{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-graph/json-schema/microsoft-graph-microsoft-graph-default-managed-app-protection-schema.json",
  "title": "microsoft.graph.defaultManagedAppProtection",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-graph-deviceappmanagement-defaultmanagedappprotection-api-openapi.yml#/components/schemas/microsoft.graph.defaultManagedAppProtection",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.managedAppProtection"
    },
    {
      "title": "defaultManagedAppProtection",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "appDataEncryptionType": {
          "$ref": "#/$defs/microsoft.graph.managedAppDataEncryptionType"
        },
        "customSettings": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.keyValuePair"
          },
          "description": "A set of string key and string value pairs to be sent to the affected users, unalterned by this service"
        },
        "deployedAppCount": {
          "maximum": 2147483647,
          "minimum": -2147483648,
          "type": "number",
          "description": "Count of apps to which the current policy is deployed.",
          "format": "int32"
        },
        "disableAppEncryptionIfDeviceEncryptionIsEnabled": {
          "type": "boolean",
          "description": "When this setting is enabled, app level encryption is disabled if device level encryption is enabled. (Android only)"
        },
        "encryptAppData": {
          "type": "boolean",
          "description": "Indicates whether managed-app data should be encrypted. (Android only)"
        },
        "faceIdBlocked": {
          "type": "boolean",
          "description": "Indicates whether use of the FaceID is allowed in place of a pin if PinRequired is set to True. (iOS Only)"
        },
        "minimumRequiredPatchVersion": {
          "type": [
            "string",
            "null"
          ],
          "description": "Define the oldest required Android security patch level a user can have to gain secure access to the app. (Android only)"
        },
        "minimumRequiredSdkVersion": {
          "type": [
            "string",
            "null"
          ],
          "description": "Versions less than the specified version will block the managed app from accessing company data. (iOS Only)"
        },
        "minimumWarningPatchVersion": {
          "type": [
            "string",
            "null"
          ],
          "description": "Define the oldest recommended Android security patch level a user can have for secure access to the app. (Android only)"
        },
        "screenCaptureBlocked": {
          "type": "boolean",
          "description": "Indicates whether screen capture is blocked. (Android only)"
        },
        "apps": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.managedMobileApp"
          },
          "description": "List of apps to which the policy is deployed.",
          "x-ms-navigationProperty": true
        },
        "deploymentSummary": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.managedAppPolicyDeploymentSummary"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Navigation property to deployment summary of the configuration.",
          "x-ms-navigationProperty": true
        },
        "@odata.type": {
          "type": "string",
          "default": "#microsoft.graph.defaultManagedAppProtection"
        }
      },
      "description": "Policy used to configure detailed management settings for a specified set of apps for all users not targeted by a TargetedManagedAppProtection Policy"
    }
  ],
  "x-ms-discriminator-value": "#microsoft.graph.defaultManagedAppProtection",
  "$defs": {
    "microsoft.graph.entity": {
      "title": "entity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.keyValuePair": {
      "title": "keyValuePair",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "Name for this key-value pair"
        },
        "value": {
          "type": [
            "string",
            "null"
          ],
          "description": "Value for this key-value pair"
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.managedAppClipboardSharingLevel": {
      "title": "managedAppClipboardSharingLevel",
      "enum": [
        "allApps",
        "managedAppsWithPasteIn",
        "managedApps",
        "blocked"
      ],
      "type": "string",
      "description": "Represents the level to which the device's clipboard may be shared between apps",
      "x-ms-enum": {
        "name": "managedAppClipboardSharingLevel",
        "modelAsString": false,
        "values": [
          {
            "value": "allApps",
            "description": "Sharing is allowed between all apps, managed or not",
            "name": "allApps"
          },
          {
            "value": "managedAppsWithPasteIn",
            "description": "Sharing is allowed between all managed apps with paste in enabled",
            "name": "managedAppsWithPasteIn"
          },
          {
            "value": "managedApps",
            "description": "Sharing is allowed between all managed apps",
            "name": "managedApps"
          },
          {
            "value": "blocked",
            "description": "Sharing between apps is disabled",
            "name": "blocked"
          }
        ]
      }
    },
    "microsoft.graph.managedAppDataEncryptionType": {
      "title": "managedAppDataEncryptionType",
      "enum": [
        "useDeviceSettings",
        "afterDeviceRestart",
        "whenDeviceLockedExceptOpenFiles",
        "whenDeviceLocked"
      ],
      "type": "string",
      "description": "Represents the level to which app data is encrypted for managed apps",
      "x-ms-enum": {
        "name": "managedAppDataEncryptionType",
        "modelAsString": false,
        "values": [
          {
            "value": "useDeviceSettings",
            "description": "App data is encrypted based on the default settings on the device.",
            "name": "useDeviceSettings"
          },
          {
            "value": "afterDeviceRestart",
            "description": "App data is encrypted when the device is restarted.",
            "name": "afterDeviceRestart"
          },
          {
            "value": "whenDeviceLockedExceptOpenFiles",
            "description": "App data associated with this policy is encrypted when the device is locked, except data in files that are open",
            "name": "whenDeviceLockedExceptOpenFiles"
          },
          {
            "value": "whenDeviceLocked",
            "description": "App data associated with this policy is encrypted when the device is locked",
            "name": "whenDeviceLocked"
          }
        ]
      }
    },
    "microsoft.graph.managedAppDataStorageLocation": {
      "title": "managedAppDataStorageLocation",
      "enum": [
        "oneDriveForBusiness",
        "sharePoint",
        "box",
        "localStorage"
      ],
      "type": "string",
      "description": "The storage locations where managed apps can potentially store their data.",
      "x-ms-enum": {
        "name": "managedAppDataStorageLocation",
        "modelAsString": false,
        "values": [
          {
            "value": "oneDriveForBusiness",
            "description": "Indicates allowed storage location for the managed app to save files is 'OneDrive for Business'.",
            "name": "oneDriveForBusiness"
          },
          {
            "value": "sharePoint",
            "description": "Indicates allowed storage location for the managed app to save files is 'Sharepoint'.",
            "name": "sharePoint"
          },
          {
            "value": "box",
            "description": "Indicates that the allowed storage location for a managed app to save files is to 'Box'. Box is a non-Microsoft solution that enables cloud-based file storage capabilities.",
            "name": "box"
          },
          {
            "value": "localStorage",
            "description": "Indicates allowed storage location for the managed app to save files is local storage on the device.",
            "name": "localStorage"
          }
        ]
      }
    },
    "microsoft.graph.managedAppDataTransferLevel": {
      "title": "managedAppDataTransferLevel",
      "enum": [
        "allApps",
        "managedApps",
        "none"
      ],
      "type": "string",
      "description": "Data can be transferred from/to these classes of apps",
      "x-ms-enum": {
        "name": "managedAppDataTransferLevel",
        "modelAsString": false,
        "values": [
          {
            "value": "allApps",
            "description": "All apps.",
            "name": "allApps"
          },
          {
            "value": "managedApps",
            "description": "Managed apps.",
            "name": "managedApps"
          },
          {
            "value": "none",
            "description": "No apps.",
            "name": "none"
          }
        ]
      }
    },
    "microsoft.graph.managedAppPinCharacterSet": {
      "title": "managedAppPinCharacterSet",
      "enum": [
        "numeric",
        "alphanumericAndSymbol"
      ],
      "type": "string",
      "description": "Character set which is to be used for a user's app PIN",
      "x-ms-enum": {
        "name": "managedAppPinCharacterSet",
        "modelAsString": false,
        "values": [
          {
            "value": "numeric",
            "description": "Numeric characters",
            "name": "numeric"
          },
          {
            "value": "alphanumericAndSymbol",
            "description": "Alphanumeric and symbolic characters",
            "name": "alphanumericAndSymbol"
          }
        ]
      }
    },
    "microsoft.graph.managedAppPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "managedAppPolicy",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "createdDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "The date and time the policy was created.",
              "format": "date-time"
            },
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "The policy's description."
            },
            "displayName": {
              "type": "string",
              "description": "Policy display name."
            },
            "lastModifiedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "description": "Last time the policy was modified.",
              "format": "date-time"
            },
            "version": {
              "type": [
                "string",
                "null"
              ],
              "description": "Version of the entity."
            },
            "@odata.type": {
              "type": "string"
            }
          },
          "description": "The ManagedAppPolicy resource represents a base type for platform specific policies."
        }
      ]
    },
    "microsoft.graph.managedAppPolicyDeploymentSummary": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "managedAppPolicyDeploymentSummary",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "configurationDeployedUserCount": {
              "maximum": 2147483647,
              "minimum": -2147483648,
              "type": "number",
              "format": "int32"
            },
            "configurationDeploymentSummaryPerApp": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.managedAppPolicyDeploymentSummaryPerApp"
              }
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ]
            },
            "lastRefreshTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": "string",
              "format": "date-time"
            },
            "version": {
              "type": [
                "string",
                "null"
              ],
              "description": "Version of the entity."
            },
            "@odata.type": {
              "type": "string"
            }
          },
          "description": "The ManagedAppEntity is the base entity type for all other entity types under app management workflow."
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.managedAppPolicyDeploymentSummary"
    },
    "microsoft.graph.managedAppPolicyDeploymentSummaryPerApp": {
      "title": "managedAppPolicyDeploymentSummaryPerApp",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "configurationAppliedUserCount": {
          "maximum": 2147483647,
          "minimum": -2147483648,
          "type": "number",
          "description": "Number of users the policy is applied.",
          "format": "int32"
        },
        "mobileAppIdentifier": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.mobileAppIdentifier"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Deployment of an app."
        },
        "@odata.type": {
          "type": "string"
        }
      },
      "description": "Represents policy deployment summary per app."
    },
    "microsoft.graph.managedAppProtection": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.managedAppPolicy"
        },
        {
          "title": "managedAppProtection",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "allowedDataStorageLocations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.managedAppDataStorageLocation"
              },
              "description": "Data storage locations where a user may store managed data."
            },
            "allowedInboundDataTransferSources": {
              "$ref": "#/$defs/microsoft.graph.managedAppDataTransferLevel"
            },
            "allowedOutboundClipboardSharingLevel": {
              "$ref": "#/$defs/microsoft.graph.managedAppClipboardSharingLevel"
            },
            "allowedOutboundDataTransferDestinations": {
              "$ref": "#/$defs/microsoft.graph.managedAppDataTransferLevel"
            },
            "contactSyncBlocked": {
              "type": "boolean",
              "description": "Indicates whether contacts can be synced to the user's device."
            },
            "dataBackupBlocked": {
              "type": "boolean",
              "description": "Indicates whether the backup of a managed app's data is blocked."
            },
            "deviceComplianceRequired": {
              "type": "boolean",
              "description": "Indicates whether device compliance is required."
            },
            "disableAppPinIfDevicePinIsSet": {
              "type": "boolean",
              "description": "Indicates whether use of the app pin is required if the device pin is set."
            },
            "fingerprintBlocked": {
              "type": "boolean",
              "description": "Indicates whether use of the fingerprint reader is allowed in place of a pin if PinRequired is set to True."
            },
            "managedBrowser": {
              "$ref": "#/$defs/microsoft.graph.managedBrowserType"
            },
            "managedBrowserToOpenLinksRequired": {
              "type": "boolean",
              "description": "Indicates whether internet links should be opened in the managed browser app, or any custom browser specified by CustomBrowserProtocol (for iOS) or CustomBrowserPackageId/CustomBrowserDisplayName (for Android)"
            },
            "maximumPinRetries": {
              "maximum": 2147483647,
              "minimum": -2147483648,
              "type": "number",
              "description": "Maximum number of incorrect pin retry attempts before the managed app is either blocked or wiped. Valid values 1 to 65535",
              "format": "int32"
            },
            "minimumPinLength": {
              "maximum": 2147483647,
              "minimum": -2147483648,
              "type": "number",
              "description": "Minimum pin length required for an app-level pin if PinRequired is set to True",
              "format": "int32"
            },
            "minimumRequiredAppVersion": {
              "type": [
                "string",
                "null"
              ],
              "description": "Versions less than the specified version will block the managed app from accessing company data."
            },
            "minimumRequiredOsVersion": {
              "type": [
                "string",
                "null"
              ],
              "description": "Versions less than the specified version will block the managed app from accessing company data."
            },
            "minimumWarningAppVersion": {
              "type": [
                "string",
                "null"
              ],
              "description": "Versions less than the specified version will result in warning message on the managed app."
            },
            "minimumWarningOsVersion": {
              "type": [
                "string",
                "null"
              ],
              "description": "Versions less than the specified version will result in warning message on the managed app from accessing company data."
            },
            "organizationalCredentialsRequired": {
              "type": "boolean",
              "description": "Indicates whether organizational credentials are required for app use."
            },
            "periodBeforePinReset": {
              "pattern": "^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$",
              "type": "string",
              "description": "TimePeriod before the all-level pin must be reset if PinRequired is set to True.",
              "format": "duration"
            },
            "periodOfflineBeforeAccessCheck": {
              "pattern": "^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$",
              "type": "string",
              "description": "The period after which access is checked when the device is not connected to the internet.",
              "format": "duration"
            },
            "periodOfflineBeforeWipeIsEnforced": {
              "pattern": "^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$",
              "type": "string",
              "description": "The amount of time an app is allowed to remain disconnected from the internet before all managed data it is wiped.",
              "format": "duration"
            },
            "periodOnlineBeforeAccessCheck": {
              "pattern": "^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$",
              "type": "string",
              "description": "The period after which access is checked when the device is connected to the internet.",
              "format": "duration"
            },
            "pinCharacterSet": {
              "$ref": "#/$defs/microsoft.graph.managedAppPinCharacterSet"
            },
            "pinRequired": {
              "type": "boolean",
              "description": "Indicates whether an app-level pin is required."
            },
            "printBlocked": {
              "type": "boolean",
              "description": "Indicates whether printing is allowed from managed apps."
            },
            "saveAsBlocked": {
              "type": "boolean",
              "description": "Indicates whether users may use the 'Save As' menu item to save a copy of protected files."
            },
            "simplePinBlocked": {
              "type": "boolean",
              "description": "Indicates whether simplePin is blocked."
            },
            "@odata.type": {
              "type": "string",
              "default": "#microsoft.graph.managedAppProtection"
            }
          },
          "description": "Policy used to configure detailed management settings for a specified set of apps"
        }
      ]
    },
    "microsoft.graph.managedBrowserType": {
      "title": "managedBrowserType",
      "enum": [
        "notConfigured",
        "microsoftEdge"
      ],
      "type": "string",
      "description": "Type of managed browser",
      "x-ms-enum-flags": {
        "isFlags": true
      },
      "x-ms-enum": {
        "name": "managedBrowserType",
        "modelAsString": false,
        "values": [
          {
            "value": "notConfigured",
            "description": "Not configured",
            "name": "notConfigured"
          },
          {
            "value": "microsoftEdge",
            "description": "Microsoft Edge",
            "name": "microsoftEdge"
          }
        ]
      }
    },
    "microsoft.graph.managedMobileApp": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "managedMobileApp",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "mobileAppIdentifier": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.mobileAppIdentifier"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "The identifier for an app with it's operating system type."
            },
            "version": {
              "type": [
                "string",
                "null"
              ],
              "description": "Version of the entity."
            },
            "@odata.type": {
              "type": "string"
            }
          },
          "description": "The identifier for the deployment an app."
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.managedMobileApp"
    },
    "microsoft.graph.mobileAppIdentifier": {
      "title": "mobileAppIdentifier",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "@odata.type": {
          "type": "string"
        }
      },
      "description": "The identifier for a mobile app."
    }
  }
}