique error code if any occurred. Learn more"
        },
        "reason": {
          "type": [
            "string",
            "null"
          ],
          "description": "Summarizes the status and describes why the status happened."
        },
        "recommendedAction": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides the resolution for the corresponding error."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.provisioningObjectSummary": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "provisioningObjectSummary",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "activityDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "Represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.  SUpports $filter (eq, gt, lt) and orderby.",
              "format": "date-time"
            },
            "changeId": {
              "type": [
                "string",
                "null"
              ],
              "description": "Unique ID of this change in this cycle. Supports $filter (eq, contains)."
            },
            "cycleId": {
              "type": [
                "string",
                "null"
              ],
              "description": "Unique ID per job iteration. Supports $filter (eq, contains)."
            },
            "durationInMilliseconds": {
              "maximum": 2147483647,
              "minimum": -2147483648,
              "type": [
                "number",
                "null"
              ],
              "description": "Indicates how long this provisioning action took to finish. Measured in milliseconds.",
              "format": "int32"
            },
            "initiatedBy": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.initiator"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of who initiated this provisioning. Supports $filter (eq, contains)."
            },
            "jobId": {
              "type": [
                "string",
                "null"
              ],
              "description": "The unique ID for the whole provisioning job. Supports $filter (eq, contains)."
            },
            "modifiedProperties": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.modifiedProperty"
              },
              "description": "Details of each property that was modified in this provisioning action on this object."
            },
            "provisioningAction": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisioningAction"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Indicates the activity name or the operation name. The possible values are: create, update, delete, stageddelete, disable, other and unknownFutureValue. For a list of activities logged, refer to Microsoft Entra activity list. Supports $filter (eq, contains)."
            },
            "provisioningStatusInfo": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisioningStatusInfo"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of provisioning status."
            },
            "provisioningSteps": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.provisioningStep"
              },
              "description": "Details of each step in provisioning."
            },
            "servicePrincipal": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisioningServicePrincipal"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Represents the service principal used for provisioning. Supports $filter (eq) for id and name."
            },
            "sourceIdentity": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisionedIdentity"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of source object being provisioned. Supports $filter (eq, contains) for identityType, id, and displayName."
            },
            "sourceSystem": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisioningSystem"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of source system of the object being provisioned. Supports $filter (eq, contains) for displayName."
            },
            "targetIdentity": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisionedIdentity"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of target object being provisioned. Supports $filter (eq, contains) for identityType, id, and displayName."
            },
            "targetSystem": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.provisioningSystem"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of target system of the object being provisioned. Supports $filter (eq, contains) for displayName."
            },
            "tenantId": {
              "type": [
                "string",
                "null"
              ],
              "description": "Unique Microsoft Entra tenant ID. Supports $filter (eq, contains)."
            },
            "@odata.type": {
              "type": "string"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.provisioningObjectSummary"
    },
    "microsoft.graph.provisioningResult": {
      "title": "provisioningResult",
      "enum": [
        "success",
        "failure",
        "skipped",
        "warning",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.provisioningServicePrincipal": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.identity"
        },
        {
          "title": "provisioningServicePrincipal",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "@odata.type": {
              "type": "string",
              "default": "#microsoft.graph.provisioningServicePrincipal"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.provisioningServicePrincipal"
    },
    "microsoft.graph.provisioningStatusErrorCategory": {
      "title": "provisioningStatusErrorCategory",
      "enum": [
        "failure",
        "nonServiceFailure",
        "success",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.provisioningStatusInfo": {
      "title": "provisioningStatusInfo",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "errorInformation": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.provisioningErrorInfo"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "If status isn't success/ skipped details for the error are contained in this."
        },
        "status": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.provisioningResult"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "The possible values are: success, warning, failure, skipped, unknownFutureValue."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.provisioningStep": {
      "title": "provisioningStep",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "description": {
          "type": [
            "string",
            "null"
          ],
          "description": "Summary of what occurred during the step."
        },
        "details": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.detailsInfo"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Details of what occurred during the step."
        },
        "name": {
          "type": [
            "string",
            "null"
          ],
          "description": "Name of the step."
        },
        "provisioningStepType": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.provisioningStepType"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Type of step. The possible values are: import, scoping, matching, processing, referenceResolution, export, unknownFutureValue."
        },
        "status": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.provisioningResult"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Status of the step. The possible values are: success, warning,  failure, skipped, unknownFutureValue."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.provisioningStepType": {
      "title": "provisioningStepType",
      "enum": [
        "import",
        "scoping",
        "matching",
        "processing",
        "referenceResolution",
        "export",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.provisioningSystem": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.identity"
        },
        {
          "title": "provisioningSystem",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "details": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.detailsInfo"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Details of the system."
            },
            "@odata.type": {
              "type": "string",
              "default": "#microsoft.graph.provisioningSystem"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.provisioningSystem"
    },
    "microsoft.graph.riskDetail": {
      "title": "riskDetail",
      "enum": [
        "none",
        "adminGeneratedTemporaryPassword",
        "userPerformedSecuredPasswordChange",
        "userPerformedSecuredPasswordReset",
        "adminConfirmedSigninSafe",
        "aiConfirmedSigninSafe",
        "userPassedMFADrivenByRiskBasedPolicy",
        "adminDismissedAllRiskForUser",
        "adminConfirmedSigninCompromised",
        "hidden",
        "adminConfirmedUserCompromised",
        "unknownFutureValue",
        "m365DAdminDismissedDetection",
        "adminConfirmedServicePrincipalCompromised",
        "adminDismissedAllRiskForServicePrincipal",
        "userChangedPasswordOnPremises",
        "adminDismissedRiskForSignIn",
        "adminConfirmedAccountSafe"
      ],
      "type": "string"
    },
    "microsoft.graph.riskEventType": {
      "title": "riskEventType",
      "enum": [
        "unlikelyTravel",
        "anonymizedIPAddress",
        "maliciousIPAddress",
        "unfamiliarFeatures",
        "malwareInfectedIPAddress",
        "suspiciousIPAddress",
        "leakedCredentials",
        "investigationsThreatIntelligence",
        "generic",
        "adminConfirmedUserCompromised",
        "mcasImpossibleTravel",
        "mcasSuspiciousInboxManipulationRules",
        "investigationsThreatIntelligenceSigninLinked",
        "maliciousIPAddressValidCredentialsBlockedIP",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.riskLevel": {
      "title": "riskLevel",
      "enum": [
        "low",
        "medium",
        "high",
        "hidden",
        "none",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.riskState": {
      "title": "riskState",
      "enum": [
        "none",
        "confirmedSafe",
        "remediated",
        "dismissed",
        "atRisk",
        "confirmedCompromised",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.signIn": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "signIn",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "appDisplayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "App name displayed in the Microsoft Entra admin center.  Supports $filter (eq, startsWith)."
            },
            "appId": {
              "type": [
                "string",
                "null"
              ],
              "description": "Unique GUID that represents the app ID in the Microsoft Entra ID.  Supports $filter (eq)."
            },
            "appliedConditionalAccessPolicies": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.appliedConditionalAccessPolicy"
              },
              "description": "Provides a list of conditional access policies that the corresponding sign-in activity triggers. Apps need more Conditional Access-related privileges to read the details of this property. For more information, see Permissions for viewing applied conditional access (CA) policies in sign-ins."
            },
            "clientAppUsed": {
              "type": [
                "string",
                "null"
              ],
              "description": "Identifies the client used for the sign-in activity. Modern authentication clients include Browser, modern clients. Legacy authentication clients include Exchange ActiveSync, IMAP, MAPI, SMTP, POP, and other clients.  Supports $filter (eq)."
            },
            "conditionalAccessStatus": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.conditionalAccessStatus"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Reports status of an activated conditional access policy. The possible values are: success, failure, notApplied, and unknownFutureValue.  Supports $filter (eq)."
            },
            "correlationId": {
              "type": [
                "string",
                "null"
              ],
              "description": "The request ID sent from the client when the sign-in is initiated. Used to troubleshoot sign-in activity.  Supports $filter (eq)."
            },
            "createdDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "Date and time (UTC) the sign-in was initiated. Example: midnight on Jan 1, 2014 is reported as 2014-01-01T00:00:00Z.  Supports $orderby, $filter (eq, le, and ge).",
              "format": "date-time"
            },
            "deviceDetail": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.deviceDetail"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Device information from where the sign-in occurred; includes device ID, operating system, and browser.  Supports $filter (eq, startsWith) on browser and operatingSytem properties."
            },
            "ipAddress": {
              "type": [
                "string",
                "null"
              ],
              "description": "IP address of the client used to sign in.  Supports $filter (eq, startsWith)."
            },
            "isInteractive": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Indicates whether a sign-in is interactive."
            },
            "location": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.signInLocation"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Provides the city, state, and country code where the sign-in originated.  Supports $filter (eq, startsWith) on city, state, and countryOrRegion properties."
            },
            "resourceDisplayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "Name of the resource the user signed into.  Supports $filter (eq)."
            },
            "resourceId": {
              "type": [
                "string",
                "null"
              ],
              "description": "ID of the resource that the user signed into.  Supports $filter (eq)."
            },
            "riskDetail": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.riskDetail"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "The reason behind a specific state of a risky user, sign-in, or a risk event. The value none means that Microsoft Entra risk detection did not flag the user or the sign-in as a risky event so far.  Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden."
            },
            "riskEventTypes": {
              "type": "array",
              "items": {
                "anyOf": [
                  {
                    "$ref": "#/$defs/microsoft.graph.riskEventType"
                  },
                  {
                    "type": [
                      "object",
                      "null"
                    ]
                  }
                ]
              }
            },
            "riskEventTypes_v2": {
              "type": "array",
              "items": {
                "type": [
                  "string",
                  "null"
                ]
              },
              "description": "The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic, or unknownFutureValue.  Supports $filter (eq, startsWith)."
            },
            "riskLevelAggregated": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.riskLevel"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Aggregated risk level. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection.  Supports $filter (eq).  Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden."
            },
            "riskLevelDuringSignIn": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.riskLevel"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Risk level during sign-in. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection.  Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden."
            },
            "riskState": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.riskState"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Reports status of the risky user, sign-in, or a risk event. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.  Supports $filter (eq)."
            },
            "status": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.signInStatus"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Sign-in status. Includes the error code and description of the error (if a sign-in failure occurs).  Supports $filter (eq) on errorCode property."
            },
            "userDisplayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "Display name of the user that initiated the sign-in.  Supports $filter (eq, startsWith)."
            },
            "userId": {
              "type": "string",
              "description": "ID of the user that initiated the sign-in.  Supports $filter (eq)."
            },
            "userPrincipalName": {
              "type": [
                "string",
                "null"
              ],
              "description": "User principal name of the user that initiated the sign-in. This value is always in lowercase. For guest users whose values in the user object typically contain #EXT# before the domain part, this property stores the value in both lowercase and the 'true' format. For example, while the user object stores AdeleVance_fabrikam.com#EXT#@contoso.com, the sign-in logs store adelevance@fabrikam.com. Supports $filter (eq, startsWith)."
            },
            "@odata.type": {
              "type": "string"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.signIn"
    },
    "microsoft.graph.signInLocation": {
      "title": "signInLocation",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "city": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides the city where the sign-in originated and is determined using latitude/longitude information from the sign-in activity."
        },
        "countryOrRegion": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides the country code info (two letter code) where the sign-in originated.  This is calculated using latitude/longitude information from the sign-in activity."
        },
        "geoCoordinates": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.geoCoordinates"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Provides the latitude, longitude and altitude where the sign-in originated."
        },
        "state": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides the State where the sign-in originated. This is calculated using latitude/longitude information from the sign-in activity."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.signInStatus": {
      "title": "signInStatus",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "additionalDetails": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides additional details on the sign-in activity"
        },
        "errorCode": {
          "maximum": 2147483647,
          "minimum": -2147483648,
          "type": [
            "number",
            "null"
          ],
          "description": "Provides the 5-6 digit error code that's generated during a sign-in failure. Check out the list of error codes and messages.",
          "format": "int32"
        },
        "failureReason": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides the error message or the reason for failure for the corresponding sign-in activity. Check out the list of error codes and messages."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.targetResource": {
      "title": "targetResource",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the visible name defined for the resource. Typically specified when the resource is created."
        },
        "groupType": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.groupType"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "When type is set to Group, this indicates the group type. The possible values are: unifiedGroups, azureAD, and unknownFutureValue"
        },
        "id": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the unique ID of the resource."
        },
        "modifiedProperties": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.modifiedProperty"
          },
          "description": "Indicates name, old value and new value of each attribute that changed. Property values depend on the operation type."
        },
        "type": {
          "type": [
            "string",
            "null"
          ],
          "description": "Describes the resource type.  Example values include Application, Group, ServicePrincipal, and User."
        },
        "userPrincipalName": {
          "type": [
            "string",
            "null"
          ],
          "description": "When type is set to User, this includes the user name that initiated the action; null for other types."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.userIdentity": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.identity"
        },
        {
          "title": "userIdentity",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "ipAddress": {
              "type": [
                "string",
                "null"
              ],
              "description": "Indicates the client IP address associated with the user performing the activity (audit log only)."
            },
            "userPrincipalName": {
              "type": [
                "string",
                "null"
              ],
              "description": "The userPrincipalName attribute of the user."
            },
            "@odata.type": {
              "type": "string",
              "default": "#microsoft.graph.userIdentity"
            }
          }
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.userIdentity"
    }
  }
}