{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-graph/json-schema/microsoft-graph-microsoft-graph-sign-in-schema.json",
  "title": "microsoft.graph.signIn",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-graph-auditlogs-signin-api-openapi.yml#/components/schemas/microsoft.graph.signIn",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "signIn",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "appDisplayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "App name displayed in the Microsoft Entra admin center.  Supports $filter (eq, startsWith)."
        },
        "appId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Unique GUID that represents the app ID in the Microsoft Entra ID.  Supports $filter (eq)."
        },
        "appliedConditionalAccessPolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.appliedConditionalAccessPolicy"
          },
          "description": "Provides a list of conditional access policies that the corresponding sign-in activity triggers. Apps need more Conditional Access-related privileges to read the details of this property. For more information, see Permissions for viewing applied conditional access (CA) policies in sign-ins."
        },
        "clientAppUsed": {
          "type": [
            "string",
            "null"
          ],
          "description": "Identifies the client used for the sign-in activity. Modern authentication clients include Browser, modern clients. Legacy authentication clients include Exchange ActiveSync, IMAP, MAPI, SMTP, POP, and other clients.  Supports $filter (eq)."
        },
        "conditionalAccessStatus": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.conditionalAccessStatus"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Reports status of an activated conditional access policy. The possible values are: success, failure, notApplied, and unknownFutureValue.  Supports $filter (eq)."
        },
        "correlationId": {
          "type": [
            "string",
            "null"
          ],
          "description": "The request ID sent from the client when the sign-in is initiated. Used to troubleshoot sign-in activity.  Supports $filter (eq)."
        },
        "createdDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": "string",
          "description": "Date and time (UTC) the sign-in was initiated. Example: midnight on Jan 1, 2014 is reported as 2014-01-01T00:00:00Z.  Supports $orderby, $filter (eq, le, and ge).",
          "format": "date-time"
        },
        "deviceDetail": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.deviceDetail"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Device information from where the sign-in occurred; includes device ID, operating system, and browser.  Supports $filter (eq, startsWith) on browser and operatingSytem properties."
        },
        "ipAddress": {
          "type": [
            "string",
            "null"
          ],
          "description": "IP address of the client used to sign in.  Supports $filter (eq, startsWith)."
        },
        "isInteractive": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates whether a sign-in is interactive."
        },
        "location": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.signInLocation"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Provides the city, state, and country code where the sign-in originated.  Supports $filter (eq, startsWith) on city, state, and countryOrRegion properties."
        },
        "resourceDisplayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Name of the resource the user signed into.  Supports $filter (eq)."
        },
        "resourceId": {
          "type": [
            "string",
            "null"
          ],
          "description": "ID of the resource that the user signed into.  Supports $filter (eq)."
        },
        "riskDetail": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.riskDetail"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "The reason behind a specific state of a risky user, sign-in, or a risk event. The value none means that Microsoft Entra risk detection did not flag the user or the sign-in as a risky event so far.  Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden."
        },
        "riskEventTypes": {
          "type": "array",
          "items": {
            "anyOf": [
              {
                "$ref": "#/$defs/microsoft.graph.riskEventType"
              },
              {
                "type": [
                  "object",
                  "null"
                ]
              }
            ]
          }
        },
        "riskEventTypes_v2": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "The list of risk event types associated with the sign-in. Possible values: unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic, or unknownFutureValue.  Supports $filter (eq, startsWith)."
        },
        "riskLevelAggregated": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.riskLevel"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Aggregated risk level. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection.  Supports $filter (eq).  Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden."
        },
        "riskLevelDuringSignIn": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.riskLevel"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Risk level during sign-in. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection.  Supports $filter (eq). Note: Details for this property are only available for Microsoft Entra ID P2 customers. All other customers are returned hidden."
        },
        "riskState": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.riskState"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Reports status of the risky user, sign-in, or a risk event. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue.  Supports $filter (eq)."
        },
        "status": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.signInStatus"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Sign-in status. Includes the error code and description of the error (if a sign-in failure occurs).  Supports $filter (eq) on errorCode property."
        },
        "userDisplayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Display name of the user that initiated the sign-in.  Supports $filter (eq, startsWith)."
        },
        "userId": {
          "type": "string",
          "description": "ID of the user that initiated the sign-in.  Supports $filter (eq)."
        },
        "userPrincipalName": {
          "type": [
            "string",
            "null"
          ],
          "description": "User principal name of the user that initiated the sign-in. This value is always in lowercase. For guest users whose values in the user object typically contain #EXT# before the domain part, this property stores the value in both lowercase and the 'true' format. For example, while the user object stores AdeleVance_fabrikam.com#EXT#@contoso.com, the sign-in logs store adelevance@fabrikam.com. Supports $filter (eq, startsWith)."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    }
  ],
  "x-ms-discriminator-value": "#microsoft.graph.signIn",
  "$defs": {
    "ReferenceNumeric": {
      "enum": [
        "-INF",
        "INF",
        "NaN"
      ],
      "type": [
        "string",
        "null"
      ]
    },
    "microsoft.graph.appliedConditionalAccessPolicy": {
      "title": "appliedConditionalAccessPolicy",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the name of the conditional access policy (example: 'Require MFA for Salesforce')."
        },
        "enforcedGrantControls": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "Refers to the grant controls enforced by the conditional access policy (example: 'Require multifactor authentication')."
        },
        "enforcedSessionControls": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "Refers to the session controls enforced by the conditional access policy (example: 'Require app enforced controls')."
        },
        "id": {
          "type": [
            "string",
            "null"
          ],
          "description": "An identifier of the conditional access policy. Supports $filter (eq)."
        },
        "result": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.appliedConditionalAccessPolicyResult"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Indicates the result of the CA policy that was triggered. The possible values are: success, failure, notApplied (policy isn't applied because policy conditions weren't met), notEnabled (This is due to the policy in a disabled state), unknown, unknownFutureValue, reportOnlySuccess, reportOnlyFailure, reportOnlyNotApplied, reportOnlyInterrupted. Use the Prefer: include-unknown-enum-members request header to get the following values in this evolvable enum: reportOnlySuccess, reportOnlyFailure, reportOnlyNotApplied, reportOnlyInterrupted."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.appliedConditionalAccessPolicyResult": {
      "title": "appliedConditionalAccessPolicyResult",
      "enum": [
        "success",
        "failure",
        "notApplied",
        "notEnabled",
        "unknown",
        "unknownFutureValue",
        "reportOnlySuccess",
        "reportOnlyFailure",
        "reportOnlyNotApplied",
        "reportOnlyInterrupted"
      ],
      "type": "string"
    },
    "microsoft.graph.conditionalAccessStatus": {
      "title": "conditionalAccessStatus",
      "enum": [
        "success",
        "failure",
        "notApplied",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.deviceDetail": {
      "title": "deviceDetail",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "browser": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the browser information of the used in the sign-in. Populated for devices registered in Microsoft Entra."
        },
        "deviceId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the unique ID of the device used in the sign-in. Populated for devices registered in Microsoft Entra."
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Refers to the name of the device used in the sign-in. Populated for devices registered in Microsoft Entra."
        },
        "isCompliant": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates whether the device is compliant or not."
        },
        "isManaged": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates if the device is managed or not."
        },
        "operatingSystem": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the OS name and version used in the sign-in."
        },
        "trustType": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates information on whether the device used in the sign-in is workplace-joined, Microsoft Entra-joined, domain-joined."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.geoCoordinates": {
      "title": "geoCoordinates",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "altitude": {
          "oneOf": [
            {
              "type": [
                "number",
                "null"
              ],
              "format": "double"
            },
            {
              "type": [
                "string",
                "null"
              ]
            },
            {
              "$ref": "#/$defs/ReferenceNumeric"
            }
          ],
          "description": "Optional. The altitude (height), in feet,  above sea level for the item. Read-only."
        },
        "latitude": {
          "oneOf": [
            {
              "type": [
                "number",
                "null"
              ],
              "format": "double"
            },
            {
              "type": [
                "string",
                "null"
              ]
            },
            {
              "$ref": "#/$defs/ReferenceNumeric"
            }
          ],
          "description": "Optional. The latitude, in decimal, for the item. Read-only."
        },
        "longitude": {
          "oneOf": [
            {
              "type": [
                "number",
                "null"
              ],
              "format": "double"
            },
            {
              "type": [
                "string",
                "null"
              ]
            },
            {
              "$ref": "#/$defs/ReferenceNumeric"
            }
          ],
          "description": "Optional. The longitude, in decimal, for the item. Read-only."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.riskDetail": {
      "title": "riskDetail",
      "enum": [
        "none",
        "adminGeneratedTemporaryPassword",
        "userPerformedSecuredPasswordChange",
        "userPerformedSecuredPasswordReset",
        "adminConfirmedSigninSafe",
        "aiConfirmedSigninSafe",
        "userPassedMFADrivenByRiskBasedPolicy",
        "adminDismissedAllRiskForUser",
        "adminConfirmedSigninCompromised",
        "hidden",
        "adminConfirmedUserCompromised",
        "unknownFutureValue",
        "m365DAdminDismissedDetection",
        "adminConfirmedServicePrincipalCompromised",
        "adminDismissedAllRiskForServicePrincipal",
        "userChangedPasswordOnPremises",
        "adminDismissedRiskForSignIn",
        "adminConfirmedAccountSafe"
      ],
      "type": "string"
    },
    "microsoft.graph.riskEventType": {
      "title": "riskEventType",
      "enum": [
        "unlikelyTravel",
        "anonymizedIPAddress",
        "maliciousIPAddress",
        "unfamiliarFeatures",
        "malwareInfectedIPAddress",
        "suspiciousIPAddress",
        "leakedCredentials",
        "investigationsThreatIntelligence",
        "generic",
        "adminConfirmedUserCompromised",
        "mcasImpossibleTravel",
        "mcasSuspiciousInboxManipulationRules",
        "investigationsThreatIntelligenceSigninLinked",
        "maliciousIPAddressValidCredentialsBlockedIP",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.riskLevel": {
      "title": "riskLevel",
      "enum": [
        "low",
        "medium",
        "high",
        "hidden",
        "none",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.riskState": {
      "title": "riskState",
      "enum": [
        "none",
        "confirmedSafe",
        "remediated",
        "dismissed",
        "atRisk",
        "confirmedCompromised",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.signInLocation": {
      "title": "signInLocation",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "city": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides the city where the sign-in originated and is determined using latitude/longitude information from the sign-in activity."
        },
        "countryOrRegion": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides the country code info (two letter code) where the sign-in originated.  This is calculated using latitude/longitude information from the sign-in activity."
        },
        "geoCoordinates": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.geoCoordinates"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Provides the latitude, longitude and altitude where the sign-in originated."
        },
        "state": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides the State where the sign-in originated. This is calculated using latitude/longitude information from the sign-in activity."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.signInStatus": {
      "title": "signInStatus",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "additionalDetails": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides additional details on the sign-in activity"
        },
        "errorCode": {
          "maximum": 2147483647,
          "minimum": -2147483648,
          "type": [
            "number",
            "null"
          ],
          "description": "Provides the 5-6 digit error code that's generated during a sign-in failure. Check out the list of error codes and messages.",
          "format": "int32"
        },
        "failureReason": {
          "type": [
            "string",
            "null"
          ],
          "description": "Provides the error message or the reason for failure for the corresponding sign-in activity. Check out the list of error codes and messages."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    }
  }
}