{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-intune/json-schema/microsoft-intune-microsoft-graph-cloud-pc-on-premises-connection-schema.json",
  "title": "microsoft.graph.cloudPcOnPremisesConnection",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-intune-openapi.yml#/components/schemas/microsoft.graph.cloudPcOnPremisesConnection",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "cloudPcOnPremisesConnection",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "adDomainName": {
          "type": [
            "string",
            "null"
          ],
          "description": "The fully qualified domain name (FQDN) of the Active Directory domain you want to join. Maximum length is 255. Optional."
        },
        "adDomainPassword": {
          "type": [
            "string",
            "null"
          ],
          "description": "The password associated with the username of an Active Directory account (adDomainUsername)."
        },
        "adDomainUsername": {
          "type": [
            "string",
            "null"
          ],
          "description": "The username of an Active Directory account (user or service account) that has permission to create computer objects in Active Directory. Required format: admin@contoso.com. Optional."
        },
        "alternateResourceUrl": {
          "type": [
            "string",
            "null"
          ],
          "description": "The interface URL of the partner service's resource that links to this Azure network connection. Requires $select to retrieve."
        },
        "connectionType": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.cloudPcOnPremisesConnectionType"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Specifies how the provisioned Cloud PC joins to Microsoft Entra. It includes different types, one is Microsoft Entra ID join, which means there's no on-premises Active Directory (AD) in the current tenant, and the Cloud PC device is joined by Microsoft Entra. Another one is hybridAzureADJoin, which means there's also an on-premises Active Directory (AD) in the current tenant and the Cloud PC device joins to on-premises Active Directory (AD) and Microsoft Entra. The type also determines which types of users can be assigned and can sign into a Cloud PC. The azureADJoin type indicates that cloud-only and hybrid users can be assigned and signed into the Cloud PC. hybridAzureADJoin indicates only hybrid users can be assigned and signed into the Cloud PC. The default value is hybridAzureADJoin."
        },
        "displayName": {
          "type": "string",
          "description": "The display name for the Azure network connection."
        },
        "healthCheckPaused": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates whether regular health checks on the network or domain configuration are paused or active. false if the regular health checks on the network or domain configuration are currently active. true if the checks are paused. If you perform a create or update operation on a onPremisesNetworkConnection resource, this value is set to false for four weeks. If you retry a health check on network or domain configuration, this value is set to false for two weeks. If the onPremisesNetworkConnection resource is attached in a provisioningPolicy or used by a Cloud PC in the past four weeks, healthCheckPaused is set to false. Read-only. Default is false."
        },
        "healthCheckStatus": {
          "$ref": "#/$defs/microsoft.graph.cloudPcOnPremisesConnectionStatus"
        },
        "healthCheckStatusDetail": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.cloudPcOnPremisesConnectionStatusDetail"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Indicates the results of health checks performed on the on-premises connection. Read-only. Requires $select to retrieve. For an example that shows how to get the inUse property, see Example 2: Get the selected properties of an Azure network connection, including healthCheckStatusDetail. Read-only."
        },
        "inUse": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When true, the Azure network connection is in use. When false, the connection isn't in use. You can't delete a connection that’s in use. Returned only on $select. For an example that shows how to get the inUse property, see Example 2: Get the selected properties of an Azure network connection, including healthCheckStatusDetail. Read-only."
        },
        "inUseByCloudPc": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates whether a Cloud PC is using this on-premises network connection. true if at least one Cloud PC is using it. Otherwise, false. Read-only. Default is false."
        },
        "organizationalUnit": {
          "type": [
            "string",
            "null"
          ],
          "description": "The organizational unit (OU) in which the computer account is created. If left null, the OU configured as the default (a well-known computer object container) in the tenant's Active Directory domain (OU) is used. Optional."
        },
        "resourceGroupId": {
          "type": "string",
          "description": "The unique identifier of the target resource group used associated with the on-premises network connectivity for Cloud PCs. Required format: '/subscriptions/{subscription-id}/resourceGroups/{resourceGroupName}'"
        },
        "scopeIds": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "The scope IDs of the corresponding permission. Currently, it's the Intune scope tag ID."
        },
        "subnetId": {
          "type": "string",
          "description": "The unique identifier of the target subnet used associated with the on-premises network connectivity for Cloud PCs. Required format: '/subscriptions/{subscription-id}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{virtualNetworkId}/subnets/{subnetName}'"
        },
        "subscriptionId": {
          "type": "string",
          "description": "The unique identifier of the Azure subscription associated with the tenant."
        },
        "subscriptionName": {
          "type": [
            "string",
            "null"
          ],
          "description": "The name of the Azure subscription is used to create an Azure network connection. Read-only."
        },
        "virtualNetworkId": {
          "type": "string",
          "description": "The unique identifier of the target virtual network used associated with the on-premises network connectivity for Cloud PCs. Required format: '/subscriptions/{subscription-id}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{virtualNetworkName}'"
        },
        "virtualNetworkLocation": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates the resource location of the target virtual network. For example, the location can be eastus2, westeurope, etc. Read-only (computed value)."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    }
  ],
  "x-ms-discriminator-value": "#microsoft.graph.cloudPcOnPremisesConnection",
  "$defs": {
    "microsoft.graph.cloudPcOnPremisesConnectionHealthCheck": {
      "title": "cloudPcOnPremisesConnectionHealthCheck",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "additionalDetail": {
          "type": [
            "string",
            "null"
          ],
          "description": "Additional details about the health check or the recommended action. For exmaple, the string value can be download.microsoft.com:443;software-download.microsoft.com:443; Read-only."
        },
        "correlationId": {
          "type": [
            "string",
            "null"
          ],
          "description": "The unique identifier of the health check item-related activities. This identifier can be useful in troubleshooting."
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "The display name for this health check item."
        },
        "endDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": "string",
          "description": "The value cannot be modified and is automatically populated when the health check ends. The Timestamp type represents date and time information using ISO 8601 format and is in Coordinated Universal Time (UTC). For example, midnight UTC on Jan 1, 2024 would look like this: '2024-01-01T00:00:00Z'. Returned by default. Read-only.",
          "format": "date-time"
        },
        "errorType": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.cloudPcOnPremisesConnectionHealthCheckErrorType"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "The type of error that occurred during this health check. Read-only."
        },
        "recommendedAction": {
          "type": [
            "string",
            "null"
          ],
          "description": "The recommended action to fix the corresponding error. For example, The Active Directory domain join check failed because the password of the domain join user has expired. Read-Only."
        },
        "startDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": "string",
          "description": "The value cannot be modified and is automatically populated when the health check starts. The Timestamp type represents date and time information using ISO 8601 format and is in  Coordinated Universal Time (UTC). For example, midnight UTC on Jan 1, 2024 would look like this: '2024-01-01T00:00:00Z'. Returned by default. Read-only.",
          "format": "date-time"
        },
        "status": {
          "$ref": "#/$defs/microsoft.graph.cloudPcOnPremisesConnectionStatus"
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.cloudPcOnPremisesConnectionHealthCheckErrorType": {
      "title": "cloudPcOnPremisesConnectionHealthCheckErrorType",
      "enum": [
        "dnsCheckFqdnNotFound",
        "dnsCheckNameWithInvalidCharacter",
        "dnsCheckUnknownError",
        "adJoinCheckFqdnNotFound",
        "adJoinCheckIncorrectCredentials",
        "adJoinCheckOrganizationalUnitNotFound",
        "adJoinCheckOrganizationalUnitIncorrectFormat",
        "adJoinCheckComputerObjectAlreadyExists",
        "adJoinCheckAccessDenied",
        "adJoinCheckCredentialsExpired",
        "adJoinCheckAccountLockedOrDisabled",
        "adJoinCheckAccountQuotaExceeded",
        "adJoinCheckServerNotOperational",
        "adJoinCheckUnknownError",
        "endpointConnectivityCheckCloudPcUrlNotAllowListed",
        "endpointConnectivityCheckWVDUrlNotAllowListed",
        "endpointConnectivityCheckIntuneUrlNotAllowListed",
        "endpointConnectivityCheckAzureADUrlNotAllowListed",
        "endpointConnectivityCheckLocaleUrlNotAllowListed",
        "endpointConnectivityCheckUnknownError",
        "azureAdDeviceSyncCheckDeviceNotFound",
        "azureAdDeviceSyncCheckLongSyncCircle",
        "azureAdDeviceSyncCheckConnectDisabled",
        "azureAdDeviceSyncCheckDurationExceeded",
        "azureAdDeviceSyncCheckScpNotConfigured",
        "azureAdDeviceSyncCheckTransientServiceError",
        "azureAdDeviceSyncCheckUnknownError",
        "resourceAvailabilityCheckNoSubnetIP",
        "resourceAvailabilityCheckSubscriptionDisabled",
        "resourceAvailabilityCheckAzurePolicyViolation",
        "resourceAvailabilityCheckSubscriptionNotFound",
        "resourceAvailabilityCheckSubscriptionTransferred",
        "resourceAvailabilityCheckGeneralSubscriptionError",
        "resourceAvailabilityCheckUnsupportedVNetRegion",
        "resourceAvailabilityCheckResourceGroupInvalid",
        "resourceAvailabilityCheckVNetInvalid",
        "resourceAvailabilityCheckSubnetInvalid",
        "resourceAvailabilityCheckResourceGroupBeingDeleted",
        "resourceAvailabilityCheckVNetBeingMoved",
        "resourceAvailabilityCheckSubnetDelegationFailed",
        "resourceAvailabilityCheckSubnetWithExternalResources",
        "resourceAvailabilityCheckResourceGroupLockedForReadonly",
        "resourceAvailabilityCheckResourceGroupLockedForDelete",
        "resourceAvailabilityCheckNoIntuneReaderRoleError",
        "resourceAvailabilityCheckIntuneDefaultWindowsRestrictionViolation",
        "resourceAvailabilityCheckIntuneCustomWindowsRestrictionViolation",
        "resourceAvailabilityCheckDeploymentQuotaLimitReached",
        "resourceAvailabilityCheckTransientServiceError",
        "resourceAvailabilityCheckUnknownError",
        "permissionCheckNoSubscriptionReaderRole",
        "permissionCheckNoResourceGroupOwnerRole",
        "permissionCheckNoVNetContributorRole",
        "permissionCheckNoResourceGroupNetworkContributorRole",
        "permissionCheckNoWindows365NetworkUserRole",
        "permissionCheckNoWindows365NetworkInterfaceContributorRole",
        "permissionCheckTransientServiceError",
        "permissionCheckUnknownError",
        "udpConnectivityCheckStunUrlNotAllowListed",
        "udpConnectivityCheckTurnUrlNotAllowListed",
        "udpConnectivityCheckUrlsNotAllowListed",
        "udpConnectivityCheckUnknownError",
        "internalServerErrorDeploymentCanceled",
        "internalServerErrorAllocateResourceFailed",
        "internalServerErrorVMDeploymentTimeout",
        "internalServerErrorUnableToRunDscScript",
        "ssoCheckKerberosConfigurationError",
        "internalServerUnknownError",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.cloudPcOnPremisesConnectionStatus": {
      "title": "cloudPcOnPremisesConnectionStatus",
      "enum": [
        "pending",
        "running",
        "passed",
        "failed",
        "warning",
        "informational",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.cloudPcOnPremisesConnectionStatusDetail": {
      "title": "cloudPcOnPremisesConnectionStatusDetail",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "endDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": "string",
          "description": "The end time of the connection health check. The Timestamp  is shown in ISO 8601 format and Coordinated Universal Time (UTC). For example, midnight UTC on Jan 1, 2014 appears as 2014-01-01T00:00:00Z. Read-Only.",
          "format": "date-time"
        },
        "healthChecks": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.cloudPcOnPremisesConnectionHealthCheck"
          },
          "description": "A list of all checks that have been run on the connection. Read-Only."
        },
        "startDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": "string",
          "description": "The start time of the health check. The timestamp is shown in ISO 8601 format and Coordinated Universal Time (UTC). For example, midnight UTC on Jan 1, 2014 appear as 2014-01-01T00:00:00Z. Read-Only.",
          "format": "date-time"
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.cloudPcOnPremisesConnectionType": {
      "title": "cloudPcOnPremisesConnectionType",
      "enum": [
        "hybridAzureADJoin",
        "azureADJoin",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.entity": {
      "title": "entity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    }
  }
}