[System]
You are a helpful assistant that answers strictly in JSON. Here's the JSON schema you must adhere to:
<schema>
{"$schema":"http://json-schema.org/draft-07/schema#","$id":"https://json.schemastore.org/utcm-monitor.json","$defs":{"microsoft.exchange.accepteddomain":{"type":"object","description":"This resource configures the Accepted Email Domains in Exchange Online.","title":"Schema for microsoft.exchange.accepteddomain","properties":{"Identity":{"type":"string","description":"Specify the Fully Qualified Domain Name for the AcceptedDomain.","title":"Identity"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the AcceptedDomain should exist or not.","title":"Ensure"},"DomainType":{"enum":["Authoritative","InternalRelay"],"description":"The type of AcceptedDomain.  Currently the EXOAcceptedDomain DSC Resource accepts a value of 'Authoritative' and 'InternalRelay'.","title":"DomainType"},"MatchSubDomains":{"type":"boolean","description":"The MatchSubDomains parameter must be false on Authoritative domains. The default value is false.","title":"MatchSubDomains"},"OutboundOnly":{"type":"boolean","description":"OutboundOnly can only be enabled if the DomainType parameter is set to Authoritative or InternalRelay. The default value is false.","title":"OutboundOnly"}},"required":["Identity"]},"microsoft.exchange.activesyncdeviceaccessrule":{"type":"object","description":"This resource configures Active Sync Device Access Rules in Exchange Online.","title":"Schema for microsoft.exchange.activesyncdeviceaccessrule","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the identity of the device access rule.","title":"Identity"},"AccessLevel":{"enum":["Allow","Block","Quarantine"],"description":"The AccessLevel parameter specifies whether the devices are allowed, blocked or quarantined.","title":"AccessLevel"},"Characteristic":{"enum":["DeviceModel","DeviceType","DeviceOS","UserAgent","XMSWLHeader"],"description":"The Characteristic parameter specifies the device characteristic or category that's used by the rule.","title":"Characteristic"},"QueryString":{"type":"string","description":"The QueryString parameter specifies the device identifier that's used by the rule. This parameter uses a text value that's used with Characteristic parameter value to define the device.","title":"QueryString"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Active Sync Device Access Rule should exist or not.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.addressbookpolicy":{"type":"object","description":"This resource configures Address Book Policies in Exchange Online.","title":"Schema for microsoft.exchange.addressbookpolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the name that you want this address book policy to be called.","title":"Name"},"AddressLists":{"type":"array","items":{"type":"string"},"description":"The AddressLists parameter specifies the address lists that will be used by mailbox users who are assigned this address book policy. This parameter accepts multiple values.","title":"AddressLists"},"GlobalAddressList":{"type":"string","description":"The GlobalAddressList parameter specifies the identity of the global address list (GAL) that will be used by mailbox users who are assigned this address book policy. You can specify only one GAL for each address book policy.","title":"GlobalAddressList"},"OfflineAddressBook":{"type":"string","description":"The OfflineAddressBook parameter specifies the identity of the offline address book (OAB) that will be used by mailbox users who are assigned this address book policy. You can specify only one OAB for each address book policy.","title":"OfflineAddressBook"},"RoomList":{"type":"string","description":"The RoomList parameter specifies the name of the room address list.","title":"RoomList"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Address Book Policy should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.addresslist":{"type":"object","description":"This resource configures Exchange Online address lists.","title":"Schema for microsoft.exchange.addresslist","properties":{"Name":{"type":"string","description":"The Name parameter specifies a unique name for the address list.","title":"Name"},"ConditionalCompany":{"type":"array","items":{"type":"string"},"description":"The ConditionalCompany parameter specifies a precanned filter that's based on the value of the recipient's Company property.","title":"ConditionalCompany"},"ConditionalCustomAttribute1":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute1 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute1 property.","title":"ConditionalCustomAttribute1"},"ConditionalCustomAttribute10":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute10 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute10 property.","title":"ConditionalCustomAttribute10"},"ConditionalCustomAttribute11":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute11 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute11 property.","title":"ConditionalCustomAttribute11"},"ConditionalCustomAttribute12":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute12 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute12 property.","title":"ConditionalCustomAttribute12"},"ConditionalCustomAttribute13":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute13 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute13 property.","title":"ConditionalCustomAttribute13"},"ConditionalCustomAttribute14":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute14 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute14 property.","title":"ConditionalCustomAttribute14"},"ConditionalCustomAttribute15":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute15 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute15 property.","title":"ConditionalCustomAttribute15"},"ConditionalCustomAttribute2":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute2 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute2 property.","title":"ConditionalCustomAttribute2"},"ConditionalCustomAttribute3":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute3 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute3 property.","title":"ConditionalCustomAttribute3"},"ConditionalCustomAttribute4":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute4 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute4 property.","title":"ConditionalCustomAttribute4"},"ConditionalCustomAttribute5":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute5 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute5 property.","title":"ConditionalCustomAttribute5"},"ConditionalCustomAttribute6":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute6 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute6 property.","title":"ConditionalCustomAttribute6"},"ConditionalCustomAttribute7":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute7 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute7 property.","title":"ConditionalCustomAttribute7"},"ConditionalCustomAttribute8":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute8 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute8 property.","title":"ConditionalCustomAttribute8"},"ConditionalCustomAttribute9":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute9 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute9 property.","title":"ConditionalCustomAttribute9"},"ConditionalDepartment":{"type":"array","items":{"type":"string"},"description":"The ConditionalDepartment parameter specifies a precanned filter that's based on the value of the recipient's Department property.","title":"ConditionalDepartment"},"ConditionalStateOrProvince":{"type":"array","items":{"type":"string"},"description":"The ConditionalStateOrProvince parameter specifies a precanned filter that's based on the value of the recipient's StateOrProvince property.","title":"ConditionalStateOrProvince"},"DisplayName":{"type":"string","description":"The DisplayName parameter specifies the display name of the address list.","title":"DisplayName"},"IncludedRecipients":{"type":"array","items":{"enum":["AllRecipients","MailboxUsers","MailContacts","MailGroups","MailUsers","Resources"]},"description":"The IncludedRecipients parameter specifies a precanned filter that's based on the recipient type.","title":"IncludedRecipients"},"RecipientFilter":{"type":"string","description":"The RecipientFilter parameter specifies a custom OPath filter that's based on the value of any available recipient property.","title":"RecipientFilter"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this AddressList should exist.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.antiphishpolicy":{"type":"object","description":"This resource configures an Anti-Phish Policy in Exchange Online.\r\nReference: https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/new-antiphishpolicy?view=exchange-ps","title":"Schema for microsoft.exchange.antiphishpolicy","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the name of the antiphishing policy that you want to modify.","title":"Identity"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this policy should exist or not.","title":"Ensure"},"AdminDisplayName":{"type":"string","description":"The AdminDisplayName parameter specifies a description for the policy.","title":"AdminDisplayName"},"PhishThresholdLevel":{"enum":["1","2","3","4"],"description":"The PhishThresholdLevel parameter specifies the tolerance level that's used by machine learning in the handling of phishing messages.","title":"PhishThresholdLevel"},"AuthenticationFailAction":{"enum":["MoveToJmf","Quarantine"],"description":"The AuthenticationFailAction parameter specifies the action to take when the message fails composite authentication.","title":"AuthenticationFailAction"},"TargetedUserProtectionAction":{"enum":["BccMessage","Delete","MoveToJmf","NoAction","Quarantine","Redirect"],"description":"The TargetedUserProtectionAction\u202fparameter specifies the action to take on detected user impersonation messages for the users specified by the TargetedUsersToProtect parameter.","title":"TargetedUserProtectionAction"},"Enabled":{"type":"boolean","description":"Specify if this policy should be enabled. Default is $true.","title":"Enabled"},"EnableFirstContactSafetyTips":{"type":"boolean","description":"The EnableFirstContactSafetyTips parameter specifies whether to enable or disable the safety tip that's shown when recipients first receive an email from a sender or do not often receive email from a sender.","title":"EnableFirstContactSafetyTips"},"EnableMailboxIntelligence":{"type":"boolean","description":"The EnableMailboxIntelligence parameter specifies whether to enable or disable mailbox intelligence (the first contact graph) in domain and user impersonation protection.","title":"EnableMailboxIntelligence"},"EnableMailboxIntelligenceProtection":{"type":"boolean","description":"The EnableMailboxIntelligenceProtection specifies whether to enable or disable enhanced impersonation results based on each user's individual sender map. This intelligence allows Microsoft 365 to customize user impersonation detection and better handle false positives.","title":"EnableMailboxIntelligenceProtection"},"EnableOrganizationDomainsProtection":{"type":"boolean","description":"The\u202fEnableOrganizationDomainsProtection parameter specifies whether to enable domain impersonation protection for all registered domains in the Office 365 organization.","title":"EnableOrganizationDomainsProtection"},"EnableSimilarDomainsSafetyTips":{"type":"boolean","description":"The\u202fEnableSimilarDomainsSafetyTips\u202fparameter specifies whether to enable safety tips that are shown to recipients in messages for domain impersonation detections.","title":"EnableSimilarDomainsSafetyTips"},"EnableSimilarUsersSafetyTips":{"type":"boolean","description":"The\u202fEnableSimilarUsersSafetyTips\u202fparameter specifies whether to enable safety tips that are shown to recipients in messages for user impersonation detections.","title":"EnableSimilarUsersSafetyTips"},"EnableSpoofIntelligence":{"type":"boolean","description":"The EnableSpoofIntelligence parameter specifies whether to enable or disable antispoofing protection for the policy.","title":"EnableSpoofIntelligence"},"EnableTargetedDomainsProtection":{"type":"boolean","description":"The\u202fEnableTargetedDomainsProtection parameter specifies whether to enable domain impersonation protection for a list of specified domains.","title":"EnableTargetedDomainsProtection"},"EnableTargetedUserProtection":{"type":"boolean","description":"The\u202fEnableTargetedUserProtection parameter specifies whether to enable user impersonation protection for the users specified by the TargetedUsersToProtect parameter","title":"EnableTargetedUserProtection"},"EnableUnauthenticatedSender":{"type":"boolean","description":"The\u202fEnableUnauthenticatedSender\u202fparameter enables or disables unauthenticated sender identification in Outlook.","title":"EnableUnauthenticatedSender"},"EnableUnusualCharactersSafetyTips":{"type":"boolean","description":"The\u202fEnableUnusualCharactersSafetyTips\u202fparameter specifies whether to enable safety tips that are shown to recipients in messages for unusual characters in domain and user impersonation detections.","title":"EnableUnusualCharactersSafetyTips"},"EnableViaTag":{"type":"boolean","description":"This setting is part of spoof protection. The\u202fEnableViaTag\u202fparameter enables or disables adding the via tag to the From address in Outlook.","title":"EnableViaTag"},"MakeDefault":{"type":"boolean","description":"Make this the default antiphishing policy","title":"MakeDefault"},"ExcludedDomains":{"type":"array","items":{"type":"string"},"description":"The\u202fExcludedDomains\u202fparameter specifies trusted domains that are excluded from scanning by antiphishing protection. You can specify multiple domains separated by commas.","title":"ExcludedDomains"},"ExcludedSenders":{"type":"array","items":{"type":"string"},"description":"The\u202fExcludedSenders\u202fparameter specifies a list of trusted sender email addresses that are excluded from scanning by antiphishing protection. You can specify multiple email addresses separated by commas.","title":"ExcludedSenders"},"HonorDmarcPolicy":{"type":"boolean","description":"The HonorDmarcPolicy enables or disables using the sender's DMARC policy to determine what to do to messages that fail DMARC checks.","title":"HonorDmarcPolicy"},"ImpersonationProtectionState":{"type":"string","description":"The ImpersonationProtectionState parameter specifies the configuration of impersonation protection.","title":"ImpersonationProtectionState"},"MailboxIntelligenceProtectionAction":{"type":"string","description":"The MailboxIntelligenceProtectionAction parameter specifies what to do with messages that fail mailbox intelligence protection.","title":"MailboxIntelligenceProtectionAction"},"MailboxIntelligenceProtectionActionRecipients":{"type":"array","items":{"type":"string"},"description":"The\u202fMailboxIntelligenceProtectionActionRecipients parameter specifies the recipients to add to detected messages when the MailboxIntelligenceProtectionAction parameter is set to the value\u202fRedirect or BccMessage.","title":"MailboxIntelligenceProtectionActionRecipients"},"MailboxIntelligenceQuarantineTag":{"type":"string","description":"The MailboxIntelligenceQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by mailbox intelligence.","title":"MailboxIntelligenceQuarantineTag"},"SpoofQuarantineTag":{"type":"string","description":"The SpoofQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by spoof intelligence.","title":"SpoofQuarantineTag"},"TargetedDomainActionRecipients":{"type":"array","items":{"type":"string"},"description":"The\u202fTargetedDomainActionRecipients parameter specifies the recipients to add to detected domain impersonation messages when the TargetedDomainProtectionAction parameter is set to the value\u202fRedirect or BccMessage. A valid value for this parameter is an email address. You can specify multiple email addresses separated by commas.","title":"TargetedDomainActionRecipients"},"TargetedDomainProtectionAction":{"enum":["BccMessage","Delete","MoveToJmf","NoAction","Quarantine","Redirect"],"description":"The TargetedDomainProtectionAction parameter specifies the action to take on detected domain impersonation messages.","title":"TargetedDomainProtectionAction"},"TargetedDomainsToProtect":{"type":"array","items":{"type":"string"},"description":"The TargetedDomainsToProtect parameter specifies the domains that are included in domain impersonation protection when the EnableTargetedDomainsProtection parameter is set to $true.","title":"TargetedDomainsToProtect"},"TargetedDomainQuarantineTag":{"type":"string","description":"The TargetedDomainQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by domain impersonation protection.","title":"TargetedDomainQuarantineTag"},"TargetedUserActionRecipients":{"type":"array","items":{"type":"string"},"description":"The\u202fTargetedUserActionRecipients parameter specifies the replacement or additional recipients for detected user impersonation messages when the TargetedUserProtectionAction parameter is set to the value\u202fRedirect or BccMessage. A valid value for this parameter is an email address. You can specify multiple email addresses separated by commas.","title":"TargetedUserActionRecipients"},"TargetedUsersToProtect":{"type":"array","items":{"type":"string"},"description":"The TargetedUsersToProtect parameter specifies the users that are included in user impersonation protection when the EnableTargetedUserProtection parameter is set to $true.","title":"TargetedUsersToProtect"},"TargetedUserQuarantineTag":{"type":"string","description":"The TargetedUserQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by user impersonation protection.","title":"TargetedUserQuarantineTag"},"DmarcQuarantineAction":{"type":"string","description":null,"title":"DmarcQuarantineAction"},"DmarcRejectAction":{"type":"string","description":null,"title":"DmarcRejectAction"}},"required":["Identity"]},"microsoft.exchange.antiphishrule":{"type":"object","description":"This resource configures an Anti-Phish Rule in Exchange Online.\r\nReference: https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/new-antiphishRule?view=exchange-ps","title":"Schema for microsoft.exchange.antiphishrule","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the name of the antiphishing rule that you want to modify.","title":"Identity"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"},"AntiPhishPolicy":{"type":"string","description":"The AntiPhishPolicy parameter specifies the name of the antiphishing policy that's associated with the antiphishing rule.","title":"AntiPhishPolicy"},"Enabled":{"type":"boolean","description":"Specify if this rule should be enabled. Default is $true.","title":"Enabled"},"Priority":{"type":"integer","description":"The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.","title":"Priority"},"Comments":{"type":"string","description":"The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.","title":"Comments"},"ExceptIfRecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"ExceptIfRecipientDomainIs"},"ExceptIfSentTo":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"ExceptIfSentTo"},"ExceptIfSentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.","title":"ExceptIfSentToMemberOf"},"RecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"RecipientDomainIs"},"SentTo":{"type":"array","items":{"type":"string"},"description":"The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"SentTo"},"SentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.","title":"SentToMemberOf"}},"required":["Identity","AntiPhishPolicy"]},"microsoft.exchange.applicationaccesspolicy":{"type":"object","description":"This resource configures Applications Access Policies in Exchange Online.","title":"Schema for microsoft.exchange.applicationaccesspolicy","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the application access policy that you want to modify.","title":"Identity"},"AccessRight":{"enum":["RestrictAccess","DenyAccess"],"description":"The AccessRight parameter specifies the permission that you want to assign in the application access policy.","title":"AccessRight"},"AppID":{"type":"array","items":{"type":"string"},"description":"The AppID parameter specifies the GUID of the apps to include in the policy.","title":"AppID"},"PolicyScopeGroupId":{"type":"string","description":"The PolicyScopeGroupID parameter specifies the recipient to define in the policy. You can use any value that uniquely identifies the recipient.","title":"PolicyScopeGroupId"},"Description":{"type":"string","description":"The Description parameter specifies a description for the policy.","title":"Description"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Application Access Policy should exist or not.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.atppolicyforo365":{"type":"object","description":"This resource configures the Advanced Threat Protection (ATP) policy\r\nin Office 365.  Tenant must be subscribed to ATP.","title":"Schema for microsoft.exchange.atppolicyforo365","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Specifies the resource is a single instance, the value must be 'Yes'","title":"IsSingleInstance"},"Identity":{"type":"string","description":"The Identity parameter specifies the ATP policy that you want to modify. There's only one policy named Default.","title":"Identity"},"Ensure":{"enum":["Present"],"description":"Since there is only one policy, the default policy, this must be set to 'Present'","title":"Ensure"},"AllowSafeDocsOpen":{"type":"boolean","description":"The AllowSafeDocsOpen parameter specifies whether users can click through and bypass the Protected View container even when Safe Documents identifies a file as malicious.","title":"AllowSafeDocsOpen"},"EnableATPForSPOTeamsODB":{"type":"boolean","description":"The EnableATPForSPOTeamsODB parameter specifies whether ATP is enabled for SharePoint Online, OneDrive for Business and Microsoft Teams. Default is $false.","title":"EnableATPForSPOTeamsODB"},"EnableSafeDocs":{"type":"boolean","description":"The EnableSafeDocs parameter specifies whether to enable the Safe Documents feature in the organization. Default is $false.","title":"EnableSafeDocs"}},"required":["IsSingleInstance"]},"microsoft.exchange.authenticationpolicy":{"type":"object","description":"This resource configures Authentication Policies in Exchange Online.","title":"Schema for microsoft.exchange.authenticationpolicy","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the authentication policy you want to view or modify.","title":"Identity"},"AllowBasicAuthActiveSync":{"type":"boolean","description":"The AllowBasicAuthActiveSync switch specifies whether to allow Basic authentication with Exchange Active Sync.","title":"AllowBasicAuthActiveSync"},"AllowBasicAuthAutodiscover":{"type":"boolean","description":"The AllowBasicAuthAutodiscover switch specifies whether to allow Basic authentication with Autodiscover.","title":"AllowBasicAuthAutodiscover"},"AllowBasicAuthImap":{"type":"boolean","description":"The AllowBasicAuthImap switch specifies whether to allow Basic authentication with IMAP.","title":"AllowBasicAuthImap"},"AllowBasicAuthMapi":{"type":"boolean","description":"The AllowBasicAuthMapi switch specifies whether to allow Basic authentication with MAPI.","title":"AllowBasicAuthMapi"},"AllowBasicAuthOfflineAddressBook":{"type":"boolean","description":"The AllowBasicAuthOfflineAddressBook switch specifies whether to allow Basic authentication with Offline Address Books.","title":"AllowBasicAuthOfflineAddressBook"},"AllowBasicAuthOutlookService":{"type":"boolean","description":"The AllowBasicAuthOutlookService switch specifies whether to allow Basic authentication with the Outlook service.","title":"AllowBasicAuthOutlookService"},"AllowBasicAuthPop":{"type":"boolean","description":"The AllowBasicAuthPop switch specifies whether to allow Basic authentication with POP.","title":"AllowBasicAuthPop"},"AllowBasicAuthPowershell":{"type":"boolean","description":"The AllowBasicAuthPowerShell switch specifies whether to allow Basic authentication with PowerShell.","title":"AllowBasicAuthPowershell"},"AllowBasicAuthReportingWebServices":{"type":"boolean","description":"The AllowBasicAuthReporting Web Services switch specifies whether to allow Basic authentication with reporting web services.","title":"AllowBasicAuthReportingWebServices"},"AllowBasicAuthRpc":{"type":"boolean","description":"The AllowBasicAuthRpc switch specifies whether to allow Basic authentication with RPC.","title":"AllowBasicAuthRpc"},"AllowBasicAuthSmtp":{"type":"boolean","description":"The AllowBasicAuthSmtp switch specifies whether to allow Basic authentication with SMTP.","title":"AllowBasicAuthSmtp"},"AllowBasicAuthWebServices":{"type":"boolean","description":"The AllowBasicAuthWebServices switch specifies whether to allow Basic authentication with Exchange Web Services (EWS).","title":"AllowBasicAuthWebServices"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the authentication Policy should exist or not.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.authenticationpolicyassignment":{"type":"object","description":"This resource assigns Exchange Online Authentication Policies to users.","title":"Schema for microsoft.exchange.authenticationpolicyassignment","properties":{"UserName":{"type":"string","description":"Name of the user assigned to the authentication policy.","title":"UserName"},"AuthenticationPolicyName":{"type":"string","description":"Name of the authentication policy.","title":"AuthenticationPolicyName"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the authentication Policy should exist or not.","title":"Ensure"}},"required":["UserName"]},"microsoft.exchange.availabilityaddressspace":{"type":"object","description":"Create a new AvailabilityAddressSpace in your cloud-based organization.","title":"Schema for microsoft.exchange.availabilityaddressspace","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the AvailabilityAddressSpace you want to modify.","title":"Identity"},"AccessMethod":{"enum":["PerUserFB","OrgWideFB","OrgWideFBToken","OrgWideFBBasic","InternalProxy"],"description":"The AccessMethod parameter specifies how the free/busy data is accessed. Valid values are:PerUserFB, OrgWideFB, OrgWideFBToken, OrgWideFBBasic,InternalProxy","title":"AccessMethod"},"Credentials":{"type":"string","description":"The Credentials parameter specifies the username and password that's used to access the Availability services in the target forest.","title":"Credentials"},"ForestName":{"type":"string","description":"The ForestName parameter specifies the SMTP domain name of the target forest for users whose free/busy data must be retrieved. If your users are distributed among multiple SMTP domains in the target forest, run the Add-AvailabilityAddressSpace command once for each SMTP domain.","title":"ForestName"},"TargetAutodiscoverEpr":{"type":"string","description":"The TargetAutodiscoverEpr parameter specifies the Autodiscover URL of Exchange Web Services for the external organization. Exchange uses Autodiscover to automatically detect the correct server endpoint for external requests.","title":"TargetAutodiscoverEpr"},"TargetServiceEpr":{"type":"string","description":"The TargetServiceEpr parameter specifies the Exchange Online Calendar Service URL of the external Microsoft 365 organization that you're trying to read free/busy information from.","title":"TargetServiceEpr"},"TargetTenantId":{"type":"string","description":"The TargetTenantID parameter specifies the tenant ID of the external Microsoft 365 organization that you're trying to read free/busy information from.","title":"TargetTenantId"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this AvailabilityAddressSpace should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.availabilityconfig":{"type":"object","description":"This resource configures the Availability Config in Exchange Online.","title":"Schema for microsoft.exchange.availabilityconfig","properties":{"OrgWideAccount":{"type":"string","description":"Specify the OrgWideAccount for the AvailabilityConfig.","title":"OrgWideAccount"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the AvailabilityConfig should exist or not.","title":"Ensure"}},"required":["OrgWideAccount"]},"microsoft.exchange.calendarprocessing":{"type":"object","description":"This resource configures the Calendar Processing settings Exchange Online.","title":"Schema for microsoft.exchange.calendarprocessing","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the resource mailbox that you want to view. You can use any value that uniquely identifies the mailbox.","title":"Identity"},"AddAdditionalResponse":{"type":"boolean","description":"The AddAdditionalResponse parameter specifies whether additional information (the value of the AdditionalResponse parameter) is added to meeting request responses","title":"AddAdditionalResponse"},"AdditionalResponse":{"type":"string","description":"The AdditionalResponse parameter specifies the additional information to be included in responses to meeting requests when the value of the AddAdditionalResponse parameter is $true. If the value contains spaces, enclose the value in quotation marks.","title":"AdditionalResponse"},"AddNewRequestsTentatively":{"type":"boolean","description":"The AddNewRequestsTentatively parameter specifies whether new meeting requests are added to the calendar as tentative","title":"AddNewRequestsTentatively"},"AddOrganizerToSubject":{"type":"boolean","description":"The AddOrganizerToSubject parameter specifies whether the meeting organizer's name is used as the subject of the meeting request.","title":"AddOrganizerToSubject"},"AllBookInPolicy":{"type":"boolean","description":"The AllBookInPolicy parameter specifies whether to automatically approve in-policy requests from all users to the resource mailbox.","title":"AllBookInPolicy"},"AllowConflicts":{"type":"boolean","description":"The AllowConflicts parameter specifies whether to allow conflicting meeting requests.","title":"AllowConflicts"},"AllowRecurringMeetings":{"type":"boolean","description":"The AllowRecurringMeetings parameter specifies whether to allow recurring meetings in meeting requests.","title":"AllowRecurringMeetings"},"AllRequestInPolicy":{"type":"boolean","description":"The AllRequestInPolicy parameter specifies whether to allow all users to submit in-policy requests to the resource mailbox.","title":"AllRequestInPolicy"},"AllRequestOutOfPolicy":{"type":"boolean","description":"The AllRequestOutOfPolicy parameter specifies whether to allow all users to submit out-of-policy requests to the resource mailbox.","title":"AllRequestOutOfPolicy"},"AutomateProcessing":{"enum":["None","AutoUpdate","AutoAccept"],"description":"The AutomateProcessing parameter enables or disables calendar processing on the mailbox.","title":"AutomateProcessing"},"BookingType":{"enum":["Standard","Reserved"],"description":"The BookingType parameter specifies how reservations work on the resource mailbox.","title":"BookingType"},"BookingWindowInDays":{"type":"integer","description":"The BookingWindowInDays parameter specifies the maximum number of days in advance that the resource can be reserved. A valid value is an integer from 0 through 1080. The default value is 180 days. The value 0 means today.","title":"BookingWindowInDays"},"BookInPolicy":{"type":"array","items":{"type":"string"},"description":"The BookInPolicy parameter specifies users or groups who are allowed to submit in-policy meeting requests to the resource mailbox that are automatically approved. You can use any value that uniquely identifies the user or group.","title":"BookInPolicy"},"ConflictPercentageAllowed":{"type":"integer","description":"The ConflictPercentageAllowed parameter specifies the maximum percentage of meeting conflicts for new recurring meeting requests. A valid value is an integer from 0 through 100. The default value is 0.","title":"ConflictPercentageAllowed"},"DeleteAttachments":{"type":"boolean","description":"The DeleteAttachments parameter specifies whether to remove attachments from all incoming messages.","title":"DeleteAttachments"},"DeleteComments":{"type":"boolean","description":"The DeleteComments parameter specifies whether to remove or keep any text in the message body of incoming meeting requests.","title":"DeleteComments"},"DeleteNonCalendarItems":{"type":"boolean","description":"The DeleteNonCalendarItems parameter specifies whether to remove or keep all non-calendar-related messages that are received by the resource mailbox.","title":"DeleteNonCalendarItems"},"DeleteSubject":{"type":"boolean","description":"The DeleteSubject parameter specifies whether to remove or keep the subject of incoming meeting requests. ","title":"DeleteSubject"},"EnableAutoRelease":{"type":"boolean","description":"N/A","title":"EnableAutoRelease"},"EnableResponseDetails":{"type":"boolean","description":"The EnableResponseDetails parameter specifies whether to include the reasons for accepting or declining a meeting in the response email message.","title":"EnableResponseDetails"},"EnforceCapacity":{"type":"boolean","description":"The EnforceCapacity parameter specifies whether to restrict the number of attendees to the capacity of the workspace. For example, if capacity is set to 10, then only 10 people can book the workspace.","title":"EnforceCapacity"},"EnforceSchedulingHorizon":{"type":"boolean","description":"The EnforceSchedulingHorizon parameter controls the behavior of recurring meetings that extend beyond the date specified by the BookingWindowInDays parameter.","title":"EnforceSchedulingHorizon"},"ForwardRequestsToDelegates":{"type":"boolean","description":"The ForwardRequestsToDelegates parameter specifies whether to forward incoming meeting requests to the delegates that are configured for the resource mailbox.","title":"ForwardRequestsToDelegates"},"MaximumConflictInstances":{"type":"integer","description":"The MaximumConflictInstances parameter specifies the maximum number of conflicts for new recurring meeting requests when the AllowRecurringMeetings parameter is set to $true. A valid value is an integer from 0 through INT32 (2147483647). The default value is 0.","title":"MaximumConflictInstances"},"MaximumDurationInMinutes":{"type":"integer","description":"The MaximumDurationInMinutes parameter specifies the maximum duration in minutes for meeting requests. A valid value is an integer from 0 through INT32 (2147483647). The default value is 1440 (24 hours).","title":"MaximumDurationInMinutes"},"MinimumDurationInMinutes":{"type":"integer","description":"The MinimumDurationInMinutes parameter specifies the minimum duration in minutes for meeting requests in workspace mailboxes. A valid value is an integer from 0 through INT32 (2147483647). The default value is 0, which means there is no minimum duration.","title":"MinimumDurationInMinutes"},"OrganizerInfo":{"type":"boolean","description":"The OrganizerInfo parameter specifies whether the resource mailbox sends organizer information when a meeting request is declined because of conflicts.","title":"OrganizerInfo"},"PostReservationMaxClaimTimeInMinutes":{"type":"integer","description":"N/A","title":"PostReservationMaxClaimTimeInMinutes"},"ProcessExternalMeetingMessages":{"type":"boolean","description":"The ProcessExternalMeetingMessages parameter specifies whether to process meeting requests that originate outside the Exchange organization.","title":"ProcessExternalMeetingMessages"},"RemoveCanceledMeetings":{"type":"boolean","description":"The RemoveCanceledMeetings parameter specifies whether to automatically delete meetings that were cancelled by the organizer from the resource mailbox's calendar. ","title":"RemoveCanceledMeetings"},"RemoveForwardedMeetingNotifications":{"type":"boolean","description":"The RemoveForwardedMeetingNotifications parameter specifies whether forwarded meeting notifications are moved to the Deleted Items folder after they're processed by the Calendar Attendant. ","title":"RemoveForwardedMeetingNotifications"},"RemoveOldMeetingMessages":{"type":"boolean","description":"The RemoveOldMeetingMessages parameter specifies whether the Calendar Attendant removes old and redundant updates and responses.","title":"RemoveOldMeetingMessages"},"RemovePrivateProperty":{"type":"boolean","description":"The RemovePrivateProperty parameter specifies whether to clear the private flag for incoming meetings that were sent by the organizer in the original requests. ","title":"RemovePrivateProperty"},"RequestInPolicy":{"type":"array","items":{"type":"string"},"description":"The RemovePrivateProperty parameter specifies whether to clear the private flag for incoming meetings that were sent by the organizer in the original requests. ","title":"RequestInPolicy"},"RequestOutOfPolicy":{"type":"array","items":{"type":"string"},"description":"The RequestOutOfPolicy parameter specifies users who are allowed to submit out-of-policy requests that require approval by a resource mailbox delegate. You can use any value that uniquely identifies the user. ","title":"RequestOutOfPolicy"},"ResourceDelegates":{"type":"array","items":{"type":"string"},"description":"The ResourceDelegates parameter specifies users can approve or reject requests that are sent to the resource mailbox. You can use any value that uniquely identifies the user. ","title":"ResourceDelegates"},"ScheduleOnlyDuringWorkHours":{"type":"boolean","description":"The ScheduleOnlyDuringWorkHours parameter specifies whether to allow meetings to be scheduled outside of the working hours that are defined for the resource mailbox.","title":"ScheduleOnlyDuringWorkHours"},"TentativePendingApproval":{"type":"boolean","description":"The TentativePendingApproval parameter specifies whether to mark pending requests as tentative on the calendar.","title":"TentativePendingApproval"},"Ensure":{"enum":["Present"],"description":"Determines whether or not the instance exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.casmailboxplan":{"type":"object","description":"This resource configures Client Access services (CAS) mailbox plans\r\nin cloud-based organizations.","title":"Schema for microsoft.exchange.casmailboxplan","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the CAS Mailbox Plan that you want to modify.","title":"Identity"},"DisplayName":{"type":"string","description":"The display name of the CAS Mailbox Plan.","title":"DisplayName"},"Ensure":{"enum":["Present"],"description":"CASMailboxPlans cannot be created/removed in O365.  This must be set to 'Present'","title":"Ensure"},"ActiveSyncEnabled":{"type":"boolean","description":"The ActiveSyncEnabled parameter enables or disables access to the mailbox by using Exchange Active Sync. Default is $true.","title":"ActiveSyncEnabled"},"ImapEnabled":{"type":"boolean","description":"The ImapEnabled parameter enables or disables access to the mailbox by using IMAP4 clients. The default value is $true for all CAS mailbox plans except ExchangeOnlineDeskless which is $false by default.","title":"ImapEnabled"},"OwaMailboxPolicy":{"type":"string","description":"The OwaMailboxPolicy parameter specifies the Outlook on the web (formerly known as Outlook Web App) mailbox policy for the mailbox plan. The default value is OwaMailboxPolicy-Default. You can use the Get-OwaMailboxPolicy cmdlet to view the available Outlook on the web mailbox policies.","title":"OwaMailboxPolicy"},"PopEnabled":{"type":"boolean","description":"The PopEnabled parameter enables or disables access to the mailbox by using POP3 clients. Default is $true.","title":"PopEnabled"}},"required":["Identity"]},"microsoft.exchange.casmailboxsettings":{"type":"object","description":"This resource configures CAS mailbox settings.","title":"Schema for microsoft.exchange.casmailboxsettings","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the mailbox that you want to configure.","title":"Identity"},"ActiveSyncAllowedDeviceIDs":{"type":"array","items":{"type":"string"},"description":"TheActiveSyncAllowedDeviceIDs parameter specifies one or more Exchange ActiveSync device IDs that are allowed to synchronize with the mailbox.","title":"ActiveSyncAllowedDeviceIDs"},"ActiveSyncBlockedDeviceIDs":{"type":"array","items":{"type":"string"},"description":"The ActiveSyncBlockedDeviceIDs parameter specifies one or more Exchange ActiveSync device IDs that aren't allowed to synchronize with the mailbox.","title":"ActiveSyncBlockedDeviceIDs"},"ActiveSyncDebugLogging":{"type":"boolean","description":"The ActiveSyncDebugLogging parameter enables or disables Exchange ActiveSync debug logging for the mailbox.","title":"ActiveSyncDebugLogging"},"ActiveSyncEnabled":{"type":"boolean","description":"The ActiveSyncEnabled parameter enables or disables access to the mailbox using Exchange ActiveSync.","title":"ActiveSyncEnabled"},"ActiveSyncMailboxPolicy":{"type":"string","description":"The ActiveSyncMailboxPolicy parameter specifies the Exchange ActiveSync mailbox policy for the mailbox.","title":"ActiveSyncMailboxPolicy"},"ActiveSyncSuppressReadReceipt":{"type":"boolean","description":"The ActiveSyncSuppressReadReceipt parameter controls the behavior of read receipts for Exchange ActiveSync clients that access the mailbox.","title":"ActiveSyncSuppressReadReceipt"},"EwsAllowEntourage":{"type":"boolean","description":"The EwsAllowEntourage parameter enables or disables access to the mailbox by Microsoft Entourage clients that use Exchange Web Services.","title":"EwsAllowEntourage"},"EwsAllowList":{"type":"array","items":{"type":"string"},"description":"The EwsAllowList parameter specifies the Exchange Web Services applications (user agent strings) that are allowed to access the mailbox.","title":"EwsAllowList"},"EwsAllowMacOutlook":{"type":"boolean","description":"The EwsAllowMacOutlook parameter enables or disables access to the mailbox by Outlook for Mac clients that use Exchange Web Services.","title":"EwsAllowMacOutlook"},"EwsAllowOutlook":{"type":"boolean","description":"The EwsAllowOutlook parameter enables or disables access to the mailbox by Outlook clients that use Exchange Web Services.","title":"EwsAllowOutlook"},"EwsApplicationAccessPolicy":{"type":"string","description":"The EwsApplicationAccessPolicy parameter controls access to the mailbox using Exchange Web Services applications.","title":"EwsApplicationAccessPolicy"},"EwsBlockList":{"type":"array","items":{"type":"string"},"description":"The EwsBlockList parameter specifies the Exchange Web Services applications (user agent strings) that aren't allowed to access the mailbox using Exchange Web Services.","title":"EwsBlockList"},"EwsEnabled":{"type":"boolean","description":"The EwsEnabled parameter enables or disables access to the mailbox using Exchange Web Services clients.","title":"EwsEnabled"},"ImapEnabled":{"type":"boolean","description":"The ImapEnabled parameter enables or disables access to the mailbox using IMAP4 clients.","title":"ImapEnabled"},"ImapMessagesRetrievalMimeFormat":{"type":"string","description":"The ImapMessagesRetrievalMimeFormat parameter specifies the message format for IMAP4 clients that access the mailbox.","title":"ImapMessagesRetrievalMimeFormat"},"ImapForceICalForCalendarRetrievalOption":{"type":"boolean","description":"The ImapForceICalForCalendarRetrievalOption parameter specifies how meeting requests are presented to IMAP4 clients that access the mailbox.","title":"ImapForceICalForCalendarRetrievalOption"},"ImapSuppressReadReceipt":{"type":"boolean","description":"The ImapSuppressReadReceipt parameter controls the behavior of read receipts for IMAP4 clients that access the mailbox.","title":"ImapSuppressReadReceipt"},"ImapUseProtocolDefaults":{"type":"boolean","description":"The ImapUseProtocolDefaults parameter specifies whether to use the IMAP4 protocol defaults for the mailbox.","title":"ImapUseProtocolDefaults"},"MacOutlookEnabled":{"type":"boolean","description":"The MacOutlookEnabled parameter enables or disables access to the mailbox using Outlook for Mac clients that use Microsoft Sync technology.","title":"MacOutlookEnabled"},"MAPIEnabled":{"type":"boolean","description":"The MAPIEnabled parameter enables or disables access to the mailbox using MAPI clients (for example, Outlook).","title":"MAPIEnabled"},"OneWinNativeOutlookEnabled":{"type":"boolean","description":"The OneWinNativeOutlookEnabled parameter enables or disables access to the mailbox using the new Outlook for Windows.","title":"OneWinNativeOutlookEnabled"},"OutlookMobileEnabled":{"type":"boolean","description":"The OutlookMobileEnabled parameter enables or disables access to the mailbox using Outlook for iOS and Android.","title":"OutlookMobileEnabled"},"OWAEnabled":{"type":"boolean","description":"The OWAEnabled parameter enables or disables access to the mailbox using Outlook on the web (formerly known as Outlook Web App or OWA).","title":"OWAEnabled"},"OWAforDevicesEnabled":{"type":"boolean","description":"The OWAforDevicesEnabled parameter enables or disables access to the mailbox using the older Outlook Web App (OWA) app on iOS and Android devices.","title":"OWAforDevicesEnabled"},"OwaMailboxPolicy":{"type":"string","description":"The OwaMailboxPolicy parameter specifies the Outlook on the web mailbox policy for the mailbox.","title":"OwaMailboxPolicy"},"PopEnabled":{"type":"boolean","description":"The PopEnabled parameter enables or disables access to the mailbox using POP3 clients.","title":"PopEnabled"},"PopForceICalForCalendarRetrievalOption":{"type":"boolean","description":"The PopForceICalForCalendarRetrievalOption parameter specifies how meeting requests are presented to POP3 clients that access the mailbox.","title":"PopForceICalForCalendarRetrievalOption"},"PopMessagesRetrievalMimeFormat":{"type":"string","description":"The PopMessagesRetrievalMimeFormat parameter specifies the message format for POP3 clients that access the mailbox.","title":"PopMessagesRetrievalMimeFormat"},"PopSuppressReadReceipt":{"type":"boolean","description":"The PopSuppressReadReceipt parameter controls the behavior of read receipts for POP3 clients that access the mailbox.","title":"PopSuppressReadReceipt"},"PopUseProtocolDefaults":{"type":"boolean","description":"The PopUseProtocolDefaults parameter specifies whether to use the POP3 protocol defaults for the mailbox.","title":"PopUseProtocolDefaults"},"PublicFolderClientAccess":{"type":"boolean","description":"The PublicFolderClientAccess parameter enables or disables access to public folders in Microsoft Outlook.","title":"PublicFolderClientAccess"},"ShowGalAsDefaultView":{"type":"boolean","description":"The ShowGalAsDefaultView parameter specifies whether the global address list (GAL) is the default recipient picker for messages.","title":"ShowGalAsDefaultView"},"SmtpClientAuthenticationDisabled":{"type":"boolean","description":"The SmtpClientAuthenticationDisabled parameter specifies whether to disable authenticated SMTP (SMTP AUTH) for the mailbox.","title":"SmtpClientAuthenticationDisabled"},"UniversalOutlookEnabled":{"type":"boolean","description":"The UniversalOutlookEnabled parameter enables or disables access to the mailbox using Windows 10 Mail and Calendar.","title":"UniversalOutlookEnabled"},"Ensure":{"enum":["Present"],"description":"Present ensures the Mailbox CAS settings are applied.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.clientaccessrule":{"type":"object","description":"This resource configures Client Access sRules.\r\nClient Access Rules help you control access to your organization based\r\non the properties of the connection.\r\n\r\nNote: Not all authentication types are supported for all protocols.\r\n\r\nThe supported authentication types per protocol can be found here:\r\nhttps://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/client-access-rules/client-access-rules","title":"Schema for microsoft.exchange.clientaccessrule","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the client access rule that you want to modify.","title":"Identity"},"Action":{"enum":["AllowAccess","DenyAccess"],"description":"The Action parameter specifies the action for the client access rule. Valid values for this parameter are AllowAccess and DenyAccess.","title":"Action"},"AnyOfAuthenticationTypes":{"type":"array","items":{"enum":["AdfsAuthentication","BasicAuthentication","CertificateBasedAuthentication","NonBasicAuthentication","OAuthAuthentication"]},"description":"The AnyOfAuthenticationTypes parameter specifies a condition for the client access rule that is based on the client's authentication type. Valid values for this parameter are AdfsAuthentication, BasicAuthentication, CertificateBasedAuthentication, NonBasicAuthentication, OAuthAuthentication.","title":"AnyOfAuthenticationTypes"},"AnyOfClientIPAddressesOrRanges":{"type":"array","items":{"type":"string"},"description":"The AnyOfClientIPAddressesOrRanges parameter specifies a condition for the client access rule that is based on the client's IP address. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.","title":"AnyOfClientIPAddressesOrRanges"},"AnyOfProtocols":{"type":"array","items":{"enum":["ExchangeActiveSync","ExchangeAdminCenter","ExchangeWebServices","IMAP4","OfflineAddressBook","OutlookAnywhere","OutlookWebApp","POP3","PowerShellWebServices","RemotePowerShell","REST","UniversalOutlook"]},"description":"The AnyOfProtocols parameter specifies a condition for the client access rule that is based on the client's protocol. Valid values for this parameter are ExchangeActiveSync,ExchangeAdminCenter,ExchangeWebServices,IMAP4,OfflineAddressBook,OutlookAnywhere,OutlookWebApp,POP3,PowerShellWebServices,RemotePowerShell,REST,UniversalOutlook.","title":"AnyOfProtocols"},"Enabled":{"type":"boolean","description":"The Enabled parameter specifies whether the client access rule is enabled or disabled. Default is $true.","title":"Enabled"},"ExceptAnyOfAuthenticationTypes":{"type":"array","items":{"enum":["AdfsAuthentication","BasicAuthentication","CertificateBasedAuthentication","NonBasicAuthentication","OAuthAuthentication"]},"description":"The ExceptAnyOfAuthenticationTypes parameter specifies an exception for the client access rule that is based on the client's authentication type. Valid values for this parameter are AdfsAuthentication, BasicAuthentication, CertificateBasedAuthentication, NonBasicAuthentication, OAuthAuthentication.","title":"ExceptAnyOfAuthenticationTypes"},"ExceptAnyOfClientIPAddressesOrRanges":{"type":"array","items":{"type":"string"},"description":"The ExceptAnyOfClientIPAddressesOrRanges parameter specifies an exception for the client access rule that is based on the client's IP address. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.","title":"ExceptAnyOfClientIPAddressesOrRanges"},"ExceptAnyOfProtocols":{"type":"array","items":{"enum":["ExchangeActiveSync","ExchangeAdminCenter","ExchangeWebServices","IMAP4","OfflineAddressBook","OutlookAnywhere","OutlookWebApp","POP3","PowerShellWebServices","RemotePowerShell","REST","UniversalOutlook"]},"description":"The ExceptAnyOfProtocols parameter specifies an exception for the client access rule that is based on the client's protocol. Valid values for this parameter are ExchangeActiveSync,ExchangeAdminCenter,ExchangeWebServices,IMAP4,OfflineAddressBook,OutlookAnywhere,OutlookWebApp,POP3,PowerShellWebServices,RemotePowerShell,REST,UniversalOutlook.","title":"ExceptAnyOfProtocols"},"ExceptUsernameMatchesAnyOfPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptUsernameMatchesAnyOfPatterns parameter specifies an exception for the client access rule that is based on the user's account name.","title":"ExceptUsernameMatchesAnyOfPatterns"},"Priority":{"type":"integer","description":"The Priority parameter specifies a priority value for the client access rule. A lower integer value indicates a higher priority, and a higher priority rule is evaluated before a lower priority rule. The default value is 1.","title":"Priority"},"RuleScope":{"enum":["All","Users"],"description":"The RuleScope parameter specifies the scope of the client access rule. Valid values are All and Users","title":"RuleScope"},"UserRecipientFilter":{"type":"string","description":"The UserRecipientFilter parameter specifies a condition for the client access rule that uses OPath filter syntax to identify the user.","title":"UserRecipientFilter"},"UsernameMatchesAnyOfPatterns":{"type":"array","items":{"type":"string"},"description":"The UsernameMatchesAnyOfPatterns parameter specifies a condition for the client access rule that is based on the user's account name.","title":"UsernameMatchesAnyOfPatterns"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Client Access Rule should exist.","title":"Ensure"}},"required":["Identity","Action"]},"microsoft.exchange.dataclassification":{"type":"object","description":"Create a new data classification policy in your cloud-based organization.","title":"Schema for microsoft.exchange.dataclassification","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the data classification rule that you want to modify.","title":"Identity"},"Description":{"type":"string","description":"The Description parameter specifies a description for the data classification rule. You use the Description parameter with the Locale and Name parameters to specify descriptions for the data classification rule in different languages. ","title":"Description"},"Fingerprints":{"type":"array","items":{"type":"string"},"description":"The Fingerprints parameter specifies the byte-encoded document files that are used as fingerprints by the data classification rule.","title":"Fingerprints"},"IsDefault":{"type":"boolean","description":"IsDefault is used with the Locale parameter to specify the default language for the data classification rule.","title":"IsDefault"},"Locale":{"type":"string","description":"The Locale parameter adds or removes languages that are associated with the data classification rule.","title":"Locale"},"Name":{"type":"string","description":"The Name parameter specifies a name for the data classification rule. The value must be less than 256 characters.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this policy should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.dataencryptionpolicy":{"type":"object","description":"Create a new Data Encryption policy in your cloud-based organization.","title":"Schema for microsoft.exchange.dataencryptionpolicy","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the data encryption policy that you want to modify.","title":"Identity"},"AzureKeyIDs":{"type":"array","items":{"type":"string"},"description":"The AzureKeyIDs parameter specifies the URI values of the Azure Key Vault keys to associate with the data encryption policy.","title":"AzureKeyIDs"},"Description":{"type":"string","description":"The Description parameter specifies an optional description for the data encryption policy","title":"Description"},"Enabled":{"type":"boolean","description":"The Enabled parameter enables or disable the data encryption policy.","title":"Enabled"},"Name":{"type":"string","description":"The Name parameter specifies the unique name for the data encryption policy.","title":"Name"},"PermanentDataPurgeContact":{"type":"string","description":"The PermanentDataPurgeContact parameter specifies a contact for the purge of all data that's encrypted by the data encryption policy.","title":"PermanentDataPurgeContact"},"PermanentDataPurgeReason":{"type":"string","description":"The PermanentDataPurgeReason parameter specifies a descriptive reason for the purge of all data that's encrypted by the data encryption policy","title":"PermanentDataPurgeReason"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this policy should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.distributiongroup":{"type":"object","description":"This resource configures Exchange Online distribution groups.","title":"Schema for microsoft.exchange.distributiongroup","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the distribution group or mail-enabled security group that you want to modify. You can use any value that uniquely identifies the group.","title":"Identity"},"Name":{"type":"string","description":"The Name parameter specifies a unique name for the address list.","title":"Name"},"Alias":{"type":"string","description":"Exchange alias (also known as the mail nickname) for the recipient","title":"Alias"},"BccBlocked":{"type":"boolean","description":"Is Bcc blocked for the distribution group.","title":"BccBlocked"},"BypassNestedModerationEnabled":{"type":"boolean","description":"The ByPassNestedModerationEnabled parameter specifies how to handle message approval when a moderated group contains other moderated groups as members.","title":"BypassNestedModerationEnabled"},"Description":{"type":"string","description":"Description of the distribution group.","title":"Description"},"DisplayName":{"type":"string","description":"The DisplayName parameter specifies the display name of the group. The display name is visible in the Exchange admin center and in address lists. The maximum length is 256 characters.","title":"DisplayName"},"HiddenGroupMembershipEnabled":{"type":"boolean","description":"The HiddenGroupMembershipEnabled switch specifies whether to hide the members of the distribution group from members of the group and users who aren't members of the group.","title":"HiddenGroupMembershipEnabled"},"ManagedBy":{"type":"array","items":{"type":"string"},"description":"The ManagedBy parameter specifies an owner for the group. A group must have at least one owner.","title":"ManagedBy"},"MemberDepartRestriction":{"enum":["Open","Closed"],"description":"The MemberDepartRestriction parameter specifies the restrictions that you put on requests to leave the group. Valid values are: Open & Closed","title":"MemberDepartRestriction"},"MemberJoinRestriction":{"enum":["Open","Closed","ApprovalRequired"],"description":"The MemberJoinRestriction parameter specifies the restrictions that you put on requests to join the group. Valid values are: Open, Closed & ApprovalRequired","title":"MemberJoinRestriction"},"Members":{"type":"array","items":{"type":"string"},"description":"The Members parameter specifies the recipients (mail-enabled objects) that are members of the group. You can use any value that uniquely identifies the recipient.","title":"Members"},"ModeratedBy":{"type":"array","items":{"type":"string"},"description":"The ModeratedBy parameter specifies one or more moderators for this group. A moderator approves messages sent to the group before the messages are delivered. A moderator must be a mailbox, mail user, or mail contact in your organization. You can use any value that uniquely identifies the moderator.","title":"ModeratedBy"},"ModerationEnabled":{"type":"boolean","description":"The ModerationEnabled parameter specifies whether moderation is enabled for this recipient.","title":"ModerationEnabled"},"Notes":{"type":"string","description":"The Notes parameters specifies additional information about the object.","title":"Notes"},"OrganizationalUnit":{"type":"string","description":"The OrganizationalUnit parameter specifies the location in Active Directory where the group is created.","title":"OrganizationalUnit"},"PrimarySmtpAddress":{"type":"string","description":"The PrimarySmtpAddress parameter specifies the primary return email address that's used for the recipient.","title":"PrimarySmtpAddress"},"RequireSenderAuthenticationEnabled":{"type":"boolean","description":"The RequireSenderAuthenticationEnabled parameter specifies whether to accept messages only from authenticated (internal) senders.","title":"RequireSenderAuthenticationEnabled"},"RoomList":{"type":"boolean","description":"The RoomList switch specifies that all members of this distribution group are room mailboxes. You don't need to specify a value with this switch.","title":"RoomList"},"AcceptMessagesOnlyFrom":{"type":"array","items":{"type":"string"},"description":"The AcceptMessagesOnlyFrom parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.","title":"AcceptMessagesOnlyFrom"},"AcceptMessagesOnlyFromDLMembers":{"type":"array","items":{"type":"string"},"description":"The AcceptMessagesOnlyFromDLMembers parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.","title":"AcceptMessagesOnlyFromDLMembers"},"AcceptMessagesOnlyFromSendersOrMembers":{"type":"array","items":{"type":"string"},"description":"The AcceptMessagesOnlyFromSendersOrMembers parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.","title":"AcceptMessagesOnlyFromSendersOrMembers"},"CustomAttribute1":{"type":"string","description":"This parameter specifies a value for the CustomAttribute1 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute1"},"CustomAttribute2":{"type":"string","description":"This parameter specifies a value for the CustomAttribute2 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute2"},"CustomAttribute3":{"type":"string","description":"This parameter specifies a value for the CustomAttribute3 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute3"},"CustomAttribute4":{"type":"string","description":"This parameter specifies a value for the CustomAttribute4 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute4"},"CustomAttribute5":{"type":"string","description":"This parameter specifies a value for the CustomAttribute5 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute5"},"CustomAttribute6":{"type":"string","description":"This parameter specifies a value for the CustomAttribute6 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute6"},"CustomAttribute7":{"type":"string","description":"This parameter specifies a value for the CustomAttribute7 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute7"},"CustomAttribute8":{"type":"string","description":"This parameter specifies a value for the CustomAttribute8 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute8"},"CustomAttribute9":{"type":"string","description":"This parameter specifies a value for the CustomAttribute9 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute9"},"CustomAttribute10":{"type":"string","description":"This parameter specifies a value for the CustomAttribute10 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute10"},"CustomAttribute11":{"type":"string","description":"This parameter specifies a value for the CustomAttribute11 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute11"},"CustomAttribute12":{"type":"string","description":"This parameter specifies a value for the CustomAttribute12 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute12"},"CustomAttribute13":{"type":"string","description":"This parameter specifies a value for the CustomAttribute13 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute13"},"CustomAttribute14":{"type":"string","description":"This parameter specifies a value for the CustomAttribute14 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute14"},"CustomAttribute15":{"type":"string","description":"This parameter specifies a value for the CustomAttribute15 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.","title":"CustomAttribute15"},"EmailAddresses":{"type":"array","items":{"type":"string"},"description":"The EmailAddresses parameter specifies all email addresses (proxy addresses) for the recipient, including the primary SMTP address. In on-premises Exchange organizations, the primary SMTP address and other proxy addresses are typically set by email address policies. However, you can use this parameter to configure other proxy addresses for the recipient.","title":"EmailAddresses"},"GrantSendOnBehalfTo":{"type":"array","items":{"type":"string"},"description":"The GrantSendOnBehalfTo parameter specifies who can send on behalf of this group. Although messages send on behalf of the group clearly show the sender in the From field (<Sender> on behalf of <Group>), replies to these messages are delivered to the group, not the sender.","title":"GrantSendOnBehalfTo"},"HiddenFromAddressListsEnabled":{"type":"boolean","description":"The HiddenFromAddressListsEnabled parameter specifies whether this recipient is visible in address lists.","title":"HiddenFromAddressListsEnabled"},"SendOofMessageToOriginatorEnabled":{"type":"boolean","description":"The SendOofMessageToOriginatorEnabled parameter specifies how to handle out of office (OOF) messages for members of the group.","title":"SendOofMessageToOriginatorEnabled"},"SendModerationNotifications":{"enum":["Always","Internal","Never"],"description":"The SendModerationNotifications parameter specifies when moderation notification messages are sent. Valid values are: Always, Internal, Never.","title":"SendModerationNotifications"},"Type":{"enum":["Distribution","Security"],"description":"The Type parameter specifies the type of group that you want to create. Valid values are: Distribution, Security","title":"Type"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this AddressList should exist.","title":"Ensure"}},"required":["Identity","Name"]},"microsoft.exchange.dkimsigningconfig":{"type":"object","description":"This resource configures the DomainKeys Identified Mail (DKIM) signing policy\r\nsettings for domains in a cloud-based organization.","title":"Schema for microsoft.exchange.dkimsigningconfig","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the DKIM signing policy that you want to modify.  This should be the FQDN. ","title":"Identity"},"AdminDisplayName":{"type":"string","description":"The AdminDisplayName parameter specifies a description for the policy.","title":"AdminDisplayName"},"BodyCanonicalization":{"enum":["Simple","Relaxed"],"description":"The BodyCanonicalization parameter specifies the canonicalization algorithm that's used to create and verify the message body part of the DKIM signature. This value effectively controls the sensitivity of DKIM to changes to the message body in transit. Valid values are 'Simple' or 'Relaxed'.  'Relaxed' is the default.","title":"BodyCanonicalization"},"HeaderCanonicalization":{"enum":["Simple","Relaxed"],"description":"The HeaderCanonicalization parameter specifies the canonicalization algorithm that's used to create and verify the message header part of the DKIM signature. This value effectively controls the sensitivity of DKIM to changes to the message headers in transit. Valid values are 'Simple' or 'Relaxed'.  'Relaxed' is the default.","title":"HeaderCanonicalization"},"KeySize":{"enum":[1024,2048],"description":"The KeySize parameter specifies the size in bits of the public key that's used in the DKIM signing policy. Valid values are 1024 and 2048","title":"KeySize"},"Enabled":{"type":"boolean","description":"The Enabled parameter specifies whether the DKIM Signing Configuration is enabled or disabled. Default is $true.","title":"Enabled"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Client Access Rule should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.emailaddresspolicy":{"type":"object","description":"This resource configures Email address policies in Exchange Online.","title":"Schema for microsoft.exchange.emailaddresspolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the email address policy. The maximum length is 64 characters.","title":"Name"},"Priority":{"type":"string","description":"The Priority parameter specifies the order that the email address policies are evaluated. By default, every time that you add a new email address policy, the policy is assigned a priority of N+1, where N is the number of email address policies that you've created.","title":"Priority"},"EnabledEmailAddressTemplates":{"type":"array","items":{"type":"string"},"description":"The EnabledEmailAddressTemplates parameter specifies the rules in the email address policy that are used to generate email addresses for recipients.","title":"EnabledEmailAddressTemplates"},"EnabledPrimarySMTPAddressTemplate":{"type":"array","items":{"type":"string"},"description":"The EnabledPrimarySMTPAddressTemplate parameter specifies the specifies the rule in the email address policy that's used to generate the primary SMTP email addresses for recipients. You can use this parameter instead of the EnabledEmailAddressTemplates if the policy only applies the primary email address and no additional proxy addresses.","title":"EnabledPrimarySMTPAddressTemplate"},"ManagedByFilter":{"type":"string","description":"The ManagedByFilter parameter specifies the email address policies to apply to Office 365 groups based on the properties of the users who create the Office 365 groups.","title":"ManagedByFilter"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Email Address Policy should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.eopprotectionpolicyrule":{"type":"object","description":"This resource configures EOP Protection Policy Rules.","title":"Schema for microsoft.exchange.eopprotectionpolicyrule","properties":{"Comments":{"type":"string","description":"The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.","title":"Comments"},"ExceptIfRecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email addresses in the specified domains. You can specify multiple domains separated by commas.","title":"ExceptIfRecipientDomainIs"},"ExceptIfSentTo":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"ExceptIfSentTo"},"ExceptIfSentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.","title":"ExceptIfSentToMemberOf"},"Identity":{"type":"string","description":"The Identity parameter specifies the rule that you want to view. You can use any value that uniquely identifies the rule. ","title":"Identity"},"State":{"type":"string","description":"This parameter define if the rule is enabled or disabled","title":"State"},"Name":{"type":"string","description":"The Name parameter specifies a unique name for the rule. The maximum length is 64 characters.","title":"Name"},"Priority":{"type":"integer","description":"The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.","title":"Priority"},"RecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The RecipientDomainIs parameter specifies a condition that looks for recipients with email addresses in the specified domains. You can specify multiple domains separated by commas.","title":"RecipientDomainIs"},"SentTo":{"type":"array","items":{"type":"string"},"description":"The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"SentTo"},"SentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The SentToMemberOf parameter specifies a condition that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You can use any value that uniquely identifies the group.","title":"SentToMemberOf"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.externalinoutlook":{"type":"object","description":"This resource will use Set-ExternalInOutlook cmdlet to modify the configuration of external sender identification that's available in Outlook, Outlook for Mac, Outlook on the web, and Outlook for iOS and Android.","title":"Schema for microsoft.exchange.externalinoutlook","properties":{"Identity":{"type":"string","description":"OrganisationIDParameter, not needed for cmdlet Functionality, use 'ExternalinOutlook' to use the same configuration for multiple Tenants","title":"Identity"},"Enabled":{"type":"boolean","description":"The Enabled parameter enables or disables external sender identification in supported versions of Outlook. Valid values are:$true: External sender identification in Outlook is enabled. An External icon is added in the area of the subject line of messages from external senders. To exempt specific senders or sender domains from this identification, use the AllowList parameter.$false: External sender identification in Outlook is disabled.","title":"Enabled"},"AllowList":{"type":"array","items":{"type":"string"},"description":"The AllowList parameter specifies exceptions to external sender identification in supported versions of Outlook. Messages received from the specified senders or senders in the specified domains don't receive native External sender identification. The allow list uses the 5322.From address (also known as the From address or P2 sender). Valid values are an individual domain (contoso.com), a domain and all subdomains (*.contoso.com) or email addresses (admin@contoso.com).","title":"AllowList"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.globaladdresslist":{"type":"object","description":"This resource configures Global Address Lists in Exchange Online.","title":"Schema for microsoft.exchange.globaladdresslist","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the GAL. The maximum length is 64 characters.","title":"Name"},"ConditionalCompany":{"type":"array","items":{"type":"string"},"description":"The ConditionalCompany parameter specifies a precanned filter that's based on the value of the recipient's Company property.","title":"ConditionalCompany"},"ConditionalCustomAttribute1":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute1 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute1 property.","title":"ConditionalCustomAttribute1"},"ConditionalCustomAttribute10":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute10 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute10 property.","title":"ConditionalCustomAttribute10"},"ConditionalCustomAttribute11":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute11 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute11 property.","title":"ConditionalCustomAttribute11"},"ConditionalCustomAttribute12":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute12 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute12 property.","title":"ConditionalCustomAttribute12"},"ConditionalCustomAttribute13":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute13 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute13 property.","title":"ConditionalCustomAttribute13"},"ConditionalCustomAttribute14":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute14 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute14 property.","title":"ConditionalCustomAttribute14"},"ConditionalCustomAttribute15":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute15 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute15 property.","title":"ConditionalCustomAttribute15"},"ConditionalCustomAttribute2":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute2 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute2 property.","title":"ConditionalCustomAttribute2"},"ConditionalCustomAttribute3":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute3 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute3 property.","title":"ConditionalCustomAttribute3"},"ConditionalCustomAttribute4":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute4 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute4 property.","title":"ConditionalCustomAttribute4"},"ConditionalCustomAttribute5":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute5 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute5 property.","title":"ConditionalCustomAttribute5"},"ConditionalCustomAttribute6":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute6 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute6 property.","title":"ConditionalCustomAttribute6"},"ConditionalCustomAttribute7":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute7 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute7 property.","title":"ConditionalCustomAttribute7"},"ConditionalCustomAttribute8":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute8 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute8 property.","title":"ConditionalCustomAttribute8"},"ConditionalCustomAttribute9":{"type":"array","items":{"type":"string"},"description":"The ConditionalCustomAttribute9 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute9 property.","title":"ConditionalCustomAttribute9"},"ConditionalDepartment":{"type":"array","items":{"type":"string"},"description":"The ConditionalDepartment parameter specifies a precanned filter that's based on the value of the recipient's Department property.","title":"ConditionalDepartment"},"ConditionalStateOrProvince":{"type":"array","items":{"type":"string"},"description":"The ConditionalStateOrProvince parameter specifies a precanned filter that's based on the value of the recipient's StateOrProvince property.","title":"ConditionalStateOrProvince"},"IncludedRecipients":{"type":"array","items":{"enum":["","AllRecipients","MailboxUsers","MailContacts","MailGroups","MailUsers","Resources"]},"description":"The IncludedRecipients parameter specifies a precanned filter that's based on the recipient type.","title":"IncludedRecipients"},"RecipientFilter":{"type":"string","description":"The RecipientFilter parameter specifies an OPath filter that's based on the value of any available recipient property.","title":"RecipientFilter"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Global Address List should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.groupsettings":{"type":"object","description":"This resource configures settings on groups\r\nsuch as the custom attributes and language.","title":"Schema for microsoft.exchange.groupsettings","properties":{"DisplayName":{"type":"string","description":"The DisplayName parameter specifies the name of the Microsoft 365 Group. The display name is visible in the Exchange admin center, address lists, and Outlook. The maximum length is 64 characters.","title":"DisplayName"},"Id":{"type":"string","description":"The unique Id of the group","title":"Id"},"AcceptMessagesOnlyFromSendersOrMembers":{"type":"array","items":{"type":"string"},"description":"The AcceptMessagesOnlyFromSendersOrMembers parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.","title":"AcceptMessagesOnlyFromSendersOrMembers"},"AccessType":{"enum":["Public","Private"],"description":"Private","title":"AccessType"},"AlwaysSubscribeMembersToCalendarEvents":{"type":"boolean","description":"The AlwaysSubscribeMembersToCalendarEvents switch controls the default subscription settings of new members that are added to the Microsoft 365 Group. Changing this setting doesn't affect existing group members.","title":"AlwaysSubscribeMembersToCalendarEvents"},"AuditLogAgeLimit":{"type":"string","description":"The AlwaysSubscribeMembersToCalendarEvents switch controls the default subscription settings of new members that are added to the Microsoft 365 Group. Changing this setting doesn't affect existing group members.","title":"AuditLogAgeLimit"},"AutoSubscribeNewMembers":{"type":"boolean","description":"The AutoSubscribeNewMembers switch specifies whether to automatically subscribe new members that are added to the Microsoft 365 Group to conversations and calendar events. Only users that are added to the group after you enable this setting are automatically subscribed to the group.","title":"AutoSubscribeNewMembers"},"CalendarMemberReadOnly":{"type":"boolean","description":"The CalendarMemberReadOnly parameter specifies whether to set read-only Calendar permissions to the Microsoft 365 Group for members of the group.","title":"CalendarMemberReadOnly"},"Classification":{"type":"string","description":"The CalendarMemberReadOnly switch specifies whether to set read-only Calendar permissions to the Microsoft 365 Group for members of the group.","title":"Classification"},"ConnectorsEnabled":{"type":"boolean","description":"The CalendarMemberReadOnly switch specifies whether to set read-only Calendar permissions to the Microsoft 365 Group for members of the group.","title":"ConnectorsEnabled"},"CustomAttribute1":{"type":"string","description":"This parameter specifies a value for the CustomAttribute1 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute1"},"CustomAttribute2":{"type":"string","description":"This parameter specifies a value for the CustomAttribute2 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute2"},"CustomAttribute3":{"type":"string","description":"This parameter specifies a value for the CustomAttribute3 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute3"},"CustomAttribute4":{"type":"string","description":"This parameter specifies a value for the CustomAttribute4 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute4"},"CustomAttribute5":{"type":"string","description":"This parameter specifies a value for the CustomAttribute5 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute5"},"CustomAttribute6":{"type":"string","description":"This parameter specifies a value for the CustomAttribute6 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute6"},"CustomAttribute7":{"type":"string","description":"This parameter specifies a value for the CustomAttribute7 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute7"},"CustomAttribute8":{"type":"string","description":"This parameter specifies a value for the CustomAttribute8 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute8"},"CustomAttribute9":{"type":"string","description":"This parameter specifies a value for the CustomAttribute9 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute9"},"CustomAttribute10":{"type":"string","description":"This parameter specifies a value for the CustomAttribute10 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute10"},"CustomAttribute11":{"type":"string","description":"This parameter specifies a value for the CustomAttribute11 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute11"},"CustomAttribute12":{"type":"string","description":"This parameter specifies a value for the CustomAttribute12 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute12"},"CustomAttribute13":{"type":"string","description":"This parameter specifies a value for the CustomAttribute13 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute13"},"CustomAttribute14":{"type":"string","description":"This parameter specifies a value for the CustomAttribute14 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute14"},"CustomAttribute15":{"type":"string","description":"This parameter specifies a value for the CustomAttribute15 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.","title":"CustomAttribute15"},"DataEncryptionPolicy":{"type":"string","description":"The DataEncryptionPolicy parameter specifies the data encryption policy that's applied to the Microsoft 365 Group. ","title":"DataEncryptionPolicy"},"EmailAddresses":{"type":"array","items":{"type":"string"},"description":"The EmailAddresses parameter specifies all the email addresses (proxy addresses) for the recipient, including the primary SMTP address.","title":"EmailAddresses"},"ExtensionCustomAttribute1":{"type":"string","description":"This parameter specifies a value for the ExtensionCustomAttribute1 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.","title":"ExtensionCustomAttribute1"},"ExtensionCustomAttribute2":{"type":"string","description":"This parameter specifies a value for the ExtensionCustomAttribute2 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.","title":"ExtensionCustomAttribute2"},"ExtensionCustomAttribute3":{"type":"string","description":"This parameter specifies a value for the ExtensionCustomAttribute3 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.","title":"ExtensionCustomAttribute3"},"ExtensionCustomAttribute4":{"type":"string","description":"This parameter specifies a value for the ExtensionCustomAttribute4 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.","title":"ExtensionCustomAttribute4"},"ExtensionCustomAttribute5":{"type":"string","description":"This parameter specifies a value for the ExtensionCustomAttribute5 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.","title":"ExtensionCustomAttribute5"},"GrantSendOnBehalfTo":{"type":"array","items":{"type":"string"},"description":"The GrantSendOnBehalfTo parameter specifies who can send on behalf of this Microsoft 365 Group.","title":"GrantSendOnBehalfTo"},"HiddenFromAddressListsEnabled":{"type":"boolean","description":"The GrantSendOnBehalfTo parameter specifies who can send on behalf of this Microsoft 365 Group.","title":"HiddenFromAddressListsEnabled"},"HiddenFromExchangeClientsEnabled":{"type":"boolean","description":"The HiddenFromExchangeClientsEnabled switch specifies whether the Microsoft 365 Group is hidden from Outlook clients connected to Microsoft 365.","title":"HiddenFromExchangeClientsEnabled"},"InformationBarrierMode":{"enum":["Explicit","Implicit","Open","OwnerModerated"],"description":"The InformationBarrierMode parameter specifies the information barrier mode for the Microsoft 365 Group.","title":"InformationBarrierMode"},"IsMemberAllowedToEditContent":{"type":"boolean","description":"This parameter specifies whether or not members are allow to edit content.","title":"IsMemberAllowedToEditContent"},"Language":{"type":"string","description":"The Language parameter specifies language preference for the Microsoft 365 Group.","title":"Language"},"MailboxRegion":{"type":"string","description":"The MailboxRegion parameter specifies the preferred data location (PDL) for the Microsoft 365 Group in multi-geo environments.","title":"MailboxRegion"},"MailTip":{"type":"string","description":"The MailTip parameter specifies the custom MailTip text for this recipient. The MailTip is shown to senders when they start drafting an email message to this recipient. ","title":"MailTip"},"MailTipTranslations":{"type":"string","description":"The MailTipTranslations parameter specifies additional languages for the custom MailTip text that's defined by the MailTip parameter.","title":"MailTipTranslations"},"MaxReceiveSize":{"type":"string","description":"The MaxReceiveSize parameter specifies the maximum size of an email message that can be sent to this group. Messages that exceed the maximum size are rejected by the group.","title":"MaxReceiveSize"},"MaxSendSize":{"type":"string","description":"The MaxSendSize parameter specifies the maximum size of an email message that can be sent by this group.","title":"MaxSendSize"},"ModeratedBy":{"type":"array","items":{"type":"string"},"description":"The ModeratedBy parameter specifies one or more moderators for this recipient. A moderator approves messages sent to the recipient before the messages are delivered. A moderator must be a mailbox, mail user, or mail contact in your organization. You can use any value that uniquely identifies the moderator. ","title":"ModeratedBy"},"ModerationEnabled":{"type":"boolean","description":"The ModerationEnabled parameter specifies whether moderation is enabled for this recipient.","title":"ModerationEnabled"},"Notes":{"type":"string","description":"The Notes parameter specifies the description of the Microsoft 365 Group. If the value contains spaces, enclose the value in quotation marks.","title":"Notes"},"PrimarySmtpAddress":{"type":"string","description":"The PrimarySmtpAddress parameter specifies the primary return email address that's used for the recipient. You can't use the EmailAddresses and PrimarySmtpAddress parameters in the same command.","title":"PrimarySmtpAddress"},"RejectMessagesFromSendersOrMembers":{"type":"array","items":{"type":"string"},"description":"The RejectMessagesFromSendersOrMembers parameter specifies who isn't allowed to send messages to this recipient. Messages from these senders are rejected.","title":"RejectMessagesFromSendersOrMembers"},"RequireSenderAuthenticationEnabled":{"type":"boolean","description":"The RequireSenderAuthenticationEnabled parameter specifies whether to accept messages only from authenticated (internal) senders. ","title":"RequireSenderAuthenticationEnabled"},"SensitivityLabelId":{"type":"string","description":"The SensitivityLabelId parameter specifies the GUID value of the sensitivity label that's assigned to the Microsoft 365 Group.","title":"SensitivityLabelId"},"SubscriptionEnabled":{"type":"boolean","description":"The SubscriptionEnabled switch specifies whether the group owners can enable subscription to conversations and calendar events on the groups they own. ","title":"SubscriptionEnabled"},"UnifiedGroupWelcomeMessageEnabled":{"type":"boolean","description":"The UnifiedGroupWelcomeMessageEnabled switch specifies whether to enable or disable sending system-generated welcome messages to users who are added as members to the Microsoft 365 Group.","title":"UnifiedGroupWelcomeMessageEnabled"}},"required":["DisplayName"]},"microsoft.exchange.hostedconnectionfilterpolicy":{"type":"object","description":"This resource configures the settings of connection filter policies\r\nin your cloud-based organization.","title":"Schema for microsoft.exchange.hostedconnectionfilterpolicy","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the Hosted Connection Filter Policy that you want to modify.","title":"Identity"},"AdminDisplayName":{"type":"string","description":"The AdminDisplayName parameter specifies a description for the policy.","title":"AdminDisplayName"},"EnableSafeList":{"type":"boolean","description":"The EnableSafeList parameter enables or disables use of the safe list. The safe list is a dynamic allow list in the Microsoft datacenter that requires no customer configuration. Valid input for this parameter is $true or $false. The default value is $false.","title":"EnableSafeList"},"IPAllowList":{"type":"array","items":{"type":"string"},"description":"The IPAllowList parameter specifies IP addresses from which messages are always allowed. Messages from the IP addresses you specify won't be identified as spam, despite any other spam characteristics of the messages. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.","title":"IPAllowList"},"IPBlockList":{"type":"array","items":{"type":"string"},"description":"The IPBlockList parameter specifies IP addresses from which messages are never allowed. Messages from the IP addresses you specify are blocked without any further spam scanning. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.","title":"IPBlockList"},"MakeDefault":{"type":"boolean","description":"The MakeDefault parameter makes the specified policy the default connection filter policy. Default is $false.","title":"MakeDefault"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Hosted Connection Filter Policy should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.hostedcontentfilterpolicy":{"type":"object","description":"This resource configures the settings of connection filter policies\r\nin your cloud-based organization.","title":"Schema for microsoft.exchange.hostedcontentfilterpolicy","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the name of the Hosted Content Filter Policy that you want to modify.","title":"Identity"},"AddXHeaderValue":{"type":"string","description":"The AddXHeaderValue parameter specifies the X-header value to add to spam messages when an action parameter is set to the value AddXHeader.","title":"AddXHeaderValue"},"AdminDisplayName":{"type":"string","description":"The AdminDisplayName parameter specifies a description for the policy.","title":"AdminDisplayName"},"AllowedSenderDomains":{"type":"array","items":{"type":"string"},"description":"The AllowedSenderDomains parameter specifies trusted domains that aren't processed by the spam filter.","title":"AllowedSenderDomains"},"AllowedSenders":{"type":"array","items":{"type":"string"},"description":"The AllowedSenders parameter specifies a list of trusted senders that aren't processed by the spam filter.","title":"AllowedSenders"},"BlockedSenderDomains":{"type":"array","items":{"type":"string"},"description":"The BlockedSenderDomains parameter specifies domains that are always marked as spam sources.","title":"BlockedSenderDomains"},"BlockedSenders":{"type":"array","items":{"type":"string"},"description":"The BlockedSenders parameter specifies senders that are always marked as spam sources.","title":"BlockedSenders"},"BulkQuarantineTag":{"type":"string","description":"The BulkQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as bulk email.","title":"BulkQuarantineTag"},"BulkSpamAction":{"enum":["MoveToJmf","AddXHeader","ModifySubject","Redirect","Delete","Quarantine","NoAction"],"description":"The BulkSpamAction parameter specifies the action to take on messages that are classified as bulk email.","title":"BulkSpamAction"},"BulkThreshold":{"type":"integer","description":"The BulkThreshold parameter specifies the Bulk Complaint Level (BCL) threshold setting. Valid values are from 1 - 9, where 1 marks most bulk email as spam, and 9 allows the most bulk email to be delivered. The default value is 7.","title":"BulkThreshold"},"DownloadLink":{"type":"boolean","description":"The DownloadLink parameter shows or hides a link in end-user spam notification messages to download the Junk Email Reporting Tool plugin for Outlook. Valid input for this parameter is $true or $false. The default value is $false.","title":"DownloadLink"},"EnableEndUserSpamNotifications":{"type":"boolean","description":"The EnableEndUserSpamNotification parameter enables for disables sending end-user spam quarantine notification messages. Valid input for this parameter is $true or $false. The default value is $false.","title":"EnableEndUserSpamNotifications"},"EnableLanguageBlockList":{"type":"boolean","description":"The EnableLanguageBlockList parameter enables or disables blocking email messages that are written in specific languages, regardless of the message contents. Valid input for this parameter is $true or $false. The default value is $false.","title":"EnableLanguageBlockList"},"EnableRegionBlockList":{"type":"boolean","description":"The EnableRegionBlockList parameter enables or disables blocking email messages that are sent from specific countries or regions, regardless of the message contents. Valid input for this parameter is $true or $false. The default value is $false.","title":"EnableRegionBlockList"},"EndUserSpamNotificationCustomSubject":{"type":"string","description":"The EndUserSpamNotificationCustomSubject parameter specifies a custom subject for end-user spam notification messages.","title":"EndUserSpamNotificationCustomSubject"},"EndUserSpamNotificationFrequency":{"type":"integer","description":"The EndUserSpamNotificationFrequency parameter specifies the repeat interval in days that end-user spam notification messages are sent. Valid input for this parameter is an integer between 1 and 15. The default value is 3.","title":"EndUserSpamNotificationFrequency"},"EndUserSpamNotificationLanguage":{"enum":["Default","English","French","German","Italian","Japanese","Spanish","Korean","Portuguese","Russian","ChineseSimplified","ChineseTraditional","Amharic","Arabic","Bulgarian","BengaliIndia","Catalan","Czech","Cyrillic","Danish","Greek","Estonian","Basque","Farsi","Finnish","Filipino","Galician","Gujarati","Hebrew","Hindi","Croatian","Hungarian","Indonesian","Icelandic","Kazakh","Kannada","Lithuanian","Latvian","Malayalam","Marathi","Malay","Dutch","NorwegianNynorsk","Norwegian","Oriya","Polish","PortuguesePortugal","Romanian","Slovak","Slovenian","SerbianCyrillic","Serbian","Swedish","Swahili","Tamil","Telugu","Thai","Turkish","Ukrainian","Urdu","Vietnamese"],"description":"The EndUserSpamNotificationLanguage parameter specifies the language of end-user spam notification messages. The default value is Default. This means the default language of end-user spam notification messages is the default language of the cloud-based organization.","title":"EndUserSpamNotificationLanguage"},"HighConfidencePhishAction":{"enum":["MoveToJmf","Redirect","Quarantine"],"description":"The HighConfidencePhishAction parameter specifies the action to take on messages that are marked as high confidence phishing","title":"HighConfidencePhishAction"},"HighConfidencePhishQuarantineTag":{"type":"string","description":"The HighConfidencePhishQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as high confidence phishing.","title":"HighConfidencePhishQuarantineTag"},"HighConfidenceSpamAction":{"enum":["MoveToJmf","AddXHeader","ModifySubject","Redirect","Delete","Quarantine","NoAction"],"description":"The HighConfidenceSpamAction parameter specifies the action to take on messages that are classified as high confidence spam.","title":"HighConfidenceSpamAction"},"HighConfidenceSpamQuarantineTag":{"type":"string","description":"The HighConfidenceSpamQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as high confidence spam.","title":"HighConfidenceSpamQuarantineTag"},"IncreaseScoreWithBizOrInfoUrls":{"enum":["Off","On","Test"],"description":"The IncreaseScoreWithBizOrInfoUrls parameter increases the spam score of messages that contain links to .biz or .info domains. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"IncreaseScoreWithBizOrInfoUrls"},"IncreaseScoreWithImageLinks":{"enum":["Off","On","Test"],"description":"The IncreaseScoreWithImageLinks parameter increases the spam score of messages that contain image links to remote websites. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"IncreaseScoreWithImageLinks"},"IncreaseScoreWithNumericIps":{"enum":["Off","On","Test"],"description":"The IncreaseScoreWithNumericIps parameter increases the spam score of messages that contain links to IP addresses. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"IncreaseScoreWithNumericIps"},"IncreaseScoreWithRedirectToOtherPort":{"enum":["Off","On","Test"],"description":"The IncreaseScoreWithRedirectToOtherPort parameter increases the spam score of messages that contain links that redirect to other TCP ports. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"IncreaseScoreWithRedirectToOtherPort"},"InlineSafetyTipsEnabled":{"type":"boolean","description":"The InlineSafetyTipsEnabled parameter specifies whether to enable or disable safety tips that are shown to recipients in messages. The default is $true","title":"InlineSafetyTipsEnabled"},"IntraOrgFilterState":{"enum":["Default","HighConfidencePhish","Phish","HighConfidenceSpam","Spam","Disabled"],"description":"The IntraOrgFilterState parameter specifies whether to enable anti-spam filtering for messages sent between internal users (users in the same organization).","title":"IntraOrgFilterState"},"LanguageBlockList":{"type":"array","items":{"type":"string"},"description":"The LanguageBlockList parameter specifies the languages to block when messages are blocked based on their language. Valid input for this parameter is a supported ISO 639-1 lowercase two-letter language code. You can specify multiple values separated by commas. This parameter is only use when the EnableRegionBlockList parameter is set to $true.","title":"LanguageBlockList"},"MakeDefault":{"type":"boolean","description":"The MakeDefault parameter makes the specified content filter policy the default content filter policy. The default value is $false","title":"MakeDefault"},"MarkAsSpamBulkMail":{"enum":["Off","On","Test"],"description":"The MarkAsSpamBulkMail parameter classifies the message as spam when the message is identified as a bulk email message. Valid values for this parameter are Off, On or Test. The default value is On.","title":"MarkAsSpamBulkMail"},"MarkAsSpamEmbedTagsInHtml":{"enum":["Off","On","Test"],"description":"The MarkAsSpamEmbedTagsInHtml parameter classifies the message as spam when the message contains HTML <embed> tags. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"MarkAsSpamEmbedTagsInHtml"},"MarkAsSpamEmptyMessages":{"enum":["Off","On","Test"],"description":"The MarkAsSpamEmptyMessages parameter classifies the message as spam when the message is empty. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"MarkAsSpamEmptyMessages"},"MarkAsSpamFormTagsInHtml":{"enum":["Off","On","Test"],"description":"The MarkAsSpamFormTagsInHtml parameter classifies the message as spam when the message contains HTML <form> tags. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"MarkAsSpamFormTagsInHtml"},"MarkAsSpamFramesInHtml":{"enum":["Off","On","Test"],"description":"The MarkAsSpamFramesInHtml parameter classifies the message as spam when the message contains HTML <frame> or <iframe> tags. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"MarkAsSpamFramesInHtml"},"MarkAsSpamFromAddressAuthFail":{"enum":["Off","On","Test"],"description":"The MarkAsSpamFromAddressAuthFail parameter classifies the message as spam when Sender ID filtering encounters a hard fail. Valid values for this parameter are Off or On. The default value is Off.","title":"MarkAsSpamFromAddressAuthFail"},"MarkAsSpamJavaScriptInHtml":{"enum":["Off","On","Test"],"description":"The MarkAsSpamJavaScriptInHtml parameter classifies the message as spam when the message contains JavaScript or VBScript. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"MarkAsSpamJavaScriptInHtml"},"MarkAsSpamNdrBackscatter":{"enum":["Off","On","Test"],"description":"The MarkAsSpamNdrBackscatter parameter classifies the message as spam when the message is a non-delivery report (NDR) to a forged sender. Valid values for this parameter are Off or On. The default value is Off.","title":"MarkAsSpamNdrBackscatter"},"MarkAsSpamObjectTagsInHtml":{"enum":["Off","On","Test"],"description":"The MarkAsSpamObjectTagsInHtml parameter classifies the message as spam when the message contains HTML <object> tags. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"MarkAsSpamObjectTagsInHtml"},"MarkAsSpamSensitiveWordList":{"enum":["Off","On","Test"],"description":"The MarkAsSpamSensitiveWordList parameter classifies the message as spam when the message contains words from the sensitive words list. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"MarkAsSpamSensitiveWordList"},"MarkAsSpamSpfRecordHardFail":{"enum":["Off","On","Test"],"description":"The MarkAsSpamSpfRecordHardFail parameter classifies the message as spam when Sender Policy Framework (SPF) record checking encounters a hard fail. Valid values for this parameter are Off or On. The default value is Off.","title":"MarkAsSpamSpfRecordHardFail"},"MarkAsSpamWebBugsInHtml":{"enum":["Off","On","Test"],"description":"The MarkAsSpamWebBugsInHtml parameter classifies the message as spam when the message contains web bugs. Valid values for this parameter are Off, On or Test. The default value is Off.","title":"MarkAsSpamWebBugsInHtml"},"ModifySubjectValue":{"type":"string","description":"The ModifySubjectValue parameter specifies the text to prepend to the existing subject of spam messages when an action parameter is set to the value ModifySubject.","title":"ModifySubjectValue"},"PhishSpamAction":{"enum":["MoveToJmf","AddXHeader","ModifySubject","Redirect","Delete","Quarantine","NoAction"],"description":"The PhishSpamAction parameter specifies the action to take on messages that are classified as phishing","title":"PhishSpamAction"},"PhishQuarantineTag":{"type":"string","description":"The PhishQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as phishing.","title":"PhishQuarantineTag"},"SpamQuarantineTag":{"type":"string","description":"The SpamQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as spam.","title":"SpamQuarantineTag"},"QuarantineRetentionPeriod":{"type":"integer","description":"The QuarantineRetentionPeriod parameter specifies the length of time in days that spam messages remain in the quarantine. Valid input for this parameter is an integer between 1 and 30. The default value is 15.","title":"QuarantineRetentionPeriod"},"RedirectToRecipients":{"type":"array","items":{"type":"string"},"description":"The RedirectToRecipients parameter specifies the replacement recipients in spam messages when an action parameter is set to the value Redirect. The action parameters that use the value of RedirectToRecipients are BulkSpamAction, HighConfidencePhishAction, HighConfidenceSpamAction, PhishSpamAction and SpamAction.","title":"RedirectToRecipients"},"RegionBlockList":{"type":"array","items":{"type":"string"},"description":"The RegionBlockList parameter specifies the region to block when messages are blocked based on their source region. Valid input for this parameter is a supported ISO 3166-1 uppercase two-letter country code. You can specify multiple values separated by commas. This parameter is only used when the EnableRegionBlockList parameter is set to $true.","title":"RegionBlockList"},"SpamAction":{"enum":["MoveToJmf","AddXHeader","ModifySubject","Redirect","Delete","Quarantine","NoAction"],"description":"The SpamAction parameter specifies the action to take on messages that are classified as spam (not high confidence spam, bulk email, or phishing). ","title":"SpamAction"},"TestModeAction":{"enum":["None","AddXHeader","BccMessage"],"description":"The TestModeAction parameter specifies the additional action to take on messages that match any of the IncreaseScoreWith or MarkAsSpam parameters that are set to the value Test. ","title":"TestModeAction"},"TestModeBccToRecipients":{"type":"array","items":{"type":"string"},"description":"The TestModeBccToRecipients parameter specifies the blind carbon copy recipients to add to spam messages when the TestModeAction action parameter is set to the value BccMessage.","title":"TestModeBccToRecipients"},"PhishZapEnabled":{"type":"boolean","description":"The PhishZapEnabled parameter enables or disables zero-hour auto purge (ZAP) to detect phishing messages in delivered messages in Exchange Online mailboxes.","title":"PhishZapEnabled"},"SpamZapEnabled":{"type":"boolean","description":"The SpamZapEnabled parameter enables or disables zero-hour auto purge (ZAP) to detect spam in delivered messages in Exchange Online mailboxes.","title":"SpamZapEnabled"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this policy should exist or not.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.hostedcontentfilterrule":{"type":"object","description":"This resource configures an Hosted Content Filter Rule in Exchange Online.\r\nReference: https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/new-HostedContentFilterRule?view=exchange-ps","title":"Schema for microsoft.exchange.hostedcontentfilterrule","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the name of the HostedContentFilter rule that you want to modify.","title":"Identity"},"HostedContentFilterPolicy":{"type":"string","description":"The HostedContentFilterPolicy parameter specifies the name of the HostedContentFilter policy that's associated with the HostedContentFilter rule.","title":"HostedContentFilterPolicy"},"Enabled":{"type":"boolean","description":"Specify if this rule should be enabled. Default is $true.","title":"Enabled"},"Priority":{"type":"integer","description":"The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.","title":"Priority"},"Comments":{"type":"string","description":"The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.","title":"Comments"},"ExceptIfRecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"ExceptIfRecipientDomainIs"},"ExceptIfSentTo":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"ExceptIfSentTo"},"ExceptIfSentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.","title":"ExceptIfSentToMemberOf"},"RecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"RecipientDomainIs"},"SentTo":{"type":"array","items":{"type":"string"},"description":"The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"SentTo"},"SentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.","title":"SentToMemberOf"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"}},"required":["Identity","HostedContentFilterPolicy"]},"microsoft.exchange.hostedoutboundspamfilterpolicy":{"type":"object","description":"This resource configures the settings of the outbound spam filter policy\r\nin your cloud-based organization.","title":"Schema for microsoft.exchange.hostedoutboundspamfilterpolicy","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the name of the policy that you want to modify. There is only one policy named 'Default'","title":"Identity"},"AdminDisplayName":{"type":"string","description":"The AdminDisplayName parameter specifies a description for the policy.","title":"AdminDisplayName"},"BccSuspiciousOutboundAdditionalRecipients":{"type":"array","items":{"type":"string"},"description":"The BccSuspiciousOutboundAdditionalRecipients parameter specifies the recipients to add to the Bcc field of outgoing spam messages. Valid input for this parameter is an email address. Separate multiple email addresses with commas.","title":"BccSuspiciousOutboundAdditionalRecipients"},"BccSuspiciousOutboundMail":{"type":"boolean","description":"The BccSuspiciousOutboundMail parameter enables or disables adding recipients to the Bcc field of outgoing spam messages. Valid input for this parameter is $true or $false. The default value is $false. You specify the additional recipients using the BccSuspiciousOutboundAdditionalRecipients parameter.","title":"BccSuspiciousOutboundMail"},"NotifyOutboundSpam":{"type":"boolean","description":"The NotifyOutboundSpam parameter enables or disables sending notification messages to administrators when an outgoing message is determined to be spam. Valid input for this parameter is $true or $false. The default value is $false. You specify the administrators to notify by using the NotifyOutboundSpamRecipients parameter.","title":"NotifyOutboundSpam"},"NotifyOutboundSpamRecipients":{"type":"array","items":{"type":"string"},"description":"The NotifyOutboundSpamRecipients parameter specifies the administrators to notify when an outgoing message is determined to be spam. Valid input for this parameter is an email address. Separate multiple email addresses with commas.","title":"NotifyOutboundSpamRecipients"},"RecipientLimitInternalPerHour":{"type":"integer","description":"The RecipientLimitInternalPerHour parameter specifies the maximum number of internal recipients that a user can send to within an hour. A valid value is 0 to 10000. The default value is 0, which means the service defaults are used.","title":"RecipientLimitInternalPerHour"},"RecipientLimitPerDay":{"type":"integer","description":"The RecipientLimitPerDay parameter specifies the maximum number of recipients that a user can send to within a day. A valid value is 0 to 10000. The default value is 0, which means the service defaults are used.","title":"RecipientLimitPerDay"},"RecipientLimitExternalPerHour":{"type":"integer","description":"The RecipientLimitExternalPerHour parameter specifies the maximum number of external recipients that a user can send to within an hour. A valid value is 0 to 10000. The default value is 0, which means the service defaults are used.","title":"RecipientLimitExternalPerHour"},"ActionWhenThresholdReached":{"type":"string","description":"The ActionWhenThresholdReached parameter specifies the action to take when any of the limits specified in the policy are reached. Valid values are: Alert, BlockUser, BlockUserForToday. BlockUserForToday is the default value.","title":"ActionWhenThresholdReached"},"AutoForwardingMode":{"type":"string","description":"The AutoForwardingMode specifies how the policy controls automatic email forwarding to outbound recipients. Valid values are: Automatic, On, Off.","title":"AutoForwardingMode"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this policy should exist or not.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.hostedoutboundspamfilterrule":{"type":"object","description":"This resource configures an Hosted Content Filter Rule in Exchange Online.\r\nReference: https://docs.microsoft.com/en-us/powershell/module/exchange/new-hostedoutboundspamfilterrule?view=exchange-ps","title":"Schema for microsoft.exchange.hostedoutboundspamfilterrule","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the name of the HostedOutboundSpamFilter rule that you want to modify.","title":"Identity"},"HostedOutboundSpamFilterPolicy":{"type":"string","description":"The HostedOutboundSpamFilterPolicy parameter specifies the name of the HostedOutboundSpamFilter policy that's associated with the HostedOutboundSpamFilter rule.","title":"HostedOutboundSpamFilterPolicy"},"Enabled":{"type":"boolean","description":"Specify if this rule should be enabled. Default is $true.","title":"Enabled"},"Priority":{"type":"integer","description":"The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.","title":"Priority"},"Comments":{"type":"string","description":"The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.","title":"Comments"},"ExceptIfSenderDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSenderDomainIs parameter specifies an exception that looks for senders with email address in the specified domains. You can specify multiple domains separated by commas.","title":"ExceptIfSenderDomainIs"},"ExceptIfFrom":{"type":"array","items":{"type":"string"},"description":"The ExceptIfFrom parameter specifies an exception that looks for messages from specific senders. You can use any value that uniquely identifies the sender.","title":"ExceptIfFrom"},"ExceptIfFromMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfFromMemberOf parameter specifies an exception that looks for messages sent by group members. You can use any value that uniquely identifies the group.","title":"ExceptIfFromMemberOf"},"SenderDomainIs":{"type":"array","items":{"type":"string"},"description":"The SenderDomainIs parameter specifies a condition that looks for senders with email address in the specified domains. You can specify multiple domains separated by commas.","title":"SenderDomainIs"},"From":{"type":"array","items":{"type":"string"},"description":"The From parameter specifies a condition that looks for messages from specific senders. You can use any value that uniquely identifies the sender.","title":"From"},"FromMemberOf":{"type":"array","items":{"type":"string"},"description":"The FromMemberOf parameter specifies a condition that looks for messages sent by group members. You can use any value that uniquely identifies the group.","title":"FromMemberOf"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"}},"required":["Identity","HostedOutboundSpamFilterPolicy"]},"microsoft.exchange.inboundconnector":{"type":"object","description":"This resource configures an Inbound connector in your cloud-based organization.","title":"Schema for microsoft.exchange.inboundconnector","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the outbound connector that you want to modify.","title":"Identity"},"AssociatedAcceptedDomains":{"type":"array","items":{"type":"string"},"description":"The AssociatedAcceptedDomains parameter specifies the accepted domains that the connector applies to, thereby limiting its scope. For example, you can apply the connector to a specific accepted domain in your organization, such as contoso.com.","title":"AssociatedAcceptedDomains"},"CloudServicesMailEnabled":{"type":"boolean","description":"The CloudServicesMailEnabled parameter specifies whether the connector is used for hybrid mail flow between an on-premises Exchange environment and Microsoft Office 365. Specifically, this parameter controls how certain internal X-MS-Exchange-Organization-* message headers are handled in messages that are sent between accepted domains in the on-premises and cloud organizations. These headers are collectively known as cross-premises headers. DO NOT USE MANUALLY!","title":"CloudServicesMailEnabled"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"ConnectorSource":{"enum":["Default","Migrated","HybridWizard"],"description":"The ConnectorSource parameter specifies how the connector is created. DO NOT CHANGE THIS!","title":"ConnectorSource"},"ConnectorType":{"enum":["Partner","OnPremises"],"description":"The ConnectorType parameter specifies a category for the domains that are serviced by the connector. Valid values are Partner and OnPremises","title":"ConnectorType"},"EFSkipIPs":{"type":"array","items":{"type":"string"},"description":"The EFSkipIPs parameter specifies the source IP addresses to skip in Enhanced Filtering for Connectors when the EFSkipLastIP parameter value is $false.","title":"EFSkipIPs"},"EFSkipLastIP":{"type":"boolean","description":"The EFSkipLastIP parameter specifies the behavior of Enhanced Filtering for Connectors.","title":"EFSkipLastIP"},"EFUsers":{"type":"array","items":{"type":"string"},"description":"The EFUsers parameter specifies the recipients that Enhanced Filtering for Connectors applies to.","title":"EFUsers"},"Enabled":{"type":"boolean","description":"Specifies whether connector is enabled.","title":"Enabled"},"RequireTls":{"type":"boolean","description":"The RequireTLS parameter specifies that all messages received by this connector require TLS transmission. Valid values for this parameter are $true or $false. The default value is $false. When the RequireTLS parameter is set to $true, all messages received by this connector require TLS transmission.","title":"RequireTls"},"RestrictDomainsToCertificate":{"type":"boolean","description":"The RestrictDomainsToCertificate parameter specifies that Office 365 should identify incoming messages that are eligible for this connector by verifying that the remote server authenticates using a TLS certificate that has the TlsSenderCertificateName in the Subject.","title":"RestrictDomainsToCertificate"},"RestrictDomainsToIPAddresses":{"type":"boolean","description":"The RestrictDomainsToIPAddresses parameter, when set to $true, automatically rejects mail from the domains specified by the SenderDomains parameter if the mail originates from an IP address that isn't specified by the SenderIPAddresses parameter.","title":"RestrictDomainsToIPAddresses"},"SenderDomains":{"type":"array","items":{"type":"string"},"description":"The SenderDomains parameter specifies the remote domains from which this connector accepts messages, thereby limiting its scope. You can use a wildcard character to specify all subdomains of a specified domain, as shown in the following example: *.contoso.com. However, you can't embed a wildcard character, as shown in the following example: domain.*.contoso.com.","title":"SenderDomains"},"SenderIPAddresses":{"type":"array","items":{"type":"string"},"description":"The SenderIPAddresses parameter specifies the remote IP addresses from which this connector accepts messages.","title":"SenderIPAddresses"},"TlsSenderCertificateName":{"type":"string","description":"The TlsSenderCertificateName parameter specifies the certificate used by the sender's domain when the RequireTls parameter is set to $true. Valid input for the TlsSenderCertificateName parameter is an SMTP domain. ","title":"TlsSenderCertificateName"},"TreatMessagesAsInternal":{"type":"boolean","description":"The TreatMessagesAsInternal parameter specifies an alternative method to identify messages sent from an on-premises organization as internal messages. You should only consider using this parameter when your on-premises organization doesn't use Exchange.","title":"TreatMessagesAsInternal"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Outbound connector should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.intraorganizationconnector":{"type":"object","description":"Create a new EXOIntraOrganizationConnector in your cloud-based organization.","title":"Schema for microsoft.exchange.intraorganizationconnector","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the intraorg connector that you want to modify.","title":"Identity"},"DiscoveryEndpoint":{"type":"string","description":"The DiscoveryEndpoint parameter specifies the externally-accessible URL that's used for the Autodiscover service for the domain that's configured in the Intra-Organization connector.","title":"DiscoveryEndpoint"},"Enabled":{"type":"boolean","description":"Specifies whether connector is enabled.","title":"Enabled"},"TargetAddressDomains":{"type":"array","items":{"type":"string"},"description":"The TargetAddressDomains parameter specifies the domain namespaces that will be used in the Intra-organization connector. These domains must have valid Autodiscover endpoints defined in their organizations. The domains and their associated Autodiscover endpoints are used by the Intra-Organization connector for feature and service connectivity. You can specify multiple domains separated by commas.","title":"TargetAddressDomains"},"TargetSharingEpr":{"type":"string","description":"The TargetSharingEpr parameter specifies the URL of the target Exchange Web Services that will be used in the Intra-Organization connector.","title":"TargetSharingEpr"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Intra-Organization connector should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.irmconfiguration":{"type":"object","description":"Modify the resource Configuration policy in your cloud-based organization.","title":"Schema for microsoft.exchange.irmconfiguration","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"AutomaticServiceUpdateEnabled":{"type":"boolean","description":"The AutomaticServiceUpdateEnabled parameter specifies whether to allow the automatic addition of new features within Azure Information Protection for your cloud-based organization.","title":"AutomaticServiceUpdateEnabled"},"AzureRMSLicensingEnabled":{"type":"boolean","description":"The AzureRMSLicensingEnabled parameter specifies whether the Exchange Online organization can to connect directly to Azure Rights Management.","title":"AzureRMSLicensingEnabled"},"DecryptAttachmentForEncryptOnly":{"type":"boolean","description":"The DecryptAttachmentForEncryptOnly parameter specifies whether mail recipients have unrestricted rights on the attachment or not for Encrypt-only mails sent using Microsoft Purview Message Encryption.","title":"DecryptAttachmentForEncryptOnly"},"EDiscoverySuperUserEnabled":{"type":"boolean","description":"The EDiscoverySuperUserEnabled parameter specifies whether members of the Discovery Management role group can access IRM-protected messages in a discovery mailbox that were returned by a discovery search.","title":"EDiscoverySuperUserEnabled"},"EnablePdfEncryption":{"type":"boolean","description":"The EnablePdfEncryption parameter specifies whether to enable the encryption of PDF attachments using Microsoft Purview Message Encryption. ","title":"EnablePdfEncryption"},"InternalLicensingEnabled":{"type":"boolean","description":"The InternalLicensingEnabled parameter specifies whether to enable IRM features for messages that are sent to internal and external recipients.","title":"InternalLicensingEnabled"},"JournalReportDecryptionEnabled":{"type":"boolean","description":"The JournalReportDecryptionEnabled parameter specifies whether to enable journal report decryption.","title":"JournalReportDecryptionEnabled"},"LicensingLocation":{"type":"array","items":{"type":"string"},"description":"The LicensingLocation parameter specifies the RMS licensing URLs. You can specify multiple URL values separated by commas.","title":"LicensingLocation"},"RejectIfRecipientHasNoRights":{"type":"boolean","description":"This parameter is available only in the cloud-based service.","title":"RejectIfRecipientHasNoRights"},"RMSOnlineKeySharingLocation":{"type":"string","description":"The RMSOnlineKeySharingLocation parameter specifies the Azure Rights Management URL that's used to get the trusted publishing domain (TPD) for the Exchange Online organization.","title":"RMSOnlineKeySharingLocation"},"SearchEnabled":{"type":"boolean","description":"The SearchEnabled parameter specifies whether to enable searching of IRM-encrypted messages in Outlook on the web (formerly known as Outlook Web App).","title":"SearchEnabled"},"SimplifiedClientAccessDoNotForwardDisabled":{"type":"boolean","description":"The SimplifiedClientAccessDoNotForwardDisabled parameter specifies whether to disable Do not forward in Outlook on the web.","title":"SimplifiedClientAccessDoNotForwardDisabled"},"SimplifiedClientAccessEnabled":{"type":"boolean","description":"The SimplifiedClientAccessEnabled parameter specifies whether to enable the Protect button in Outlook on the web.","title":"SimplifiedClientAccessEnabled"},"SimplifiedClientAccessEncryptOnlyDisabled":{"type":"boolean","description":"The SimplifiedClientAccessEncryptOnlyDisabled parameter specifies whether to disable Encrypt only in Outlook on the web. ","title":"SimplifiedClientAccessEncryptOnlyDisabled"},"TransportDecryptionSetting":{"enum":["Disabled","Mandatory","Optional"],"description":"The TransportDecryptionSetting parameter specifies the transport decryption configuration.","title":"TransportDecryptionSetting"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Outbound connector should exist.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.exchange.journalrule":{"type":"object","description":"This resource allows to configure Journal Rules in Exchange Online.","title":"Schema for microsoft.exchange.journalrule","properties":{"Name":{"type":"string","description":"Name of the Journal Rule","title":"Name"},"JournalEmailAddress":{"type":"string","description":"The JournalEmailAddress parameter specifies a recipient object to which journal reports are sent. You can use any value that uniquely identifies the recipient.","title":"JournalEmailAddress"},"Recipient":{"type":"string","description":"The Recipient parameter specifies the SMTP address of a mailbox, contact, or distribution group to journal. If you specify a distribution group, all recipients in that distribution group are journaled. All messages sent to or from a recipient are journaled.","title":"Recipient"},"Enabled":{"type":"boolean","description":"Specifies whether the Journal Rule is enabled or not.","title":"Enabled"},"RuleScope":{"enum":["Global","Internal","External"],"description":"The Scope parameter specifies the scope of email messages to which the journal rule is applied","title":"RuleScope"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the rule exists, Absent that it does not.","title":"Ensure"}},"required":["Name","JournalEmailAddress"]},"microsoft.exchange.mailboxautoreplyconfiguration":{"type":"object","description":"This resource configures the Auto Reply settings of mailboxes.","title":"Schema for microsoft.exchange.mailboxautoreplyconfiguration","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the mailbox that you want to modify. You can use any value that uniquely identifies the mailbox.","title":"Identity"},"Owner":{"type":"string","description":"User Principal Name of the mailbox owner","title":"Owner"},"AutoDeclineFutureRequestsWhenOOF":{"type":"boolean","description":"The AutoDeclineFutureRequestsWhenOOF parameter specifies whether to automatically decline new meeting requests that are sent to the mailbox during the scheduled time period when Automatic Replies are being sent. ","title":"AutoDeclineFutureRequestsWhenOOF"},"AutoReplyState":{"enum":["Enabled","Disabled","Scheduled"],"description":"The AutoReplyState parameter specifies whether the mailbox is enabled for Automatic Replies. Valid values are: Enabled, Disabled, Scheduled","title":"AutoReplyState"},"CreateOOFEvent":{"type":"boolean","description":"The CreateOOFEvent parameter specifies whether to create a calendar event that corresponds to the scheduled time period when Automatic Replies are being sent for the mailbox.","title":"CreateOOFEvent"},"DeclineAllEventsForScheduledOOF":{"type":"boolean","description":"The DeclineAllEventsForScheduledOOF parameter specifies whether to decline all existing calendar events in the mailbox during the scheduled time period when Automatic Replies are being sent.","title":"DeclineAllEventsForScheduledOOF"},"DeclineEventsForScheduledOOF":{"type":"boolean","description":"The DeclineEventsForScheduledOOF parameter specifies whether it's possible to decline existing calendar events in the mailbox during the scheduled time period when Automatic Replies are being sent. ","title":"DeclineEventsForScheduledOOF"},"DeclineMeetingMessage":{"type":"string","description":"The DeclineMeetingMessage parameter specifies the text in the message when meetings requests that are sent to the mailbox are automatically declined.","title":"DeclineMeetingMessage"},"EndTime":{"type":"string","description":"The EndTime parameter specifies the end date and time that Automatic Replies are sent for the mailbox. You use this parameter only when the AutoReplyState parameter is set to Scheduled, and the value of this parameter is meaningful only when AutoReplyState is Scheduled.","title":"EndTime"},"EventsToDeleteIDs":{"type":"array","items":{"type":"string"},"description":"The EventsToDeleteIDs parameter specifies the calendar events to delete from the mailbox when the DeclineEventsForScheduledOOF parameter is set to $true.","title":"EventsToDeleteIDs"},"ExternalAudience":{"enum":["None","Known","All"],"description":"The ExternalAudience parameter specifies whether Automatic Replies are sent to external senders. Valid values are: None, Known, All","title":"ExternalAudience"},"ExternalMessage":{"type":"string","description":"The ExternalMessage parameter specifies the Automatic Replies message that's sent to external senders or senders outside the organization. If the value contains spaces, enclose the value in quotation marks.","title":"ExternalMessage"},"InternalMessage":{"type":"string","description":"The InternalMessage parameter specifies the Automatic Replies message that's sent to internal senders or senders within the organization. If the value contains spaces, enclose the value in quotation marks.","title":"InternalMessage"},"OOFEventSubject":{"type":"string","description":"The OOFEventSubject parameter specifies the subject for the calendar event that's automatically created when the CreateOOFEvent parameter is set to $true.","title":"OOFEventSubject"},"StartTime":{"type":"string","description":"The StartTime parameter specifies the start date and time that Automatic Replies are sent for the specified mailbox. You use this parameter only when the AutoReplyState parameter is set to Scheduled, and the value of this parameter is meaningful only when AutoReplyState is Scheduled.","title":"StartTime"},"Ensure":{"enum":["Present"],"description":"Represents the existence of the instance. This must be set to 'Present'","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.mailboxcalendarfolder":{"type":"object","description":"This resource configures calendar publishing or sharing settings on a mailbox\r\nfor the visibility of calendar information to external users.","title":"Schema for microsoft.exchange.mailboxcalendarfolder","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the calendar folder that you want to modify.","title":"Identity"},"DetailLevel":{"enum":["AvailabilityOnly","LimitedDetails","FullDetails"],"description":"The DetailLevel parameter specifies the level of calendar detail that's published and available to anonymous users.","title":"DetailLevel"},"PublishDateRangeFrom":{"enum":["OneDay","ThreeDays","OneWeek","OneMonth","ThreeMonths","SixMonths","OneYear"],"description":"The PublishDateRangeFrom parameter specifies the start date of calendar information to publish (past information).","title":"PublishDateRangeFrom"},"PublishDateRangeTo":{"enum":["OneDay","ThreeDays","OneWeek","OneMonth","ThreeMonths","SixMonths","OneYear"],"description":"The PublishDateRangeTo parameter specifies the end date of calendar information to publish (future information).","title":"PublishDateRangeTo"},"PublishEnabled":{"type":"boolean","description":"The PublishEnabled parameter specifies whether to publish the specified calendar information.","title":"PublishEnabled"},"SearchableUrlEnabled":{"type":"boolean","description":"The SearchableUrlEnabled parameter specifies whether the published calendar URL is discoverable on the web.","title":"SearchableUrlEnabled"},"SharedCalendarSyncStartDate":{"type":"string","description":"The SharedCalendarSyncStartDate parameter specifies the limit for past events in the shared calendar that are visible to delegates. A copy of the shared calendar within the specified date range is stored in the delegate's mailbox.","title":"SharedCalendarSyncStartDate"},"Ensure":{"enum":["Present"],"description":"Determines whether or not the instance exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.mailboxpermission":{"type":"object","description":"Use this resource to modify the permissions of mailbox.","title":"Schema for microsoft.exchange.mailboxpermission","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the mailbox where you want to assign permissions to the user. You can use any value that uniquely identifies the mailbox.","title":"Identity"},"AccessRights":{"type":"array","items":{"type":"string"},"description":"The AccessRights parameter specifies the permission that you want to add for the user on the mailbox. Valid values are: ChangeOwner, ChangePermission, DeleteItem, ExternalAccount, FullAccess and ReadPermission.","title":"AccessRights"},"User":{"type":"string","description":"The User parameter specifies who gets the permissions on the mailbox.","title":"User"},"InheritanceType":{"enum":["None","All","Children","Descendents","SelfAndChildren"],"description":"The InheritanceType parameter specifies how permissions are inherited by folders in the mailbox. Valid values are: None, All, Children, Descendents, SelfAndChildren.","title":"InheritanceType"},"Owner":{"type":"string","description":"The Owner parameter specifies the owner of the mailbox object.","title":"Owner"},"Deny":{"type":"boolean","description":"The Deny switch specifies that the permissions you're adding are Deny permissions.","title":"Deny"},"Ensure":{"enum":["Present"],"description":"Determines whether or not the permission should exist on the mailbox.","title":"Ensure"}},"required":["Identity","AccessRights","User","InheritanceType"]},"microsoft.exchange.mailboxplan":{"type":"object","description":"Use this resource to modify the settings of mailbox plans in the cloud-based service.","title":"Schema for microsoft.exchange.mailboxplan","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the Mailbox Plan that you want to modify.","title":"Identity"},"DisplayName":{"type":"string","description":"The display name of the mailbox plan.","title":"DisplayName"},"Ensure":{"enum":["Present"],"description":"MailboxPlans cannot be created/removed in O365.  This must be set to 'Present'","title":"Ensure"},"IssueWarningQuota":{"type":"string","description":"The IssueWarningQuota parameter specifies the warning threshold for the size of the mailboxes that are created or enabled using the mailbox plan.","title":"IssueWarningQuota"},"MaxReceiveSize":{"type":"string","description":"The MaxReceiveSize parameter specifies the maximum size of a message that can be sent to the mailbox.","title":"MaxReceiveSize"},"MaxSendSize":{"type":"string","description":"The MaxSendSize parameter specifies the maximum size of a message that can be sent by the mailbox.","title":"MaxSendSize"},"ProhibitSendQuota":{"type":"string","description":"The ProhibitSendQuota parameter specifies a size limit for the mailbox.","title":"ProhibitSendQuota"},"ProhibitSendReceiveQuota":{"type":"string","description":"The ProhibitSendReceiveQuota parameter specifies a size limit for the mailbox.","title":"ProhibitSendReceiveQuota"},"RetainDeletedItemsFor":{"type":"string","description":"The RetainDeletedItemsFor parameter specifies the length of time to keep soft-deleted items for the mailbox.","title":"RetainDeletedItemsFor"},"RetentionPolicy":{"type":"string","description":"The RetentionPolicy parameter specifies the retention policy that's applied to the mailbox.","title":"RetentionPolicy"},"RoleAssignmentPolicy":{"type":"string","description":"The RoleAssignmentPolicy parameter specifies the role assignment policy that's applied to the mailbox.","title":"RoleAssignmentPolicy"}},"required":["Identity"]},"microsoft.exchange.mailboxsettings":{"type":"object","description":"This resource configures settings on Mailboxes\r\nsuch as the Regional settings and its timezone.","title":"Schema for microsoft.exchange.mailboxsettings","properties":{"DisplayName":{"type":"string","description":"The display name of the Shared Mailbox","title":"DisplayName"},"TimeZone":{"type":"string","description":"The name of the Time Zone to assign to the mailbox","title":"TimeZone"},"Locale":{"type":"string","description":"The code of the Locale to assign to the mailbox","title":"Locale"},"Ensure":{"enum":["Present"],"description":"Present ensures the Mailbox Settings are applied","title":"Ensure"}},"required":["DisplayName"]},"microsoft.exchange.mailcontact":{"type":"object","description":"This resource configures Exchange Online address lists.","title":"Schema for microsoft.exchange.mailcontact","properties":{"Name":{"type":"string","description":"The Name parameter specifies a unique name for the mail contact.","title":"Name"},"ExternalEmailAddress":{"type":"string","description":"The ExternalEmailAddress parameter specifies the target email address of the mail contact or mail user. By default, this value is used as the primary email address of the mail contact or mail user.","title":"ExternalEmailAddress"},"Alias":{"type":"string","description":"The Alias parameter specifies the Exchange alias (also known as the mail nickname) for the recipient. This value identifies the recipient as a mail-enabled object, and shouldn't be confused with multiple email addresses for the same recipient (also known as proxy addresses). A recipient can have only one Alias value. The maximum length is 64 characters.","title":"Alias"},"DisplayName":{"type":"string","description":"The DisplayName parameter specifies the display name of the mail contact. The display name is visible in the Exchange admin center and in address lists. ","title":"DisplayName"},"FirstName":{"type":"string","description":"The FirstName parameter specifies the user's first name.","title":"FirstName"},"Initials":{"type":"string","description":"The Initials parameter specifies the user's middle initials.","title":"Initials"},"LastName":{"type":"string","description":"The LastName parameter specifies the user's last name.","title":"LastName"},"MacAttachmentFormat":{"enum":["BinHex","UuEncode","AppleSingle","AppleDouble"],"description":"The MacAttachmentFormat parameter specifies the Apple Macintosh operating system attachment format to use for messages sent to the mail contact or mail user. Valid values are: BinHex, UuEncode, AppleSingle, AppleDouble","title":"MacAttachmentFormat"},"MessageBodyFormat":{"enum":["Text","Html","TextAndHtml"],"description":"The MessageBodyFormat parameter specifies the message body format for messages sent to the mail contact or mail user. Valid values are: Text, Html, TextAndHtml","title":"MessageBodyFormat"},"MessageFormat":{"enum":["Mime","Text"],"description":"The MessageFormat parameter specifies the message format for messages sent to the mail contact or mail user. Valid values are: Mime, Text","title":"MessageFormat"},"ModeratedBy":{"type":"array","items":{"type":"string"},"description":"The ModeratedBy parameter specifies one or more moderators for this mail contact. A moderator approves messages sent to the mail contact before the messages are delivered. A moderator must be a mailbox, mail user, or mail contact in your organization.","title":"ModeratedBy"},"ModerationEnabled":{"type":"boolean","description":"The ModerationEnabled parameter specifies whether moderation is enabled for this recipient.","title":"ModerationEnabled"},"OrganizationalUnit":{"type":"string","description":"The OrganizationalUnit parameter specifies the location in Active Directory where the new contact is created.","title":"OrganizationalUnit"},"SendModerationNotifications":{"enum":["Always","Internal","Never"],"description":"The SendModerationNotifications parameter specifies when moderation notification messages are sent. Valid values are: ALways, Internal, Never","title":"SendModerationNotifications"},"UsePreferMessageFormat":{"type":"boolean","description":"The UsePreferMessageFormat specifies whether the message format settings configured for the mail user or mail contact override the global settings configured for the remote domain or configured by the message sender","title":"UsePreferMessageFormat"},"CustomAttribute1":{"type":"string","description":"The CustomAttribute1 parameter specifies the value of the CustomAttribute1","title":"CustomAttribute1"},"CustomAttribute2":{"type":"string","description":"The CustomAttribute2 parameter specifies the value of the CustomAttribute2","title":"CustomAttribute2"},"CustomAttribute3":{"type":"string","description":"The CustomAttribute3 parameter specifies the value of the CustomAttribute3","title":"CustomAttribute3"},"CustomAttribute4":{"type":"string","description":"The CustomAttribute4 parameter specifies the value of the CustomAttribute4","title":"CustomAttribute4"},"CustomAttribute5":{"type":"string","description":"The CustomAttribute5 parameter specifies the value of the CustomAttribute5","title":"CustomAttribute5"},"CustomAttribute6":{"type":"string","description":"The CustomAttribute6 parameter specifies the value of the CustomAttribute6","title":"CustomAttribute6"},"CustomAttribute7":{"type":"string","description":"The CustomAttribute7 parameter specifies the value of the CustomAttribute7","title":"CustomAttribute7"},"CustomAttribute8":{"type":"string","description":"The CustomAttribute8 parameter specifies the value of the CustomAttribute8","title":"CustomAttribute8"},"CustomAttribute9":{"type":"string","description":"The CustomAttribute9 parameter specifies the value of the CustomAttribute9","title":"CustomAttribute9"},"CustomAttribute10":{"type":"string","description":"The CustomAttribute10 parameter specifies the value of the CustomAttribute10","title":"CustomAttribute10"},"CustomAttribute11":{"type":"string","description":"The CustomAttribute11 parameter specifies the value of the CustomAttribute11","title":"CustomAttribute11"},"CustomAttribute12":{"type":"string","description":"The CustomAttribute12 parameter specifies the value of the CustomAttribute12","title":"CustomAttribute12"},"CustomAttribute13":{"type":"string","description":"The CustomAttribute13 parameter specifies the value of the CustomAttribute13","title":"CustomAttribute13"},"CustomAttribute14":{"type":"string","description":"The CustomAttribute14 parameter specifies the value of the CustomAttribute14","title":"CustomAttribute14"},"CustomAttribute15":{"type":"string","description":"The CustomAttribute15 parameter specifies the value of the CustomAttribute15","title":"CustomAttribute15"},"ExtensionCustomAttribute1":{"type":"array","items":{"type":"string"},"description":"The ExtensionCustomAttribute1 parameter specifies the value of the ExtensionCustomAttribute1","title":"ExtensionCustomAttribute1"},"ExtensionCustomAttribute2":{"type":"array","items":{"type":"string"},"description":"The ExtensionCustomAttribute2 parameter specifies the value of the ExtensionCustomAttribute2","title":"ExtensionCustomAttribute2"},"ExtensionCustomAttribute3":{"type":"array","items":{"type":"string"},"description":"The ExtensionCustomAttribute3 parameter specifies the value of the ExtensionCustomAttribute3","title":"ExtensionCustomAttribute3"},"ExtensionCustomAttribute4":{"type":"array","items":{"type":"string"},"description":"The ExtensionCustomAttribute4 parameter specifies the value of the ExtensionCustomAttribute4","title":"ExtensionCustomAttribute4"},"ExtensionCustomAttribute5":{"type":"array","items":{"type":"string"},"description":"The ExtensionCustomAttribute5 parameter specifies the value of the ExtensionCustomAttribute5","title":"ExtensionCustomAttribute5"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Contact should exist.","title":"Ensure"}},"required":["Name","ExternalEmailAddress"]},"microsoft.exchange.mailtips":{"type":"object","description":"This resource allows to configure Mailtips behaviors in Exchange Online.","title":"Schema for microsoft.exchange.mailtips","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"MailTipsAllTipsEnabled":{"type":"boolean","description":"Specifies whether MailTips are enabled.","title":"MailTipsAllTipsEnabled"},"MailTipsGroupMetricsEnabled":{"type":"boolean","description":"Specifies whether MailTips that rely on group metrics data are enabled.","title":"MailTipsGroupMetricsEnabled"},"MailTipsLargeAudienceThreshold":{"type":"integer","description":"Specifies what a large audience is.","title":"MailTipsLargeAudienceThreshold"},"MailTipsMailboxSourcedTipsEnabled":{"type":"boolean","description":"Specifies whether MailTips that rely on mailbox data (out-of-office or full mailbox) are enabled.","title":"MailTipsMailboxSourcedTipsEnabled"},"MailTipsExternalRecipientsTipsEnabled":{"type":"boolean","description":"Specifies whether MailTips for external recipients are enabled.","title":"MailTipsExternalRecipientsTipsEnabled"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this MailTip should exist.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.exchange.malwarefilterpolicy":{"type":"object","description":"Create or modify a EXOMalwareFilterPolicy in your cloud-based organization.","title":"Schema for microsoft.exchange.malwarefilterpolicy","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the MalwareFilterPolicy you want to modify.","title":"Identity"},"AdminDisplayName":{"type":"string","description":"The AdminDisplayName parameter specifies a description for the policy. If the value contains spaces, enclose the value in quotation marks.","title":"AdminDisplayName"},"CustomExternalBody":{"type":"string","description":"The CustomExternalBody parameter specifies the body of the custom notification message for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation marks.","title":"CustomExternalBody"},"CustomExternalSubject":{"type":"string","description":"The CustomExternalSubject parameter specifies the subject of the custom notification message for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation marks.","title":"CustomExternalSubject"},"CustomFromAddress":{"type":"string","description":"The CustomFromAddress parameter specifies the From address of the custom notification message for malware detections in messages from internal or external senders.","title":"CustomFromAddress"},"CustomFromName":{"type":"string","description":"The CustomFromName parameter specifies the From name of the custom notification message for malware detections in messages from internal or external senders. If the value contains spaces, enclose the value in quotation marks.","title":"CustomFromName"},"CustomInternalBody":{"type":"string","description":"The CustomInternalBody parameter specifies the body of the custom notification message for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation marks.","title":"CustomInternalBody"},"CustomInternalSubject":{"type":"string","description":"The CustomInternalSubject parameter specifies the subject of the custom notification message for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation marks.","title":"CustomInternalSubject"},"CustomNotifications":{"type":"boolean","description":"The CustomNotifications parameter enables or disables custom notification messages for malware detections in messages from internal or external senders. Valid values are: $true, $false.","title":"CustomNotifications"},"EnableExternalSenderAdminNotifications":{"type":"boolean","description":"The EnableExternalSenderAdminNotifications parameter enables or disables sending malware detection notification messages to an administrator for messages from external senders. Valid values are: $true, $false.","title":"EnableExternalSenderAdminNotifications"},"EnableFileFilter":{"type":"boolean","description":"The EnableFileFilter parameter enables or disables common attachment blocking - also known as the Common Attachment Types Filter.Valid values are: $true, $false.","title":"EnableFileFilter"},"EnableInternalSenderAdminNotifications":{"type":"boolean","description":"The EnableInternalSenderAdminNotifications parameter enables or disables sending malware detection notification messages to an administrator for messages from internal senders. Valid values are: $true, $false.","title":"EnableInternalSenderAdminNotifications"},"ExternalSenderAdminAddress":{"type":"string","description":"The ExternalSenderAdminAddress parameter specifies the email address of the administrator who will receive notification messages for malware detections in messages from external senders.","title":"ExternalSenderAdminAddress"},"FileTypeAction":{"enum":["Quarantine","Reject"],"description":"The FileTypeAction parameter specifies what's done to messages that contain one or more attachments where the file extension is included in the FileTypes parameter (common attachment blocking). Valid values are Quarantine and Reject. The default value is Reject.","title":"FileTypeAction"},"FileTypes":{"type":"array","items":{"type":"string"},"description":"The FileTypes parameter specifies the file types that are automatically blocked by common attachment blocking (also known as the Common Attachment Types Filter), regardless of content.","title":"FileTypes"},"InternalSenderAdminAddress":{"type":"string","description":"The InternalSenderAdminAddress parameter specifies the email address of the administrator who will receive notification messages for malware detections in messages from internal senders.","title":"InternalSenderAdminAddress"},"MakeDefault":{"type":"boolean","description":"MakeDefault makes this malware filter policy the default policy. Valid values are: $true, $false.","title":"MakeDefault"},"QuarantineTag":{"type":"string","description":"The QuarantineTag specifies the quarantine policy that's used on messages that are quarantined as malware.","title":"QuarantineTag"},"ZapEnabled":{"type":"boolean","description":"The ZapEnabled parameter enables or disables zero-hour auto purge (ZAP) for malware. ZAP detects malware in unread messages that have already been delivered to the user's Inbox. Valid values are: $true, $false.","title":"ZapEnabled"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this MalwareFilterPolicy should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.malwarefilterrule":{"type":"object","description":"Create or modify a new EXOMalwareFilterRule in your cloud-based organization.","title":"Schema for microsoft.exchange.malwarefilterrule","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the EXO resource you want to modify.","title":"Identity"},"Comments":{"type":"string","description":"The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.","title":"Comments"},"Enabled":{"type":"boolean","description":"The Enabled parameter enables or disables the malware filter rule. Valid input for this parameter is $true or $false. The default value is $true.","title":"Enabled"},"ExceptIfRecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"ExceptIfRecipientDomainIs"},"ExceptIfSentTo":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"ExceptIfSentTo"},"ExceptIfSentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.","title":"ExceptIfSentToMemberOf"},"MalwareFilterPolicy":{"type":"string","description":"The MalwareFilterPolicy parameter specifies the malware filter policy to apply to messages that match the conditions defined by this malware filter rule.","title":"MalwareFilterPolicy"},"Priority":{"type":"string","description":"The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.","title":"Priority"},"RecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"RecipientDomainIs"},"SentTo":{"type":"array","items":{"type":"string"},"description":"The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"SentTo"},"SentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The SentToMemberOf parameter specifies a condition that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You can use any value that uniquely identifies the group.","title":"SentToMemberOf"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if the Malware Filter Rule should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.managementrole":{"type":"object","description":"This resource configures RBAC Management Roles in Exchange Online.","title":"Schema for microsoft.exchange.managementrole","properties":{"Name":{"type":"string","description":"The Name parameter specifies the name of the role. The maximum length of the name is 64 characters.","title":"Name"},"Parent":{"type":"string","description":"The Parent parameter specifies the identity of the role to copy. Mandatory for management role creation/update or when Ensure=Present. Non-mandatory for Ensure=Absent","title":"Parent"},"Description":{"type":"string","description":"The Description parameter specifies the description that's displayed when the management role is viewed using the Get-ManagementRole cmdlet.","title":"Description"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Management Role should exist or not.","title":"Ensure"}},"required":["Name","Parent"]},"microsoft.exchange.managementroleassignment":{"type":"object","description":"This resource configures RBAC Management Roles Assignments in Exchange Online.","title":"Schema for microsoft.exchange.managementroleassignment","properties":{"Name":{"type":"string","description":"The Name parameter specifies a name for the new management role assignment. The maximum length of the name is 64 characters.","title":"Name"},"Role":{"type":"string","description":"The Role parameter specifies the existing role to assign. You can use any value that uniquely identifies the role.","title":"Role"},"App":{"type":"string","description":"The App parameter specifies the service principal to assign the management role to. Specifically, the ServiceId GUID value from the output of the Get-ServicePrincipal cmdlet (for example, 6233fba6-0198-4277-892f-9275bf728bcc).","title":"App"},"Policy":{"type":"string","description":"The Policy parameter specifies the name of the management role assignment policy to assign the management role to.","title":"Policy"},"SecurityGroup":{"type":"string","description":"The SecurityGroup parameter specifies the name of the management role group or mail-enabled universal security group to assign the management role to.","title":"SecurityGroup"},"User":{"type":"string","description":"The User parameter specifies the name or alias of the user to assign the management role to.","title":"User"},"CustomRecipientWriteScope":{"type":"string","description":"The CustomRecipientWriteScope parameter specifies the existing recipient-based management scope to associate with this management role assignment.","title":"CustomRecipientWriteScope"},"CustomResourceScope":{"type":"string","description":"The CustomResourceScope parameter specifies the custom management scope to associate with this management role assignment. You can use any value that uniquely identifies the management scope.","title":"CustomResourceScope"},"ExclusiveRecipientWriteScope":{"type":"string","description":"The ExclusiveConfigWriteScope parameter specifies the exclusive configuration-based management scope to associate with the new role assignment.","title":"ExclusiveRecipientWriteScope"},"RecipientAdministrativeUnitScope":{"type":"string","description":"The RecipientAdministrativeUnitScope parameter specifies the administrative unit to scope the new role assignment to.","title":"RecipientAdministrativeUnitScope"},"RecipientOrganizationalUnitScope":{"type":"string","description":"The RecipientOrganizationalUnitScope parameter specifies the OU to scope the new role assignment to. If you use the RecipientOrganizationalUnitScope parameter, you can't use the CustomRecipientWriteScope or ExclusiveRecipientWriteScope parameters.","title":"RecipientOrganizationalUnitScope"},"RecipientRelativeWriteScope":{"type":"string","description":"The RecipientRelativeWriteScope parameter specifies the type of restriction to apply to a recipient scope. The available types are None, Organization, MyGAL, Self, and MyDistributionGroups. The RecipientRelativeWriteScope parameter is automatically set when the CustomRecipientWriteScope or RecipientOrganizationalUnitScope parameters are used.","title":"RecipientRelativeWriteScope"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Management Role Assignment should exist or not.","title":"Ensure"}},"required":["Name","Role"]},"microsoft.exchange.managementroleentry":{"type":"object","description":"This resource configures RBAC Management Roles Entries in Exchange Online.","title":"Schema for microsoft.exchange.managementroleentry","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the role entry that you want to modify.","title":"Identity"},"Parameters":{"type":"array","items":{"type":"string"},"description":"The Parameters parameter specifies the parameters to be added to or removed from the role entry.","title":"Parameters"},"Type":{"enum":["Cmdlet","Script","ApplicationPermission","WebService"],"description":"The Type parameter specifies the type of role entry to return.","title":"Type"}},"required":["Identity"]},"microsoft.exchange.messageclassification":{"type":"object","description":"Create a new Message Classification policy in your cloud-based organization.","title":"Schema for microsoft.exchange.messageclassification","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the OME Configuration policy that you want to modify.","title":"Identity"},"ClassificationID":{"type":"string","description":"The ClassificationID parameter specifies the classification ID (GUID) of an existing message classification that you want to import and use in your Exchange organization.","title":"ClassificationID"},"DisplayName":{"type":"string","description":"The DisplayName parameter specifies the title of the message classification that's displayed in Outlook and selected by users.","title":"DisplayName"},"DisplayPrecedence":{"enum":["Highest","Higher","High","MediumHigh","Medium","MediumLow","Low","Lower","Lowest"],"description":"The DisplayPrecedence parameter specifies the relative precedence of the message classification to other message classifications that may be applied to a specified message.","title":"DisplayPrecedence"},"Name":{"type":"string","description":"The Name parameter specifies the unique name for the message classification.","title":"Name"},"PermissionMenuVisible":{"type":"boolean","description":"The PermissionMenuVisible parameter specifies whether the values that you entered for the DisplayName and RecipientDescription parameters are displayed in Outlook as the user composes a message. ","title":"PermissionMenuVisible"},"RecipientDescription":{"type":"string","description":"The RecipientDescription parameter specifies the detailed text that's shown to Outlook recipient when they receive a message that has the message classification applied.","title":"RecipientDescription"},"RetainClassificationEnabled":{"type":"boolean","description":"The RetainClassificationEnabled parameter specifies whether the message classification should persist with the message if the message is forwarded or replied to.","title":"RetainClassificationEnabled"},"SenderDescription":{"type":"string","description":"The SenderDescription parameter specifies the detailed text that's shown to Outlook senders when they select a message classification to apply to a message before they send the message. ","title":"SenderDescription"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Outbound connector should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.mobiledevicemailboxpolicy":{"type":"object","description":"This resource configures Mobile Device Mailbox Policies in Exchange Online.","title":"Schema for microsoft.exchange.mobiledevicemailboxpolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the friendly name of the mobile device mailbox policy.","title":"Name"},"AllowApplePushNotifications":{"type":"boolean","description":"The AllowApplePushNotifications parameter specifies whether push notifications are allowed to Apple mobile devices.","title":"AllowApplePushNotifications"},"AllowBluetooth":{"enum":["Disable","HandsfreeOnly","Allow"],"description":"The AllowBluetooth parameter specifies whether the Bluetooth capabilities are allowed on the mobile phone. The available options are Disable, HandsfreeOnly, and Allow. The default value is Allow.","title":"AllowBluetooth"},"AllowBrowser":{"type":"boolean","description":"The AllowBrowser parameter indicates whether Microsoft Pocket Internet Explorer is allowed on the mobile phone. This parameter doesn't affect third-party browsers.","title":"AllowBrowser"},"AllowCamera":{"type":"boolean","description":"The AllowCamera parameter specifies whether the mobile phone's camera is allowed.","title":"AllowCamera"},"AllowConsumerEmail":{"type":"boolean","description":"The AllowConsumerEmail parameter specifies whether the mobile phone user can configure a personal email account on the mobile phone.","title":"AllowConsumerEmail"},"AllowDesktopSync":{"type":"boolean","description":"The AllowDesktopSync parameter specifies whether the mobile phone can synchronize with a desktop computer through a cable.","title":"AllowDesktopSync"},"AllowExternalDeviceManagement":{"type":"boolean","description":"The AllowExternalDeviceManagement parameter specifies whether an external device management program is allowed to manage the mobile phone.","title":"AllowExternalDeviceManagement"},"AllowGooglePushNotifications":{"type":"boolean","description":"The AllowGooglePushNotifications parameter controls whether the user can receive push notifications from Google for Outlook on the web for devices.","title":"AllowGooglePushNotifications"},"AllowHTMLEmail":{"type":"boolean","description":"The AllowHTMLEmail parameter specifies whether HTML email is enabled on the mobile phone.","title":"AllowHTMLEmail"},"AllowInternetSharing":{"type":"boolean","description":"The AllowInternetSharing parameter specifies whether the mobile phone can be used as a modem to connect a computer to the Internet.","title":"AllowInternetSharing"},"AllowIrDA":{"type":"boolean","description":"The AllowIrDA parameter specifies whether infrared connections are allowed to the mobile phone.","title":"AllowIrDA"},"AllowMobileOTAUpdate":{"type":"boolean","description":"The AllowMobileOTAUpdate parameter specifies whether the Exchange ActiveSync mailbox policy can be sent to the mobile phone over a cellular data connection.","title":"AllowMobileOTAUpdate"},"AllowMicrosoftPushNotifications":{"type":"boolean","description":"The AllowMicrosoftPushNotifications parameter specifies whether push notifications are enabled on the mobile device.","title":"AllowMicrosoftPushNotifications"},"AllowNonProvisionableDevices":{"type":"boolean","description":"The AllowNonProvisionableDevices parameter specifies whether all mobile phones can synchronize with the server running Exchange.","title":"AllowNonProvisionableDevices"},"AllowPOPIMAPEmail":{"type":"boolean","description":"The AllowPOPIMAPEmail parameter specifies whether the user can configure a POP3 or IMAP4 email account on the mobile phone.","title":"AllowPOPIMAPEmail"},"AllowRemoteDesktop":{"type":"boolean","description":"The AllowRemoteDesktop parameter specifies whether the mobile phone can initiate a remote desktop connection.","title":"AllowRemoteDesktop"},"AllowSimplePassword":{"type":"boolean","description":"The AllowSimplePassword parameter specifies whether a simple device password is allowed. A simple device password is a password that has a specific pattern, such as 1111 or 1234.","title":"AllowSimplePassword"},"AllowSMIMEEncryptionAlgorithmNegotiation":{"enum":["AllowAnyAlgorithmNegotiation","BlockNegotiation","OnlyStrongAlgorithmNegotiation"],"description":"The AllowSMIMEEncryptionAlgorithmNegotiation parameter specifies whether the messaging application on the mobile device can negotiate the encryption algorithm if a recipient's certificate doesn't support the specified encryption algorithm.","title":"AllowSMIMEEncryptionAlgorithmNegotiation"},"AllowSMIMESoftCerts":{"type":"boolean","description":"The AllowSMIMESoftCerts parameter specifies whether S/MIME software certificates are allowed.","title":"AllowSMIMESoftCerts"},"AllowStorageCard":{"type":"boolean","description":"The AllowStorageCard parameter specifies whether the mobile phone can access information stored on a storage card.","title":"AllowStorageCard"},"AllowTextMessaging":{"type":"boolean","description":"The AllowTextMessaging parameter specifies whether text messaging is allowed from the mobile phone.","title":"AllowTextMessaging"},"AllowUnsignedApplications":{"type":"boolean","description":"The AllowUnsignedApplications parameter specifies whether unsigned applications can be installed on the mobile phone.","title":"AllowUnsignedApplications"},"AllowUnsignedInstallationPackages":{"type":"boolean","description":"The AllowUnsignedInstallationPackages parameter specifies whether unsigned installation packages can be executed on the mobile phone.","title":"AllowUnsignedInstallationPackages"},"AllowWiFi":{"type":"boolean","description":"The AllowWiFi parameter specifies whether wireless Internet access is allowed on the mobile phone. ","title":"AllowWiFi"},"AlphanumericPasswordRequired":{"type":"boolean","description":"The AlphanumericPasswordRequired parameter specifies whether the password for the mobile phone must be alphanumeric.","title":"AlphanumericPasswordRequired"},"ApprovedApplicationList":{"type":"array","items":{"type":"string"},"description":"The ApprovedApplicationList parameter specifies a list of approved applications for the mobile phone.","title":"ApprovedApplicationList"},"AttachmentsEnabled":{"type":"boolean","description":"The AttachmentsEnabled parameter specifies whether attachments can be downloaded.","title":"AttachmentsEnabled"},"DeviceEncryptionEnabled":{"type":"boolean","description":"The DeviceEncryptionEnabled parameter specifies whether encryption is enabled.","title":"DeviceEncryptionEnabled"},"DevicePolicyRefreshInterval":{"type":"string","description":"The DevicePolicyRefreshInterval parameter specifies how often the policy is sent from the server to the mobile phone.","title":"DevicePolicyRefreshInterval"},"IrmEnabled":{"type":"boolean","description":"The IrmEnabled parameter specifies whether Information Rights Management (IRM) is enabled for the mailbox policy.","title":"IrmEnabled"},"IsDefault":{"type":"boolean","description":"The IsDefault parameter specifies whether this policy is the default Mobile Device mailbox policy.","title":"IsDefault"},"MaxAttachmentSize":{"type":"string","description":"The MaxAttachmentSize parameter specifies the maximum size of attachments that can be downloaded to the mobile phone.","title":"MaxAttachmentSize"},"MaxCalendarAgeFilter":{"enum":["All","TwoWeeks","OneMonth","ThreeMonths","SixMonths"],"description":"The MaxCalendarAgeFilter parameter specifies the maximum range of calendar days that can be synchronized to the device.","title":"MaxCalendarAgeFilter"},"MaxEmailAgeFilter":{"enum":["All","OneDay","ThreeDays","OneWeek","TwoWeeks","OneMonth"],"description":"The MaxEmailAgeFilter parameter specifies the maximum number of days of email items to synchronize to the mobile phone.","title":"MaxEmailAgeFilter"},"MaxEmailBodyTruncationSize":{"type":"string","description":"The MaxEmailBodyTruncationSize parameter specifies the maximum size at which email messages are truncated when synchronized to the mobile phone. The value is specified in kilobytes (KB).","title":"MaxEmailBodyTruncationSize"},"MaxEmailHTMLBodyTruncationSize":{"type":"string","description":"The MaxEmailHTMLBodyTruncationSize parameter specifies the maximum size at which HTML-formatted email messages are synchronized to the mobile phone. The value is specified in KB.","title":"MaxEmailHTMLBodyTruncationSize"},"MaxInactivityTimeLock":{"type":"string","description":"The MaxInactivityTimeDeviceLock parameter specifies the length of time that the mobile phone can be inactive before the password is required to reactivate it.","title":"MaxInactivityTimeLock"},"MaxPasswordFailedAttempts":{"type":"string","description":"The MaxPasswordFailedAttempts parameter specifies the number of attempts a user can make to enter the correct password for the mobile phone. You can enter any number from 4 through 16 or the value Unlimited.","title":"MaxPasswordFailedAttempts"},"MinPasswordComplexCharacters":{"type":"string","description":"The MinPasswordComplexCharacters parameter specifies the character sets that are required in the password of the mobile device.","title":"MinPasswordComplexCharacters"},"MinPasswordLength":{"type":"string","description":"The MinPasswordLength parameter specifies the minimum number of characters in the mobile device password.","title":"MinPasswordLength"},"PasswordEnabled":{"type":"boolean","description":"The PasswordEnabled parameter specifies whether a password is required on the mobile device.","title":"PasswordEnabled"},"PasswordExpiration":{"type":"string","description":"The PasswordExpiration parameter specifies how long a password can be used on a mobile device before the user is forced to change the password.","title":"PasswordExpiration"},"PasswordHistory":{"type":"string","description":"The PasswordHistory parameter specifies the number of unique new passwords that need to be created on the mobile device before an old password can be reused.","title":"PasswordHistory"},"PasswordRecoveryEnabled":{"type":"boolean","description":"The PasswordRecoveryEnabled parameter specifies whether the recovery password for the mobile device is stored in Exchange.","title":"PasswordRecoveryEnabled"},"RequireDeviceEncryption":{"type":"boolean","description":"The RequireDeviceEncryption parameter specifies whether encryption is required on the mobile device.","title":"RequireDeviceEncryption"},"RequireEncryptedSMIMEMessages":{"type":"boolean","description":"The RequireEncryptedSMIMEMessages parameter specifies whether the mobile device must send encrypted S/MIME messages.","title":"RequireEncryptedSMIMEMessages"},"RequireEncryptionSMIMEAlgorithm":{"enum":["DES","TripleDES","RC240bit","RC264bit","RC2128bit"],"description":"The RequireEncryptionSMIMEAlgorithm parameter specifies the algorithm that's required to encrypt S/MIME messages on a mobile device.","title":"RequireEncryptionSMIMEAlgorithm"},"RequireManualSyncWhenRoaming":{"type":"boolean","description":"The RequireSignedSMIMEAlgorithm parameter specifies the algorithm that's used to sign S/MIME messages on the mobile device.","title":"RequireManualSyncWhenRoaming"},"RequireSignedSMIMEAlgorithm":{"enum":["SHA1","MD5"],"description":"The RequireSignedSMIMEAlgorithm parameter specifies the algorithm that's used to sign S/MIME messages on the mobile device.","title":"RequireSignedSMIMEAlgorithm"},"RequireSignedSMIMEMessages":{"type":"boolean","description":"The RequireSignedSMIMEMessages parameter specifies whether the mobile device must send signed S/MIME messages.","title":"RequireSignedSMIMEMessages"},"RequireStorageCardEncryption":{"type":"boolean","description":"The RequireStorageCardEncryption parameter specifies whether storage card encryption is required on the mobile device.","title":"RequireStorageCardEncryption"},"UnapprovedInROMApplicationList":{"type":"array","items":{"type":"string"},"description":"The UnapprovedInROMApplicationList parameter specifies a list of applications that can't be run in ROM on the mobile device.","title":"UnapprovedInROMApplicationList"},"UNCAccessEnabled":{"type":"boolean","description":"The UNCAccessEnabled parameter specifies whether access to Microsoft Windows file shares is enabled from the mobile device.","title":"UNCAccessEnabled"},"WSSAccessEnabled":{"type":"boolean","description":"The WSSAccessEnabled parameter specifies whether access to Microsoft Windows SharePoint Services is enabled from the mobile device.","title":"WSSAccessEnabled"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Mobile Device Mailbox Policy should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.offlineaddressbook":{"type":"object","description":"This resource configures Offline Address Books in Exchange Online.","title":"Schema for microsoft.exchange.offlineaddressbook","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the Offline Address Book. The maximum length is 64 characters.","title":"Name"},"AddressLists":{"type":"array","items":{"type":"string"},"description":"The AddressLists parameter specifies the address lists or global address lists that are included in the OAB. You can use any value that uniquely identifies the address list.","title":"AddressLists"},"ConfiguredAttributes":{"type":"array","items":{"type":"string"},"description":"The ConfiguredAttributes parameter specifies the recipient MAPI properties that are available in the OAB.","title":"ConfiguredAttributes"},"DiffRetentionPeriod":{"type":"string","description":"The DiffRetentionPeriod parameter specifies the number of days that the OAB difference files are stored on the server.","title":"DiffRetentionPeriod"},"IsDefault":{"type":"boolean","description":"The IsDefault parameter specifies whether the OAB is used by all mailboxes and mailbox databases that don't have an OAB specified.","title":"IsDefault"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Offline Address Book should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.omeconfiguration":{"type":"object","description":"Create a new OME Configuration policy in your cloud-based organization.","title":"Schema for microsoft.exchange.omeconfiguration","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the OME Configuration policy that you want to modify.","title":"Identity"},"BackgroundColor":{"type":"string","description":"The BackgroundColor parameter specifies the background color","title":"BackgroundColor"},"DisclaimerText":{"type":"string","description":"The DisclaimerText parameter specifies the disclaimer text in the email that contains the encrypted message","title":"DisclaimerText"},"EmailText":{"type":"string","description":"The EmailText parameter specifies the default text that accompanies encrypted email messages.","title":"EmailText"},"ExternalMailExpiryInDays":{"type":"integer","description":"The ExternalMailExpiryInDays parameter specifies the number of days that the encrypted message is available to external recipients in the Microsoft 365 portal. A valid value is an integer from 0 to 730.","title":"ExternalMailExpiryInDays"},"IntroductionText":{"type":"string","description":"The IntroductionText parameter specifies the default text that accompanies encrypted email messages.","title":"IntroductionText"},"OTPEnabled":{"type":"boolean","description":"The OTPEnabled parameter specifies whether to allow recipients to use a one-time passcode to view encrypted messages.","title":"OTPEnabled"},"PortalText":{"type":"string","description":"The PortalText parameter specifies the text that appears at the top of the encrypted email viewing portal.","title":"PortalText"},"PrivacyStatementUrl":{"type":"string","description":"The PrivacyStatementUrl parameter specifies the Privacy Statement link in the encrypted email notification message.","title":"PrivacyStatementUrl"},"ReadButtonText":{"type":"string","description":"The ReadButtonText parameter specifies the text that appears on the 'Read the message' button. ","title":"ReadButtonText"},"SocialIdSignIn":{"type":"boolean","description":"The SocialIdSignIn parameter specifies whether a user is allowed to view an encrypted message in the Microsoft 365 admin center using their own social network id (Google, Yahoo, and Microsoft account).","title":"SocialIdSignIn"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Outbound connector should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.onpremisesorganization":{"type":"object","description":"This resource configures On-Premises Organization in Exchange Online.","title":"Schema for microsoft.exchange.onpremisesorganization","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the identity of the on-premises organization object.","title":"Identity"},"HybridDomains":{"type":"array","items":{"type":"string"},"description":"The HybridDomains parameter specifies the domains that are configured in the hybrid deployment between an Office 365 tenant and an on-premises Exchange organization. The domains specified in this parameter must match the domains listed in the HybridConfiguration Active Directory object for the on-premises Exchange organization configured by the Hybrid Configuration wizard. ","title":"HybridDomains"},"InboundConnector":{"type":"string","description":"The InboundConnector parameter specifies the name of the inbound connector configured on the Microsoft Exchange Online Protection (EOP) service for a hybrid deployment configured with an on-premises Exchange organization.","title":"InboundConnector"},"OutboundConnector":{"type":"string","description":"The OutboundConnector parameter specifies the name of the outbound connector configured on the EOP service for a hybrid deployment configured with an on-premises Exchange organization.","title":"OutboundConnector"},"OrganizationName":{"type":"string","description":"The OrganizationName parameter specifies the Active Directory object name of the on-premises Exchange organization.","title":"OrganizationName"},"OrganizationGuid":{"type":"string","description":"The OrganizationGuid parameter specifies the globally unique identifier (GUID) of the on-premises Exchange organization object in the Office 365 tenant.","title":"OrganizationGuid"},"OrganizationRelationship":{"type":"string","description":"The OrganizationRelationship parameter specifies the organization relationship configured by the Hybrid Configuration wizard on the Office 365 tenant as part of a hybrid deployment with an on-premises Exchange organization. This organization relationship defines the federated sharing features enabled on the Office 365 tenant.","title":"OrganizationRelationship"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the On-Premises Organization should exist or not.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.organizationconfig":{"type":"object","description":"This resource configures the Exchange Online organization-wide\r\nsettings.","title":"Schema for microsoft.exchange.organizationconfig","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"ActivityBasedAuthenticationTimeoutEnabled":{"type":"boolean","description":"The ActivityBasedAuthenticationTimeoutEnabled parameter specifies whether the timed logoff feature is enabled. The default value is $true","title":"ActivityBasedAuthenticationTimeoutEnabled"},"ActivityBasedAuthenticationTimeoutInterval":{"type":"string","description":"The ActivityBasedAuthenticationTimeoutInterval parameter specifies the time span for logoff. You enter this value as a time span: hh:mm:ss where hh = hours, mm = minutes and ss = seconds. Valid values for this parameter are from 00:05:00 to 08:00:00 (5 minutes to 8 hours). The default value is 06:00:00 (6 hours).","title":"ActivityBasedAuthenticationTimeoutInterval"},"ActivityBasedAuthenticationTimeoutWithSingleSignOnEnabled":{"type":"boolean","description":"The ActivityBasedAuthenticationTimeoutWithSingleSignOnEnabled parameter specifies whether to keep single sign-on enabled. The default value is $true.","title":"ActivityBasedAuthenticationTimeoutWithSingleSignOnEnabled"},"AppsForOfficeEnabled":{"type":"boolean","description":"The AppsForOfficeEnabled parameter specifies whether to enable apps for Outlook features. By default, the parameter is set to $true. If the flag is set to $false, no new apps can be activated for any user in the organization.","title":"AppsForOfficeEnabled"},"AsyncSendEnabled":{"type":"boolean","description":"The AsyncSendEnabled parameter specifies whether to enable or disable async send in Outlook on the web.","title":"AsyncSendEnabled"},"AuditDisabled":{"type":"boolean","description":"The AuditDisabled parameter specifies whether to disable or enable mailbox auditing for the organization.","title":"AuditDisabled"},"AutodiscoverPartialDirSync":{"type":"boolean","description":"Setting this parameter to $true will cause unknown users to be redirected to the on-premises endpoint and will allow on-premises users to discover their mailbox automatically.","title":"AutodiscoverPartialDirSync"},"AutoExpandingArchive":{"type":"boolean","description":"The AutoExpandingArchive switch enables the unlimited archiving feature (called auto-expanding archiving) in an Exchange Online organization. You don't need to specify a value with this switch.","title":"AutoExpandingArchive"},"BlockMoveMessagesForGroupFolders":{"type":"boolean","description":"No description available for BlockMoveMessagesForGroupFolders","title":"BlockMoveMessagesForGroupFolders"},"BookingsAddressEntryRestricted":{"type":"boolean","description":"The BookingsAddressEntryRestricted parameter specifies whether addresses can be collected from Bookings customers.","title":"BookingsAddressEntryRestricted"},"BookingsAuthEnabled":{"type":"boolean","description":"The BookingsAuthEnabled parameter specifies whether to enforce authentication to access all published Bookings pages.","title":"BookingsAuthEnabled"},"BookingsBlockedWordsEnabled":{"type":"boolean","description":"No description available for BookingsBlockedWordsEnabled","title":"BookingsBlockedWordsEnabled"},"BookingsCreationOfCustomQuestionsRestricted":{"type":"boolean","description":"The BookingsCreationOfCustomQuestionsRestricted parameter specifies whether Bookings admins can add custom questions.","title":"BookingsCreationOfCustomQuestionsRestricted"},"BookingsEnabled":{"type":"boolean","description":"The BookingsEnabled parameter specifies whether to enable Microsoft Bookings in an organization.","title":"BookingsEnabled"},"BookingsExposureOfStaffDetailsRestricted":{"type":"boolean","description":"The BookingsExposureOfStaffDetailsRestricted parameter specifies whether the attributes of internal Bookings staff members are visible to external Bookings customers.","title":"BookingsExposureOfStaffDetailsRestricted"},"BookingsMembershipApprovalRequired":{"type":"boolean","description":"The BookingsMembershipApprovalRequired parameter enables a membership approval requirement when new staff members are added to Bookings calendars.","title":"BookingsMembershipApprovalRequired"},"BookingsNamingPolicyEnabled":{"type":"boolean","description":"No description available for BookingsNamingPolicyEnabled","title":"BookingsNamingPolicyEnabled"},"BookingsNamingPolicyPrefix":{"type":"string","description":"No description available for BookingsNamingPolicyPrefix","title":"BookingsNamingPolicyPrefix"},"BookingsNamingPolicyPrefixEnabled":{"type":"boolean","description":"No description available for BookingsNamingPolicyPrefixEnabled","title":"BookingsNamingPolicyPrefixEnabled"},"BookingsNamingPolicySuffix":{"type":"string","description":"No description available for BookingsNamingPolicySuffix","title":"BookingsNamingPolicySuffix"},"BookingsNamingPolicySuffixEnabled":{"type":"boolean","description":"No description available for BookingsNamingPolicySuffixEnabled","title":"BookingsNamingPolicySuffixEnabled"},"BookingsNotesEntryRestricted":{"type":"boolean","description":"The BookingsNotesEntryRestricted parameter specifies whether appointment notes can be collected from Bookings customers.","title":"BookingsNotesEntryRestricted"},"BookingsPaymentsEnabled":{"type":"boolean","description":"The BookingsPaymentsEnabled parameter specifies whether to enable online payment node inside Bookings.","title":"BookingsPaymentsEnabled"},"BookingsPhoneNumberEntryRestricted":{"type":"boolean","description":"The BookingsPhoneNumberEntryRestricted parameter specifies whether phone numbers can be collected from Bookings customers.","title":"BookingsPhoneNumberEntryRestricted"},"BookingsSearchEngineIndexDisabled":{"type":"boolean","description":"No description available for BookingsSearchEngineIndexDisabled","title":"BookingsSearchEngineIndexDisabled"},"BookingsSmsMicrosoftEnabled":{"type":"boolean","description":"No description available for BookingsSmsMicrosoftEnabled","title":"BookingsSmsMicrosoftEnabled"},"BookingsSocialSharingRestricted":{"type":"boolean","description":"The BookingsSocialSharingRestricted parameter allows you to control whether, or not, your users can see social sharing options inside Bookings.","title":"BookingsSocialSharingRestricted"},"ByteEncoderTypeFor7BitCharsets":{"type":"integer","description":"The ByteEncoderTypeFor7BitCharsets parameter specifies the 7-bit transfer encoding method for MIME format for messages sent to this remote domain.","title":"ByteEncoderTypeFor7BitCharsets"},"ComplianceMLBgdCrawlEnabled":{"type":"boolean","description":"No description available for ComplianceMLBgdCrawlEnabled","title":"ComplianceMLBgdCrawlEnabled"},"ConnectorsActionableMessagesEnabled":{"type":"boolean","description":"The ConnectorsActionableMessagesEnabled parameter specifies whether to enable or disable actionable buttons in messages (connector cards) from connected apps on Outlook on the web.","title":"ConnectorsActionableMessagesEnabled"},"ConnectorsEnabled":{"type":"boolean","description":"The ConnectorsEnabled parameter specifies whether to enable or disable all connected apps in organization.","title":"ConnectorsEnabled"},"ConnectorsEnabledForOutlook":{"type":"boolean","description":"The ConnectorsEnabledForOutlook parameter specifies whether to enable or disable connected apps in Outlook on the web. ","title":"ConnectorsEnabledForOutlook"},"ConnectorsEnabledForSharepoint":{"type":"boolean","description":"The ConnectorsEnabledForSharepoint parameter specifies whether to enable or disable connected apps on Sharepoint.","title":"ConnectorsEnabledForSharepoint"},"ConnectorsEnabledForTeams":{"type":"boolean","description":"The ConnectorsEnabledForTeams parameter specifies whether to enable or disable connected apps on Teams.","title":"ConnectorsEnabledForTeams"},"ConnectorsEnabledForYammer":{"type":"boolean","description":"The ConnectorsEnabledForYammer parameter specifies whether to enable or disable connected apps on Yammer.","title":"ConnectorsEnabledForYammer"},"CustomerLockboxEnabled":{"type":"boolean","description":"Enable Customer Lockbox.","title":"CustomerLockboxEnabled"},"DefaultAuthenticationPolicy":{"type":"string","description":"The DefaultAuthenticationPolicy parameter specifies the authentication policy that's used for the whole organization. You can use any value that uniquely identifies the policy.","title":"DefaultAuthenticationPolicy"},"DefaultGroupAccessType":{"enum":["Private","Public"],"description":"The DefaultGroupAccessType parameter specifies the default access type for Office 365 groups.","title":"DefaultGroupAccessType"},"DefaultMinutesToReduceLongEventsBy":{"type":"integer","description":"The DefaultMinutesToReduceLongEventsBy parameter specifies the number of minutes to reduce calendar events by if the events are 60 minutes or longer.","title":"DefaultMinutesToReduceLongEventsBy"},"DefaultMinutesToReduceShortEventsBy":{"type":"integer","description":"The DefaultMinutesToReduceShortEventsBy parameter specifies the number of minutes to reduce calendar events by if the events are less than 60 minutes long.","title":"DefaultMinutesToReduceShortEventsBy"},"DefaultPublicFolderAgeLimit":{"type":"string","description":"The DefaultPublicFolderAgeLimit parameter specifies the default age limit for the contents of public folders across the entire organization. Content in a public folder is automatically deleted when this age limit is exceeded. This attribute applies to all public folders in the organization that don't have their own AgeLimit setting. To specify a value, enter it as a time span: dd.hh:mm:ss where d = days, h = hours, m = minutes, and s = seconds. Or, enter the value $null. The default value is blank ($null).","title":"DefaultPublicFolderAgeLimit"},"DefaultPublicFolderDeletedItemRetention":{"type":"string","description":"The DefaultPublicFolderDeletedItemRetention parameter specifies the default value of the length of time to retain deleted items for public folders across the entire organization. This attribute applies to all public folders in the organization that don't have their own RetainDeletedItemsFor attribute set.","title":"DefaultPublicFolderDeletedItemRetention"},"DefaultPublicFolderIssueWarningQuota":{"type":"string","description":"The DefaultPublicFolderIssueWarningQuota parameter specifies the default value across the entire organization for the public folder size at which a warning message is sent to this folder's owners, warning that the public folder is almost full. This attribute applies to all public folders within the organization that don't have their own warning quota attribute set. The default value of this attribute is unlimited. The valid input range for this parameter is from 0 through 2199023254529 bytes(2 TB). If you enter a value of unlimited, no size limit is imposed on the public folder.","title":"DefaultPublicFolderIssueWarningQuota"},"DefaultPublicFolderMaxItemSize":{"type":"string","description":"The DefaultPublicFolderMaxItemSize parameter specifies the default maximum size for posted items within public folders across the entire organization. Items larger than the value of the DefaultPublicFolderMaxItemSize parameter are rejected. This attribute applies to all public folders within the organization that don't have their own MaxItemSize attribute set. The default value of this attribute is unlimited.","title":"DefaultPublicFolderMaxItemSize"},"DefaultPublicFolderMovedItemRetention":{"type":"string","description":"The DefaultPublicFolderMovedItemRetention parameter specifies how long items that have been moved between mailboxes are kept in the source mailbox for recovery purposes before being removed by the Public Folder Assistant.","title":"DefaultPublicFolderMovedItemRetention"},"DefaultPublicFolderProhibitPostQuota":{"type":"string","description":"The DefaultPublicFolderProhibitPostQuota parameter specifies the size of a public folder at which users are notified that the public folder is full. Users can't post to a folder whose size is larger than the DefaultPublicFolderProhibitPostQuota parameter value. The default value of this attribute is unlimited.","title":"DefaultPublicFolderProhibitPostQuota"},"DirectReportsGroupAutoCreationEnabled":{"type":"boolean","description":"The DirectReportsGroupAutoCreationEnabled parameter specifies whether to enable or disable the automatic creation of direct report Office 365 groups.","title":"DirectReportsGroupAutoCreationEnabled"},"DisablePlusAddressInRecipients":{"type":"boolean","description":"The DisablePlusAddressInRecipients parameter specifies whether to enable or disable plus addressing (also known as subaddressing) for Exchange Online mailboxes.","title":"DisablePlusAddressInRecipients"},"DistributionGroupDefaultOU":{"type":"string","description":"The DistributionGroupDefaultOU parameter specifies the container where distribution groups are created by default.","title":"DistributionGroupDefaultOU"},"DistributionGroupNameBlockedWordsList":{"type":"array","items":{"type":"string"},"description":"The DistributionGroupNameBlockedWordsList parameter specifies words that can't be included in the names of distribution groups. Separate multiple values with commas.","title":"DistributionGroupNameBlockedWordsList"},"DistributionGroupNamingPolicy":{"type":"string","description":"The DistributionGroupNamingPolicy parameter specifies the template applied to the name of distribution groups that are created in the organization. You can enforce that a prefix or suffix be applied to all distribution groups. Prefixes and suffixes can be either a string or an attribute, and you can combine strings and attributes.","title":"DistributionGroupNamingPolicy"},"ElcProcessingDisabled":{"type":"boolean","description":"The ElcProcessingDisabled parameter specifies whether to enable or disable the processing of mailboxes by the Managed Folder Assistant.","title":"ElcProcessingDisabled"},"EnableOutlookEvents":{"type":"boolean","description":"The EnableOutlookEvents parameter specifies whether Outlook or Outlook on the web automatically discovers events from email messages and adds them to user calendars.","title":"EnableOutlookEvents"},"EndUserDLUpgradeFlowsDisabled":{"type":"boolean","description":"The EndUserDLUpgradeFlowsDisabled parameter specifies whether to prevent users from upgrading their own distribution groups to Office 365 groups in an Exchange Online organization.","title":"EndUserDLUpgradeFlowsDisabled"},"EwsAllowEntourage":{"type":"boolean","description":"The EwsAllowEntourage parameter specifies whether to enable or disable Entourage 2008 to access Exchange Web Services (EWS) for the entire organization.","title":"EwsAllowEntourage"},"EwsAllowList":{"type":"array","items":{"type":"string"},"description":"The EwsAllowList parameter specifies the applications that are allowed to access EWS or REST when the EwsApplicationAccessPolicy parameter is set to EwsAllowList. Other applications that aren't specified by this parameter aren't allowed to access EWS or REST. You identify the application by its user agent string value. Wildcard characters (*) are supported.","title":"EwsAllowList"},"EwsAllowMacOutlook":{"type":"boolean","description":"The EwsAllowMacOutlook parameter enables or disables access to mailboxes by Outlook for Mac clients that use Exchange Web Services (for example, Outlook for Mac 2011 or later).","title":"EwsAllowMacOutlook"},"EwsAllowOutlook":{"type":"boolean","description":"The EwsAllowOutlook parameter enables or disables access to mailboxes by Outlook clients that use Exchange Web Services. Outlook uses Exchange Web Services for free/busy, out-of-office settings, and calendar sharing.","title":"EwsAllowOutlook"},"EwsApplicationAccessPolicy":{"enum":["EnforceAllowList","EnforceBlockList"],"description":"The EwsApplicationAccessPolicy parameter specifies the client applications that have access to EWS and REST.","title":"EwsApplicationAccessPolicy"},"EwsBlockList":{"type":"array","items":{"type":"string"},"description":"The EwsBlockList parameter specifies the applications that aren't allowed to access EWS or REST when the EwsApplicationAccessPolicy parameter is set to EnforceBlockList. All other applications that aren't specified by this parameter are allowed to access EWS or REST. You identify the application by its user agent string value. Wildcard characters (*) are supported.","title":"EwsBlockList"},"EwsEnabled":{"type":"boolean","description":"The EwsEnabled parameter specifies whether to globally enable or disable EWS access for the entire organization, regardless of what application is making the request.","title":"EwsEnabled"},"ExchangeNotificationEnabled":{"type":"boolean","description":"The ExchangeNotificationEnabled parameter enables or disables Exchange notifications sent to administrators regarding their organizations. Valid input for this parameter is $true or $false.","title":"ExchangeNotificationEnabled"},"ExchangeNotificationRecipients":{"type":"array","items":{"type":"string"},"description":"The ExchangeNotificationRecipients parameter specifies the recipients for Exchange notifications sent to administrators regarding their organizations. If the ExchangeNotificationEnabled parameter is set to $false, no notification messages are sent. Be sure to enclose values that contain spaces in quotation marks and separate multiple values with commas. If this parameter isn't set, Exchange notifications are sent to all administrators.","title":"ExchangeNotificationRecipients"},"FindTimeAttendeeAuthenticationEnabled":{"type":"boolean","description":"The FindTimeAttendeeAuthenticationEnabled parameter controls whether attendees are required to verify their identity in meeting polls using the FindTime Outlook add-in.","title":"FindTimeAttendeeAuthenticationEnabled"},"FindTimeAutoScheduleDisabled":{"type":"boolean","description":"The FindTimeAutoScheduleDisabled parameter controls automatically scheduling the meeting once a consensus is reached in meeting polls using the FindTime Outlook add-in.","title":"FindTimeAutoScheduleDisabled"},"FindTimeLockPollForAttendeesEnabled":{"type":"boolean","description":"The FindTimeLockPollForAttendeesEnabled controls whether the Lock poll for attendees setting is managed by the organization.","title":"FindTimeLockPollForAttendeesEnabled"},"FindTimeOnlineMeetingOptionDisabled":{"type":"boolean","description":"The FindTimeOnlineMeetingOptionDisabled parameter controls the availability of the Online meeting checkbox for Teams in meeting polls using the FindTime Outlook add-in.","title":"FindTimeOnlineMeetingOptionDisabled"},"FocusedInboxOn":{"type":"boolean","description":"The FocusedInboxOn parameter enables or disables Focused Inbox for the organization.","title":"FocusedInboxOn"},"HierarchicalAddressBookRoot":{"type":"string","description":"The HierarchicalAddressBookRoot parameter specifies the user, contact, or group to be used as the root organization for a hierarchical address book in the Exchange organization. You can use any value that uniquely identifies the recipient.","title":"HierarchicalAddressBookRoot"},"IPListBlocked":{"type":"array","items":{"type":"string"},"description":"The IPListBlocked parameter specifies the blocked IP addresses that aren't allowed to connect to Exchange Online organization. These settings affect client connections that use Basic authentication where on-premises Active Directory Federation Services (ADFS) servers federate authentication with Azure Active Directory. Note that the new settings might take up to 4 hours to fully propagate across the service.","title":"IPListBlocked"},"IsGroupFoldersAndRulesEnabled":{"type":"boolean","description":"No description available for IsGroupFoldersAndRulesEnabled","title":"IsGroupFoldersAndRulesEnabled"},"IsGroupMemberAllowedToEditContent":{"type":"boolean","description":"No description available for IsGroupMemberAllowedToEditContent","title":"IsGroupMemberAllowedToEditContent"},"LeanPopoutEnabled":{"type":"boolean","description":"The LeanPopoutEnabled parameter specifies whether to enable faster loading of pop-out messages in Outlook on the web for Internet Explorer and Microsoft Edge.","title":"LeanPopoutEnabled"},"LinkPreviewEnabled":{"type":"boolean","description":"The LinkPreviewEnabled parameter specifies whether link preview of URLs in email messages is allowed for the organization.","title":"LinkPreviewEnabled"},"MailTipsAllTipsEnabled":{"type":"boolean","description":"The MailTipsAllTipsEnabled parameter specifies whether MailTips are enabled. The default value is $true.","title":"MailTipsAllTipsEnabled"},"MailTipsExternalRecipientsTipsEnabled":{"type":"boolean","description":"The MailTipsExternalRecipientsTipsEnabled parameter specifies whether MailTips for external recipients are enabled. The default value is $false.","title":"MailTipsExternalRecipientsTipsEnabled"},"MailTipsGroupMetricsEnabled":{"type":"boolean","description":"The MailTipsGroupMetricsEnabled parameter specifies whether MailTips that rely on group metrics data are enabled. The default value is $true.","title":"MailTipsGroupMetricsEnabled"},"MailTipsLargeAudienceThreshold":{"type":"integer","description":"The MailTipsLargeAudienceThreshold parameter specifies what a large audience is. The default value is 25.","title":"MailTipsLargeAudienceThreshold"},"MailTipsMailboxSourcedTipsEnabled":{"type":"boolean","description":"The MailTipsMailboxSourcedTipsEnabled parameter specifies whether MailTips that rely on mailbox data (out-of-office or full mailbox) are enabled.","title":"MailTipsMailboxSourcedTipsEnabled"},"MaskClientIpInReceivedHeadersEnabled":{"type":"boolean","description":"No description available for MaskClientIpInReceivedHeadersEnabled.","title":"MaskClientIpInReceivedHeadersEnabled"},"MatchSenderOrganizerProperties":{"type":"boolean","description":"No description available for MatchSenderOrganizerProperties.","title":"MatchSenderOrganizerProperties"},"MessageHighlightsEnabled":{"type":"boolean","description":"No description available for MessageHighlightsEnabled.","title":"MessageHighlightsEnabled"},"MessageRecallEnabled":{"type":"boolean","description":"The MessageRecallEnabled parameter enables or disables the message recall feature in the organization.","title":"MessageRecallEnabled"},"MessageRemindersEnabled":{"type":"boolean","description":"The MessageRemindersEnabled parameter enables or disables the message reminders feature in the organization.","title":"MessageRemindersEnabled"},"MobileAppEducationEnabled":{"type":"boolean","description":"The MobileAppEducationEnabled specifies whether to show or hide the Outlook for iOS and Android education reminder in Outlook on the web.","title":"MobileAppEducationEnabled"},"OAuth2ClientProfileEnabled":{"type":"boolean","description":"The OAuth2ClientProfileEnabled parameter enables or disables modern authentication in the Exchange organization.","title":"OAuth2ClientProfileEnabled"},"OnlineMeetingsByDefaultEnabled":{"type":"boolean","description":"The OnlineMeetingsByDefaultEnabled parameter specifies whether to set all meetings as Teams by default during meeting creation.","title":"OnlineMeetingsByDefaultEnabled"},"OutlookGifPickerDisabled":{"type":"boolean","description":"The OutlookGifPickerDisabled parameter disables the GIF Search (powered by Bing) feature that's built into the Compose page in Outlook on the web.","title":"OutlookGifPickerDisabled"},"OutlookMobileGCCRestrictionsEnabled":{"type":"boolean","description":"The OutlookMobileGCCRestrictionsEnabled parameter specifies whether to enable or disable features within Outlook for iOS and Android that are not FedRAMP compliant for Office 365 US Government Community Cloud (GCC) customers.","title":"OutlookMobileGCCRestrictionsEnabled"},"OutlookPayEnabled":{"type":"boolean","description":"The OutlookPayEnabled parameter enables or disables Payments in Outlook in the Office 365 organization.","title":"OutlookPayEnabled"},"OutlookTextPredictionDisabled":{"type":"boolean","description":"No description available for OutlookTextPredictionDisabled.","title":"OutlookTextPredictionDisabled"},"PublicComputersDetectionEnabled":{"type":"boolean","description":"The PublicComputersDetectionEnabled parameter specifies whether Outlook on the web will detect when a user signs from a public or private computer or network, and then enforces the attachment handling settings from public networks. The default is $false. However, if you set this parameter to $true, Outlook on the web will determine if the user is signing in from a public computer, and all public attachment handling rules will be applied and enforced.","title":"PublicComputersDetectionEnabled"},"PublicFoldersEnabled":{"enum":["None","Local","Remote"],"description":"The PublicFoldersEnabled parameter specifies how public folders are deployed in your organization.","title":"PublicFoldersEnabled"},"PublicFolderShowClientControl":{"type":"boolean","description":"The PublicFolderShowClientControl parameter enables or disables access to public folders in Microsoft Outlook.","title":"PublicFolderShowClientControl"},"ReadTrackingEnabled":{"type":"boolean","description":"The ReadTrackingEnabled parameter specifies whether the tracking for read status for messages in an organization is enabled. The default value is $false.","title":"ReadTrackingEnabled"},"RecallReadMessagesEnabled":{"type":"boolean","description":"No description available for RecallReadMessagesEnabled.","title":"RecallReadMessagesEnabled"},"RemotePublicFolderMailboxes":{"type":"array","items":{"type":"string"},"description":"The RemotePublicFolderMailboxes parameter specifies the identities of the public folder objects (represented as mail user objects locally) corresponding to the public folder mailboxes created in the remote forest. The public folder values set here are used only if the public folder deployment is a remote deployment.","title":"RemotePublicFolderMailboxes"},"SendFromAliasEnabled":{"type":"boolean","description":"The SendFromAliasEnabled parameter allows mailbox users to send messages using aliases (proxy addresses). It does this by disabling the rewriting of aliases to their primary SMTP address. This change is implemented in the Exchange Online service","title":"SendFromAliasEnabled"},"SharedDomainEmailAddressFlowEnabled":{"type":"boolean","description":"No description available for SharedDomainEmailAddressFlowEnabled.","title":"SharedDomainEmailAddressFlowEnabled"},"ShortenEventScopeDefault":{"type":"string","description":"The ShortenEventScopeDefault parameter specifies whether calendar events start late or end early in the organization.","title":"ShortenEventScopeDefault"},"SiteMailboxCreationURL":{"type":"string","description":"The SiteMailboxCreationURL parameter specifies the URL that's used to create site mailboxes. Site mailboxes improve collaboration and user productivity by allowing access to both SharePoint documents and Exchange email in Outlook 2013 or later.","title":"SiteMailboxCreationURL"},"SmtpActionableMessagesEnabled":{"type":"boolean","description":"The SmtpActionableMessagesEnabled parameter specifies whether to enable or disable action buttons in email messages in Outlook on the web.","title":"SmtpActionableMessagesEnabled"},"VisibleMeetingUpdateProperties":{"type":"string","description":"The VisibleMeetingUpdateProperties parameter specifies whether meeting message updates will be auto-processed on behalf of attendees. Auto-processed updates are applied to the attendee's calendar item, and then the meeting message is moved to the deleted items. The attendee never sees the update in their inbox, but their calendar is updated.","title":"VisibleMeetingUpdateProperties"},"WebPushNotificationsDisabled":{"type":"boolean","description":"The WebPushNotificationsDisabled parameter specifies whether to enable or disable Web Push Notifications in Outlook on the Web. This feature provides web push notifications which appear on a user's desktop while the user is not using Outlook on the Web. This brings awareness of incoming messages while they are working elsewhere on their computer.","title":"WebPushNotificationsDisabled"},"WebSuggestedRepliesDisabled":{"type":"boolean","description":"The WebSuggestedRepliesDisabled parameter specifies whether to enable or disable Suggested Replies in Outlook on the web. This feature provides suggested replies to emails so users can easily and quickly respond to messages.","title":"WebSuggestedRepliesDisabled"},"WorkspaceTenantEnabled":{"type":"boolean","description":"The WorkspaceTenantEnabled parameter enables or disables workspace booking in the organization.","title":"WorkspaceTenantEnabled"}},"required":["IsSingleInstance"]},"microsoft.exchange.organizationrelationship":{"type":"object","description":"This resource configures the Organization Relationship in Exchange Online.","title":"Schema for microsoft.exchange.organizationrelationship","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the organization relationship. The maximum length is 64 characters.","title":"Name"},"ArchiveAccessEnabled":{"type":"boolean","description":"The ArchiveAccessEnabled parameter specifies whether the organization relationship has been configured to provide remote archive access.","title":"ArchiveAccessEnabled"},"DeliveryReportEnabled":{"type":"boolean","description":"The DeliveryReportEnabled parameter specifies whether Delivery Reports should be shared over the organization relationship.","title":"DeliveryReportEnabled"},"DomainNames":{"type":"array","items":{"type":"string"},"description":"The DomainNames parameter specifies the SMTP domains of the external organization. You can specify multiple domains separated by commas.","title":"DomainNames"},"Enabled":{"type":"boolean","description":"The Enabled parameter specifies whether to enable the organization relationship.","title":"Enabled"},"FreeBusyAccessEnabled":{"type":"boolean","description":"The FreeBusyAccessEnabled parameter specifies whether the organization relationship should be used to retrieve free/busy information from the external organization.","title":"FreeBusyAccessEnabled"},"FreeBusyAccessLevel":{"enum":["None","AvailabilityOnly","LimitedDetails"],"description":"The FreeBusyAccessLevel parameter specifies the maximum amount of detail returned to the requesting organization. Valid values are: None, AvailabilityOnly or LimitedDetails","title":"FreeBusyAccessLevel"},"FreeBusyAccessScope":{"type":"string","description":"The FreeBusyAccessScope parameter specifies a mail-enabled security group in the internal organization that contains users whose free/busy information is accessible by an external organization. You can use any value that uniquely identifies the group.","title":"FreeBusyAccessScope"},"MailboxMoveEnabled":{"type":"boolean","description":"The MailboxMoveEnabled parameter specifies whether the organization relationship enables moving mailboxes to or from the external organization.","title":"MailboxMoveEnabled"},"MailboxMoveCapability":{"enum":["Inbound","Outbound","RemoteInbound","RemoteOutbound","None"],"description":"The MailboxMoveCapability parameter is used in cross-tenant mailbox migrations.","title":"MailboxMoveCapability"},"MailboxMovePublishedScopes":{"type":"array","items":{"type":"string"},"description":"The MailboxMovePublishedScopes parameter is used in cross-tenant mailbox migrations to specify the mail-enabled security groups whose members are allowed to migrate.","title":"MailboxMovePublishedScopes"},"MailTipsAccessEnabled":{"type":"boolean","description":"The MailTipsAccessEnabled parameter specifies whether MailTips for users in this organization are returned over this organization relationship.","title":"MailTipsAccessEnabled"},"MailTipsAccessLevel":{"enum":["None","All","Limited"],"description":"The MailTipsAccessLevel parameter specifies the level of MailTips data externally shared over this organization relationship. This parameter can have the following values: All, Limited, None","title":"MailTipsAccessLevel"},"MailTipsAccessScope":{"type":"string","description":"The MailTipsAccessScope parameter specifies a mail-enabled security group in the internal organization that contains users whose free/busy information is accessible by an external organization. You can use any value that uniquely identifies the group.","title":"MailTipsAccessScope"},"OauthApplicationId":{"type":"string","description":"The OAuthApplicationId is used in cross-tenant mailbox migrations to specify the application ID of the mailbox migration app that you consented to.","title":"OauthApplicationId"},"OrganizationContact":{"type":"string","description":"The OrganizationContact parameter specifies the email address that can be used to contact the external organization (for example, administrator@fourthcoffee.com).","title":"OrganizationContact"},"PhotosEnabled":{"type":"boolean","description":"The PhotosEnabled parameter specifies whether photos for users in the internal organization are returned over the organization relationship.","title":"PhotosEnabled"},"TargetApplicationUri":{"type":"string","description":"The TargetApplicationUri parameter specifies the target Uniform Resource Identifier (URI) of the external organization. The TargetApplicationUri parameter is specified by Exchange when requesting a delegated token to retrieve free and busy information, for example, mail.contoso.com.","title":"TargetApplicationUri"},"TargetAutodiscoverEpr":{"type":"string","description":"The TargetAutodiscoverEpr parameter specifies the Autodiscover URL of Exchange Web Services for the external organization. Exchange uses Autodiscover to automatically detect the correct Exchangeserver endpoint to use for external requests.","title":"TargetAutodiscoverEpr"},"TargetOwaURL":{"type":"string","description":"The TargetOwaURL parameter specifies the Outlook on the web (formerly Outlook Web App) URL of the external organization that's defined in the organization relationship. It is used for Outlook on the web redirection in a cross-premise Exchange scenario. Configuring this attribute enables users in the organization to use their current Outlook on the web URL to access Outlook on the web in the external organization.","title":"TargetOwaURL"},"TargetSharingEpr":{"type":"string","description":"The TargetSharingEpr parameter specifies the URL of the target Exchange Web Services for the external organization.","title":"TargetSharingEpr"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the OrganizationRelationship should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.outboundconnector":{"type":"object","description":"Create a new Inbound connector in your cloud-based organization.","title":"Schema for microsoft.exchange.outboundconnector","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the outbound connector that you want to modify.","title":"Identity"},"Enabled":{"type":"boolean","description":"Specifies whether connector is enabled.","title":"Enabled"},"UseMXRecord":{"type":"boolean","description":"Specifies whether connector should use MXRecords for target resolution.","title":"UseMXRecord"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"ConnectorSource":{"enum":["Default","Migrated","HybridWizard"],"description":"The ConnectorSource parameter specifies how the connector is created. DO NOT CHANGE THIS!","title":"ConnectorSource"},"ConnectorType":{"enum":["Partner","OnPremises"],"description":"The ConnectorType parameter specifies a category for the domains that are serviced by the connector.","title":"ConnectorType"},"RecipientDomains":{"type":"array","items":{"type":"string"},"description":"The RecipientDomains parameter specifies the domain that the Outbound connector routes mail to. You can specify multiple domains separated by commas.","title":"RecipientDomains"},"SmartHosts":{"type":"array","items":{"type":"string"},"description":"The SmartHosts parameter specifies the smart hosts the Outbound connector uses to route mail. This parameter is required if you set the UseMxRecord parameter to $false and must be specified on the same command line.","title":"SmartHosts"},"TlsDomain":{"type":"string","description":"The TlsDomain parameter specifies the domain name that the Outbound connector uses to verify the FQDN of the target certificate when establishing a TLS secured connection. This parameter is only used if the TlsSettings parameter is set to DomainValidation. Valid input for the TlsDomain parameter is an SMTP domain. You can use a wildcard character to specify all subdomains of a specified domain, as shown in the following example: *.contoso.com. However, you can't embed a wildcard character, as shown in the following example: domain.*.contoso.com","title":"TlsDomain"},"TlsSettings":{"enum":["EncryptionOnly","CertificateValidation","DomainValidation"],"description":"The TlsSettings parameter specifies the TLS authentication level that's used for outbound TLS connections established by this Outbound connector.","title":"TlsSettings"},"IsTransportRuleScoped":{"type":"boolean","description":"The IsTransportRuleScoped parameter specifies whether the Outbound connector is associated with a transport rule (also known as a mail flow rule).","title":"IsTransportRuleScoped"},"RouteAllMessagesViaOnPremises":{"type":"boolean","description":"The RouteAllMessagesViaOnPremises parameter specifies that all messages serviced by this connector are first routed through the on-premises messaging system (Centralized mailrouting).","title":"RouteAllMessagesViaOnPremises"},"CloudServicesMailEnabled":{"type":"boolean","description":"The CloudServicesMailEnabled parameter specifies whether the connector is used for hybrid mail flow between an on-premises Exchange environment and Microsoft Office 365. Specifically, this parameter controls how certain internal X-MS-Exchange-Organization-* message headers are handled in messages that are sent between accepted domains in the on-premises and cloud organizations. These headers are collectively known as cross-premises headers. DO NOT USE MANUALLY!","title":"CloudServicesMailEnabled"},"AllAcceptedDomains":{"type":"boolean","description":"The AllAcceptedDomains parameter specifies whether the Outbound connector is used in hybrid organizations where message recipients are in accepted domains of the cloud-based organization.","title":"AllAcceptedDomains"},"SenderRewritingEnabled":{"type":"boolean","description":"The SenderRewritingEnabled parameter specifies that all messages that normally qualify for SRS rewriting are rewritten for routing through the on-premises email system.","title":"SenderRewritingEnabled"},"TestMode":{"type":"boolean","description":"The TestMode parameter specifies whether you want to enabled or disable test mode for the Outbound connector.","title":"TestMode"},"ValidationRecipients":{"type":"array","items":{"type":"string"},"description":"The ValidationRecipients parameter specifies the email addresses of the validation recipients for the Outbound connector. You can specify multiple email addresses separated by commas.","title":"ValidationRecipients"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Outbound connector should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.owamailboxpolicy":{"type":"object","description":"This resource configures OWA Mailbox Policies in Exchange Online.","title":"Schema for microsoft.exchange.owamailboxpolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name for the policy. The maximum length is 64 characters.","title":"Name"},"AccountTransferEnabled":{"type":"boolean","description":"The AccountTransferEnabled parameter specifies whether to enable or disable QR code sign-in. By default, QR code sign-in is enabled.","title":"AccountTransferEnabled"},"ActionForUnknownFileAndMIMETypes":{"enum":["Allow","ForceSave","Block"],"description":"The ActionForUnknownFileAndMIMETypes parameter specifies how to handle file types that aren't specified in the Allow, Block, and Force Save lists for file types and MIME types","title":"ActionForUnknownFileAndMIMETypes"},"ActiveSyncIntegrationEnabled":{"type":"boolean","description":"The ActiveSyncIntegrationEnabled parameter specifies whether to enable or disable Exchange ActiveSync settings in Outlook on the web. ","title":"ActiveSyncIntegrationEnabled"},"AdditionalAccountsEnabled":{"type":"boolean","description":"No description available.","title":"AdditionalAccountsEnabled"},"AdditionalStorageProvidersAvailable":{"type":"boolean","description":"The AdditionalStorageProvidersAvailable parameter specifies whether to allow additional storage providers (for example, Box, Dropbox, Facebook, Google Drive, Egnyte, personal OneDrive) attachments in Outlook on the web.","title":"AdditionalStorageProvidersAvailable"},"AllAddressListsEnabled":{"type":"boolean","description":"The AllAddressListsEnabled parameter specifies which address lists are available in Outlook on the web.","title":"AllAddressListsEnabled"},"AllowCopyContactsToDeviceAddressBook":{"type":"boolean","description":"The AllowCopyContactsToDeviceAddressBook parameter specifies whether users can copy the contents of their Contacts folder to a mobile device's native address book when using Outlook on the web for devices.","title":"AllowCopyContactsToDeviceAddressBook"},"AllowedFileTypes":{"type":"array","items":{"type":"string"},"description":"The AllowedFileTypes parameter specifies the attachment file types (file extensions) that can be saved locally or viewed from Outlook on the web.","title":"AllowedFileTypes"},"AllowedMimeTypes":{"type":"array","items":{"type":"string"},"description":"The AllowedMimeTypes parameter specifies the MIME extensions of attachments that allow the attachments to be saved locally or viewed from Outlook on the web.","title":"AllowedMimeTypes"},"BlockedFileTypes":{"type":"array","items":{"type":"string"},"description":"The BlockedFileTypes parameter specifies a list of attachment file types (file extensions) that can't be saved locally or viewed from Outlook on the web.","title":"BlockedFileTypes"},"BlockedMimeTypes":{"type":"array","items":{"type":"string"},"description":"The BlockedMimeTypes parameter specifies MIME extensions in attachments that prevent the attachments from being saved locally or viewed from Outlook on the web.","title":"BlockedMimeTypes"},"BookingsMailboxCreationEnabled":{"type":"boolean","description":"No description available.","title":"BookingsMailboxCreationEnabled"},"ChangeSettingsAccountEnabled":{"type":"boolean","description":"No description available.","title":"ChangeSettingsAccountEnabled"},"ClassicAttachmentsEnabled":{"type":"boolean","description":"The ClassicAttachmentsEnabled parameter specifies whether users can attach local files as regular email attachments in Outlook on the web.","title":"ClassicAttachmentsEnabled"},"ConditionalAccessPolicy":{"enum":["Off","ReadOnly","ReadOnlyPlusAttachmentsBlocked"],"description":"The ConditionalAccessPolicy parameter specifies the Outlook on the Web Policy for limited access. For this feature to work properly, you also need to configure a Conditional Access policy in the Azure Active Directory Portal.","title":"ConditionalAccessPolicy"},"DefaultTheme":{"type":"string","description":"The DefaultTheme parameter specifies the default theme that's used in Outlook on the web when the user hasn't selected a theme. The default value is blank ($null).","title":"DefaultTheme"},"DirectFileAccessOnPrivateComputersEnabled":{"type":"boolean","description":"The DirectFileAccessOnPrivateComputersEnabled parameter specifies the left-click options for attachments in Outlook on the web for private computer sessions. ","title":"DirectFileAccessOnPrivateComputersEnabled"},"DirectFileAccessOnPublicComputersEnabled":{"type":"boolean","description":"The DirectFileAccessOnPrivateComputersEnabled parameter specifies the left-click options for attachments in Outlook on the web for public computer sessions.","title":"DirectFileAccessOnPublicComputersEnabled"},"DisableFacebook":{"type":"boolean","description":"The DisableFacebook switch specifies whether users can synchronize their Facebook contacts to their Contacts folder in Outlook on the web. By default, Facebook integration is enabled.","title":"DisableFacebook"},"DisplayPhotosEnabled":{"type":"boolean","description":"The DisplayPhotosEnabled parameter specifies whether users see sender photos in Outlook on the web.","title":"DisplayPhotosEnabled"},"ExplicitLogonEnabled":{"type":"boolean","description":"The ExplicitLogonEnabled parameter specifies whether to allow a user to open someone else's mailbox in Outlook on the web (provided that user has permissions to the mailbox).","title":"ExplicitLogonEnabled"},"ExternalImageProxyEnabled":{"type":"boolean","description":"The ExternalImageProxyEnabled parameter specifies whether to load all external images through the Outlook external image proxy.","title":"ExternalImageProxyEnabled"},"ExternalSPMySiteHostURL":{"type":"string","description":"The ExternalSPMySiteHostURL specifies the My Site Host URL for external users.","title":"ExternalSPMySiteHostURL"},"FeedbackEnabled":{"type":"boolean","description":"The FeedbackEnabled parameter specifies whether to enable or disable inline feedback surveys in Outlook on the web.","title":"FeedbackEnabled"},"ForceSaveAttachmentFilteringEnabled":{"type":"boolean","description":"The ForceSaveAttachmentFilteringEnabled parameter specifies whether files are filtered before they can be saved from Outlook on the web.","title":"ForceSaveAttachmentFilteringEnabled"},"ForceSaveFileTypes":{"type":"array","items":{"type":"string"},"description":"The ForceSaveFileTypes parameter specifies the attachment file types (file extensions) that can only be saved from Outlook on the web (not opened).","title":"ForceSaveFileTypes"},"ForceSaveMimeTypes":{"type":"array","items":{"type":"string"},"description":"The ForceSaveMimeTypes parameter specifies the MIME extensions in attachments that only allow the attachments to be saved locally (not opened).","title":"ForceSaveMimeTypes"},"ForceWacViewingFirstOnPrivateComputers":{"type":"boolean","description":"The ForceWacViewingFirstOnPrivateComputers parameter specifies whether private computers must first preview an Office file as a web page in Office Online Server (formerly known as Office Web Apps Server and Web Access Companion Server) before opening the file in the local application.","title":"ForceWacViewingFirstOnPrivateComputers"},"ForceWacViewingFirstOnPublicComputers":{"type":"boolean","description":"The ForceWacViewingFirstOnPublicComputers parameter specifies whether public computers must first preview an Office file as a web page in Office Online Server before opening the file in the local application.","title":"ForceWacViewingFirstOnPublicComputers"},"FreCardsEnabled":{"type":"boolean","description":"The FreCardsEnabled parameter specifies whether the theme, signature, and phone cards are available in Outlook on the web.","title":"FreCardsEnabled"},"GlobalAddressListEnabled":{"type":"boolean","description":"The GlobalAddressListEnabled parameter specifies whether the global address list is available in Outlook on the web.","title":"GlobalAddressListEnabled"},"GroupCreationEnabled":{"type":"boolean","description":"The GroupCreationEnabled parameter specifies whether Office 365 group creation is available in Outlook on the web.","title":"GroupCreationEnabled"},"InstantMessagingEnabled":{"type":"boolean","description":"The InstantMessagingEnabled parameter specifies whether instant messaging is available in Outlook on the web.","title":"InstantMessagingEnabled"},"InstantMessagingType":{"enum":["None","Ocs"],"description":"The InstantMessagingType parameter specifies the type of instant messaging provider in Outlook on the web.","title":"InstantMessagingType"},"InterestingCalendarsEnabled":{"type":"boolean","description":"The InterestingCalendarsEnabled parameter specifies whether interesting calendars are available in Outlook on the web.","title":"InterestingCalendarsEnabled"},"InternalSPMySiteHostURL":{"type":"string","description":"The InternalSPMySiteHostURL specifies the My Site Host URL for internal users.","title":"InternalSPMySiteHostURL"},"IRMEnabled":{"type":"boolean","description":"The IRMEnabled parameter specifies whether Information Rights Management (IRM) features are available in Outlook on the web.","title":"IRMEnabled"},"ItemsToOtherAccountsEnabled":{"type":"boolean","description":"No description available.","title":"ItemsToOtherAccountsEnabled"},"IsDefault":{"type":"boolean","description":"The IsDefault switch specifies whether the Outlook on the web policy is the default policy that's used to configure the Outlook on the web settings for new mailboxes.","title":"IsDefault"},"JournalEnabled":{"type":"boolean","description":"The JournalEnabled parameter specifies whether the Journal folder is available in Outlook on the web.","title":"JournalEnabled"},"LocalEventsEnabled":{"type":"boolean","description":"The LocalEventsEnabled parameter specifies whether local events calendars are available in Outlook on the web.","title":"LocalEventsEnabled"},"LogonAndErrorLanguage":{"type":"integer","description":"The LogonAndErrorLanguage parameter specifies the language that used in Outlook on the web for forms-based authentication and for error messages when a user's current language setting can't be read. A valid value is a supported Microsoft Windows Language Code Identifier (LCID). For example, 1033 is US English.","title":"LogonAndErrorLanguage"},"MessagePreviewsDisabled":{"type":"boolean","description":"No description available.","title":"MessagePreviewsDisabled"},"NotesEnabled":{"type":"boolean","description":"The NotesEnabled parameter specifies whether the Notes folder is available in Outlook on the web.","title":"NotesEnabled"},"NpsSurveysEnabled":{"type":"boolean","description":"The NpsSurveysEnabled parameter specifies whether to enable or disable the Net Promoter Score (NPS) survey in Outlook on the web. The survey allows uses to rate Outlook on the web on a scale of 1 to 5, and to provide feedback and suggested improvements in free text.","title":"NpsSurveysEnabled"},"OneWinNativeOutlookEnabled":{"type":"boolean","description":"The OneWinNativeOutlookEnabled parameter controls the availability of the new Outlook for Windows App.","title":"OneWinNativeOutlookEnabled"},"OrganizationEnabled":{"type":"boolean","description":"When the OrganizationEnabled parameter is set to $false, the Automatic Reply option doesn't include external and internal options, the address book doesn't show the organization hierarchy, and the Resources tab in Calendar forms is disabled.","title":"OrganizationEnabled"},"OnSendAddinsEnabled":{"type":"boolean","description":"The OnSendAddinsEnabled parameter specifies whether to enable or disable on send add-ins in Outlook on the web (add-ins that support events when a user clicks Send).","title":"OnSendAddinsEnabled"},"OutboundCharset":{"enum":["AutoDetect","AlwaysUTF8","UserLanguageChoice"],"description":"The OutboundCharset parameter specifies the character set that's used for outgoing messages in Outlook on the web.","title":"OutboundCharset"},"OutlookBetaToggleEnabled":{"type":"boolean","description":"The OutlookBetaToggleEnabled parameter specifies whether to enable or disable the Outlook on the web Preview toggle. The Preview toggle allows users to try the new Outlook on the web experience.","title":"OutlookBetaToggleEnabled"},"OWALightEnabled":{"type":"boolean","description":"The OWALightEnabled parameter controls the availability of the light version of Outlook on the web.","title":"OWALightEnabled"},"PersonalAccountsEnabled":{"type":"boolean","description":"No description available.","title":"PersonalAccountsEnabled"},"PersonalAccountCalendarsEnabled":{"type":"boolean","description":"The PersonalAccountCalendarsEnabled parameter specifies whether to allow users to connect to their personal Outlook.com or Google Calendar in Outlook on the web.","title":"PersonalAccountCalendarsEnabled"},"PhoneticSupportEnabled":{"type":"boolean","description":"The PhoneticSupportEnabled parameter specifies phonetically spelled entries in the address book. This parameter is available for use in Japan.","title":"PhoneticSupportEnabled"},"PlacesEnabled":{"type":"boolean","description":"The PlacesEnabled parameter specifies whether to enable or disable Places in Outlook on the web. Places lets users search, share, and map location details by using Bing.","title":"PlacesEnabled"},"PremiumClientEnabled":{"type":"boolean","description":"The PremiumClientEnabled parameter controls the availability of the full version of Outlook Web App.","title":"PremiumClientEnabled"},"PrintWithoutDownloadEnabled":{"type":"boolean","description":"The PrintWithoutDownloadEnabled specifies whether to allow printing of supported files without downloading the attachment in Outlook on the web.","title":"PrintWithoutDownloadEnabled"},"ProjectMocaEnabled":{"type":"boolean","description":"The ProjectMocaEnabled parameter enables or disables access to Project Moca in Outlook on the web.","title":"ProjectMocaEnabled"},"PublicFoldersEnabled":{"type":"boolean","description":"The PublicFoldersEnabled parameter specifies whether a user can browse or read items in public folders in Outlook Web App.","title":"PublicFoldersEnabled"},"RecoverDeletedItemsEnabled":{"type":"boolean","description":"The RecoverDeletedItemsEnabled parameter specifies whether a user can use Outlook Web App to view, recover, or delete permanently items that have been deleted from the Deleted Items folder.","title":"RecoverDeletedItemsEnabled"},"ReferenceAttachmentsEnabled":{"type":"boolean","description":"The ReferenceAttachmentsEnabled parameter specifies whether users can attach files from the cloud as linked attachments in Outlook on the web.","title":"ReferenceAttachmentsEnabled"},"RemindersAndNotificationsEnabled":{"type":"boolean","description":"The RemindersAndNotificationsEnabled parameter specifies whether notifications and reminders are enabled in Outlook on the web.","title":"RemindersAndNotificationsEnabled"},"ReportJunkEmailEnabled":{"type":"boolean","description":"The ReportJunkEmailEnabled parameter specifies whether users can report messages to Microsoft or unsubscribe from messages in Outlook on the web. ","title":"ReportJunkEmailEnabled"},"RulesEnabled":{"type":"boolean","description":"The RulesEnabled parameter specifies whether a user can view, create, or modify server-side rules in Outlook on the web.","title":"RulesEnabled"},"SatisfactionEnabled":{"type":"boolean","description":"The SatisfactionEnabled parameter specifies whether to enable or disable the satisfaction survey.","title":"SatisfactionEnabled"},"SaveAttachmentsToCloudEnabled":{"type":"boolean","description":"The SaveAttachmentsToCloudEnabled parameter specifies whether users can save regular email attachments to the cloud.","title":"SaveAttachmentsToCloudEnabled"},"SearchFoldersEnabled":{"type":"boolean","description":"The SearchFoldersEnabled parameter specifies whether Search Folders are available in Outlook on the web.","title":"SearchFoldersEnabled"},"SetPhotoEnabled":{"type":"boolean","description":"The SetPhotoEnabled parameter specifies whether users can add, change, and remove their sender photo in Outlook on the web.","title":"SetPhotoEnabled"},"SetPhotoURL":{"type":"string","description":"The SetPhotoURL parameter controls where users go to select their photo. Note that you can't specify a URL that contains one or more picture files, as there is no mechanism to copy a URL photo to the properties of the users' Exchange Online mailboxes.","title":"SetPhotoURL"},"ShowOnlineArchiveEnabled":{"type":"boolean","description":"No description available.","title":"ShowOnlineArchiveEnabled"},"SignaturesEnabled":{"type":"boolean","description":"The SignaturesEnabled parameter specifies whether to enable or disable the use of signatures in Outlook on the web.","title":"SignaturesEnabled"},"SkipCreateUnifiedGroupCustomSharepointClassification":{"type":"boolean","description":"The SkipCreateUnifiedGroupCustomSharepointClassification parameter specifies whether to skip a custom SharePoint page during the creation of Office 365 Groups in Outlook web app.","title":"SkipCreateUnifiedGroupCustomSharepointClassification"},"TeamSnapCalendarsEnabled":{"type":"boolean","description":"The TeamSnapCalendarsEnabled parameter specifies whether to allow users to connect to their personal TeamSnap calendars in Outlook on the web.","title":"TeamSnapCalendarsEnabled"},"TextMessagingEnabled":{"type":"boolean","description":"The TextMessagingEnabled parameter specifies whether users can send and receive text messages in Outlook on the web.","title":"TextMessagingEnabled"},"ThemeSelectionEnabled":{"type":"boolean","description":"The ThemeSelectionEnabled parameter specifies whether users can change the theme in Outlook on the web.","title":"ThemeSelectionEnabled"},"UMIntegrationEnabled":{"type":"boolean","description":"The UMIntegrationEnabled parameter specifies whether Unified Messaging (UM) integration is enabled in Outlook on the web.","title":"UMIntegrationEnabled"},"UseGB18030":{"type":"boolean","description":"The UseGB18030 parameter specifies whether to use the GB18030 character set instead of GB2312 in Outlook on the web.","title":"UseGB18030"},"UseISO885915":{"type":"boolean","description":"The UseISO885915 parameter specifies whether to use the character set ISO8859-15 instead of ISO8859-1 in Outlook on the web.","title":"UseISO885915"},"UserVoiceEnabled":{"type":"boolean","description":"The UserVoiceEnabled parameter specifies whether to enable or disable Outlook UserVoice in Outlook on the web. Outlook UserVoice is a customer feedback area that's available in Office 365.","title":"UserVoiceEnabled"},"WacEditingEnabled":{"type":"boolean","description":"The WacEditingEnabled parameter specifies whether to enable or disable editing documents in Outlook on the web by using Office Online Server (formerly known as Office Web Apps Server and Web Access Companion Server). ","title":"WacEditingEnabled"},"WacExternalServicesEnabled":{"type":"boolean","description":"The WacExternalServicesEnabled parameter specifies whether to enable or disable external services when viewing documents in Outlook on the web (for example, machine translation) by using Office Online Server.","title":"WacExternalServicesEnabled"},"WacOMEXEnabled":{"type":"boolean","description":"The WacOMEXEnabled parameter specifies whether to enable or disable apps for Outlook in Outlook on the web in Office Online Server.","title":"WacOMEXEnabled"},"WacViewingOnPrivateComputersEnabled":{"type":"boolean","description":"The WacViewingOnPrivateComputersEnabled parameter specifies whether to enable or disable web viewing of supported Office documents private computer sessions in Office Online Server (formerly known as Office Web Apps Server and Web Access Companion Server). By default, all Outlook on the web sessions are considered to be on private computers.","title":"WacViewingOnPrivateComputersEnabled"},"WacViewingOnPublicComputersEnabled":{"type":"boolean","description":"The WacViewingOnPublicComputersEnabled parameter specifies whether to enable or disable web viewing of supported Office documents in public computer sessions in Office Online Server. ","title":"WacViewingOnPublicComputersEnabled"},"WeatherEnabled":{"type":"boolean","description":"The WeatherEnabled parameter specifies whether to enable or disable weather information in the calendar in Outlook on the web.","title":"WeatherEnabled"},"WebPartsFrameOptionsType":{"enum":["None","SameOrigin","Deny"],"description":"The WebPartsFrameOptionsType parameter specifies what sources can access web parts in IFRAME or FRAME elements in Outlook on the web.","title":"WebPartsFrameOptionsType"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the OWA Mailbox Policy should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.partnerapplication":{"type":"object","description":"This resource configures Partner Applications in Exchange Online.","title":"Schema for microsoft.exchange.partnerapplication","properties":{"Name":{"type":"string","description":"The Name parameter specifies a new name for the partner application.","title":"Name"},"ApplicationIdentifier":{"type":"string","description":"The ApplicationIdentifier parameter specifies a unique application identifier for the partner application that uses an authorization server.","title":"ApplicationIdentifier"},"AcceptSecurityIdentifierInformation":{"type":"boolean","description":"The AcceptSecurityIdentifierInformation parameter specifies whether Exchange should accept security identifiers (SIDs) from another trusted Active Directory forest for the partner application.","title":"AcceptSecurityIdentifierInformation"},"AccountType":{"enum":["OrganizationalAccount","ConsumerAccount"],"description":"The AccountType parameter specifies the type of Microsoft account that's required for the partner application.","title":"AccountType"},"Enabled":{"type":"boolean","description":"The Enabled parameter specifies whether the partner application is enabled.","title":"Enabled"},"LinkedAccount":{"type":"string","description":"The LinkedAccount parameter specifies a linked Active Directory user account for the application.","title":"LinkedAccount"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Partner Application should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.perimeterconfiguration":{"type":"object","description":"Modify the perimeter Configuration policy in your cloud-based organization.","title":"Schema for microsoft.exchange.perimeterconfiguration","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"GatewayIPAddresses":{"type":"array","items":{"type":"string"},"description":"Use the GatewayIPAddresses parameter to create or modify a list of gateway server IP addresses to add to IP safelists.","title":"GatewayIPAddresses"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Outbound connector should exist.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.exchange.place":{"type":"object","description":"This resource configures a place in Exchange Online (e.g., room).","title":"Schema for microsoft.exchange.place","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the room mailbox that you want to modify. You can use any value that uniquely identifies the room.","title":"Identity"},"DisplayName":{"type":"string","description":"The display name of the place.","title":"DisplayName"},"AudioDeviceName":{"type":"string","description":"The AudioDeviceName parameter specifies the name of the audio device in the room. If the value contains spaces, enclose the value in quotation marks.","title":"AudioDeviceName"},"Building":{"type":"string","description":"The Building parameter specifies the building name or building number that the room is in. If the value contains spaces, enclose the value in quotation marks.","title":"Building"},"Capacity":{"type":"integer","description":"The Capacity parameter specifies the capacity of the room. A valid value is an integer.","title":"Capacity"},"City":{"type":"string","description":"The City parameter specifies the room's city. If the value contains spaces, enclose the value in quotation marks.","title":"City"},"CountryOrRegion":{"type":"string","description":"The CountryOrRegion parameter specifies the room's country or region. A valid value is a valid ISO 3166-1 two-letter country code (for example, AU for Australia) or the corresponding friendly name for the country (which might be different from the official ISO 3166 Maintenance Agency short name).","title":"CountryOrRegion"},"Desks":{"type":"array","items":{"type":"string"},"description":"N/A","title":"Desks"},"DisplayDeviceName":{"type":"string","description":"The DisplayDeviceName parameter specifies the name of the display device in the room. If the value contains spaces, enclose the value in quotation marks.","title":"DisplayDeviceName"},"Floor":{"type":"string","description":"The Floor parameter specifies the floor number that the room is on.","title":"Floor"},"FloorLabel":{"type":"string","description":"The FloorLabel parameter specifies a descriptive label for the floor that the room is on. If the value contains spaces, enclose the value in quotation marks.","title":"FloorLabel"},"GeoCoordinates":{"type":"string","description":"The GeoCoordinates parameter specifies the room's location in latitude, longitude and (optionally) altitude coordinates.","title":"GeoCoordinates"},"IsWheelChairAccessible":{"type":"boolean","description":"The IsWheelChairAccessible parameter specifies whether the room is wheelchair accessible.","title":"IsWheelChairAccessible"},"Label":{"type":"string","description":"The Label parameter specifies a descriptive label for the room (for example, a number or name). If the value contains spaces, enclose the value in quotation marks.","title":"Label"},"MTREnabled":{"type":"boolean","description":"The MTREnabled parameter identifies the room as configured with a Microsoft Teams room system. You can add Teams room systems as audio sources in Teams meetings that involve the room.","title":"MTREnabled"},"ParentId":{"type":"string","description":"The ParentId parameter specifies the ID of a Place in the parent location hierarchy in Microsoft Places.","title":"ParentId"},"ParentType":{"enum":["Floor","Section","None"],"description":"The ParentType parameter specifies the parent type of the ParentId in Microsoft Places. Valid values are: Floor, Section","title":"ParentType"},"Phone":{"type":"string","description":"The Phone parameter specifies the room's telephone number.","title":"Phone"},"PostalCode":{"type":"string","description":"The PostalCode parameter specifies the room's postal code.","title":"PostalCode"},"State":{"type":"string","description":"The State parameter specifies the room's state or province.","title":"State"},"Street":{"type":"string","description":"The Street parameter specifies the room's physical address.","title":"Street"},"Tags":{"type":"array","items":{"type":"string"},"description":"The Tags parameter specifies additional features of the room (for example, details like the type of view or furniture type).","title":"Tags"},"VideoDeviceName":{"type":"string","description":"The VideoDeviceName parameter specifies the name of the video device in the room. If the value contains spaces, enclose the value in quotation marks.","title":"VideoDeviceName"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Outbound connector should exist.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.policytipconfig":{"type":"object","description":"This resource configures Policy Tips in Exchange Online.","title":"Schema for microsoft.exchange.policytipconfig","properties":{"Name":{"type":"string","description":"The Name parameter specifies the custom Policy Tip you want to modify.","title":"Name"},"Value":{"type":"string","description":"The Value parameter specifies the text that's displayed by the Policy Tip.","title":"Value"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Policy Tip Config should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.quarantinepolicy":{"type":"object","description":"Create or modify a EXOQuarantinePolicy in your cloud-based organization.","title":"Schema for microsoft.exchange.quarantinepolicy","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the QuarantinePolicy you want to modify.","title":"Identity"},"EndUserQuarantinePermissionsValue":{"type":"integer","description":"The EndUserQuarantinePermissionsValue parameter specifies the end-user permissions for the quarantine policy.","title":"EndUserQuarantinePermissionsValue"},"ESNEnabled":{"type":"boolean","description":"The ESNEnabled parameter specifies whether to enable quarantine notifications (formerly known as end-user spam notifications) for the policy.","title":"ESNEnabled"},"MultiLanguageCustomDisclaimer":{"type":"array","items":{"type":"string"},"description":"The MultiLanguageCustomDisclaimer parameter specifies the custom disclaimer text to use near the bottom of quarantine notifications.","title":"MultiLanguageCustomDisclaimer"},"MultiLanguageSenderName":{"type":"array","items":{"type":"string"},"description":"The MultiLanguageSenderName parameter specifies the email sender's display name to use in quarantine notifications.","title":"MultiLanguageSenderName"},"MultiLanguageSetting":{"type":"array","items":{"type":"string"},"description":"The MultiLanguageSetting parameter specifies the language of quarantine notifications.","title":"MultiLanguageSetting"},"OrganizationBrandingEnabled":{"type":"boolean","description":"The OrganizationBrandingEnabled parameter enables or disables organization branding in the end-user quarantine notification messages.","title":"OrganizationBrandingEnabled"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this QuarantinePolicy should exist.","title":"Ensure"},"EndUserSpamNotificationFrequency":{"type":"string","description":"The EndUserSpamNotificationFrequency parameter species how often quarantine notifications are sent to users. Valid values are: 04:00:00 (4 hours),1.00:00:00 (1 day),7.00:00:00 (7 days)","title":"EndUserSpamNotificationFrequency"},"QuarantinePolicyType":{"type":"string","description":"The QuarantinePolicyType parameter filters the results by the specified quarantine policy type. Valid values are: QuarantinePolicy, GlobalQuarantinePolicy","title":"QuarantinePolicyType"},"EndUserSpamNotificationFrequencyInDays":{"type":"string","description":"This parameter is reserved for internal Microsoft use.","title":"EndUserSpamNotificationFrequencyInDays"},"CustomDisclaimer":{"type":"string","description":"This parameter is reserved for internal Microsoft use.","title":"CustomDisclaimer"},"EndUserSpamNotificationCustomFromAddress":{"type":"string","description":"The EndUserSpamNotificationCustomFromAddress specifies the email address of an existing internal sender to use as the sender for quarantine notifications. To set this parameter back to the default email address quarantine@messaging.microsoft.com, use the value $null.","title":"EndUserSpamNotificationCustomFromAddress"},"EsnCustomSubject":{"type":"array","items":{"type":"string"},"description":"The EsnCustomSubject parameter specifies the text to use in the Subject field of quarantine notifications.This setting is available only in the built-in quarantine policy named DefaultGlobalTag that controls global quarantine policy settings.","title":"EsnCustomSubject"}},"required":["Identity"]},"microsoft.exchange.recipientpermission":{"type":"object","description":"This resource allows users to retrieve Office 365 Recipient Permissions.","title":"Schema for microsoft.exchange.recipientpermission","properties":{"Identity":{"type":"string","description":"The mailbox the permission should be given on.","title":"Identity"},"Trustee":{"type":"string","description":"The account to give the permission to.","title":"Trustee"},"AccessRights":{"type":"array","items":{"type":"string"},"description":"The access rights granted to the account. Only 'SendAs' is supported.","title":"AccessRights"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the group exists, absent ensures it is removed","title":"Ensure"}},"required":["Identity","Trustee"]},"microsoft.exchange.remotedomain":{"type":"object","description":"This resource configures the Remote Email Domains in Exchange Online.","title":"Schema for microsoft.exchange.remotedomain","properties":{"Identity":{"type":"string","description":"Specify the Identity for the RemoteDomain.","title":"Identity"},"DomainName":{"type":"string","description":"The DomainName parameter specifies the SMTP domain that you want to establish as a remote domain. A valid value is an SMTP domain (for example, contoso.com). The maximum length is 256 characters.","title":"DomainName"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the RemoteDomain should exist or not.","title":"Ensure"},"AllowedOOFType":{"enum":["External","ExternalLegacy","InternalLegacy","None"],"description":"The AllowedOOFType parameter specifies the type of automatic replies or out-of-office (also known as OOF) notifications than can be sent to recipients in the remote domain. Valid values are: External, ExternalLegacy, InternalLegacy or None","title":"AllowedOOFType"},"AutoForwardEnabled":{"type":"boolean","description":"The AutoForwardEnabled parameter specifies whether to allow messages that are auto-forwarded by client email programs in your organization.","title":"AutoForwardEnabled"},"AutoReplyEnabled":{"type":"boolean","description":"The AutoReplyEnabled parameter specifies whether to allow messages that are automatic replies from client email programs in your organization (for example, automatic reply messages that are generated by rules in Outlook).","title":"AutoReplyEnabled"},"ByteEncoderTypeFor7BitCharsets":{"enum":["Use7Bit","UseQP","UseBase64","UseQPHtmlDetectTextPlain","UseBase64HtmlDetectTextPlain","UseQPHtml7BitTextPlain","UseBase64Html7BitTextPlain","Undefined"],"description":"The ByteEncoderTypeFor7BitCharsets parameter specifies the 7-bit transfer encoding method for MIME format for messages sent to this remote domain.","title":"ByteEncoderTypeFor7BitCharsets"},"CharacterSet":{"type":"string","description":"The CharacterSet parameter specifies a character set for MIME messages without defined character sets that are sent from your organization to recipients in the remote domain.","title":"CharacterSet"},"ContentType":{"enum":["MimeHtmlText","MimeText","MimeHtml"],"description":"The ContentType parameter specifies the outbound message content type and formatting.","title":"ContentType"},"DeliveryReportEnabled":{"type":"boolean","description":"The DeliveryReportEnabled parameter specifies whether to allow delivery reports from client software in your organization to recipients in the remote domain.","title":"DeliveryReportEnabled"},"DisplaySenderName":{"type":"boolean","description":"The DisplaySenderName parameter specifies whether to show the sender's Display Name in the From email address for messages sent to recipients in the remote domain.","title":"DisplaySenderName"},"IsInternal":{"type":"boolean","description":"The IsInternal parameter specifies whether the recipients in the remote domain are considered to be internal recipients.","title":"IsInternal"},"LineWrapSize":{"type":"string","description":"The LineWrapSize parameter specifies the line-wrap size for messages to recipients in the remote domain. Valid values are an integer from 0 through 132 or the value to unlimited. The default value is unlimited.","title":"LineWrapSize"},"MeetingForwardNotificationEnabled":{"type":"boolean","description":"The MeetingForwardNotificationEnabled parameter specifies whether to enable meeting forward notifications for recipients in the remote domain.","title":"MeetingForwardNotificationEnabled"},"Name":{"type":"string","description":"The Name parameter specifies a unique name for the remote domain object. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.","title":"Name"},"NDREnabled":{"type":"boolean","description":"The NDREnabled parameter specifies whether to allow non-delivery reports (also known NDRs or bounce messages) from your organization to recipients in the remote domain.","title":"NDREnabled"},"NonMimeCharacterSet":{"type":"string","description":"The NonMimeCharacterSet parameter specifies a character set for plain text messages without defined character sets that are sent from your organization to recipients in the remote domain.","title":"NonMimeCharacterSet"},"PreferredInternetCodePageForShiftJis":{"enum":["50220","50221","50222","Undefined"],"description":"The PreferredInternetCodePageForShiftJis parameter specifies the specific code page to use for Shift JIS character encoding in messages that are sent to recipients in the remote domain.","title":"PreferredInternetCodePageForShiftJis"},"RequiredCharsetCoverage":{"type":"integer","description":"The RequiredCharsetCoverage parameter specifies a percentage threshold for characters in a message that must match to apply your organization's preferred character set before switching to automatic character set detection.","title":"RequiredCharsetCoverage"},"TargetDeliveryDomain":{"type":"boolean","description":"The TargetDeliveryDomain parameter specifies whether the remote domain is used in cross-forest deployments to generate target email addresses for new mail users that represent users in the other organization (for example, all mailboxes hosted on Exchange Online are represented as mail users in your on-premises organization).","title":"TargetDeliveryDomain"},"TNEFEnabled":{"type":"boolean","description":"The TNEFEnabled parameter specifies whether Transport Neutral Encapsulation Format (TNEF) message encoding is used on messages sent to the remote domain.","title":"TNEFEnabled"},"TrustedMailInboundEnabled":{"type":"boolean","description":"The TrustedMailInboundEnabled parameter specifies whether messages from senders in the remote domain are treated as trusted messages.","title":"TrustedMailInboundEnabled"},"TrustedMailOutboundEnabled":{"type":"boolean","description":"The TrustedMailOutboundEnabled parameter specifies whether messages sent to recipients in the remote domain are treated as trusted messages.","title":"TrustedMailOutboundEnabled"},"UseSimpleDisplayName":{"type":"boolean","description":"The UseSimpleDisplayName parameter specifies whether the sender's simple display name is used for the From email address in messages sent to recipients in the remote domain.","title":"UseSimpleDisplayName"}},"required":["Identity"]},"microsoft.exchange.reportsubmissionpolicy":{"type":"object","description":"Create or modify an EXOReportSubmissionPolicy in your cloud-based organization.","title":"Schema for microsoft.exchange.reportsubmissionpolicy","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Specifies the resource is a single instance, the value must be 'Yes'.","title":"IsSingleInstance"},"DisableQuarantineReportingOption":{"type":"boolean","description":"The DisableQuarantineReportingOption parameter allows or prevents users from reporting messages in quarantine.","title":"DisableQuarantineReportingOption"},"EnableCustomNotificationSender":{"type":"boolean","description":"The EnableCustomNotificationSender parameter specifies whether a custom sender email address is used for result messages after an admin reviews and marks the reported messages as junk, not junk, or phishing.","title":"EnableCustomNotificationSender"},"EnableOrganizationBranding":{"type":"boolean","description":"The EnableOrganizationBranding parameter specifies whether to show the company logo in the footer of result messages that users receive after an admin reviews and marks the reported messages as junk, not junk, or phishing.","title":"EnableOrganizationBranding"},"EnableReportToMicrosoft":{"type":"boolean","description":"The EnableReportToMicrosoft parameter specifies whether Microsoft integrated reporting experience is enabled or disabled.","title":"EnableReportToMicrosoft"},"EnableThirdPartyAddress":{"type":"boolean","description":"The EnableThirdPartyAddress parameter specifies whether you're using third-party reporting tools in Outlook instead of Microsoft tools to send messages to the reporting mailbox in Exchange Online.","title":"EnableThirdPartyAddress"},"EnableUserEmailNotification":{"type":"boolean","description":"The EnableUserEmailNotification parameter species whether users receive result messages after an admin reviews and marks the reported messages as junk, not junk, or phishing.","title":"EnableUserEmailNotification"},"JunkReviewResultMessage":{"type":"string","description":"The JunkReviewResultMessage parameter specifies the custom text to use in result messages after an admin reviews and marks the reported messages as junk.","title":"JunkReviewResultMessage"},"NotJunkReviewResultMessage":{"type":"string","description":"The NotJunkReviewResultMessage parameter specifies the custom text to use in result messages after an admin reviews and marks the reported messages as not junk.","title":"NotJunkReviewResultMessage"},"NotificationFooterMessage":{"type":"string","description":"The NotificationFooterMessage parameter specifies the custom footer text to use in email notifications after an admin reviews and marks the reported messages as junk, not junk, or phishing.","title":"NotificationFooterMessage"},"NotificationSenderAddress":{"type":"string","description":"The NotificationSenderAddress parameter specifies the sender email address to use in result messages after an admin reviews and marks the reported messages as junk, not junk, or phishing.","title":"NotificationSenderAddress"},"PhishingReviewResultMessage":{"type":"string","description":"The PhishingReviewResultMessage parameter specifies the custom text to use in result messages after an admin reviews and marks the reported messages as phishing.","title":"PhishingReviewResultMessage"},"PostSubmitMessage":{"type":"string","description":"The PostSubmitMessage parameter specifies the custom pop-up message text to use in Outlook notifications after users report messages.","title":"PostSubmitMessage"},"PostSubmitMessageEnabled":{"type":"boolean","description":"The PostSubmitMessageEnabled parameter enables or disables the pop-up Outlook notifications that users see after they report messages using Microsoft reporting tools.","title":"PostSubmitMessageEnabled"},"PostSubmitMessageTitle":{"type":"string","description":"The PostSubmitMessage parameter parameter specifies the custom pop-up message title to use in Outlook notifications after users report messages.","title":"PostSubmitMessageTitle"},"PreSubmitMessage":{"type":"string","description":"The PreSubmitMessage parameter specifies the custom pop-up message text to use in Outlook notifications before users report messages. ","title":"PreSubmitMessage"},"PreSubmitMessageEnabled":{"type":"boolean","description":"The PreSubmitMessageEnabled parameter enables or disables the pop-up Outlook notifications that users see before they report messages using Microsoft reporting tools.","title":"PreSubmitMessageEnabled"},"PreSubmitMessageTitle":{"type":"string","description":"The PreSubmitMessage parameter parameter specifies the custom pop-up message title to use in Outlook notifications before users report messages.","title":"PreSubmitMessageTitle"},"ReportJunkAddresses":{"type":"array","items":{"type":"string"},"description":"The ReportJunkAddresses parameter specifies the email address of the reporting mailbox in Exchange Online to receive user reported messages in reporting in Outlook using Microsoft or third-party reporting tools in Outlook.","title":"ReportJunkAddresses"},"ReportJunkToCustomizedAddress":{"type":"boolean","description":"The ReportJunkToCustomizedAddress parameter specifies whether to send user reported messages from Outlook (using Microsoft or third-party reporting tools) to the reporting mailbox as part of reporting in Outlook. ","title":"ReportJunkToCustomizedAddress"},"ReportNotJunkAddresses":{"type":"array","items":{"type":"string"},"description":"The ReportNotJunkAddresses parameter specifies the email address of the reporting mailbox in Exchange Online to receive user reported messages in reporting in Outlook using Microsoft or third-party reporting tools in Outlook.","title":"ReportNotJunkAddresses"},"ReportNotJunkToCustomizedAddress":{"type":"boolean","description":"The ReportNotJunkToCustomizedAddress parameter specifies whether to send user reported messages from Outlook (using Microsoft or third-party reporting tools) to the reporting mailbox as part of reporting in Outlook.","title":"ReportNotJunkToCustomizedAddress"},"ReportPhishAddresses":{"type":"array","items":{"type":"string"},"description":"The ReportPhishAddresses parameter specifies the email address of the reporting mailbox in Exchange Online to receive user reported messages in reporting in Outlook using Microsoft or third-party reporting tools in Outlook.","title":"ReportPhishAddresses"},"ReportPhishToCustomizedAddress":{"type":"boolean","description":"The ReportPhishToCustomizedAddress parameter specifies whether to send user reported messages from Outlook (using Microsoft or third-party reporting tools) to the reporting mailbox as part of reporting in Outlook.","title":"ReportPhishToCustomizedAddress"},"ThirdPartyReportAddresses":{"type":"array","items":{"type":"string"},"description":"Use the ThirdPartyReportAddresses parameter to specify the email address of the reporting mailbox when you're using a third-party product for user submissions instead of reporting in Outlook.","title":"ThirdPartyReportAddresses"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this report submission policy should exist.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.exchange.reportsubmissionrule":{"type":"object","description":"Create or modify an EXOReportSubmissionRule in your cloud-based organization.","title":"Schema for microsoft.exchange.reportsubmissionrule","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Specifies the resource is a single instance, the value must be 'Yes'.","title":"IsSingleInstance"},"Identity":{"type":"string","description":"The Identity parameter specifies the report submission rule that you want to modify.","title":"Identity"},"Comments":{"type":"string","description":"The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time.","title":"Comments"},"SentTo":{"type":"array","items":{"type":"string"},"description":"The SentTo parameter specifies the email address of the reporting mailbox in Exchange Online where user reported messages are sent.","title":"SentTo"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this report submission rule should exist.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.exchange.resourceconfiguration":{"type":"object","description":"Modify the resource Configuration policy in your cloud-based organization.","title":"Schema for microsoft.exchange.resourceconfiguration","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"ResourcePropertySchema":{"type":"array","items":{"type":"string"},"description":"The ResourcePropertySchema parameter specifies the custom resource property that you want to make available to room or equipment mailboxes. This parameter uses the syntax Room/<Text> or Equipment/<Text> where the <Text> value doesn't contain spaces. For example, Room/Whiteboard or Equipment/Van.","title":"ResourcePropertySchema"},"Ensure":{"enum":["Present","Absent"],"description":"Specifies if this Outbound connector should exist.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.exchange.roleassignmentpolicy":{"type":"object","description":"This resource configures Role Assignment Policies in Exchange Online.","title":"Schema for microsoft.exchange.roleassignmentpolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the new name of the assignment policy. The maximum length is 64 characters.","title":"Name"},"Description":{"type":"string","description":"The Description parameter specifies the description that's displayed when the role assignment policy is viewed using the Get-RoleAssignmentPolicy cmdlet.","title":"Description"},"IsDefault":{"type":"boolean","description":"The IsDefault switch makes the assignment policy the default assignment policy.","title":"IsDefault"},"Roles":{"type":"array","items":{"type":"string"},"description":"The Roles parameter specifies the management roles to assign to the role assignment policy when it's created.","title":"Roles"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Role Assignment Policy should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.rolegroup":{"type":"object","description":"This resource configures Role Groups in Exchange Online.","title":"Schema for microsoft.exchange.rolegroup","properties":{"Name":{"type":"string","description":"The Name parameter specifies the name of the role. The maximum length of the name is 64 characters.","title":"Name"},"Description":{"type":"string","description":"The Description parameter specifies the description that's displayed when the role group is viewed using the Get-RoleGroup cmdlet. Enclose the description in quotation marks","title":"Description"},"Members":{"type":"array","items":{"type":"string"},"description":"The Members parameter specifies the mailboxes or mail-enabled USGs to add as a member of the role group. You can identify the user or group by the name, DN, or primary SMTP address value. You can specify multiple members separated by commas (Value1,Value2,...ValueN). If the value contains spaces, enclose the value in quotation marks","title":"Members"},"Roles":{"type":"array","items":{"type":"string"},"description":"The Roles parameter specifies the management roles to assign to the role group when it's created. If a role name contains spaces, enclose the name in quotation marks. If you want to assign more that one role, separate the role names with commas.","title":"Roles"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Role Group should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.safeattachmentpolicy":{"type":"object","description":"This resource configures the settings of the Safe Attachments policies\r\nin your cloud-based organization.","title":"Schema for microsoft.exchange.safeattachmentpolicy","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the name of the SafeAttachmentpolicy that you want to modify.","title":"Identity"},"Action":{"enum":["Block","Replace","Allow","DynamicDelivery"],"description":"The Action parameter specifies the action for the Safe Attachments policy.","title":"Action"},"ActionOnError":{"type":"boolean","description":"The ActionOnError parameter specifies the error handling option for Safe Attachments scanning (what to do if scanning times out or an error occurs). Valid values are: $true: The action specified by the Action parameter is applied to messages even when the attachments aren't successfully scanned. $false: The action specified by the Action parameter isn't applied to messages when the attachments aren't successfully scanned. This is the default value.","title":"ActionOnError"},"AdminDisplayName":{"type":"string","description":"The AdminDisplayName parameter specifies a description for the policy.","title":"AdminDisplayName"},"Enable":{"type":"boolean","description":"Specify if this policy should be enabled. Default is $true.","title":"Enable"},"QuarantineTag":{"type":"string","description":"The QuarantineTag specifies the quarantine policy that's used on messages that are quarantined as malware by Safe Attachments.","title":"QuarantineTag"},"Redirect":{"type":"boolean","description":"The Redirect parameter specifies whether to send detected malware attachments to another email address. Valid values are: $true: Malware attachments are sent to the email address specified by the RedirectAddress parameter. $false: Malware attachments aren't sent to another email address. This is the default value.","title":"Redirect"},"RedirectAddress":{"type":"string","description":"The RedirectAddress parameter specifies the email address where detected malware attachments are sent when the Redirect parameter is set to the value $true.","title":"RedirectAddress"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this policy should exist or not.","title":"Ensure"}},"required":["Identity"]},"microsoft.exchange.safeattachmentrule":{"type":"object","description":"This resource configures an Safe Attachment Rule in Exchange Online.","title":"Schema for microsoft.exchange.safeattachmentrule","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the name of the SafeAttachment rule that you want to modify.","title":"Identity"},"SafeAttachmentPolicy":{"type":"string","description":"The SafeAttachmentPolicy parameter specifies the name of the SafeAttachment policy that's associated with the SafeAttachment rule.","title":"SafeAttachmentPolicy"},"Enabled":{"type":"boolean","description":"Specify if this rule should be enabled. Default is $true.","title":"Enabled"},"Priority":{"type":"integer","description":"The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.","title":"Priority"},"Comments":{"type":"string","description":"The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.","title":"Comments"},"ExceptIfRecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"ExceptIfRecipientDomainIs"},"ExceptIfSentTo":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"ExceptIfSentTo"},"ExceptIfSentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.","title":"ExceptIfSentToMemberOf"},"RecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"RecipientDomainIs"},"SentTo":{"type":"array","items":{"type":"string"},"description":"The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"SentTo"},"SentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.","title":"SentToMemberOf"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"}},"required":["Identity","SafeAttachmentPolicy"]},"microsoft.exchange.safelinkspolicy":{"type":"object","description":"This resource configures the settings of the SafeLinks policies\r\nin your cloud-based organization.","title":"Schema for microsoft.exchange.safelinkspolicy","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the SafeLinks policy that you want to modify.","title":"Identity"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this policy should exist or not.","title":"Ensure"},"AdminDisplayName":{"type":"string","description":"The AdminDisplayName parameter specifies a description for the policy.","title":"AdminDisplayName"},"AllowClickThrough":{"type":"boolean","description":"The AllowClickThrough parameter specifies whether to allow users to click through to the original URL on warning pages.","title":"AllowClickThrough"},"CustomNotificationText":{"type":"string","description":"The custom notification text specifies the customized notification text to show to users.","title":"CustomNotificationText"},"DeliverMessageAfterScan":{"type":"boolean","description":"The DeliverMessageAfterScan parameter specifies whether to deliver email messages only after Safe Links scanning is complete. Valid values are: $true: Wait until Safe Links scanning is complete before delivering the message. $false: If Safe Links scanning can't complete, deliver the message anyway. This is the default value.","title":"DeliverMessageAfterScan"},"DoNotRewriteUrls":{"type":"array","items":{"type":"string"},"description":"The DoNotRewriteUrls parameter specifies a URL that's skipped by Safe Links scanning. You can specify multiple values separated by commas.","title":"DoNotRewriteUrls"},"EnableForInternalSenders":{"type":"boolean","description":"The EnableForInternalSenders parameter specifies whether the Safe Links policy is applied to messages sent between internal senders and internal recipients within the same Exchange Online organization.","title":"EnableForInternalSenders"},"EnableOrganizationBranding":{"type":"boolean","description":"The EnableOrganizationBranding parameter specifies whether your organization's logo is displayed on Safe Links warning and notification pages.","title":"EnableOrganizationBranding"},"EnableSafeLinksForOffice":{"type":"boolean","description":"The EnableSafeLinksForOffice parameter specifies whether to enable Safe Links protection for supported Office desktop, mobile, or web apps.","title":"EnableSafeLinksForOffice"},"EnableSafeLinksForTeams":{"type":"boolean","description":"The EnableSafeLinksForTeams parameter specifies whether Safe Links is enabled for Microsoft Teams. Valid values are: $true: Safe Links is enabled for Teams. If a protected user clicks a malicious link in a Teams conversation, group chat, or from channels, a warning page will appear in the default web browser. $false: Safe Links isn't enabled for Teams. This is the default value.","title":"EnableSafeLinksForTeams"},"EnableSafeLinksForEmail":{"type":"boolean","description":"The EnableSafeLinksForEmail parameter specifies whether to enable Safe Links protection for email messages. Valid values are: $true: Safe Links is enabled for email. When a user clicks a link in an email, the link is checked by Safe Links. If the link is found to be malicious, a warning page appears in the default web browser. $false: Safe Links isn't enabled for email. This is the default value.","title":"EnableSafeLinksForEmail"},"DisableUrlRewrite":{"type":"boolean","description":"The DisableUrlRewrite parameter specifies whether to rewrite (wrap) URLs in email messages. Valid values are: $true: URLs in messages are not rewritten, but messages are still scanned by Safe Links prior to delivery. Time of click checks on links are done using the Safe Links API in supported Outlook clients (currently, Outlook for Windows and Outlook for Mac). Typically, we don't recommend using this value. $false: URLs in messages are rewritten. API checks still occur on unwrapped URLs in supported clients if the user is in a valid Safe Links policy. This is the default value.","title":"DisableUrlRewrite"},"ScanUrls":{"type":"boolean","description":"The ScanUrls parameter specifies whether to enable or disable the scanning of links in email messages. Valid values are: $true: Scanning links in email messages is enabled. $false: Scanning links in email messages is disabled. This is the default value.","title":"ScanUrls"},"TrackClicks":{"type":"boolean","description":"The TrackClicks parameter specifies whether to track user clicks related to Safe Links protection of links.","title":"TrackClicks"},"UseTranslatedNotificationText":{"type":"boolean","description":"The UseTranslatedNotificationText specifies whether to use Microsoft Translator to automatically localize the custom notification text that you specified with the CustomNotificationText parameter.","title":"UseTranslatedNotificationText"}},"required":["Identity"]},"microsoft.exchange.safelinksrule":{"type":"object","description":"This resource configures an SafeLinks Rule in Exchange Online.","title":"Schema for microsoft.exchange.safelinksrule","properties":{"Identity":{"type":"string","description":"The Identity parameter specifies the name of the SafeLink rule that you want to modify.","title":"Identity"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"},"SafeLinksPolicy":{"type":"string","description":"The SafeLinksPolicy parameter specifies the name of the SafeLink policy that's associated with the SafeLinksing rule.","title":"SafeLinksPolicy"},"Enabled":{"type":"boolean","description":"Specify if this rule should be enabled. Default is $true.","title":"Enabled"},"Priority":{"type":"integer","description":"The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.","title":"Priority"},"Comments":{"type":"string","description":"The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.","title":"Comments"},"ExceptIfRecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"ExceptIfRecipientDomainIs"},"ExceptIfSentTo":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"ExceptIfSentTo"},"ExceptIfSentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.","title":"ExceptIfSentToMemberOf"},"RecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"RecipientDomainIs"},"SentTo":{"type":"array","items":{"type":"string"},"description":"The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"SentTo"},"SentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.","title":"SentToMemberOf"}},"required":["Identity","SafeLinksPolicy"]},"microsoft.exchange.sharedmailbox":{"type":"object","description":"This resource allows users to create Office 365 Shared Mailboxes.","title":"Schema for microsoft.exchange.sharedmailbox","properties":{"DisplayName":{"type":"string","description":"The display name of the Shared Mailbox","title":"DisplayName"},"Identity":{"type":"string","description":"The unique identifier of the Shared Mailbox","title":"Identity"},"PrimarySMTPAddress":{"type":"string","description":"The primary email address of the Shared Mailbox","title":"PrimarySMTPAddress"},"Alias":{"type":"string","description":"The alias of the Shared Mailbox","title":"Alias"},"EmailAddresses":{"type":"array","items":{"type":"string"},"description":"The EmailAddresses parameter specifies all the email addresses (proxy addresses) for the Shared Mailbox","title":"EmailAddresses"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the group exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.exchange.sharingpolicy":{"type":"object","description":"This resource configures Sharing Policies in Exchange Online.","title":"Schema for microsoft.exchange.sharingpolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the sharing policy. The maximum length is 64 characters.","title":"Name"},"Default":{"type":"boolean","description":"The Default switch specifies that the sharing policy is the default sharing policy for all mailboxes.","title":"Default"},"Enabled":{"type":"boolean","description":"The Enabled parameter specifies whether to enable the sharing policy. Valid values for this parameter are $true or $false.","title":"Enabled"},"Domains":{"type":"array","items":{"type":"string"},"description":"The Domains parameter specifies domains to which this policy applies and the sharing policy action.","title":"Domains"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Sharing Policy should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.sweeprule":{"type":"object","description":"Use this resource to create Sweep rules in mailboxes. Sweep rules run at regular intervals to help keep your Inbox clean.","title":"Schema for microsoft.exchange.sweeprule","properties":{"Name":{"type":"string","description":"The Name parameter specifies the name of the Sweep rule. If the value contains spaces, enclose the value in quotation marks.","title":"Name"},"Provider":{"type":"string","description":"The Provider parameter specifies the provider for the Sweep rule. If the value contains spaces, enclose the value in quotation marks. For Sweep rules that you create in Outlook on the web, the default value is Exchange16.","title":"Provider"},"DestinationFolder":{"type":"string","description":"The DestinationFolder parameter specifies an action for the Sweep rule that moves messages to the specified folder.","title":"DestinationFolder"},"Enabled":{"type":"boolean","description":"The Enabled parameter specifies whether the Sweep rule is enabled or disabled.","title":"Enabled"},"KeepForDays":{"type":"integer","description":"The KeepForDays parameter specifies an action for the Sweep rule that specifies the number of days to keep messages that match the conditions of the rule. After the number of days have passed, the messages are moved to the location that's specified by the DestinationFolder parameter (by default, the Deleted Items folder). You can't use this parameter with the KeepLatest parameter and the Sweep rule must contain a KeepForDays or KeepLatest parameter value.","title":"KeepForDays"},"KeepLatest":{"type":"integer","description":"The KeepLatest parameter specifies an action for the Sweep rule that specifies the number of messages to keep that match the conditions of the rule. After the number of messages is exceeded, the oldest messages are moved to the location that's specified by the DestinationFolder parameter (by default, the Deleted Items folder). You can't use this parameter with the KeepForDays parameter and the Sweep rule must contain a KeepForDays or KeepLatest parameter value.","title":"KeepLatest"},"Mailbox":{"type":"string","description":"The Mailbox parameter specifies the mailbox where you want to create the Sweep rule. You can use any value that uniquely identifies the mailbox.","title":"Mailbox"},"SenderName":{"type":"string","description":"The SenderName parameter specifies a condition for the Sweep rule that looks for the specified sender in messages. For internal senders, you can use any value that uniquely identifies the sender.","title":"SenderName"},"SourceFolder":{"type":"string","description":"The SourceFolder parameter specifies a condition for the Sweep rule that looks for messages in the specified folder.","title":"SourceFolder"},"SystemCategory":{"type":"string","description":"The SystemCategory parameter specifies a condition for the sweep rule that looks for messages with the specified system category. System categories are available to all mailboxes in the organization.","title":"SystemCategory"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.exchange.transportconfig":{"type":"object","description":"This resource configures the Exchange Online transport\r\nsettings.","title":"Schema for microsoft.exchange.transportconfig","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Specifies the resource is a single instance, the value must be 'Yes'.","title":"IsSingleInstance"},"AddressBookPolicyRoutingEnabled":{"type":"boolean","description":"The AddressBookPolicyRoutingEnabled parameter controls how recipients are resolved in an organization that uses address book policies to create separate virtual organizations within the same Exchange organization.","title":"AddressBookPolicyRoutingEnabled"},"AllowLegacyTLSClients":{"type":"boolean","description":"Allow legacy TLS clients","title":"AllowLegacyTLSClients"},"ClearCategories":{"type":"boolean","description":"The ClearCategories parameter keeps or removes Microsoft Outlook message categories during content conversion.","title":"ClearCategories"},"ConvertDisclaimerWrapperToEml":{"type":"boolean","description":"The ConvertDisclaimerWrapperToEml parameter specifies whether the original message will be added as a TNEF attachment or a regular EML attachment to a disclaimer.","title":"ConvertDisclaimerWrapperToEml"},"DSNConversionMode":{"type":"string","description":"The DSNConversionMode parameter controls how Exchange handles delivery status notifications that are generated by earlier versions of Exchange or other messaging systems.","title":"DSNConversionMode"},"ExternalDelayDsnEnabled":{"type":"boolean","description":"The ExternalDelayDsnEnabled parameter specifies whether a delay delivery status notification (DSN) message should be created for external messages that couldn't be immediately delivered. ","title":"ExternalDelayDsnEnabled"},"ExternalDsnDefaultLanguage":{"type":"string","description":"The ExternalDsnDefaultLanguage parameter specifies which Exchange server language should be used by default when you create external DSN messages.","title":"ExternalDsnDefaultLanguage"},"ExternalDsnLanguageDetectionEnabled":{"type":"boolean","description":"The ExternalDsnLanguageDetectionEnabled parameter specifies whether the server should try to send an external DSN message in the same language as the original message that generated the notification.","title":"ExternalDsnLanguageDetectionEnabled"},"ExternalDsnReportingAuthority":{"type":"string","description":"The ExternalDsnReportingAuthority parameter specifies the domain in the machine-readable part of external DSN messages. ","title":"ExternalDsnReportingAuthority"},"ExternalDsnSendHtml":{"type":"boolean","description":"The ExternalDsnSendHtml parameter specifies whether external DSN messages should be HTML or plain text.","title":"ExternalDsnSendHtml"},"ExternalPostmasterAddress":{"type":"string","description":"The ExternalPostmasterAddress parameter specifies the email address in the From header field of an external DSN message.","title":"ExternalPostmasterAddress"},"HeaderPromotionModeSetting":{"type":"string","description":"The HeaderPromotionModeSetting parameter specifies whether named properties are created for custom X-headers on messages received.","title":"HeaderPromotionModeSetting"},"InternalDelayDsnEnabled":{"type":"boolean","description":"The InternalDelayDsnEnabled parameter specifies whether a delay DSN message should be created for messages sent to or from recipients or senders in the same Exchange organization that couldn't be immediately delivered.","title":"InternalDelayDsnEnabled"},"InternalDsnDefaultLanguage":{"type":"string","description":"The InternalDsnDefaultLanguage parameter specifies which Exchange server language should be used by default when you create internal DSN messages.","title":"InternalDsnDefaultLanguage"},"InternalDsnLanguageDetectionEnabled":{"type":"boolean","description":"The InternalDsnLanguageDetectionEnabled parameter specifies whether the server should try to send an internal DSN message in the same language as the original message that generated the notification.","title":"InternalDsnLanguageDetectionEnabled"},"InternalDsnReportingAuthority":{"type":"string","description":"The InternalDsnReportingAuthority parameter specifies the domain in the machine-readable part of internal DSN messages.","title":"InternalDsnReportingAuthority"},"InternalDsnSendHtml":{"type":"boolean","description":"The InternalDsnSendHtml parameter specifies whether internal DSN messages should be HTML or plain text.","title":"InternalDsnSendHtml"},"JournalMessageExpirationDays":{"type":"integer","description":"The JournalMessageExpirationDays parameter extends the number of days that undeliverable journal reports are queued before they expire.","title":"JournalMessageExpirationDays"},"JournalingReportNdrTo":{"type":"string","description":"The JournalingReportNdrTo parameter specifies the email address to which journal reports are sent if the journaling mailbox is unavailable.","title":"JournalingReportNdrTo"},"MaxRecipientEnvelopeLimit":{"type":"string","description":"The MaxRecipientEnvelopeLimit parameter specifies the maximum number of recipients in a message.","title":"MaxRecipientEnvelopeLimit"},"ReplyAllStormBlockDurationHours":{"type":"integer","description":"Reply all storm block duration hours.","title":"ReplyAllStormBlockDurationHours"},"ReplyAllStormDetectionMinimumRecipients":{"type":"integer","description":"Reply all storm detection minimum recipients.","title":"ReplyAllStormDetectionMinimumRecipients"},"ReplyAllStormDetectionMinimumReplies":{"type":"integer","description":"Reply all storm detection minimum replies.","title":"ReplyAllStormDetectionMinimumReplies"},"ReplyAllStormProtectionEnabled":{"type":"boolean","description":"Reply all storm protection enabled.","title":"ReplyAllStormProtectionEnabled"},"Rfc2231EncodingEnabled":{"type":"boolean","description":"The Rfc2231EncodingEnabled parameter specifies whether the RFC 2231 encoding of MIME parameters for outbound messages is enabled in your organization.","title":"Rfc2231EncodingEnabled"},"SmtpClientAuthenticationDisabled":{"type":"boolean","description":"The SmtpClientAuthenticationDisabled parameter specifies whether to disable authenticated SMTP (SMTP AUTH) for the whole organization.","title":"SmtpClientAuthenticationDisabled"}},"required":["IsSingleInstance"]},"microsoft.exchange.transportrule":{"type":"object","description":"This resource configures Transport Rules in Exchange Online.","title":"Schema for microsoft.exchange.transportrule","properties":{"Name":{"type":"string","description":"The Name parameter specifies the display name of the transport rule to be created. The maximum length is 64 characters.","title":"Name"},"ADComparisonAttribute":{"type":"string","description":"This parameter specifies a condition or part of a condition for the rule. The name of the corresponding exception parameter starts with ExceptIf.","title":"ADComparisonAttribute"},"ADComparisonOperator":{"enum":["Equal","NotEqual"],"description":"This parameter specifies a condition or part of a condition for the rule. The name of the corresponding exception parameter starts with ExceptIf.","title":"ADComparisonOperator"},"ActivationDate":{"type":"string","description":"The ActivationDate parameter specifies when the rule starts processing messages. The rule won't take any action on messages until the specified date/time.","title":"ActivationDate"},"AddManagerAsRecipientType":{"enum":["To","Cc","Bcc","Redirect"],"description":"The AddManagerAsRecipientType parameter specifies an action that delivers or redirects messages to the user that's defined in the sender's Manager attribute.","title":"AddManagerAsRecipientType"},"AddToRecipients":{"type":"array","items":{"type":"string"},"description":"The AddToRecipients parameter specifies an action that adds recipients to the To field of messages.","title":"AddToRecipients"},"AnyOfCcHeader":{"type":"array","items":{"type":"string"},"description":"The AnyOfCcHeader parameter specifies a condition that looks for recipients in the Cc field of messages.","title":"AnyOfCcHeader"},"AnyOfCcHeaderMemberOf":{"type":"array","items":{"type":"string"},"description":"The AnyOfCcHeaderMemberOf parameter specifies a condition that looks for group members in the Cc field of messages.","title":"AnyOfCcHeaderMemberOf"},"AnyOfRecipientAddressContainsWords":{"type":"array","items":{"type":"string"},"description":"The AnyOfRecipientAddressContainsWords parameter specifies a condition that looks for words in recipient email addresses.","title":"AnyOfRecipientAddressContainsWords"},"AnyOfRecipientAddressMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The AnyOfRecipientAddressMatchesPatterns parameter specifies a condition that looks for text patterns in recipient email addresses by using regular expressions.","title":"AnyOfRecipientAddressMatchesPatterns"},"AnyOfToCcHeader":{"type":"array","items":{"type":"string"},"description":"The AnyOfToCcHeader parameter specifies a condition that looks for recipients in the To or Cc fields of messages.","title":"AnyOfToCcHeader"},"AnyOfToCcHeaderMemberOf":{"type":"array","items":{"type":"string"},"description":"The AnyOfToCcHeaderMemberOf parameter specifies a condition that looks for group members in the To and Cc fields of messages.","title":"AnyOfToCcHeaderMemberOf"},"AnyOfToHeader":{"type":"array","items":{"type":"string"},"description":"The AnyOfToHeader parameter specifies a condition that looks for recipients in the To field of messages.","title":"AnyOfToHeader"},"AnyOfToHeaderMemberOf":{"type":"array","items":{"type":"string"},"description":"The AnyOfToHeaderMemberOf parameter specifies a condition that looks for group members in the To field of messages.","title":"AnyOfToHeaderMemberOf"},"ApplyClassification":{"type":"string","description":"The ApplyClassification parameter specifies an action that applies a message classification to messages. ","title":"ApplyClassification"},"ApplyHtmlDisclaimerFallbackAction":{"enum":["Wrap","Ignore","Reject"],"description":"The ApplyHtmlDisclaimerFallbackAction parameter specifies what to do if the HTML disclaimer can't be added to a message.","title":"ApplyHtmlDisclaimerFallbackAction"},"ApplyHtmlDisclaimerLocation":{"enum":["Append","Prepend"],"description":"The ApplyHtmlDisclaimerLocation parameter specifies where to insert the HTML disclaimer text in the body of messages.","title":"ApplyHtmlDisclaimerLocation"},"ApplyHtmlDisclaimerText":{"type":"string","description":"The ApplyHtmlDisclaimerText parameter specifies an action that adds the disclaimer text to messages.","title":"ApplyHtmlDisclaimerText"},"ApplyOME":{"type":"boolean","description":"The ApplyOME parameter specifies an action that encrypts messages and their attachments by using Office 365 Message Encryption.","title":"ApplyOME"},"ApplyRightsProtectionCustomizationTemplate":{"type":"string","description":"The ApplyRightsProtectionCustomizationTemplate parameter specifies an action that applies a custom branding template for OME encrypted messages.","title":"ApplyRightsProtectionCustomizationTemplate"},"ApplyRightsProtectionTemplate":{"type":"string","description":"The ApplyRightsProtectionTemplate parameter specifies an action that applies rights management service (RMS) templates to messages. ","title":"ApplyRightsProtectionTemplate"},"AttachmentContainsWords":{"type":"array","items":{"type":"string"},"description":"The AttachmentContainsWords parameter specifies a condition that looks for words in message attachments. ","title":"AttachmentContainsWords"},"AttachmentExtensionMatchesWords":{"type":"array","items":{"type":"string"},"description":"The AttachmentExtensionMatchesWords parameter specifies a condition that looks for words in the file name extensions of message attachments.","title":"AttachmentExtensionMatchesWords"},"AttachmentHasExecutableContent":{"type":"boolean","description":"The AttachmentHasExecutableContent parameter specifies a condition that looks for executable content in message attachments.","title":"AttachmentHasExecutableContent"},"AttachmentIsPasswordProtected":{"type":"boolean","description":"The AttachmentIsPasswordProtected parameter specifies a condition that looks for password protected files in messages (because the contents of the file can't be inspected).","title":"AttachmentIsPasswordProtected"},"AttachmentIsUnsupported":{"type":"boolean","description":"The AttachmentIsUnsupported parameter specifies a condition that looks for unsupported file types in messages.","title":"AttachmentIsUnsupported"},"AttachmentMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The AttachmentMatchesPatterns parameter specifies a condition that looks for text patterns in the content of message attachments by using regular expressions.","title":"AttachmentMatchesPatterns"},"AttachmentNameMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The AttachmentNameMatchesPatterns parameter specifies a condition that looks for text patterns in the file name of message attachments by using regular expressions.","title":"AttachmentNameMatchesPatterns"},"AttachmentProcessingLimitExceeded":{"type":"boolean","description":"The AttachmentProcessingLimitExceeded parameter specifies a condition that looks for messages where attachment scanning didn't complete.","title":"AttachmentProcessingLimitExceeded"},"AttachmentPropertyContainsWords":{"type":"array","items":{"type":"string"},"description":"The AttachmentPropertyContainsWords parameter specifies a condition that looks for words in the properties of attached Office documents.","title":"AttachmentPropertyContainsWords"},"AttachmentSizeOver":{"type":"string","description":"The AttachmentSizeOver parameter specifies a condition that looks for messages where any attachment is greater than the specified size.","title":"AttachmentSizeOver"},"BetweenMemberOf1":{"type":"array","items":{"type":"string"},"description":"The BetweenMemberOf1 parameter specifies a condition that looks for messages that are sent between group members.","title":"BetweenMemberOf1"},"BetweenMemberOf2":{"type":"array","items":{"type":"string"},"description":"The BetweenMemberOf2 parameter specifies a condition that looks for messages that are sent between group members.","title":"BetweenMemberOf2"},"BlindCopyTo":{"type":"array","items":{"type":"string"},"description":"The BlindCopyTo parameter specifies an action that adds recipients to the Bcc field of messages. ","title":"BlindCopyTo"},"Comments":{"type":"string","description":"The Comments parameter specifies optional descriptive text for the rule. The length of the comment can't exceed 1024 characters.","title":"Comments"},"ContentCharacterSetContainsWords":{"type":"array","items":{"type":"string"},"description":"The ContentCharacterSetContainsWords parameter specifies a condition that looks for character set names in messages.","title":"ContentCharacterSetContainsWords"},"CopyTo":{"type":"array","items":{"type":"string"},"description":"The CopyTo parameter specifies an action that adds recipients to the Cc field of messages.","title":"CopyTo"},"DeleteMessage":{"type":"boolean","description":"The DeleteMessage parameter specifies an action that silently drops messages without an NDR.","title":"DeleteMessage"},"DlpPolicy":{"type":"string","description":"The DlpPolicy parameter specifies the data loss prevention (DLP) policy that's associated with the rule.","title":"DlpPolicy"},"Enabled":{"type":"boolean","description":"The Enabled parameter specifies whether the new rule is created as enabled or disabled.","title":"Enabled"},"ExceptIfADComparisonAttribute":{"type":"string","description":"The ExceptIfADComparisonAttribute parameter specifies an exception that compares an Active Directory attribute between the sender and all recipients of the message.","title":"ExceptIfADComparisonAttribute"},"ExceptIfADComparisonOperator":{"enum":["Equal","NotEqual"],"description":"The ExceptIfADComparisonOperator parameter specifies the comparison operator for the ExceptIfADComparisonAttribute parameter.","title":"ExceptIfADComparisonOperator"},"ExceptIfAnyOfCcHeader":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAnyOfCcHeader parameter specifies an exception that looks for recipients in the Cc field of messages.","title":"ExceptIfAnyOfCcHeader"},"ExceptIfAnyOfCcHeaderMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAnyOfCcHeaderMemberOf parameter specifies an exception that looks for group members in the Cc field of messages. You can use any value that uniquely identifies the group.","title":"ExceptIfAnyOfCcHeaderMemberOf"},"ExceptIfAnyOfRecipientAddressContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAnyOfRecipientAddressContainsWords parameter specifies an exception that looks for words in recipient email addresses.","title":"ExceptIfAnyOfRecipientAddressContainsWords"},"ExceptIfAnyOfRecipientAddressMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAnyOfRecipientAddressMatchesPatterns parameter specifies an exception that looks for text patterns in recipient email addresses by using regular expressions.","title":"ExceptIfAnyOfRecipientAddressMatchesPatterns"},"ExceptIfAnyOfToCcHeader":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAnyOfToCcHeader parameter specifies an exception that looks for recipients in the To or Cc fields of messages.","title":"ExceptIfAnyOfToCcHeader"},"ExceptIfAnyOfToCcHeaderMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAnyOfToCcHeaderMemberOf parameter specifies an exception that looks for group members in the To and Cc fields of messages.","title":"ExceptIfAnyOfToCcHeaderMemberOf"},"ExceptIfAnyOfToHeader":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAnyOfToHeader parameter specifies an exception that looks for recipients in the To field of messages.","title":"ExceptIfAnyOfToHeader"},"ExceptIfAnyOfToHeaderMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAnyOfToHeaderMemberOf parameter specifies an exception that looks for group members in the To field of messages.","title":"ExceptIfAnyOfToHeaderMemberOf"},"ExceptIfAttachmentContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAttachmentContainsWords parameter specifies an exception that looks for words in message attachments.","title":"ExceptIfAttachmentContainsWords"},"ExceptIfAttachmentExtensionMatchesWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAttachmentExtensionMatchesWords parameter specifies an exception that looks for words in the file name extensions of message attachments.","title":"ExceptIfAttachmentExtensionMatchesWords"},"ExceptIfAttachmentHasExecutableContent":{"type":"boolean","description":"The ExceptIfAttachmentHasExecutableContent parameter specifies an exception that looks for executable content in message attachments.","title":"ExceptIfAttachmentHasExecutableContent"},"ExceptIfAttachmentIsPasswordProtected":{"type":"boolean","description":"The ExceptIfAttachmentIsPasswordProtected parameter specifies an exception that looks for password protected files in messages (because the contents of the file can't be inspected).","title":"ExceptIfAttachmentIsPasswordProtected"},"ExceptIfAttachmentIsUnsupported":{"type":"boolean","description":"The ExceptIfAttachmentIsUnsupported parameter specifies an exception that looks for unsupported file types in messages.","title":"ExceptIfAttachmentIsUnsupported"},"ExceptIfAttachmentMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAttachmentMatchesPatterns parameter specifies an exception that looks for text patterns in the content of message attachments by using regular expressions.","title":"ExceptIfAttachmentMatchesPatterns"},"ExceptIfAttachmentNameMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAttachmentNameMatchesPatterns parameter specifies an exception that looks for text patterns in the file name of message attachments by using regular expressions.","title":"ExceptIfAttachmentNameMatchesPatterns"},"ExceptIfAttachmentPropertyContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAttachmentPropertyContainsWords parameter specifies an exception that looks for words in the properties of attached Office documents. ","title":"ExceptIfAttachmentPropertyContainsWords"},"ExceptIfAttachmentProcessingLimitExceeded":{"type":"boolean","description":"The ExceptIfAttachmentProcessingLimitExceeded parameter specifies an exception that looks for messages where attachment scanning didn't complete.","title":"ExceptIfAttachmentProcessingLimitExceeded"},"ExceptIfAttachmentSizeOver":{"type":"string","description":"The ExceptIfAttachmentSizeOver parameter specifies an exception that looks for messages where any attachment is greater than the specified size.","title":"ExceptIfAttachmentSizeOver"},"ExceptIfBetweenMemberOf1":{"type":"array","items":{"type":"string"},"description":"The ExceptIfBetweenMemberOf1 parameter specifies an exception that looks for messages that are sent between group members. ","title":"ExceptIfBetweenMemberOf1"},"ExceptIfBetweenMemberOf2":{"type":"array","items":{"type":"string"},"description":"The ExceptIfBetweenMemberOf2 parameter specifies an exception that looks for messages that are sent between group members.","title":"ExceptIfBetweenMemberOf2"},"ExceptIfContentCharacterSetContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfContentCharacterSetContainsWords parameter specifies an exception that looks for character set names in messages.","title":"ExceptIfContentCharacterSetContainsWords"},"ExceptIfFrom":{"type":"array","items":{"type":"string"},"description":"The ExceptIfFrom parameter specifies an exception that looks for messages from specific senders.","title":"ExceptIfFrom"},"ExceptIfFromAddressContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfFromAddressContainsWords parameter specifies an exception that looks for words in the sender's email address.","title":"ExceptIfFromAddressContainsWords"},"ExceptIfFromAddressMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfFromAddressMatchesPatterns parameter specifies an exception that looks for text patterns in the sender's email address by using regular expressions.","title":"ExceptIfFromAddressMatchesPatterns"},"ExceptIfFromMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfFromMemberOf parameter specifies an exception that looks for messages sent by group members.","title":"ExceptIfFromMemberOf"},"ExceptIfFromScope":{"enum":["InOrganization","NotInOrganization"],"description":"The ExceptIfFromScope parameter specifies an exception that looks for the location of message senders.","title":"ExceptIfFromScope"},"ExceptIfHasClassification":{"type":"string","description":"The ExceptIfHasClassification parameter specifies an exception that looks for messages with the specified message classification.","title":"ExceptIfHasClassification"},"ExceptIfHasNoClassification":{"type":"boolean","description":"The ExceptIfHasNoClassification parameter specifies an exception that looks for messages with or without any message classifications.","title":"ExceptIfHasNoClassification"},"ExceptIfHasSenderOverride":{"type":"boolean","description":"DEPRECATED","title":"ExceptIfHasSenderOverride"},"ExceptIfHeaderContainsMessageHeader":{"type":"string","description":"The ExceptIfHeaderContainsMessageHeader parameter specifies the name of header field in the message header when searching for the words specified by the ExceptIfHeaderContainsWords parameter.","title":"ExceptIfHeaderContainsMessageHeader"},"ExceptIfHeaderContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfHeaderContainsWords parameter specifies an exception that looks for words in a header field.","title":"ExceptIfHeaderContainsWords"},"ExceptIfHeaderMatchesMessageHeader":{"type":"string","description":"The ExceptIfHeaderMatchesMessageHeader parameter specifies the name of header field in the message header when searching for the text patterns specified by the ExceptIfHeaderMatchesPatterns parameter.","title":"ExceptIfHeaderMatchesMessageHeader"},"ExceptIfHeaderMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfHeaderMatchesPatterns parameter specifies an exception that looks for text patterns in a header field by using regular expressions.","title":"ExceptIfHeaderMatchesPatterns"},"ExceptIfManagerAddresses":{"type":"array","items":{"type":"string"},"description":"The ExceptIfManagerAddresses parameter specifies the users (managers) for the ExceptIfManagerForEvaluatedUser parameter.","title":"ExceptIfManagerAddresses"},"ExceptIfManagerForEvaluatedUser":{"type":"string","description":"The ExceptIfManagerForEvaluatedUser parameter specifies an exception that looks for users in the Manager attribute of senders or recipients.","title":"ExceptIfManagerForEvaluatedUser"},"ExceptIfMessageTypeMatches":{"enum":["OOF","AutoForward","Encrypted","Calendaring","PermissionControlled","Voicemail","Signed","ApprovalRequest","ReadReceipt"],"description":"The ExceptIfMessageTypeMatches parameter specifies an exception that looks for messages of the specified type.","title":"ExceptIfMessageTypeMatches"},"ExceptIfMessageContainsDataClassifications":{"type":"array","items":{"type":"string"},"description":"DEPRECATED","title":"ExceptIfMessageContainsDataClassifications"},"ExceptIfMessageSizeOver":{"type":"string","description":"The ExceptIfMessageSizeOver parameter specifies an exception that looks for messages larger than the specified size. ","title":"ExceptIfMessageSizeOver"},"ExceptIfRecipientADAttributeContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientADAttributeContainsWords parameter specifies an exception that looks for words in the Active Directory attributes of recipients.","title":"ExceptIfRecipientADAttributeContainsWords"},"ExceptIfRecipientADAttributeMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientADAttributeMatchesPatterns parameter specifies an exception that looks for text patterns in the Active Directory attributes of recipients by using regular expressions.","title":"ExceptIfRecipientADAttributeMatchesPatterns"},"ExceptIfRecipientAddressContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientAddressContainsWords parameter specifies an exception that looks for words in recipient email addresses.","title":"ExceptIfRecipientAddressContainsWords"},"ExceptIfRecipientAddressMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientAddressMatchesPatterns parameter specifies an exception that looks for text patterns in recipient email addresses by using regular expressions.","title":"ExceptIfRecipientAddressMatchesPatterns"},"ExceptIfRecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains.","title":"ExceptIfRecipientDomainIs"},"ExceptIfRecipientInSenderList":{"type":"array","items":{"type":"string"},"description":"This parameter is reserved for internal Microsoft use.","title":"ExceptIfRecipientInSenderList"},"ExceptIfSCLOver":{"type":"string","description":"The ExceptIfSCLOver parameter specifies an exception that looks for the SCL value of messages","title":"ExceptIfSCLOver"},"ExceptIfSenderADAttributeContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSenderADAttributeContainsWords parameter specifies an exception that looks for words in Active Directory attributes of message senders.","title":"ExceptIfSenderADAttributeContainsWords"},"ExceptIfSenderADAttributeMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSenderADAttributeMatchesPatterns parameter specifies an exception that looks for text patterns in Active Directory attributes of message senders by using regular expressions.","title":"ExceptIfSenderADAttributeMatchesPatterns"},"ExceptIfSenderDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSenderDomainIs parameter specifies an exception that looks for senders with email address in the specified domains.","title":"ExceptIfSenderDomainIs"},"ExceptIfSenderInRecipientList":{"type":"array","items":{"type":"string"},"description":"This parameter is reserved for internal Microsoft use.","title":"ExceptIfSenderInRecipientList"},"ExceptIfSenderIpRanges":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSenderIpRanges parameter specifies an exception that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.","title":"ExceptIfSenderIpRanges"},"ExceptIfSenderManagementRelationship":{"enum":["Manager","DirectReport"],"description":"The ExceptIfSenderManagementRelationship parameter specifies an exception that looks for the relationship between the sender and recipients in messages.","title":"ExceptIfSenderManagementRelationship"},"ExceptIfSentTo":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"ExceptIfSentTo"},"ExceptIfSentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.","title":"ExceptIfSentToMemberOf"},"ExceptIfSentToScope":{"enum":["InOrganization","NotInOrganization","ExternalPartner","ExternalNonPartner"],"description":"The ExceptIfSentToScope parameter specifies an exception that looks for the location of a recipient. ","title":"ExceptIfSentToScope"},"ExceptIfSubjectContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSubjectContainsWords parameter specifies an exception that looks for words in the Subject field of messages.","title":"ExceptIfSubjectContainsWords"},"ExceptIfSubjectMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSubjectMatchesPatterns parameter specifies an exception that looks for text patterns in the Subject field of messages by using regular expressions.","title":"ExceptIfSubjectMatchesPatterns"},"ExceptIfSubjectOrBodyContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSubjectOrBodyContainsWords parameter specifies an exception that looks for words in the Subject field or body of messages.","title":"ExceptIfSubjectOrBodyContainsWords"},"ExceptIfSubjectOrBodyMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSubjectOrBodyMatchesPatterns parameter specifies an exception that looks for text patterns in the Subject field or body of messages.","title":"ExceptIfSubjectOrBodyMatchesPatterns"},"ExceptIfWithImportance":{"enum":["Low","Normal","High"],"description":"The ExceptIfWithImportance parameter specifies an exception that looks for messages with the specified importance level.","title":"ExceptIfWithImportance"},"ExpiryDate":{"type":"string","description":"The ExpiryDate parameter specifies when this rule will stop processing messages. The rule won't take any action on messages after the specified date/time.","title":"ExpiryDate"},"From":{"type":"array","items":{"type":"string"},"description":"The From parameter specifies a condition that looks for messages from specific senders. You can use any value that uniquely identifies the sender.","title":"From"},"FromAddressContainsWords":{"type":"array","items":{"type":"string"},"description":"The FromAddressContainsWords parameter specifies a condition that looks for words in the sender's email address. ","title":"FromAddressContainsWords"},"FromAddressMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The FromAddressMatchesPatterns parameter specifies a condition that looks for text patterns in the sender's email address by using regular expressions.","title":"FromAddressMatchesPatterns"},"FromMemberOf":{"type":"array","items":{"type":"string"},"description":"The FromMemberOf parameter specifies a condition that looks for messages sent by group members.","title":"FromMemberOf"},"FromScope":{"enum":["InOrganization","NotInOrganization"],"description":"The FromScope parameter specifies a condition that looks for the location of message senders.","title":"FromScope"},"GenerateIncidentReport":{"type":"string","description":"The GenerateIncidentReport parameter specifies where to send the incident report that's defined by the IncidentReportContent parameter.","title":"GenerateIncidentReport"},"GenerateNotification":{"type":"string","description":"The GenerateNotification parameter specifies an action that sends a notification message to recipients.","title":"GenerateNotification"},"HasClassification":{"type":"string","description":"The HasClassification parameter specifies a condition that looks for messages with the specified message classification.","title":"HasClassification"},"HasNoClassification":{"type":"boolean","description":"The HasNoClassification parameter specifies a condition that looks for messages with or without any message classifications.","title":"HasNoClassification"},"HasSenderOverride":{"type":"boolean","description":"DEPRECATED","title":"HasSenderOverride"},"HeaderContainsMessageHeader":{"type":"string","description":"The HeaderContainsMessageHeader parameter specifies the name of header field in the message header when searching for the words specified by the HeaderContainsWords parameter.","title":"HeaderContainsMessageHeader"},"HeaderContainsWords":{"type":"array","items":{"type":"string"},"description":"The HeaderContainsWords parameter specifies a condition that looks for words in a header field.","title":"HeaderContainsWords"},"HeaderMatchesMessageHeader":{"type":"string","description":"The HeaderMatchesMessageHeader parameter specifies the name of header field in the message header when searching for the text patterns specified by the HeaderMatchesPatterns parameter.","title":"HeaderMatchesMessageHeader"},"HeaderMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The HeaderMatchesPatterns parameter specifies a condition that looks for text patterns in a header field by using regular expressions. ","title":"HeaderMatchesPatterns"},"IncidentReportContent":{"type":"array","items":{"type":"string"},"description":"The IncidentReportContent parameter specifies the message properties that are included in the incident report that's generated when a message violates a DLP policy. ","title":"IncidentReportContent"},"ManagerAddresses":{"type":"array","items":{"type":"string"},"description":"The ManagerAddresses parameter specifies the users (managers) for the ExceptIfManagerForEvaluatedUser parameter.","title":"ManagerAddresses"},"ManagerForEvaluatedUser":{"enum":["Recipient","Sender"],"description":"The ManagerForEvaluatedUser parameter specifies a condition that looks for users in the Manager attribute of senders or recipients.","title":"ManagerForEvaluatedUser"},"MessageContainsDataClassifications":{"type":"array","items":{"type":"string"},"description":"DEPRECATED","title":"MessageContainsDataClassifications"},"MessageSizeOver":{"type":"string","description":"The MessageSizeOver parameter specifies a condition that looks for messages larger than the specified size. The size includes the message and all attachments.","title":"MessageSizeOver"},"MessageTypeMatches":{"enum":["OOF","AutoForward","Encrypted","Calendaring","PermissionControlled","Voicemail","Signed","ApprovalRequest","ReadReceipt"],"description":"The MessageTypeMatches parameter specifies a condition that looks for messages of the specified type.","title":"MessageTypeMatches"},"Mode":{"enum":["Audit","AuditAndNotify","Enforce"],"description":"The Mode parameter specifies how the rule operates.","title":"Mode"},"ModerateMessageByManager":{"type":"boolean","description":"The ModerateMessageByManager parameter specifies an action that forwards messages for approval to the user that's specified in the sender's Manager attribute.","title":"ModerateMessageByManager"},"ModerateMessageByUser":{"type":"array","items":{"type":"string"},"description":"The ModerateMessageByUser parameter specifies an action that forwards messages for approval to the specified users.","title":"ModerateMessageByUser"},"NotifySender":{"enum":["NotifyOnly","RejectMessage","RejectUnlessFalsePositiveOverride","RejectUnlessSilentOverride","RejectUnlessExplicitOverride"],"description":"DEPRECATED","title":"NotifySender"},"PrependSubject":{"type":"string","description":"The PrependSubject parameter specifies an action that adds text to add to the beginning of the Subject field of messages.","title":"PrependSubject"},"Priority":{"type":"integer","description":"The Priority parameter specifies a priority value for the rule that determines the order of rule processing.","title":"Priority"},"Quarantine":{"type":"boolean","description":"The Quarantine parameter specifies an action that quarantines messages.","title":"Quarantine"},"RecipientADAttributeContainsWords":{"type":"array","items":{"type":"string"},"description":"The RecipientADAttributeContainsWords parameter specifies a condition that looks for words in the Active Directory attributes of recipients. ","title":"RecipientADAttributeContainsWords"},"RecipientADAttributeMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The RecipientADAttributeMatchesPatterns parameter specifies a condition that looks for text patterns in the Active Directory attributes of recipients by using regular expressions.","title":"RecipientADAttributeMatchesPatterns"},"RecipientAddressContainsWords":{"type":"array","items":{"type":"string"},"description":"The RecipientAddressContainsWords parameter specifies a condition that looks for words in recipient email addresses.","title":"RecipientAddressContainsWords"},"RecipientAddressMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The RecipientAddressMatchesPatterns parameter specifies a condition that looks for text patterns in recipient email addresses by using regular expressions.","title":"RecipientAddressMatchesPatterns"},"RecipientAddressType":{"enum":["Original","Resolved"],"description":"The RecipientAddressType parameter specifies how conditions and exceptions check recipient email addresses.","title":"RecipientAddressType"},"RecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains.","title":"RecipientDomainIs"},"RecipientInSenderList":{"type":"array","items":{"type":"string"},"description":"This parameter is reserved for internal Microsoft use.","title":"RecipientInSenderList"},"RedirectMessageTo":{"type":"array","items":{"type":"string"},"description":"The RedirectMessageTo parameter specifies a rule action that redirects messages to the specified recipients.","title":"RedirectMessageTo"},"RejectMessageEnhancedStatusCode":{"type":"string","description":"The RejectMessageEnhancedStatusCode parameter specifies the enhanced status code that's used when the rule rejects messages.","title":"RejectMessageEnhancedStatusCode"},"RejectMessageReasonText":{"type":"string","description":"The RejectMessageReasonText parameter specifies the explanation text that's used when the rule rejects messages.","title":"RejectMessageReasonText"},"RemoveHeader":{"type":"string","description":"The RemoveHeader parameter specifies an action that removes a header field from the message header.","title":"RemoveHeader"},"RemoveOME":{"type":"boolean","description":"The RemoveOME parameter specifies an action that removes the previous version of Office 365 Message Encryption from messages and their attachments.","title":"RemoveOME"},"RemoveOMEv2":{"type":"boolean","description":"The RemoveOMEv2 parameter specifies an action that removes Office 365 Message Encryption from messages and their attachments.","title":"RemoveOMEv2"},"RemoveRMSAttachmentEncryption":{"type":"boolean","description":"This parameter specifies an action or part of an action for the rule.","title":"RemoveRMSAttachmentEncryption"},"RouteMessageOutboundConnector":{"type":"string","description":"The RouteMessageOutboundConnector parameter specifies an action that routes messages through the specified Outbound connector in Office 365.","title":"RouteMessageOutboundConnector"},"RouteMessageOutboundRequireTls":{"type":"boolean","description":"The RouteMessageOutboundRequireTls parameter specifies an action that uses Transport Layer Security (TLS) encryption to deliver messages outside your organization.","title":"RouteMessageOutboundRequireTls"},"RuleErrorAction":{"enum":["Ignore","Defer"],"description":"The RuleErrorAction parameter specifies what to do if rule processing can't be completed on messages.","title":"RuleErrorAction"},"RuleSubType":{"enum":["Dlp","None"],"description":"The RuleSubType parameter specifies the rule type.","title":"RuleSubType"},"SCLOver":{"type":"string","description":"The SCLOver parameter specifies a condition that looks for the SCL value of messages","title":"SCLOver"},"SenderADAttributeContainsWords":{"type":"array","items":{"type":"string"},"description":"The SenderADAttributeContainsWords parameter specifies a condition that looks for words in Active Directory attributes of message senders.","title":"SenderADAttributeContainsWords"},"SenderADAttributeMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The SenderADAttributeMatchesPatterns parameter specifies a condition that looks for text patterns in Active Directory attributes of message senders by using regular expressions.","title":"SenderADAttributeMatchesPatterns"},"SenderAddressLocation":{"enum":["Header","Envelope","HeaderOrEnvelope"],"description":"The SenderAddressLocation parameter specifies where to look for sender addresses in conditions and exceptions that examine sender email addresses.","title":"SenderAddressLocation"},"SenderDomainIs":{"type":"array","items":{"type":"string"},"description":"The SenderDomainIs parameter specifies a condition that looks for senders with email address in the specified domains.","title":"SenderDomainIs"},"SenderInRecipientList":{"type":"array","items":{"type":"string"},"description":"This parameter is reserved for internal Microsoft use.","title":"SenderInRecipientList"},"SenderIpRanges":{"type":"array","items":{"type":"string"},"description":"The SenderIpRanges parameter specifies a condition that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.","title":"SenderIpRanges"},"SenderManagementRelationship":{"enum":["Manager","DirectReport"],"description":"The SenderManagementRelationship parameter specifies a condition that looks for the relationship between the sender and recipients in messages.","title":"SenderManagementRelationship"},"SentTo":{"type":"array","items":{"type":"string"},"description":"The SentTo parameter specifies a condition that looks for recipients in messages.","title":"SentTo"},"SentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The SentToMemberOf parameter specifies a condition that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups.","title":"SentToMemberOf"},"SentToScope":{"enum":["InOrganization","NotInOrganization","ExternalPartner","ExternalNonPartner"],"description":"The SentToScope parameter specifies a condition that looks for the location of recipients.","title":"SentToScope"},"SetAuditSeverity":{"enum":["DoNotAudit","Low","Medium","High"],"description":"The SetAuditSeverity parameter specifies an action that sets the severity level of the incident report and the corresponding entry that's written to the message tracking log when messages violate DLP policies.","title":"SetAuditSeverity"},"SetHeaderName":{"type":"string","description":"The SetHeaderName parameter specifies an action that adds or modifies a header field in the message header.","title":"SetHeaderName"},"SetHeaderValue":{"type":"string","description":"The SetHeaderValue parameter specifies an action that adds or modifies a header field in the message header.","title":"SetHeaderValue"},"SetSCL":{"type":"string","description":"The SetSCL parameter specifies an action that adds or modifies the SCL value of messages.","title":"SetSCL"},"StopRuleProcessing":{"type":"boolean","description":"The StopRuleProcessing parameter specifies an action that stops processing more rules.","title":"StopRuleProcessing"},"SubjectContainsWords":{"type":"array","items":{"type":"string"},"description":"The SubjectContainsWords parameter specifies a condition that looks for words in the Subject field of messages.","title":"SubjectContainsWords"},"SubjectMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The SubjectMatchesPatterns parameter specifies a condition that looks for text patterns in the Subject field of messages by using regular expressions.","title":"SubjectMatchesPatterns"},"SubjectOrBodyContainsWords":{"type":"array","items":{"type":"string"},"description":"The SubjectOrBodyContainsWords parameter specifies a condition that looks for words in the Subject field or body of messages.","title":"SubjectOrBodyContainsWords"},"SubjectOrBodyMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The SubjectOrBodyMatchesPatterns parameter specifies a condition that looks for text patterns in the Subject field or body of messages.","title":"SubjectOrBodyMatchesPatterns"},"WithImportance":{"enum":["Low","Normal","High"],"description":"The WithImportance parameter specifies a condition that looks for messages with the specified importance level.","title":"WithImportance"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Transport Rule should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.entra.administrativeunit":{"type":"object","description":"This resource configures an Azure AD Administrative Unit.","title":"Schema for microsoft.entra.administrativeunit","properties":{"DisplayName":{"type":"string","description":"DisplayName of the Administrative Unit","title":"DisplayName"},"Id":{"type":"string","description":"Object-Id of the Administrative Unit","title":"Id"},"Description":{"type":"string","description":"Description of the Administrative Unit","title":"Description"},"Visibility":{"type":"string","description":"Visibility of the Administrative Unit. Specify HiddenMembership if members of the AU are hidden","title":"Visibility"},"MembershipType":{"type":"string","description":"Specify membership type. Possible values are Assigned and Dynamic. Note that the functionality is currently in preview.","title":"MembershipType"},"MembershipRule":{"type":"string","description":"Specify membership rule. Requires that MembershipType is set to Dynamic. Note that the functionality is currently in preview.","title":"MembershipRule"},"MembershipRuleProcessingState":{"type":"string","description":"Specify dynamic membership-rule processing-state. Valid values are 'On' and 'Paused'. Requires that MembershipType is set to Dynamic. Note that the functionality is currently in preview.","title":"MembershipRuleProcessingState"},"Members":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Administrative Unit.","title":"Schema for MSFT_MicrosoftGraphMember","properties":{"Identity":{"type":"string","description":"Identity of member. For users, specify a UserPrincipalName. For groups, devices and serviceprincipals, specify DisplayName","title":"Identity"},"Type":{"enum":["User","Group","Device","ServicePrincipal"],"description":"Specify User, Group or Device to interpret the identity for Members. Specify User, Group or ServicePrincipal for ScopedRoleMembers.","title":"Type"}},"required":[]},"description":"Specify members. Only specify if MembershipType is NOT set to Dynamic","title":"Members"},"ScopedRoleMembers":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Administrative Unit.","title":"Schema for MSFT_MicrosoftGraphScopedRoleMembership","properties":{"RoleName":{"type":"string","description":"Name of the Azure AD Role that is assigned. See https://learn.microsoft.com/en-us/azure/active-directory/roles/admin-units-assign-roles#roles-that-can-be-assigned-with-administrative-unit-scope","title":"RoleName"},"RoleMemberInfo":{"type":"object","description":"Member that is assigned the scoped role. Note: Any groups must be role-enabled","title":"RoleMemberInfo","properties":{"Identity":{"type":"string","description":"Identity of member. For users, specify a UserPrincipalName. For groups, devices and serviceprincipals, specify DisplayName","title":"Identity"},"Type":{"enum":["User","Group","Device","ServicePrincipal"],"description":"Specify User, Group or Device to interpret the identity for Members. Specify User, Group or ServicePrincipal for ScopedRoleMembers.","title":"Type"}},"required":[]}},"required":[]},"description":"Specify Scoped Role Membership. Note: Any groups must be role-enabled","title":"ScopedRoleMembers"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the Administrative Unit exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.application":{"type":"object","description":"This resource configures an Azure Active Directory Application.","title":"Schema for microsoft.entra.application","properties":{"DisplayName":{"type":"string","description":"DisplayName of the app","title":"DisplayName"},"ObjectId":{"type":"string","description":"ObjectID of the app.","title":"ObjectId"},"AppId":{"type":"string","description":"AppId for the app.","title":"AppId"},"AvailableToOtherTenants":{"type":"boolean","description":"Indicates whether this application is available in other tenants.","title":"AvailableToOtherTenants"},"Description":{"type":"string","description":"A free text field to provide a description of the application object to end users. The maximum allowed size is 1024 characters.","title":"Description"},"GroupMembershipClaims":{"type":"string","description":"A bitmask that configures the groups claim issued in a user or OAuth 2.0 access token that the application expects.","title":"GroupMembershipClaims"},"Homepage":{"type":"string","description":"The URL to the application's homepage.","title":"Homepage"},"IdentifierUris":{"type":"array","items":{"type":"string"},"description":"User-defined URI(s) that uniquely identify a Web application within its Azure AD tenant, or within a verified custom domain.","title":"IdentifierUris"},"IsFallbackPublicClient":{"type":"boolean","description":"Specifies the fallback application type as public client, such as an installed application running on a mobile device. The default value is false, which means the fallback application type is confidential client such as web app. There are certain scenarios where Microsoft Entra ID cannot determine the client application type (for example, ROPC flow where it is configured without specifying a redirect URI). In those cases, Microsoft Entra ID will interpret the application type based on the value of this property.","title":"IsFallbackPublicClient"},"KnownClientApplications":{"type":"array","items":{"type":"string"},"description":"Client applications that are tied to this resource application.","title":"KnownClientApplications"},"LogoutURL":{"type":"string","description":"The logout url for this application.","title":"LogoutURL"},"PublicClient":{"type":"boolean","description":"Specifies whether this application is a public client (such as an installed application running on a mobile device). Default is false.","title":"PublicClient"},"ReplyURLs":{"type":"array","items":{"type":"string"},"description":"Specifies the URLs that user tokens are sent to for sign in, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to.","title":"ReplyURLs"},"Owners":{"type":"array","items":{"type":"string"},"description":"UPN or ObjectID values of the app's owners.","title":"Owners"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Azure AD App should exist or not.","title":"Ensure"},"Permissions":{"type":"array","items":{"type":"object","description":"This resource configures an Azure Active Directory Application.","title":"Schema for MSFT_AADApplicationPermission","properties":{"Name":{"type":"string","description":"Name of the requested permission.","title":"Name"},"SourceAPI":{"type":"string","description":"Name of the API from which the permission comes from.","title":"SourceAPI"},"Type":{"enum":["AppOnly","Delegated"],"description":"Type of permission.","title":"Type"},"AdminConsentGranted":{"type":"boolean","description":"Represented whether or not the Admin consent been granted on the app.","title":"AdminConsentGranted"}},"required":[]},"description":"API permissions for the Azure Active Directory Application.","title":"Permissions"}},"required":["DisplayName"]},"microsoft.entra.attributeset":{"type":"object","description":"Represents a group of related custom security attribute definitions.","title":"Schema for microsoft.entra.attributeset","properties":{"Id":{"type":"string","description":"Identifier for the attribute set that is unique within a tenant. Can be up to 32 characters long and include Unicode characters. Cannot contain spaces or special characters. Cannot be changed later. Case insensitive","title":"Id"},"Description":{"type":"string","description":"Identifier for the attribute set that is unique within a tenant. Can be up to 32 characters long and include Unicode characters. Cannot contain spaces or special characters. Cannot be changed later. Case insensitive","title":"Description"},"MaxAttributesPerSet":{"type":"integer","description":"Maximum number of custom security attributes that can be defined in this attribute set. Default value is null. If not specified, the administrator can add up to the maximum of 500 active attributes per tenant. Can be changed later.","title":"MaxAttributesPerSet"},"Ensure":{"enum":["Present"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Id"]},"microsoft.entra.authenticationcontextclassreference":{"type":"object","description":"Represents a Microsoft Entra authentication context class reference. Authentication context class references are custom values that define a Conditional Access authentication requirement","title":"Schema for microsoft.entra.authenticationcontextclassreference","properties":{"Id":{"enum":["c1","c2","c3","c4","c5","c6","c7","c8","c9","c10","c11","c12","c13","c14","c15","c16","c17","c18","c19","c20","c21","c22","c23","c24","c25"],"description":"Identifier used to reference the authentication context class. The id is used to trigger step-up authentication for the referenced authentication requirements and is the value that will be issued in the acrs claim of an access token. This value in the claim is used to verify that the required authentication context has been satisfied. The allowed values are c1 through c25.","title":"Id"},"DisplayName":{"type":"string","description":"A friendly name that identifies the authenticationContextClassReference object when building user-facing admin experiences. For example, a selection UX","title":"DisplayName"},"Description":{"type":"string","description":"A short explanation of the policies that are enforced by authenticationContextClassReference. This value should be used to provide secondary text to describe the authentication context class reference when building user-facing admin experiences. For example, a selection UX.","title":"Description"},"IsAvailable":{"type":"boolean","description":"Indicates whether the authenticationContextClassReference has been published by the security admin and is ready for use by apps. When it's set to false, it shouldn't be shown in admin UX experiences because the value isn't currently available for selection.","title":"IsAvailable"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Id"]},"microsoft.entra.authenticationmethodpolicy":{"type":"object","description":"Azure AD Authentication Method Policy","title":"Schema for microsoft.entra.authenticationmethodpolicy","properties":{"Description":{"type":"string","description":"A description of the policy.","title":"Description"},"DisplayName":{"type":"string","description":"The name of the policy.","title":"DisplayName"},"PolicyMigrationState":{"enum":["preMigration","migrationInProgress","migrationComplete","unknownFutureValue"],"description":"The state of migration of the authentication methods policy from the legacy multifactor authentication and self-service password reset (SSPR) policies. The possible values are: premigration - means the authentication methods policy is used for authentication only, legacy policies are respected. migrationInProgress - means the authentication methods policy is used for both authentication and SSPR, legacy policies are respected. migrationComplete - means the authentication methods policy is used for authentication and SSPR, legacy policies are ignored. unknownFutureValue - Evolvable enumeration sentinel value. Do not use.","title":"PolicyMigrationState"},"PolicyVersion":{"type":"string","description":"The version of the policy in use.","title":"PolicyVersion"},"ReconfirmationInDays":{"type":"integer","description":"Days before the user will be asked to reconfirm their method.","title":"ReconfirmationInDays"},"RegistrationEnforcement":{"type":"object","description":"Enforce registration at sign-in time. This property can be used to remind users to set up targeted authentication methods.","title":"RegistrationEnforcement","properties":{"AuthenticationMethodsRegistrationCampaign":{"type":"object","description":"Run campaigns to remind users to setup targeted authentication methods.","title":"AuthenticationMethodsRegistrationCampaign","properties":{"ExcludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy","title":"Schema for MSFT_MicrosoftGraphExcludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD user or group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: user, group, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Users and groups of users that are excluded from being prompted to set up the authentication method.","title":"ExcludeTargets"},"IncludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy","title":"Schema for MSFT_MicrosoftGraphAuthenticationMethodsRegistrationCampaignIncludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD user or group.","title":"Id"},"TargetedAuthenticationMethod":{"type":"string","description":"The authentication method that the user is prompted to register. The value must be microsoftAuthenticator.","title":"TargetedAuthenticationMethod"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: user, group, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Users and groups of users that are prompted to set up the authentication method.","title":"IncludeTargets"},"SnoozeDurationInDays":{"type":"integer","description":"Specifies the number of days that the user sees a prompt again if they select 'Not now' and snoozes the prompt. Minimum 0 days. Maximum: 14 days. If the value is '0'  The user is prompted during every MFA attempt.","title":"SnoozeDurationInDays"},"State":{"enum":["default","enabled","disabled","unknownFutureValue"],"description":"Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.","title":"State"}},"required":[]}},"required":[]},"SystemCredentialPreferences":{"type":"object","description":"Prompt users with their most-preferred credential for multifactor authentication.","title":"SystemCredentialPreferences","properties":{"ExcludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy","title":"Schema for MSFT_AADAuthenticationMethodPolicyExcludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Users and groups excluded from the preferred authentication method experience of the system.","title":"ExcludeTargets"},"IncludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy","title":"Schema for MSFT_AADAuthenticationMethodPolicyIncludeTarget","properties":{"Id":{"type":"string","description":"The ID of the entity targeted.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The kind of entity targeted. Possible values are: user, group.","title":"TargetType"}},"required":[]},"description":"Users and groups included in the preferred authentication method experience of the system.","title":"IncludeTargets"},"State":{"enum":["default","enabled","disabled","unknownFutureValue"],"description":"Indicates whether the feature is enabled or disabled. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set, and uses the default behavior of Azure Active Directory for the setting. The default value is disabled.","title":"State"}},"required":[]},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Ensure":{"enum":["Present"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.authenticationmethodpolicyauthenticator":{"type":"object","description":"Azure AD Authentication Method Policy Authenticator","title":"Schema for microsoft.entra.authenticationmethodpolicyauthenticator","properties":{"FeatureSettings":{"type":"object","description":"A collection of Microsoft Authenticator settings such as number matching and location context, and whether they are enabled for all users or specific users only.","title":"FeatureSettings","properties":{"CompanionAppAllowedState":{"type":"object","description":"Determines whether users will be able to approve push notifications on other Microsoft applications such as Outlook Mobile.","title":"CompanionAppAllowedState","properties":{"ExcludeTarget":{"type":"object","description":"A single entity that's excluded from using this feature.","title":"ExcludeTarget","properties":{"Id":{"type":"string","description":"The ID of the entity that's targeted in the include or exclude rule or all_users to target all users.","title":"Id"},"TargetType":{"enum":["group","administrativeUnit","role","unknownFutureValue"],"description":"The kind of entity that's targeted. The possible values are: group, administrativeUnit, role, unknownFutureValue.","title":"TargetType"}},"required":[]},"IncludeTarget":{"type":"object","description":"A single entity that's allowed to use this feature.","title":"IncludeTarget","properties":{"Id":{"type":"string","description":"The ID of the entity that's targeted in the include or exclude rule or all_users to target all users.","title":"Id"},"TargetType":{"enum":["group","administrativeUnit","role","unknownFutureValue"],"description":"The kind of entity that's targeted. The possible values are: group, administrativeUnit, role, unknownFutureValue.","title":"TargetType"}},"required":[]},"State":{"enum":["default","enabled","disabled","unknownFutureValue"],"description":"Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.","title":"State"}},"required":[]},"DisplayAppInformationRequiredState":{"type":"object","description":"Determines whether the user's Authenticator app will show them the client app they are signing into.","title":"DisplayAppInformationRequiredState","properties":{"ExcludeTarget":{"type":"object","description":"A single entity that's excluded from using this feature.","title":"ExcludeTarget","properties":{"Id":{"type":"string","description":"The ID of the entity that's targeted in the include or exclude rule or all_users to target all users.","title":"Id"},"TargetType":{"enum":["group","administrativeUnit","role","unknownFutureValue"],"description":"The kind of entity that's targeted. The possible values are: group, administrativeUnit, role, unknownFutureValue.","title":"TargetType"}},"required":[]},"IncludeTarget":{"type":"object","description":"A single entity that's allowed to use this feature.","title":"IncludeTarget","properties":{"Id":{"type":"string","description":"The ID of the entity that's targeted in the include or exclude rule or all_users to target all users.","title":"Id"},"TargetType":{"enum":["group","administrativeUnit","role","unknownFutureValue"],"description":"The kind of entity that's targeted. The possible values are: group, administrativeUnit, role, unknownFutureValue.","title":"TargetType"}},"required":[]},"State":{"enum":["default","enabled","disabled","unknownFutureValue"],"description":"Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.","title":"State"}},"required":[]},"DisplayLocationInformationRequiredState":{"type":"object","description":"Determines whether the user's Authenticator app will show them the geographic location of where the authentication request originated from.","title":"DisplayLocationInformationRequiredState","properties":{"ExcludeTarget":{"type":"object","description":"A single entity that's excluded from using this feature.","title":"ExcludeTarget","properties":{"Id":{"type":"string","description":"The ID of the entity that's targeted in the include or exclude rule or all_users to target all users.","title":"Id"},"TargetType":{"enum":["group","administrativeUnit","role","unknownFutureValue"],"description":"The kind of entity that's targeted. The possible values are: group, administrativeUnit, role, unknownFutureValue.","title":"TargetType"}},"required":[]},"IncludeTarget":{"type":"object","description":"A single entity that's allowed to use this feature.","title":"IncludeTarget","properties":{"Id":{"type":"string","description":"The ID of the entity that's targeted in the include or exclude rule or all_users to target all users.","title":"Id"},"TargetType":{"enum":["group","administrativeUnit","role","unknownFutureValue"],"description":"The kind of entity that's targeted. The possible values are: group, administrativeUnit, role, unknownFutureValue.","title":"TargetType"}},"required":[]},"State":{"enum":["default","enabled","disabled","unknownFutureValue"],"description":"Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.","title":"State"}},"required":[]},"NumberMatchingRequiredState":{"type":"object","description":"Specifies whether the user needs to enter a number in the Authenticator app from the login screen to complete their login. Value is ignored for phone sign-in notifications.","title":"NumberMatchingRequiredState","properties":{"ExcludeTarget":{"type":"object","description":"A single entity that's excluded from using this feature.","title":"ExcludeTarget","properties":{"Id":{"type":"string","description":"The ID of the entity that's targeted in the include or exclude rule or all_users to target all users.","title":"Id"},"TargetType":{"enum":["group","administrativeUnit","role","unknownFutureValue"],"description":"The kind of entity that's targeted. The possible values are: group, administrativeUnit, role, unknownFutureValue.","title":"TargetType"}},"required":[]},"IncludeTarget":{"type":"object","description":"A single entity that's allowed to use this feature.","title":"IncludeTarget","properties":{"Id":{"type":"string","description":"The ID of the entity that's targeted in the include or exclude rule or all_users to target all users.","title":"Id"},"TargetType":{"enum":["group","administrativeUnit","role","unknownFutureValue"],"description":"The kind of entity that's targeted. The possible values are: group, administrativeUnit, role, unknownFutureValue.","title":"TargetType"}},"required":[]},"State":{"enum":["default","enabled","disabled","unknownFutureValue"],"description":"Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.","title":"State"}},"required":[]}},"required":[]},"IsSoftwareOathEnabled":{"type":"boolean","description":"true if users can use the OTP code generated by the Microsoft Authenticator app, false otherwise.","title":"IsSoftwareOathEnabled"},"ExcludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Authenticator","title":"Schema for MSFT_AADAuthenticationMethodPolicyAuthenticatorExcludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are excluded from a policy.","title":"ExcludeTargets"},"IncludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Authenticator","title":"Schema for MSFT_AADAuthenticationMethodPolicyAuthenticatorIncludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are included from a policy.","title":"IncludeTargets"},"State":{"enum":["enabled","disabled"],"description":"The state of the policy. Possible values are: enabled, disabled.","title":"State"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Id"]},"microsoft.entra.authenticationmethodpolicyemail":{"type":"object","description":"Azure AD Authentication Method Policy Email","title":"Schema for microsoft.entra.authenticationmethodpolicyemail","properties":{"AllowExternalIdToUseEmailOtp":{"enum":["default","enabled","disabled","unknownFutureValue"],"description":"Determines whether email OTP is usable by external users for authentication. Possible values are: default, enabled, disabled, unknownFutureValue. Tenants in the default state who did not use public preview will automatically have email OTP enabled beginning in October 2021.","title":"AllowExternalIdToUseEmailOtp"},"ExcludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Email","title":"Schema for MSFT_AADAuthenticationMethodPolicyEmailExcludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are excluded from a policy.","title":"ExcludeTargets"},"IncludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Email","title":"Schema for MSFT_AADAuthenticationMethodPolicyEmailIncludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are included from a policy.","title":"IncludeTargets"},"State":{"enum":["enabled","disabled"],"description":"The state of the policy. Possible values are: enabled, disabled.","title":"State"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Id"]},"microsoft.entra.authenticationmethodpolicyfido2":{"type":"object","description":"Azure AD Authentication Method Policy Fido2","title":"Schema for microsoft.entra.authenticationmethodpolicyfido2","properties":{"IsAttestationEnforced":{"type":"boolean","description":"Determines whether attestation must be enforced for FIDO2 security key registration.","title":"IsAttestationEnforced"},"IsSelfServiceRegistrationAllowed":{"type":"boolean","description":"Determines if users can register new FIDO2 security keys.","title":"IsSelfServiceRegistrationAllowed"},"KeyRestrictions":{"type":"object","description":"Controls whether key restrictions are enforced on FIDO2 security keys, either allowing or disallowing certain key types as defined by Authenticator Attestation GUID (AAGUID), an identifier that indicates the type (e.g. make and model) of the authenticator.","title":"KeyRestrictions","properties":{"AaGuids":{"type":"array","items":{"type":"string"},"description":"A collection of Authenticator Attestation GUIDs. AADGUIDs define key types and manufacturers.","title":"AaGuids"},"EnforcementType":{"enum":["allow","block","unknownFutureValue"],"description":"Enforcement type. Possible values are: allow, block.","title":"EnforcementType"},"IsEnforced":{"type":"boolean","description":"Determines if the configured key enforcement is enabled.","title":"IsEnforced"}},"required":[]},"ExcludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Fido2","title":"Schema for MSFT_AADAuthenticationMethodPolicyFido2ExcludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are excluded from a policy.","title":"ExcludeTargets"},"IncludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Fido2","title":"Schema for MSFT_AADAuthenticationMethodPolicyFido2IncludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are included from a policy.","title":"IncludeTargets"},"State":{"enum":["enabled","disabled"],"description":"The state of the policy. Possible values are: enabled, disabled.","title":"State"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Id"]},"microsoft.entra.authenticationmethodpolicysms":{"type":"object","description":"Azure AD Authentication Method Policy Sms","title":"Schema for microsoft.entra.authenticationmethodpolicysms","properties":{"ExcludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Sms","title":"Schema for MSFT_AADAuthenticationMethodPolicySmsExcludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are excluded from a policy.","title":"ExcludeTargets"},"IncludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Sms","title":"Schema for MSFT_AADAuthenticationMethodPolicySmsIncludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are included from a policy.","title":"IncludeTargets"},"State":{"enum":["enabled","disabled"],"description":"The state of the policy. Possible values are: enabled, disabled.","title":"State"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Id"]},"microsoft.entra.authenticationmethodpolicysoftware":{"type":"object","description":"Azure AD Authentication Method Policy Software","title":"Schema for microsoft.entra.authenticationmethodpolicysoftware","properties":{"ExcludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Software","title":"Schema for MSFT_AADAuthenticationMethodPolicySoftwareExcludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are excluded from a policy.","title":"ExcludeTargets"},"IncludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Software","title":"Schema for MSFT_AADAuthenticationMethodPolicySoftwareIncludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are included from a policy.","title":"IncludeTargets"},"State":{"enum":["enabled","disabled"],"description":"The state of the policy. Possible values are: enabled, disabled.","title":"State"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Id"]},"microsoft.entra.authenticationmethodpolicytemporary":{"type":"object","description":"Azure AD Authentication Method Policy Temporary","title":"Schema for microsoft.entra.authenticationmethodpolicytemporary","properties":{"DefaultLength":{"type":"integer","description":"Default length in characters of a Temporary Access Pass object. Must be between 8 and 48 characters.","title":"DefaultLength"},"DefaultLifetimeInMinutes":{"type":"integer","description":"Default lifetime in minutes for a Temporary Access Pass. Value can be any integer between the minimumLifetimeInMinutes and maximumLifetimeInMinutes.","title":"DefaultLifetimeInMinutes"},"IsUsableOnce":{"type":"boolean","description":"If true, all the passes in the tenant will be restricted to one-time use. If false, passes in the tenant can be created to be either one-time use or reusable.","title":"IsUsableOnce"},"MaximumLifetimeInMinutes":{"type":"integer","description":"Maximum lifetime in minutes for any Temporary Access Pass created in the tenant. Value can be between 10 and 43200 minutes (equivalent to 30 days).","title":"MaximumLifetimeInMinutes"},"MinimumLifetimeInMinutes":{"type":"integer","description":"Minimum lifetime in minutes for any Temporary Access Pass created in the tenant. Value can be between 10 and 43200 minutes (equivalent to 30 days).","title":"MinimumLifetimeInMinutes"},"ExcludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Temporary","title":"Schema for MSFT_AADAuthenticationMethodPolicyTemporaryExcludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are excluded from a policy.","title":"ExcludeTargets"},"IncludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Temporary","title":"Schema for MSFT_AADAuthenticationMethodPolicyTemporaryIncludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are included from a policy.","title":"IncludeTargets"},"State":{"enum":["enabled","disabled"],"description":"The state of the policy. Possible values are: enabled, disabled.","title":"State"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Id"]},"microsoft.entra.authenticationmethodpolicyvoice":{"type":"object","description":"Azure AD Authentication Method Policy Voice","title":"Schema for microsoft.entra.authenticationmethodpolicyvoice","properties":{"IsOfficePhoneAllowed":{"type":"boolean","description":"true if users can register office phones, otherwise, false.","title":"IsOfficePhoneAllowed"},"ExcludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Voice","title":"Schema for MSFT_AADAuthenticationMethodPolicyVoiceExcludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are excluded from a policy.","title":"ExcludeTargets"},"IncludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy Voice","title":"Schema for MSFT_AADAuthenticationMethodPolicyVoiceIncludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["user","group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are included from a policy.","title":"IncludeTargets"},"State":{"enum":["enabled","disabled"],"description":"The state of the policy. Possible values are: enabled, disabled.","title":"State"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Id"]},"microsoft.entra.authenticationmethodpolicyx509":{"type":"object","description":"Azure AD Authentication Method Policy X509","title":"Schema for microsoft.entra.authenticationmethodpolicyx509","properties":{"AuthenticationModeConfiguration":{"type":"object","description":"Defines strong authentication configurations. This configuration includes the default authentication mode and the different rules for strong authentication bindings.","title":"AuthenticationModeConfiguration","properties":{"Rules":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy X509","title":"Schema for MSFT_MicrosoftGraphX509CertificateRule","properties":{"Identifier":{"type":"string","description":"The identifier of the X.509 certificate. Required.","title":"Identifier"},"X509CertificateAuthenticationMode":{"enum":["x509CertificateSingleFactor","x509CertificateMultiFactor","unknownFutureValue"],"description":"The type of strong authentication mode. The possible values are: x509CertificateSingleFactor, x509CertificateMultiFactor, unknownFutureValue. Required.","title":"X509CertificateAuthenticationMode"},"X509CertificateRuleType":{"enum":["issuerSubject","policyOID","unknownFutureValue"],"description":"The type of the X.509 certificate mode configuration rule. The possible values are: issuerSubject, policyOID, unknownFutureValue. Required.","title":"X509CertificateRuleType"}},"required":[]},"description":"Rules are configured in addition to the authentication mode to bind a specific x509CertificateRuleType to an x509CertificateAuthenticationMode. For example, bind the policyOID with identifier 1.32.132.343 to x509CertificateMultiFactor authentication mode.","title":"Rules"},"X509CertificateAuthenticationDefaultMode":{"enum":["x509CertificateSingleFactor","x509CertificateMultiFactor","unknownFutureValue"],"description":"The type of strong authentication mode. The possible values are: x509CertificateSingleFactor, x509CertificateMultiFactor, unknownFutureValue.","title":"X509CertificateAuthenticationDefaultMode"}},"required":[]},"CertificateUserBindings":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy X509","title":"Schema for MSFT_MicrosoftGraphX509CertificateUserBinding","properties":{"Priority":{"type":"integer","description":"The priority of the binding. Azure AD uses the binding with the highest priority. This value must be a non-negative integer and unique in the collection of objects in the certificateUserBindings property of an x509CertificateAuthenticationMethodConfiguration object. Required","title":"Priority"},"UserProperty":{"type":"string","description":"Defines the Azure AD user property of the user object to use for the binding. The possible values are: userPrincipalName, onPremisesUserPrincipalName, email. Required.","title":"UserProperty"},"X509CertificateField":{"type":"string","description":"The field on the X.509 certificate to use for the binding. The possible values are: PrincipalName, RFC822Name.","title":"X509CertificateField"}},"required":[]},"description":"Defines fields in the X.509 certificate that map to attributes of the Azure AD user object in order to bind the certificate to the user. The priority of the object determines the order in which the binding is carried out. The first binding that matches will be used and the rest ignored.","title":"CertificateUserBindings"},"ExcludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy X509","title":"Schema for MSFT_AADAuthenticationMethodPolicyX509ExcludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"TargetType":{"enum":["group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are excluded from a policy.","title":"ExcludeTargets"},"IncludeTargets":{"type":"array","items":{"type":"object","description":"Azure AD Authentication Method Policy X509","title":"Schema for MSFT_AADAuthenticationMethodPolicyX509IncludeTarget","properties":{"Id":{"type":"string","description":"The object identifier of an Azure AD group.","title":"Id"},"isRegistrationRequired":{"type":"boolean","description":"Determines if the user is enforced to register the authentication method.","title":"isRegistrationRequired"},"TargetType":{"enum":["group","unknownFutureValue"],"description":"The type of the authentication method target. Possible values are: group and unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Displayname of the groups of users that are included from a policy.","title":"IncludeTargets"},"State":{"enum":["enabled","disabled"],"description":"The state of the policy. Possible values are: enabled, disabled.","title":"State"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Id"]},"microsoft.entra.authenticationstrengthpolicy":{"type":"object","description":"Azure AD Authentication Strength Policy","title":"Schema for microsoft.entra.authenticationstrengthpolicy","properties":{"DisplayName":{"type":"string","description":"The name of the policy.","title":"DisplayName"},"Description":{"type":"string","description":"A description of the policy.","title":"Description"},"Id":{"type":"string","description":"The unique identifier of the policy.","title":"Id"},"AllowedCombinations":{"type":"array","items":{"type":"string"},"description":"The authentication method combinations allowed by this authentication strength policy.","title":"AllowedCombinations"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.authorizationpolicy":{"type":"object","description":"This resource configures the Azure Active Directory Authorization Policy.\r\n\r\nThe policy is managed using the BETA API, some properties may have been added in the API but not in the resource\r\n\r\n## Azure AD Permissions\r\n\r\nTo authenticate via Microsoft Graph, this resource required the following Application permissions:\r\n\r\n* **Automate**\r\n  * Policy.Read.All\r\n  * Policy.ReadWrite.Authorization\r\n\r\n* **Export**\r\n  * Policy.Read.All\r\n\r\nNOTE: All permissions listed above require admin consent.","title":"Schema for microsoft.entra.authorizationpolicy","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"DisplayName":{"type":"string","description":"Display name for this policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of this policy.","title":"Description"},"AllowedToSignUpEmailBasedSubscriptions":{"type":"boolean","description":"Boolean Indicates whether users can sign up for email based subscriptions.","title":"AllowedToSignUpEmailBasedSubscriptions"},"AllowedToUseSSPR":{"type":"boolean","description":"Boolean Indicates whether the Self-Serve Password Reset feature can be used by users on the tenant.","title":"AllowedToUseSSPR"},"AllowEmailVerifiedUsersToJoinOrganization":{"type":"boolean","description":"Boolean Indicates whether a user can join the tenant by email validation.","title":"AllowEmailVerifiedUsersToJoinOrganization"},"AllowInvitesFrom":{"enum":["None","AdminsAndGuestInviters","AdminsGuestInvitersAndAllMembers","Everyone"],"description":"Indicates who can invite external users to the organization. Possible values are: None, AdminsAndGuestInviters, AdminsGuestInvitersAndAllMembers, Everyone. Everyone is the default setting for all cloud environments except US Government.","title":"AllowInvitesFrom"},"BlockMsolPowershell":{"type":"boolean","description":"Boolean To disable the use of MSOL PowerShell, set this property to true. This will also disable user-based access to the legacy service endpoint used by MSOL PowerShell. This does not affect Azure AD Connect or Microsoft Graph.","title":"BlockMsolPowershell"},"DefaultUserRoleAllowedToCreateApps":{"type":"boolean","description":"Boolean Indicates whether the default user role can create applications.","title":"DefaultUserRoleAllowedToCreateApps"},"DefaultUserRoleAllowedToCreateSecurityGroups":{"type":"boolean","description":"Boolean Indicates whether the default user role can create security groups.","title":"DefaultUserRoleAllowedToCreateSecurityGroups"},"DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice":{"type":"boolean","description":"Indicates whether the registered owners of a device can read their own BitLocker recovery keys with default user role.","title":"DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice"},"DefaultUserRoleAllowedToCreateTenants":{"type":"boolean","description":"Indicates whether the default user role can create tenants. This setting corresponds to the Restrict non-admin users from creating tenants setting in the User settings menu in the Azure portal. When this setting is false, users assigned the Tenant Creator role can still create tenants.","title":"DefaultUserRoleAllowedToCreateTenants"},"DefaultUserRoleAllowedToReadOtherUsers":{"type":"boolean","description":"Boolean Indicates whether the default user role can read other users.","title":"DefaultUserRoleAllowedToReadOtherUsers"},"GuestUserRole":{"enum":["Guest","RestrictedGuest","User"],"description":"The role that should be granted to guest users. Refer to List unifiedRoleDefinitions to find the list of available role templates. Only supported roles today are User, Guest User, and Restricted Guest User (2af84b1e-32c8-42b7-82bc-daa82404023b).","title":"GuestUserRole"},"PermissionGrantPolicyIdsAssignedToDefaultUserRole":{"type":"array","items":{"type":"string"},"description":"String collection Indicates if user consent to apps is allowed, and if it is, which permission to grant consent and which app consent policy (permissionGrantPolicy) govern the permission for users to grant consent. Value should be in the format managePermissionGrantsForSelf.{id}, where {id} is the id of a built-in or custom app consent policy. An empty list indicates user consent to apps is disabled.","title":"PermissionGrantPolicyIdsAssignedToDefaultUserRole"},"Ensure":{"enum":["Present"],"description":"Specify that the Azure Authorization Policy should exist.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.entra.conditionalaccesspolicy":{"type":"object","description":"This resource configures an Azure Active Directory Conditional Access Policy.","title":"Schema for microsoft.entra.conditionalaccesspolicy","properties":{"DisplayName":{"type":"string","description":"DisplayName of the AAD CA Policy","title":"DisplayName"},"Id":{"type":"string","description":"Specifies the GUID for the Policy.","title":"Id"},"State":{"enum":["disabled","enabled","enabledForReportingButNotEnforced"],"description":"Specifies the State of the Policy.","title":"State"},"IncludeApplications":{"type":"array","items":{"type":"string"},"description":"Cloud Apps in scope of the Policy.","title":"IncludeApplications"},"ApplicationsFilter":{"type":"string","description":"Rule syntax is similar to that used for membership rules for groups in Microsoft Entra ID.","title":"ApplicationsFilter"},"ApplicationsFilterMode":{"enum":["include","exclude"],"description":"Mode to use for the filter. Possible values are include or exclude.","title":"ApplicationsFilterMode"},"ExcludeApplications":{"type":"array","items":{"type":"string"},"description":"Cloud Apps out of scope of the Policy.","title":"ExcludeApplications"},"IncludeUserActions":{"type":"array","items":{"type":"string"},"description":"User Actions in scope of the Policy.","title":"IncludeUserActions"},"IncludeUsers":{"type":"array","items":{"type":"string"},"description":"Users in scope of the Policy.","title":"IncludeUsers"},"ExcludeUsers":{"type":"array","items":{"type":"string"},"description":"Users out of scope of the Policy.","title":"ExcludeUsers"},"IncludeGroups":{"type":"array","items":{"type":"string"},"description":"Groups in scope of the Policy.","title":"IncludeGroups"},"ExcludeGroups":{"type":"array","items":{"type":"string"},"description":"Groups out of scope of the Policy.","title":"ExcludeGroups"},"IncludeRoles":{"type":"array","items":{"type":"string"},"description":"AAD Admin Roles in scope of the Policy.","title":"IncludeRoles"},"ExcludeRoles":{"type":"array","items":{"type":"string"},"description":"AAD Admin Roles out of scope of the Policy.","title":"ExcludeRoles"},"IncludeGuestOrExternalUserTypes":{"type":"array","items":{"enum":["none","internalGuest","b2bCollaborationGuest","b2bCollaborationMember","b2bDirectConnectUser","otherExternalUser","serviceProvider","unknownFutureValue"]},"description":"Represents the Included internal guests or external user types. This is a multi-valued property. Supported values are: b2bCollaborationGuest, b2bCollaborationMember, b2bDirectConnectUser, internalGuest, OtherExternalUser, serviceProvider and unknownFutureValue.","title":"IncludeGuestOrExternalUserTypes"},"IncludeExternalTenantsMembershipKind":{"enum":["","all","enumerated","unknownFutureValue"],"description":"Represents the Included Tenants membership kind. The possible values are: all, enumerated, unknownFutureValue. enumerated references an object of conditionalAccessEnumeratedExternalTenants derived type.","title":"IncludeExternalTenantsMembershipKind"},"IncludeExternalTenantsMembers":{"type":"array","items":{"type":"string"},"description":"Represents the Included collection of tenant ids in the scope of Conditional Access for guests and external users policy targeting.","title":"IncludeExternalTenantsMembers"},"ExcludeGuestOrExternalUserTypes":{"type":"array","items":{"enum":["none","internalGuest","b2bCollaborationGuest","b2bCollaborationMember","b2bDirectConnectUser","otherExternalUser","serviceProvider","unknownFutureValue"]},"description":"Represents the Excluded internal guests or external user types. This is a multi-valued property. Supported values are: b2bCollaborationGuest, b2bCollaborationMember, b2bDirectConnectUser, internalGuest, OtherExternalUser, serviceProvider and unknownFutureValue.","title":"ExcludeGuestOrExternalUserTypes"},"ExcludeExternalTenantsMembershipKind":{"enum":["","all","enumerated","unknownFutureValue"],"description":"Represents the Excluded Tenants membership kind. The possible values are: all, enumerated, unknownFutureValue. enumerated references an object of conditionalAccessEnumeratedExternalTenants derived type.","title":"ExcludeExternalTenantsMembershipKind"},"ExcludeExternalTenantsMembers":{"type":"array","items":{"type":"string"},"description":"Represents the Excluded collection of tenant ids in the scope of Conditional Access for guests and external users policy targeting.","title":"ExcludeExternalTenantsMembers"},"IncludePlatforms":{"type":"array","items":{"type":"string"},"description":"Client Device Platforms in scope of the Policy.","title":"IncludePlatforms"},"ExcludePlatforms":{"type":"array","items":{"type":"string"},"description":"Client Device Platforms out of scope of the Policy.","title":"ExcludePlatforms"},"IncludeLocations":{"type":"array","items":{"type":"string"},"description":"AAD Named Locations in scope of the Policy.","title":"IncludeLocations"},"ExcludeLocations":{"type":"array","items":{"type":"string"},"description":"AAD Named Locations out of scope of the Policy.","title":"ExcludeLocations"},"DeviceFilterMode":{"enum":["include","exclude"],"description":"Client Device Filter mode of the Policy.","title":"DeviceFilterMode"},"DeviceFilterRule":{"type":"string","description":"Client Device Filter rule of the Policy.","title":"DeviceFilterRule"},"UserRiskLevels":{"type":"array","items":{"type":"string"},"description":"AAD Identity Protection User Risk Levels in scope of the Policy.","title":"UserRiskLevels"},"SignInRiskLevels":{"type":"array","items":{"type":"string"},"description":"AAD Identity Protection Sign-in Risk Levels in scope of the Policy.","title":"SignInRiskLevels"},"ClientAppTypes":{"type":"array","items":{"type":"string"},"description":"Client App types in scope of the Policy.","title":"ClientAppTypes"},"GrantControlOperator":{"enum":["AND","OR"],"description":"Operator to be used for Grant Controls.","title":"GrantControlOperator"},"BuiltInControls":{"type":"array","items":{"type":"string"},"description":"List of built-in Grant Controls to be applied by the Policy.","title":"BuiltInControls"},"ApplicationEnforcedRestrictionsIsEnabled":{"type":"boolean","description":"Specifies, whether Application Enforced Restrictions are enabled in the Policy.","title":"ApplicationEnforcedRestrictionsIsEnabled"},"CloudAppSecurityIsEnabled":{"type":"boolean","description":"Specifies, whether Cloud App Security is enforced by the Policy.","title":"CloudAppSecurityIsEnabled"},"CloudAppSecurityType":{"type":"string","description":"Specifies, what Cloud App Security control is enforced by the Policy.","title":"CloudAppSecurityType"},"SignInFrequencyValue":{"type":"integer","description":"Sign in frequency time in the given unit to be enforced by the policy.","title":"SignInFrequencyValue"},"TermsOfUse":{"type":"string","description":"Display name of the terms of use to assign.","title":"TermsOfUse"},"CustomAuthenticationFactors":{"type":"array","items":{"type":"string"},"description":"Custom Controls assigned to the grant property of this policy.","title":"CustomAuthenticationFactors"},"SignInFrequencyType":{"enum":["Days","Hours",""],"description":"Sign in frequency unit (days/hours) to be interpreted by the policy.","title":"SignInFrequencyType"},"SignInFrequencyIsEnabled":{"type":"boolean","description":"Specifies, whether sign-in frequency is enforced by the Policy.","title":"SignInFrequencyIsEnabled"},"SignInFrequencyInterval":{"enum":["timeBased","everyTime","unknownFutureValue"],"description":"Sign in frequency interval. Possible values are: 'timeBased', 'everyTime' and 'unknownFutureValue'.","title":"SignInFrequencyInterval"},"PersistentBrowserIsEnabled":{"type":"boolean","description":"Specifies, whether Browser Persistence is controlled by the Policy.","title":"PersistentBrowserIsEnabled"},"PersistentBrowserMode":{"enum":["Always","Never",""],"description":"Specifies, what Browser Persistence control is enforced by the Policy.","title":"PersistentBrowserMode"},"AuthenticationStrength":{"type":"string","description":"Name of the associated authentication strength policy.","title":"AuthenticationStrength"},"TransferMethods":{"type":"string","description":"Names of the associated authentication flow transfer methods. Possible values are '', 'deviceCodeFlow', 'authenticationTransfer', or 'deviceCodeFlow,authenticationTransfer'.","title":"TransferMethods"},"AuthenticationContexts":{"type":"array","items":{"type":"string"},"description":"Authentication context class references.","title":"AuthenticationContexts"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Azure AD CA Policy should exist or not.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.crosstenantaccesspolicy":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies.","title":"Schema for microsoft.entra.crosstenantaccesspolicy","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"DisplayName":{"type":"string","description":"The name of the policy.","title":"DisplayName"},"AllowedCloudEndpoints":{"type":"array","items":{"enum":["microsoftonline.com","microsoftonline.us","partner.microsoftonline.cn"]},"description":"Used to specify which Microsoft clouds an organization would like to collaborate with. By default, this value is empty.","title":"AllowedCloudEndpoints"},"Ensure":{"enum":["Present"],"description":"Specify if the policy should exist or not.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.entra.crosstenantaccesspolicyconfigurationdefault":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for microsoft.entra.crosstenantaccesspolicyconfigurationdefault","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"B2BCollaborationInbound":{"type":"object","description":"Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B collaboration.","title":"B2BCollaborationInbound","properties":{"Applications":{"type":"object","description":"The list of applications targeted with your cross-tenant access policy.","title":"Applications","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]},"UsersAndGroups":{"type":"object","description":"The list of users and groups targeted with your cross-tenant access policy.","title":"UsersAndGroups","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]}},"required":[]},"B2BCollaborationOutbound":{"type":"object","description":"Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B collaboration.","title":"B2BCollaborationOutbound","properties":{"Applications":{"type":"object","description":"The list of applications targeted with your cross-tenant access policy.","title":"Applications","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]},"UsersAndGroups":{"type":"object","description":"The list of users and groups targeted with your cross-tenant access policy.","title":"UsersAndGroups","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]}},"required":[]},"B2BDirectConnectInbound":{"type":"object","description":"Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B direct connect.","title":"B2BDirectConnectInbound","properties":{"Applications":{"type":"object","description":"The list of applications targeted with your cross-tenant access policy.","title":"Applications","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]},"UsersAndGroups":{"type":"object","description":"The list of users and groups targeted with your cross-tenant access policy.","title":"UsersAndGroups","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]}},"required":[]},"B2BDirectConnectOutbound":{"type":"object","description":"Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B direct connect.","title":"B2BDirectConnectOutbound","properties":{"Applications":{"type":"object","description":"The list of applications targeted with your cross-tenant access policy.","title":"Applications","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]},"UsersAndGroups":{"type":"object","description":"The list of users and groups targeted with your cross-tenant access policy.","title":"UsersAndGroups","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]}},"required":[]},"InboundTrust":{"type":"object","description":"Determines the partner-specific configuration for trusting other Conditional Access claims from external Azure AD organizations.","title":"InboundTrust","properties":{"IsCompliantDeviceAccepted":{"type":"boolean","description":"Specifies whether compliant devices from external Azure AD organizations are trusted.","title":"IsCompliantDeviceAccepted"},"IsHybridAzureADJoinedDeviceAccepted":{"type":"boolean","description":"Specifies whether hybrid Azure AD joined devices from external Azure AD organizations are trusted.","title":"IsHybridAzureADJoinedDeviceAccepted"},"IsMfaAccepted":{"type":"boolean","description":"Specifies whether MFA from external Azure AD organizations is trusted.","title":"IsMfaAccepted"}},"required":[]},"Ensure":{"enum":["Present"],"description":"Specify if the instance should exist or not.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.entra.crosstenantaccesspolicyconfigurationpartner":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Partner.","title":"Schema for microsoft.entra.crosstenantaccesspolicyconfigurationpartner","properties":{"PartnerTenantId":{"type":"string","description":"The tenant identifier for the partner Azure Active Directory (Azure AD) organization.","title":"PartnerTenantId"},"B2BCollaborationInbound":{"type":"object","description":"Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B collaboration.","title":"B2BCollaborationInbound","properties":{"Applications":{"type":"object","description":"The list of applications targeted with your cross-tenant access policy.","title":"Applications","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]},"UsersAndGroups":{"type":"object","description":"The list of users and groups targeted with your cross-tenant access policy.","title":"UsersAndGroups","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]}},"required":[]},"B2BCollaborationOutbound":{"type":"object","description":"Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B collaboration.","title":"B2BCollaborationOutbound","properties":{"Applications":{"type":"object","description":"The list of applications targeted with your cross-tenant access policy.","title":"Applications","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]},"UsersAndGroups":{"type":"object","description":"The list of users and groups targeted with your cross-tenant access policy.","title":"UsersAndGroups","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]}},"required":[]},"B2BDirectConnectInbound":{"type":"object","description":"Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B direct connect.","title":"B2BDirectConnectInbound","properties":{"Applications":{"type":"object","description":"The list of applications targeted with your cross-tenant access policy.","title":"Applications","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]},"UsersAndGroups":{"type":"object","description":"The list of users and groups targeted with your cross-tenant access policy.","title":"UsersAndGroups","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]}},"required":[]},"B2BDirectConnectOutbound":{"type":"object","description":"Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B direct connect.","title":"B2BDirectConnectOutbound","properties":{"Applications":{"type":"object","description":"The list of applications targeted with your cross-tenant access policy.","title":"Applications","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]},"UsersAndGroups":{"type":"object","description":"The list of users and groups targeted with your cross-tenant access policy.","title":"UsersAndGroups","properties":{"AccessType":{"enum":["allowed","blocked","unknownFutureValue"],"description":"Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.","title":"AccessType"},"Targets":{"type":"array","items":{"type":"object","description":"This resource manages Azure AD Cross Tenant Access Policies Configuration Default.","title":"Schema for MSFT_AADCrossTenantAccessPolicyTarget","properties":{"Target":{"type":"string","description":"The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.","title":"Target"},"TargetType":{"enum":["user","group","application","unknownFutureValue"],"description":"The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.","title":"TargetType"}},"required":[]},"description":"Specifies whether to target users, groups, or applications with this rule.","title":"Targets"}},"required":[]}},"required":[]},"AutomaticUserConsentSettings":{"type":"object","description":"Determines the partner-specific configuration for accepting trust claims from other tenant invitations.","title":"AutomaticUserConsentSettings","properties":{"InboundAllowed":{"type":"boolean","description":"Specifies whether you want to automatically trust Inbound invitations.","title":"InboundAllowed"},"OutboundAllowed":{"type":"boolean","description":"Specifies whether you want to automatically trust Outbound invitations.","title":"OutboundAllowed"}},"required":[]},"InboundTrust":{"type":"object","description":"Determines the partner-specific configuration for trusting other Conditional Access claims from external Azure AD organizations.","title":"InboundTrust","properties":{"IsCompliantDeviceAccepted":{"type":"boolean","description":"Specifies whether compliant devices from external Azure AD organizations are trusted.","title":"IsCompliantDeviceAccepted"},"IsHybridAzureADJoinedDeviceAccepted":{"type":"boolean","description":"Specifies whether hybrid Azure AD joined devices from external Azure AD organizations are trusted.","title":"IsHybridAzureADJoinedDeviceAccepted"},"IsMfaAccepted":{"type":"boolean","description":"Specifies whether MFA from external Azure AD organizations is trusted.","title":"IsMfaAccepted"}},"required":[]},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the policy should exist or not.","title":"Ensure"}},"required":["PartnerTenantId"]},"microsoft.entra.entitlementmanagementaccesspackage":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package.","title":"Schema for microsoft.entra.entitlementmanagementaccesspackage","properties":{"DisplayName":{"type":"string","description":"The display name of the access package.","title":"DisplayName"},"Id":{"type":"string","description":"The Id of the access package.","title":"Id"},"CatalogId":{"type":"string","description":"Identifier of the access package catalog referencing this access package.","title":"CatalogId"},"Description":{"type":"string","description":"The description of the access package.","title":"Description"},"IsHidden":{"type":"boolean","description":"Whether the access package is hidden from the requestor.","title":"IsHidden"},"IsRoleScopesVisible":{"type":"boolean","description":"Indicates whether role scopes are visible.","title":"IsRoleScopesVisible"},"AccessPackageResourceRoleScopes":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package.","title":"Schema for MSFT_AccessPackageResourceRoleScope","properties":{"Id":{"type":"string","description":"The Id of the resource roleScope.","title":"Id"},"AccessPackageResourceOriginId":{"type":"string","description":"The origine Id of the resource.","title":"AccessPackageResourceOriginId"},"AccessPackageResourceRoleDisplayName":{"type":"string","description":"The display name of the resource role.","title":"AccessPackageResourceRoleDisplayName"}},"required":[]},"description":"The resources and roles included in the access package.","title":"AccessPackageResourceRoleScopes"},"IncompatibleAccessPackages":{"type":"array","items":{"type":"string"},"description":"The access packages whose assigned users are ineligible to be assigned this access package.","title":"IncompatibleAccessPackages"},"AccessPackagesIncompatibleWith":{"type":"array","items":{"type":"string"},"description":"The access packages that are incompatible with this package.","title":"AccessPackagesIncompatibleWith"},"IncompatibleGroups":{"type":"array","items":{"type":"string"},"description":"The groups whose members are ineligible to be assigned this access package.","title":"IncompatibleGroups"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.entitlementmanagementaccesspackageassignmentpolicy":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for microsoft.entra.entitlementmanagementaccesspackageassignmentpolicy","properties":{"DisplayName":{"type":"string","description":"The display name of the policy.","title":"DisplayName"},"Id":{"type":"string","description":"Id of the access package assignment policy.","title":"Id"},"AccessPackageId":{"type":"string","description":"Identifier of the access package.","title":"AccessPackageId"},"AccessReviewSettings":{"type":"object","description":"Who must review, and how often, the assignments to the access package from this policy. This property is null if reviews are not required.","title":"AccessReviewSettings","properties":{"AccessReviewTimeoutBehavior":{"enum":["acceptAccessRecommendation","keepAccess","removeAccess","unknownFutureValue"],"description":"The default decision to apply if the request is not reviewed within the period specified in durationInDays.","title":"AccessReviewTimeoutBehavior"},"DurationInDays":{"type":"integer","description":"The number of days within which reviewers should provide input.","title":"DurationInDays"},"IsAccessRecommendationEnabled":{"type":"boolean","description":"Specifies whether to display recommendations to the reviewer. The default value is true","title":"IsAccessRecommendationEnabled"},"IsApprovalJustificationRequired":{"type":"boolean","description":"Specifies whether the reviewer must provide justification for the approval. The default value is true.","title":"IsApprovalJustificationRequired"},"IsEnabled":{"type":"boolean","description":"If true, access reviews are required for assignments from this policy.","title":"IsEnabled"},"RecurrenceType":{"type":"string","description":"The interval for recurrence, such as monthly or quarterly.","title":"RecurrenceType"},"ReviewerType":{"type":"string","description":"Who should be asked to do the review, either Self or Reviewers.","title":"ReviewerType"},"Reviewers":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphuserset","properties":{"odataType":{"enum":["#microsoft.graph.singleUser","#microsoft.graph.groupMembers","#microsoft.graph.requestorManager","#microsoft.graph.internalSponsors","#microsoft.graph.externalSponsors","#microsoft.graph.connectedOrganizationMembers"],"description":"The type of the resource","title":"odataType"},"Id":{"type":"string","description":"The id of the resource.","title":"Id"},"IsBackup":{"type":"boolean","description":"Indicates whether the resource is a backup fallback approver.","title":"IsBackup"},"ManagerLevel":{"type":"integer","description":"The hierarchical level of the manager with respect to the requestor. For example, the direct manager of a requestor would have a managerLevel of 1, while the manager of the requestor's manager would have a managerLevel of 2. Default value for managerLevel is 1. Possible values for this property range from 1 to 2.","title":"ManagerLevel"}},"required":[]},"description":"If the reviewerType is Reviewers, this collection specifies the users who will be reviewers, either by ID or as members of a group, using a collection of singleUser and groupMembers.","title":"Reviewers"},"StartDateTime":{"type":"string","description":"When the first review should start.","title":"StartDateTime"}},"required":[]},"CanExtend":{"type":"boolean","description":"Indicates whether a user can extend the access package assignment duration after approval.","title":"CanExtend"},"Description":{"type":"string","description":"The description of the policy.","title":"Description"},"DurationInDays":{"type":"integer","description":"The number of days in which assignments from this policy last until they are expired.","title":"DurationInDays"},"ExpirationDateTime":{"type":"string","description":"The expiration date for assignments created in this policy. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z","title":"ExpirationDateTime"},"Questions":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphaccesspackagequestion","properties":{"odataType":{"enum":["#microsoft.graph.accessPackageMultipleChoiceQuestion","#microsoft.graph.accessPackageTextInputQuestion"],"description":"The type of the resource","title":"odataType"},"Id":{"type":"string","description":"ID of the question.","title":"Id"},"IsAnswerEditable":{"type":"boolean","description":"Specifies whether the requestor is allowed to edit answers to questions.","title":"IsAnswerEditable"},"IsRequired":{"type":"boolean","description":"Whether the requestor is required to supply an answer or not.","title":"IsRequired"},"Sequence":{"type":"integer","description":"Relative position of this question when displaying a list of questions to the requestor.","title":"Sequence"},"QuestionText":{"type":"object","description":"The text of the question to show to the requestor.","title":"QuestionText","properties":{"DefaultText":{"type":"string","description":"The fallback string, which is used when a requested localization is not available. Required.","title":"DefaultText"},"LocalizedTexts":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphaccessPackageLocalizedText","properties":{"Text":{"type":"string","description":"The text in the specific language. Required.","title":"Text"},"LanguageCode":{"type":"string","description":"The ISO code for the intended language. Required.","title":"LanguageCode"}},"required":[]},"description":"Content represented in a format for a specific locale.","title":"LocalizedTexts"}},"required":[]},"Choices":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphaccessPackageAnswerChoice","properties":{"ActualValue":{"type":"string","description":"The actual value of the selected choice. This is typically a string value which is understandable by applications. Required.","title":"ActualValue"},"displayValue":{"type":"object","description":"The localized display values shown to the requestor and approvers. Required.","title":"displayValue","properties":{"DefaultText":{"type":"string","description":"The fallback string, which is used when a requested localization is not available. Required.","title":"DefaultText"},"LocalizedTexts":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphaccessPackageLocalizedText","properties":{"Text":{"type":"string","description":"The text in the specific language. Required.","title":"Text"},"LanguageCode":{"type":"string","description":"The ISO code for the intended language. Required.","title":"LanguageCode"}},"required":[]},"description":"Content represented in a format for a specific locale.","title":"LocalizedTexts"}},"required":[]}},"required":[]},"description":"List of answer choices.","title":"Choices"},"AllowsMultipleSelection":{"type":"boolean","description":"Indicates whether requestor can select multiple choices as their answer.","title":"AllowsMultipleSelection"},"RegexPattern":{"type":"string","description":"This is the regex pattern that the corresponding text answer must follow.","title":"RegexPattern"},"IsSingleLineQuestion":{"type":"boolean","description":"Indicates whether the answer will be in single or multiple line format.","title":"IsSingleLineQuestion"}},"required":[]},"description":"Questions that are posed to the requestor.","title":"Questions"},"RequestApprovalSettings":{"type":"object","description":"Who must approve requests for access package in this policy.","title":"RequestApprovalSettings","properties":{"ApprovalMode":{"enum":["SingleStage","Serial","Parallel","NoApproval"],"description":"One of SingleStage, Serial, Parallel, NoApproval (default). NoApproval is used when isApprovalRequired is false.","title":"ApprovalMode"},"ApprovalStages":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphapprovalstage1","properties":{"ApprovalStageTimeOutInDays":{"type":"integer","description":"The number of days that a request can be pending a response before it is automatically denied.","title":"ApprovalStageTimeOutInDays"},"EscalationTimeInMinutes":{"type":"integer","description":"Indicates whether the approver is required to provide a justification for approving a request.","title":"EscalationTimeInMinutes"},"IsApproverJustificationRequired":{"type":"boolean","description":"If true, then one or more escalation approvers are configured in this approval stage.","title":"IsApproverJustificationRequired"},"IsEscalationEnabled":{"type":"boolean","description":"If escalation is required, the time a request can be pending a response from a primary approver.","title":"IsEscalationEnabled"},"PrimaryApprovers":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphuserset","properties":{"odataType":{"enum":["#microsoft.graph.singleUser","#microsoft.graph.groupMembers","#microsoft.graph.requestorManager","#microsoft.graph.internalSponsors","#microsoft.graph.externalSponsors","#microsoft.graph.connectedOrganizationMembers"],"description":"The type of the resource","title":"odataType"},"Id":{"type":"string","description":"The id of the resource.","title":"Id"},"IsBackup":{"type":"boolean","description":"Indicates whether the resource is a backup fallback approver.","title":"IsBackup"},"ManagerLevel":{"type":"integer","description":"The hierarchical level of the manager with respect to the requestor. For example, the direct manager of a requestor would have a managerLevel of 1, while the manager of the requestor's manager would have a managerLevel of 2. Default value for managerLevel is 1. Possible values for this property range from 1 to 2.","title":"ManagerLevel"}},"required":[]},"description":"The users who will be asked to approve requests. A collection of singleUser, groupMembers, requestorManager, internalSponsors and externalSponsors. When creating or updating a policy, include at least one userSet in this collection.","title":"PrimaryApprovers"},"EscalationApprovers":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphuserset","properties":{"odataType":{"enum":["#microsoft.graph.singleUser","#microsoft.graph.groupMembers","#microsoft.graph.requestorManager","#microsoft.graph.internalSponsors","#microsoft.graph.externalSponsors","#microsoft.graph.connectedOrganizationMembers"],"description":"The type of the resource","title":"odataType"},"Id":{"type":"string","description":"The id of the resource.","title":"Id"},"IsBackup":{"type":"boolean","description":"Indicates whether the resource is a backup fallback approver.","title":"IsBackup"},"ManagerLevel":{"type":"integer","description":"The hierarchical level of the manager with respect to the requestor. For example, the direct manager of a requestor would have a managerLevel of 1, while the manager of the requestor's manager would have a managerLevel of 2. Default value for managerLevel is 1. Possible values for this property range from 1 to 2.","title":"ManagerLevel"}},"required":[]},"description":"If escalation is enabled and the primary approvers do not respond before the escalation time, the escalationApprovers are the users who will be asked to approve requests. This can be a collection of singleUser, groupMembers, requestorManager, internalSponsors and externalSponsors. When creating or updating a policy, if there are no escalation approvers, or escalation approvers are not required for the stage, the value of this property should be an empty collection.","title":"EscalationApprovers"}},"required":[]},"description":"If approval is required, the one or two elements of this collection define each of the stages of approval. An empty array if no approval is required.","title":"ApprovalStages"},"IsApprovalRequired":{"type":"boolean","description":"Indicates whether approval is required for requests in this policy.","title":"IsApprovalRequired"},"IsApprovalRequiredForExtension":{"type":"boolean","description":"Indicates whether approval is required for a user to extend their assignment.","title":"IsApprovalRequiredForExtension"},"IsRequestorJustificationRequired":{"type":"boolean","description":"Indicates whether the requestor is required to supply a justification in their request.","title":"IsRequestorJustificationRequired"}},"required":[]},"RequestorSettings":{"type":"object","description":"Who can request this access package from this policy.","title":"RequestorSettings","properties":{"AcceptRequests":{"type":"boolean","description":"Indicates whether new requests are accepted on this policy.","title":"AcceptRequests"},"AllowedRequestors":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphuserset","properties":{"odataType":{"enum":["#microsoft.graph.singleUser","#microsoft.graph.groupMembers","#microsoft.graph.requestorManager","#microsoft.graph.internalSponsors","#microsoft.graph.externalSponsors","#microsoft.graph.connectedOrganizationMembers"],"description":"The type of the resource","title":"odataType"},"Id":{"type":"string","description":"The id of the resource.","title":"Id"},"IsBackup":{"type":"boolean","description":"Indicates whether the resource is a backup fallback approver.","title":"IsBackup"},"ManagerLevel":{"type":"integer","description":"The hierarchical level of the manager with respect to the requestor. For example, the direct manager of a requestor would have a managerLevel of 1, while the manager of the requestor's manager would have a managerLevel of 2. Default value for managerLevel is 1. Possible values for this property range from 1 to 2.","title":"ManagerLevel"}},"required":[]},"description":"The users who are allowed to request on this policy, which can be singleUser, groupMembers, and connectedOrganizationMembers.","title":"AllowedRequestors"},"ScopeType":{"enum":["NoSubjects","SpecificDirectorySubjects","SpecificConnectedOrganizationSubjects","AllConfiguredConnectedOrganizationSubjects","AllExistingConnectedOrganizationSubjects","AllExistingDirectoryMemberUsers","AllExistingDirectorySubjects","AllExternalSubjects"],"description":"Who can request.","title":"ScopeType"}},"required":[]},"CustomExtensionHandlers":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphcustomextensionhandler","properties":{"CustomExtensionId":{"type":"string","description":"Indicates which custom workflow extension will be executed at this stage.","title":"CustomExtensionId"},"Stage":{"enum":["assignmentRequestCreated","assignmentRequestApproved","assignmentRequestGranted","assignmentRequestRemoved","assignmentFourteenDaysBeforeExpiration","assignmentOneDayBeforeExpiration","unknownFutureValue"],"description":"Indicates the stage of the access package assignment request workflow when the access package custom extension runs.","title":"Stage"},"Id":{"type":"string","description":"Identifier of the stage.","title":"Id"}},"required":[]},"description":"The collection of stages when to execute one or more custom access package workflow extensions.","title":"CustomExtensionHandlers"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.entitlementmanagementaccesspackagecatalog":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Catalog.","title":"Schema for microsoft.entra.entitlementmanagementaccesspackagecatalog","properties":{"DisplayName":{"type":"string","description":"The display name of the access package catalog.","title":"DisplayName"},"Id":{"type":"string","description":"The id of the access package catalog.","title":"Id"},"CatalogStatus":{"type":"string","description":"Has the value Published if the access packages are available for management.","title":"CatalogStatus"},"CatalogType":{"enum":["UserManaged","ServiceDefault"],"description":"One of UserManaged or ServiceDefault.","title":"CatalogType"},"Description":{"type":"string","description":"The description of the access package catalog.","title":"Description"},"IsExternallyVisible":{"type":"boolean","description":"Whether the access packages in this catalog can be requested by users outside of the tenant.","title":"IsExternallyVisible"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.entitlementmanagementaccesspackagecatalogresource":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Catalog Resource.","title":"Schema for microsoft.entra.entitlementmanagementaccesspackagecatalogresource","properties":{"DisplayName":{"type":"string","description":"The display name of the resource, such as the application name, group name or site name.","title":"DisplayName"},"Id":{"type":"string","description":"Id of the access package catalog resource.","title":"Id"},"CatalogId":{"type":"string","description":"The unique ID of the access package catalog.","title":"CatalogId"},"AddedBy":{"type":"string","description":"The name of the user or application that first added this resource. Read-only.","title":"AddedBy"},"AddedOn":{"type":"string","description":"The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.","title":"AddedOn"},"Attributes":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Catalog Resource.","title":"Schema for MSFT_MicrosoftGraphaccesspackageresourceattribute","properties":{"AttributeDestination":{"type":"object","description":"Information about how to set the attribute, currently a accessPackageUserDirectoryAttributeStore object type.","title":"AttributeDestination","properties":{"odataType":{"enum":["#microsoft.graph.accessPackageUserDirectoryAttributeStore"],"description":"Type of the access package resource attribute destination.","title":"odataType"}},"required":[]},"AttributeName":{"type":"string","description":"The name of the attribute in the end system.","title":"AttributeName"},"AttributeSource":{"type":"object","description":"Information about how to populate the attribute value when an accessPackageAssignmentRequest is being fulfilled, currently a accessPackageResourceAttributeQuestion object type.","title":"AttributeSource","properties":{"odataType":{"enum":["#microsoft.graph.accessPackageResourceAttributeQuestion"],"description":"Type of the access package resource attribute source.","title":"odataType"},"Question":{"type":"object","description":"The question asked in order to get the value of the attribute.","title":"Question","properties":{"odataType":{"enum":["#microsoft.graph.accessPackageTextInputQuestion","#microsoft.graph.accessPackageMultipleChoiceQuestion"],"description":"Type of the access package resource attribute question.","title":"odataType"},"Id":{"type":"string","description":"Id of the access package resource attribute question.","title":"Id"},"IsRequired":{"type":"boolean","description":"Indicates whether the requestor is required to supply an answer or not.","title":"IsRequired"},"IsSingleLine":{"type":"boolean","description":"Indicates whether the answer will be in single or multiple line format.","title":"IsSingleLine"},"RegexPattern":{"type":"string","description":"This is the regex pattern that the corresponding text answer must follow.","title":"RegexPattern"},"Sequence":{"type":"integer","description":"Relative position of this question when displaying a list of questions to the requestor.","title":"Sequence"},"QuestionText":{"type":"object","description":"The text of the question to show to the requestor.","title":"QuestionText","properties":{"DefaultText":{"type":"string","description":"The fallback string, which is used when a requested localization is not available. Required.","title":"DefaultText"},"LocalizedTexts":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphaccessPackageLocalizedText","properties":{"Text":{"type":"string","description":"The text in the specific language. Required.","title":"Text"},"LanguageCode":{"type":"string","description":"The ISO code for the intended language. Required.","title":"LanguageCode"}},"required":[]},"description":"Content represented in a format for a specific locale.","title":"LocalizedTexts"}},"required":[]},"AllowsMultipleSelection":{"type":"boolean","description":"Indicates whether requestor can select multiple choices as their answer.","title":"AllowsMultipleSelection"},"Choices":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphaccessPackageAnswerChoice","properties":{"ActualValue":{"type":"string","description":"The actual value of the selected choice. This is typically a string value which is understandable by applications. Required.","title":"ActualValue"},"displayValue":{"type":"object","description":"The localized display values shown to the requestor and approvers. Required.","title":"displayValue","properties":{"DefaultText":{"type":"string","description":"The fallback string, which is used when a requested localization is not available. Required.","title":"DefaultText"},"LocalizedTexts":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.","title":"Schema for MSFT_MicrosoftGraphaccessPackageLocalizedText","properties":{"Text":{"type":"string","description":"The text in the specific language. Required.","title":"Text"},"LanguageCode":{"type":"string","description":"The ISO code for the intended language. Required.","title":"LanguageCode"}},"required":[]},"description":"Content represented in a format for a specific locale.","title":"LocalizedTexts"}},"required":[]}},"required":[]},"description":"List of answer choices.","title":"Choices"}},"required":[]}},"required":[]},"Id":{"type":"string","description":"Id of the access package resource attribute.","title":"Id"},"IsEditable":{"type":"boolean","description":"Specifies whether or not an existing attribute value can be edited by the requester.","title":"IsEditable"},"IsPersistedOnAssignmentRemoval":{"type":"boolean","description":"Specifies whether the attribute will remain in the end system after an assignment ends.","title":"IsPersistedOnAssignmentRemoval"}},"required":[]},"description":"Contains information about the attributes to be collected from the requestor and sent to the resource application.","title":"Attributes"},"Description":{"type":"string","description":"A description for the resource.","title":"Description"},"IsPendingOnboarding":{"type":"boolean","description":"True if the resource is not yet available for assignment. Read-only.","title":"IsPendingOnboarding"},"OriginId":{"type":"string","description":"The unique identifier of the resource in the origin system. In the case of an Azure AD group, this is the identifier of the group.","title":"OriginId"},"OriginSystem":{"type":"string","description":"The type of the resource in the origin system.","title":"OriginSystem"},"ResourceType":{"type":"string","description":"The type of the resource.","title":"ResourceType"},"Url":{"type":"string","description":"A unique resource locator for the resource, such as the URL for signing a user into an application.","title":"Url"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.entitlementmanagementconnectedorganization":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Connected Organization.","title":"Schema for microsoft.entra.entitlementmanagementconnectedorganization","properties":{"DisplayName":{"type":"string","description":"The display name of the connected organization.","title":"DisplayName"},"Id":{"type":"string","description":"The Id of the Connected organization object.","title":"Id"},"Description":{"type":"string","description":"The description of the connected organization.","title":"Description"},"IdentitySources":{"type":"array","items":{"type":"object","description":"This resource configures an Azure AD Entitlement Management Connected Organization.","title":"Schema for MSFT_AADEntitlementManagementConnectedOrganizationIdentitySource","properties":{"odataType":{"enum":["#microsoft.graph.azureActiveDirectoryTenant","#microsoft.graph.crossCloudAzureActiveDirectoryTenant","#microsoft.graph.domainIdentitySource","#microsoft.graph.externalDomainFederation"],"description":"Type of the identity source.","title":"odataType"},"DisplayName":{"type":"string","description":"The name of the Azure Active Directory tenant.","title":"DisplayName"},"ExternalTenantId":{"type":"string","description":"The ID of the Azure Active Directory tenant.","title":"ExternalTenantId"},"CloudInstance":{"type":"string","description":"The ID of the cloud where the tenant is located, one of microsoftonline.com, microsoftonline.us or partner.microsoftonline.cn.","title":"CloudInstance"},"DomainName":{"type":"string","description":"The domain name.","title":"DomainName"},"IssuerUri":{"type":"string","description":"The issuerURI of the incoming federation.","title":"IssuerUri"}},"required":[]},"description":"The identity sources in this connected organization.","title":"IdentitySources"},"State":{"enum":["configured","proposed","unknownFutureValue"],"description":"The state of a connected organization defines whether assignment policies with requestor scope type AllConfiguredConnectedOrganizationSubjects are applicable or not.","title":"State"},"ExternalSponsors":{"type":"array","items":{"type":"string"},"description":"Collection of objectID of external sponsors. the sponsor can be a user or a group.","title":"ExternalSponsors"},"InternalSponsors":{"type":"array","items":{"type":"string"},"description":"Collection of objectID of internal sponsors. the sponsor can be a user or a group.","title":"InternalSponsors"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.externalidentitypolicy":{"type":"object","description":"Represents the tenant-wide policy that controls whether external users can leave the guest Microsoft Entra tenant via self-service controls.","title":"Schema for microsoft.entra.externalidentitypolicy","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"AllowDeletedIdentitiesDataRemoval":{"type":"boolean","description":"Reserved for future use.","title":"AllowDeletedIdentitiesDataRemoval"},"allowExternalIdentitiesToLeave":{"type":"boolean","description":"Defines whether external users can leave the guest tenant. If set to false, self-service controls are disabled, and the admin of the guest tenant must manually remove the external user from the guest tenant. When the external user leaves the tenant, their data in the guest tenant is first soft-deleted then permanently deleted in 30 days.","title":"allowExternalIdentitiesToLeave"}},"required":["IsSingleInstance","allowExternalIdentitiesToLeave"]},"microsoft.entra.group":{"type":"object","description":"This resource configures an Azure Active Directory group. IMPORTANT: It does not support mail enabled security groups or mail enabled groups that are not unified or dynamic groups.\r\n\r\nIf using with AADUser, be aware that if AADUser->MemberOf is being specified and the referenced group is configured with AADGroup->Member then a conflict may arise if the two don't match. It is usually best to choose only one of them. See AADUser","title":"Schema for microsoft.entra.group","properties":{"DisplayName":{"type":"string","description":"DisplayName of the Azure Active Directory Group","title":"DisplayName"},"MailNickname":{"type":"string","description":"Specifies a mail nickname for the group.","title":"MailNickname"},"Description":{"type":"string","description":"Specifies a description for the group.","title":"Description"},"Id":{"type":"string","description":"Specifies an ID for the group.","title":"Id"},"Owners":{"type":"array","items":{"type":"string"},"description":"User Service Principal values for the group's owners.","title":"Owners"},"Members":{"type":"array","items":{"type":"string"},"description":"User Service Principal values for the group's members.","title":"Members"},"GroupAsMembers":{"type":"array","items":{"type":"string"},"description":"Displayname values for the groups member of the group.","title":"GroupAsMembers"},"MemberOf":{"type":"array","items":{"type":"string"},"description":"DisplayName values for the groups that this group is a member of.","title":"MemberOf"},"GroupTypes":{"type":"array","items":{"type":"string"},"description":"Specifies that the group is a dynamic group. To create a dynamic group, specify a value of DynamicMembership.","title":"GroupTypes"},"MembershipRule":{"type":"string","description":"Specifies the membership rule for a dynamic group.","title":"MembershipRule"},"MembershipRuleProcessingState":{"enum":["On","Paused"],"description":"Specifies the rule processing state. The acceptable values for this parameter are: On. Process the group rule or Paused. Stop processing the group rule.","title":"MembershipRuleProcessingState"},"SecurityEnabled":{"type":"boolean","description":"Specifies whether the group is security enabled. For security groups, this value must be $True.","title":"SecurityEnabled"},"MailEnabled":{"type":"boolean","description":"Specifies whether this group is mail enabled. Currently, you cannot create mail enabled groups in Azure AD.","title":"MailEnabled"},"IsAssignableToRole":{"type":"boolean","description":"Specifies whether this group can be assigned a role. Only available when creating a group and can't be modified after group is created.","title":"IsAssignableToRole"},"AssignedToRole":{"type":"array","items":{"type":"string"},"description":"DisplayName values for the roles that the group is assigned to.","title":"AssignedToRole"},"Visibility":{"enum":["Public","Private","HiddenMembership"],"description":"This parameter determines the visibility of the group's content and members list.","title":"Visibility"},"AssignedLicenses":{"type":"array","items":{"type":"object","description":"This resource configures an Azure Active Directory group. IMPORTANT: It does not support mail enabled security groups or mail enabled groups that are not unified or dynamic groups.\r\n\r\nIf using with AADUser, be aware that if AADUser->MemberOf is being specified and the referenced group is configured with AADGroup->Member then a conflict may arise if the two don't match. It is usually best to choose only one of them. See AADUser","title":"Schema for MSFT_AADGroupLicense","properties":{"DisabledPlans":{"type":"array","items":{"type":"string"},"description":"A collection of the unique identifiers for plans that have been disabled.","title":"DisabledPlans"},"SkuId":{"type":"string","description":"The unique identifier for the SKU.","title":"SkuId"}},"required":[]},"description":"List of Licenses assigned to the group.","title":"AssignedLicenses"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Azure AD Group should exist or not.","title":"Ensure"}},"required":["DisplayName","MailNickname","SecurityEnabled","MailEnabled"]},"microsoft.entra.grouplifecyclepolicy":{"type":"object","description":"This resource configures an Azure Active Directory Group Lifecycle Policy (e.g. Expiration).","title":"Schema for microsoft.entra.grouplifecyclepolicy","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"GroupLifetimeInDays":{"type":"integer","description":"The number of days a group can exist before it needs to be renewed.","title":"GroupLifetimeInDays"},"ManagedGroupTypes":{"enum":["All","None","Selected"],"description":"This parameter allows the admin to select which office 365 groups the policy will apply to. 'None' will create the policy in a disabled state. 'All' will apply the policy to every Office 365 group in the tenant. 'Selected' will allow the admin to choose specific Office 365 groups that the policy will apply to.","title":"ManagedGroupTypes"},"AlternateNotificationEmails":{"type":"array","items":{"type":"string"},"description":"Notification emails for groups that have no owners will be sent to these email addresses.","title":"AlternateNotificationEmails"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Azure AD Groups Lifecycle Policy should exist or not.","title":"Ensure"}},"required":["IsSingleInstance","GroupLifetimeInDays","ManagedGroupTypes","AlternateNotificationEmails"]},"microsoft.entra.groupsnamingpolicy":{"type":"object","description":"This resource configures an Azure Active Directory Group Naming Policy.","title":"Schema for microsoft.entra.groupsnamingpolicy","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"PrefixSuffixNamingRequirement":{"type":"string","description":"Prefixes and suffixes to add to the group name.","title":"PrefixSuffixNamingRequirement"},"CustomBlockedWordsList":{"type":"array","items":{"type":"string"},"description":"Comma delimited list of words that should be blocked from being included in groups' names.","title":"CustomBlockedWordsList"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Azure AD Groups Naming Policy should exist or not.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.entra.groupssettings":{"type":"object","description":"This resource configures an Azure Active Directory Groups Settings.","title":"Schema for microsoft.entra.groupssettings","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"EnableGroupCreation":{"type":"boolean","description":"The flag indicating whether Office 365 group creation is allowed in the directory by non-admin users. This setting does not require an Azure Active Directory Premium P1 license.","title":"EnableGroupCreation"},"EnableMIPLabels":{"type":"boolean","description":"Boolean indicating whether or not sensitivity labels can be assigned to M365-groups.","title":"EnableMIPLabels"},"AllowGuestsToBeGroupOwner":{"type":"boolean","description":"Boolean indicating whether or not a guest user can be an owner of groups.","title":"AllowGuestsToBeGroupOwner"},"AllowGuestsToAccessGroups":{"type":"boolean","description":"Boolean indicating whether or not a guest user can have access to Office 365 groups content. This setting does not require an Azure Active Directory Premium P1 license.","title":"AllowGuestsToAccessGroups"},"GuestUsageGuidelinesUrl":{"type":"string","description":"The url of a link to the guest usage guidelines.","title":"GuestUsageGuidelinesUrl"},"GroupCreationAllowedGroupName":{"type":"string","description":"Name of the security group for which the members are allowed to create Office 365 groups even when EnableGroupCreation == false.","title":"GroupCreationAllowedGroupName"},"AllowToAddGuests":{"type":"boolean","description":"A boolean indicating whether or not is allowed to add guests to this directory.","title":"AllowToAddGuests"},"UsageGuidelinesUrl":{"type":"string","description":"A link to the Group Usage Guidelines.","title":"UsageGuidelinesUrl"},"NewUnifiedGroupWritebackDefault":{"type":"boolean","description":"Boolean, a tenant-wide setting that assigns the default value to the writebackConfiguration/isEnabled property of new groups, if the property isn't specified during group creation. This setting is applicable when group writeback is configured in Microsoft Entra Connect.","title":"NewUnifiedGroupWritebackDefault"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Azure AD Groups Naming Policy should exist or not.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.entra.namedlocationpolicy":{"type":"object","description":"This resource configures the Azure AD Named Location Policies in Azure Active Directory","title":"Schema for microsoft.entra.namedlocationpolicy","properties":{"OdataType":{"enum":["#microsoft.graph.countryNamedLocation","#microsoft.graph.ipNamedLocation","#microsoft.graph.compliantNetworkNamedLocation"],"description":"Specifies the Odata Type of a Named Location object in Azure Active Directory","title":"OdataType"},"Id":{"type":"string","description":"Specifies the ID of a Named Location in Azure Active Directory.","title":"Id"},"DisplayName":{"type":"string","description":"Specifies the Display Name of a Named Location in Azure Active Directory","title":"DisplayName"},"IpRanges":{"type":"array","items":{"type":"string"},"description":"Specifies the IP ranges of the Named Location in Azure Active Directory","title":"IpRanges"},"IsTrusted":{"type":"boolean","description":"Specifies the isTrusted value for the Named Location (IP ranges only) in Azure Active Directory","title":"IsTrusted"},"CountriesAndRegions":{"type":"array","items":{"type":"string"},"description":"Specifies the countries and regions for the Named Location in Azure Active Directory","title":"CountriesAndRegions"},"CountryLookupMethod":{"enum":["clientIpAddress","authenticatorAppGps"],"description":"Determines what method is used to decide which country the user is located in. Possible values are clientIpAddress(default) and authenticatorAppGps.","title":"CountryLookupMethod"},"IncludeUnknownCountriesAndRegions":{"type":"boolean","description":"Specifies the includeUnknownCountriesAndRegions value for the Named Location in Azure Active Directory","title":"IncludeUnknownCountriesAndRegions"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Azure AD Named Location should exist or not.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.roledefinition":{"type":"object","description":"This resource configures an Azure Active Directory role definition.\r\nTo configure custom roles you require an Azure AD Premium P1 license.\r\nThe account used to configure role definitions based on this resource needs either to be a\r\n\"Global Administrator\" or a \"Privileged role administrator\".","title":"Schema for microsoft.entra.roledefinition","properties":{"DisplayName":{"type":"string","description":"Specifies a display name for the role definition.","title":"DisplayName"},"Id":{"type":"string","description":"Specifies Id for the role definition.","title":"Id"},"Description":{"type":"string","description":"Specifies a description for the role definition.","title":"Description"},"ResourceScopes":{"type":"array","items":{"type":"string"},"description":"Specifies the resource scopes for the role definition.","title":"ResourceScopes"},"IsEnabled":{"type":"boolean","description":"Specifies whether the role definition is enabled.","title":"IsEnabled"},"RolePermissions":{"type":"array","items":{"type":"string"},"description":"Specifies permissions for the role definition.","title":"RolePermissions"},"TemplateId":{"type":"string","description":"Specifies template id for the role definition.","title":"TemplateId"},"Version":{"type":"string","description":"Specifies version for the role definition.","title":"Version"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Azure AD Role definition should exist or not.","title":"Ensure"}},"required":["DisplayName","IsEnabled","RolePermissions"]},"microsoft.entra.roleeligibilityschedulerequest":{"type":"object","description":"Represents a request for a role eligibility for a principal through PIM. The role eligibility can be permanently eligible without an expiry date or temporarily eligible with an expiry date. Inherits from request.","title":"Schema for microsoft.entra.roleeligibilityschedulerequest","properties":{"Principal":{"type":"string","description":"User Principal Name of the eligibility request.","title":"Principal"},"RoleDefinition":{"type":"string","description":"Role associated with the eligibility request.","title":"RoleDefinition"},"PrincipalType":{"enum":["Group","User"],"description":"Represented the type of principal to assign the request to. Accepted values are: Group and User.","title":"PrincipalType"},"DirectoryScopeId":{"type":"string","description":"Identifier of the directory object representing the scope of the role eligibility. The scope of an role eligibility determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use / for tenant-wide scope. Use appScopeId to limit the scope to an application only. Either directoryScopeId or appScopeId is required.","title":"DirectoryScopeId"},"Id":{"type":"string","description":"Identifier for the Role Eligibility Schedule Request.","title":"Id"},"AppScopeId":{"type":"string","description":"Identifier of the app-specific scope when the role eligibility is scoped to an app. The scope of a role eligibility determines the set of resources for which the principal is eligible to access. App scopes are scopes that are defined and understood by this application only. Use / for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Either directoryScopeId or appScopeId is required.","title":"AppScopeId"},"Action":{"enum":["adminAssign","adminUpdate","adminRemove","selfActivate","selfDeactivate","adminExtend","adminRenew","selfExtend","selfRenew","unknownFutureValue"],"description":"Represents the type of operation on the role eligibility request.The possible values are: adminAssign, adminUpdate, adminRemove, selfActivate, selfDeactivate, adminExtend, adminRenew, selfExtend, selfRenew, unknownFutureValue.","title":"Action"},"IsValidationOnly":{"type":"boolean","description":"Determines whether the call is a validation or an actual call. Only set this property if you want to check whether an activation is subject to additional rules like MFA before actually submitting the request.","title":"IsValidationOnly"},"Justification":{"type":"string","description":"A message provided by users and administrators when create they create the unifiedRoleEligibilityScheduleRequest object. Optional when action is adminRemove. Whether this property is required or optional is also dependent on the settings for the Azure AD role.","title":"Justification"},"ScheduleInfo":{"type":"object","description":"The period of the role eligibility. Optional when action is adminRemove. The period of eligibility is dependent on the settings of the Azure AD role.","title":"ScheduleInfo","properties":{"expiration":{"type":"object","description":"When the eligible or active assignment expires.","title":"expiration","properties":{"duration":{"type":"string","description":"The requestor's desired duration of access represented in ISO 8601 format for durations. For example, PT3H refers to three hours. If specified in a request, endDateTime should not be present and the type property should be set to afterDuration.","title":"duration"},"endDateTime":{"type":"string","description":"Timestamp of date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.","title":"endDateTime"},"type":{"enum":["notSpecified","noExpiration","afterDateTime","afterDuration"],"description":"The requestor's desired expiration pattern type. The possible values are: notSpecified, noExpiration, afterDateTime, afterDuration.","title":"type"}},"required":[]},"recurrence":{"type":"object","description":"The frequency of the eligible or active assignment. This property is currently unsupported in PIM.","title":"recurrence","properties":{"pattern":{"type":"object","description":"The frequency of an event.","title":"pattern","properties":{"dayOfMonth":{"type":"integer","description":"The day of the month on which the event occurs.","title":"dayOfMonth"},"daysOfWeek":{"type":"array","items":{"enum":["sunday","monday","tuesday","wednesday","thursday","friday","saturday"]},"description":"A collection of the days of the week on which the event occurs. The possible values are: sunday, monday, tuesday, wednesday, thursday, friday, saturday","title":"daysOfWeek"},"firstDayOfWeek":{"enum":["sunday","monday","tuesday","wednesday","thursday","friday","saturday"],"description":"The first day of the week.","title":"firstDayOfWeek"},"index":{"enum":["first","second","third","fourth","last"],"description":"Specifies on which instance of the allowed days specified in daysOfWeek the event occurs, counted from the first instance in the month. The possible values are: first, second, third, fourth, last.","title":"index"},"interval":{"type":"integer","description":"The number of units between occurrences, where units can be in days, weeks, months, or years, depending on the type.","title":"interval"},"month":{"type":"integer","description":"The month in which the event occurs. This is a number from 1 to 12.","title":"month"},"type":{"enum":["daily","weekly","absoluteMonthly","relativeMonthly","absoluteYearly","relativeYearly"],"description":"The recurrence pattern type: daily, weekly, absoluteMonthly, relativeMonthly, absoluteYearly, relativeYearly.","title":"type"}},"required":[]},"range":{"type":"object","description":"The duration of an event.","title":"range","properties":{"endDate":{"type":"string","description":"The date to stop applying the recurrence pattern. Depending on the recurrence pattern of the event, the last occurrence of the meeting may not be this date.","title":"endDate"},"numberOfOccurrences":{"type":"integer","description":"The number of times to repeat the event. Required and must be positive if type is numbered.","title":"numberOfOccurrences"},"recurrenceTimeZone":{"type":"string","description":"Time zone for the startDate and endDate properties.","title":"recurrenceTimeZone"},"startDate":{"type":"string","description":"The date to start applying the recurrence pattern. The first occurrence of the meeting may be this date or later, depending on the recurrence pattern of the event. Must be the same value as the start property of the recurring event.","title":"startDate"},"type":{"enum":["endDate","noEnd","numbered"],"description":"The recurrence range. The possible values are: endDate, noEnd, numbered.","title":"type"}},"required":["endDate","startDate","type"]}},"required":[]},"startDateTime":{"type":"string","description":"When the eligible or active assignment becomes active.","title":"startDateTime"}},"required":[]},"TicketInfo":{"type":"object","description":"Ticket details linked to the role eligibility request including details of the ticket number and ticket system.","title":"TicketInfo","properties":{"ticketNumber":{"type":"string","description":"The ticket number.","title":"ticketNumber"},"ticketSystem":{"type":"string","description":"The description of the ticket system.","title":"ticketSystem"}},"required":[]},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Principal","RoleDefinition"]},"microsoft.entra.rolesetting":{"type":"object","description":"This resource configure existing Azure roles. All UI parameters can be configured using this resource like:\r\n- Notifications\r\n- require approval / ticket / justification / MFA","title":"Schema for microsoft.entra.rolesetting","properties":{"DisplayName":{"type":"string","description":"RuleDefinition DisplayName","title":"DisplayName"},"Id":{"type":"string","description":"Specifies the RoleId.","title":"Id"},"ActivationMaxDuration":{"type":"string","description":"Activation maximum duration (hours).","title":"ActivationMaxDuration"},"ActivationReqJustification":{"type":"boolean","description":"Require justification on activation (True/False)","title":"ActivationReqJustification"},"ActivationReqTicket":{"type":"boolean","description":"Require ticket information on activation (True/False)","title":"ActivationReqTicket"},"ActivationReqMFA":{"type":"boolean","description":"Require MFA on activation (True/False)","title":"ActivationReqMFA"},"ApprovaltoActivate":{"type":"boolean","description":"Require approval to activate (True/False)","title":"ApprovaltoActivate"},"ActivateApprover":{"type":"array","items":{"type":"string"},"description":"Approver User UPN and/or Group Displayname","title":"ActivateApprover"},"PermanentEligibleAssignmentisExpirationRequired":{"type":"boolean","description":"Allow permanent eligible assignment (True/False)","title":"PermanentEligibleAssignmentisExpirationRequired"},"ExpireEligibleAssignment":{"type":"string","description":"Expire eligible assignments after (Days)","title":"ExpireEligibleAssignment"},"PermanentActiveAssignmentisExpirationRequired":{"type":"boolean","description":"Allow permanent active assignment (True/False)","title":"PermanentActiveAssignmentisExpirationRequired"},"ExpireActiveAssignment":{"type":"string","description":"Expire active assignments after (Days)","title":"ExpireActiveAssignment"},"AssignmentReqMFA":{"type":"boolean","description":"Require Azure Multi-Factor Authentication on active assignment (True/False)","title":"AssignmentReqMFA"},"AssignmentReqJustification":{"type":"boolean","description":"Require justification on active assignment (True/False)","title":"AssignmentReqJustification"},"ElegibilityAssignmentReqMFA":{"type":"boolean","description":"Require Azure Multi-Factor Authentication on eligible assignment (True/False)","title":"ElegibilityAssignmentReqMFA"},"ElegibilityAssignmentReqJustification":{"type":"boolean","description":"Require justification on eligible assignment (True/False)","title":"ElegibilityAssignmentReqJustification"},"EligibleAlertNotificationDefaultRecipient":{"type":"boolean","description":"Send notifications when members are assigned as eligible to this role: Role assignment alert, default recipient (True/False)","title":"EligibleAlertNotificationDefaultRecipient"},"EligibleAlertNotificationAdditionalRecipient":{"type":"array","items":{"type":"string"},"description":"Send notifications when members are assigned as eligible to this role: Role assignment alert, additional recipient (UPN)","title":"EligibleAlertNotificationAdditionalRecipient"},"EligibleAlertNotificationOnlyCritical":{"type":"boolean","description":"Send notifications when members are assigned as eligible to this role: Role assignment alert, only critical Email (True/False)","title":"EligibleAlertNotificationOnlyCritical"},"EligibleAssigneeNotificationDefaultRecipient":{"type":"boolean","description":"Send notifications when members are assigned as eligible to this role: Notification to the assigned user (assignee), default recipient (True/False)","title":"EligibleAssigneeNotificationDefaultRecipient"},"EligibleAssigneeNotificationAdditionalRecipient":{"type":"array","items":{"type":"string"},"description":"Send notifications when members are assigned as eligible to this role: Notification to the assigned user (assignee), additional recipient (UPN)","title":"EligibleAssigneeNotificationAdditionalRecipient"},"EligibleAssigneeNotificationOnlyCritical":{"type":"boolean","description":"Send notifications when members are assigned as eligible to this role: Notification to the assigned user (assignee), only critical Email (True/False)","title":"EligibleAssigneeNotificationOnlyCritical"},"EligibleApproveNotificationDefaultRecipient":{"type":"boolean","description":"Send notifications when members are assigned as eligible to this role: Request to approve a role assignment renewal/extension, default recipient (True/False)","title":"EligibleApproveNotificationDefaultRecipient"},"EligibleApproveNotificationAdditionalRecipient":{"type":"array","items":{"type":"string"},"description":"Send notifications when members are assigned as eligible to this role: Request to approve a role assignment renewal/extension, additional recipient (UPN)","title":"EligibleApproveNotificationAdditionalRecipient"},"EligibleApproveNotificationOnlyCritical":{"type":"boolean","description":"Send notifications when members are assigned as eligible to this role: Request to approve a role assignment renewal/extension, only critical Email (True/False)","title":"EligibleApproveNotificationOnlyCritical"},"ActiveAlertNotificationDefaultRecipient":{"type":"boolean","description":"Send notifications when members are assigned as active to this role: Role assignment alert, default recipient (True/False)","title":"ActiveAlertNotificationDefaultRecipient"},"ActiveAlertNotificationAdditionalRecipient":{"type":"array","items":{"type":"string"},"description":"Send notifications when members are assigned as active to this role: Role assignment alert, additional recipient (UPN)","title":"ActiveAlertNotificationAdditionalRecipient"},"ActiveAlertNotificationOnlyCritical":{"type":"boolean","description":"Send notifications when members are assigned as active to this role: Role assignment alert, only critical Email (True/False)","title":"ActiveAlertNotificationOnlyCritical"},"ActiveAssigneeNotificationDefaultRecipient":{"type":"boolean","description":"Send notifications when members are assigned as active to this role: Notification to the assigned user (assignee), default recipient (True/False)","title":"ActiveAssigneeNotificationDefaultRecipient"},"ActiveAssigneeNotificationAdditionalRecipient":{"type":"array","items":{"type":"string"},"description":"Send notifications when members are assigned as active to this role: Notification to the assigned user (assignee), additional recipient (UPN)","title":"ActiveAssigneeNotificationAdditionalRecipient"},"ActiveAssigneeNotificationOnlyCritical":{"type":"boolean","description":"Send notifications when members are assigned as active to this role: Notification to the assigned user (assignee), only critical Email (True/False)","title":"ActiveAssigneeNotificationOnlyCritical"},"ActiveApproveNotificationDefaultRecipient":{"type":"boolean","description":"Send notifications when members are assigned as active to this role: Request to approve a role assignment renewal/extension, default recipient (True/False)","title":"ActiveApproveNotificationDefaultRecipient"},"ActiveApproveNotificationAdditionalRecipient":{"type":"array","items":{"type":"string"},"description":"Send notifications when members are assigned as active to this role: Request to approve a role assignment renewal/extension, additional recipient (UPN)","title":"ActiveApproveNotificationAdditionalRecipient"},"ActiveApproveNotificationOnlyCritical":{"type":"boolean","description":"Send notifications when members are assigned as active to this role: Request to approve a role assignment renewal/extension, only critical Email (True/False)","title":"ActiveApproveNotificationOnlyCritical"},"EligibleAssignmentAlertNotificationDefaultRecipient":{"type":"boolean","description":"Send notifications when eligible members activate this role: Role assignment alert, default recipient (True/False)","title":"EligibleAssignmentAlertNotificationDefaultRecipient"},"EligibleAssignmentAlertNotificationAdditionalRecipient":{"type":"array","items":{"type":"string"},"description":"Send notifications when eligible members activate this role: Role assignment alert, additional recipient (UPN)","title":"EligibleAssignmentAlertNotificationAdditionalRecipient"},"EligibleAssignmentAlertNotificationOnlyCritical":{"type":"boolean","description":"Send notifications when eligible members activate this role: Role assignment alert, only critical Email (True/False)","title":"EligibleAssignmentAlertNotificationOnlyCritical"},"EligibleAssignmentAssigneeNotificationDefaultRecipient":{"type":"boolean","description":"Send notifications when eligible members activate this role: Notification to activated user (requestor), default recipient (True/False)","title":"EligibleAssignmentAssigneeNotificationDefaultRecipient"},"EligibleAssignmentAssigneeNotificationAdditionalRecipient":{"type":"array","items":{"type":"string"},"description":"Send notifications when eligible members activate this role: Notification to activated user (requestor), additional recipient (UPN)","title":"EligibleAssignmentAssigneeNotificationAdditionalRecipient"},"EligibleAssignmentAssigneeNotificationOnlyCritical":{"type":"boolean","description":"Send notifications when eligible members activate this role: Notification to activated user (requestor), only critical Email (True/False)","title":"EligibleAssignmentAssigneeNotificationOnlyCritical"},"AuthenticationContextRequired":{"type":"boolean","description":"Authorization context is required (True/False)","title":"AuthenticationContextRequired"},"AuthenticationContextName":{"type":"string","description":"Descriptive name of associated authorization context","title":"AuthenticationContextName"},"AuthenticationContextId":{"type":"string","description":"Authorization context id","title":"AuthenticationContextId"},"Ensure":{"enum":["Present"],"description":"Specify if the Azure AD role setting should exist or not.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.securitydefaults":{"type":"object","description":"This resource configures the Security Defaults in Azure Active Directory.","title":"Schema for microsoft.entra.securitydefaults","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"DisplayName":{"type":"string","description":"Display name of the security defaults.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the security defaults.","title":"Description"},"IsEnabled":{"type":"boolean","description":"Represents whether or not security defaults are enabled.","title":"IsEnabled"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Azure AD App should exist or not.","title":"Ensure"}},"required":["IsSingleInstance"]},"microsoft.entra.serviceprincipal":{"type":"object","description":"This resource configures an Azure Active Directory ServicePrincipal.","title":"Schema for microsoft.entra.serviceprincipal","properties":{"AppId":{"type":"string","description":"The unique identifier for the associated application.","title":"AppId"},"AppRoleAssignedTo":{"type":"array","items":{"type":"object","description":"This resource configures an Azure Active Directory ServicePrincipal.","title":"Schema for MSFT_AADServicePrincipalRoleAssignment","properties":{"PrincipalType":{"enum":["Group","User"],"description":"Type of principal. Accepted values are User or Group","title":"PrincipalType"},"Identity":{"type":"string","description":"Unique identity representing the principal.","title":"Identity"}},"required":[]},"description":"App role assignments for this app or service, granted to users, groups, and other service principals.","title":"AppRoleAssignedTo"},"ObjectID":{"type":"string","description":"The ObjectID of the ServicePrincipal","title":"ObjectID"},"DisplayName":{"type":"string","description":"Displayname of the ServicePrincipal.","title":"DisplayName"},"AlternativeNames":{"type":"array","items":{"type":"string"},"description":"The alternative names for this service principal","title":"AlternativeNames"},"AccountEnabled":{"type":"boolean","description":"True if the service principal account is enabled; otherwise, false.","title":"AccountEnabled"},"AppRoleAssignmentRequired":{"type":"boolean","description":"Indicates whether an application role assignment is required.","title":"AppRoleAssignmentRequired"},"ErrorUrl":{"type":"string","description":"Specifies the error URL of the ServicePrincipal.","title":"ErrorUrl"},"Homepage":{"type":"string","description":"Specifies the homepage of the ServicePrincipal.","title":"Homepage"},"LogoutUrl":{"type":"string","description":"Specifies the LogoutURL of the ServicePrincipal.","title":"LogoutUrl"},"PublisherName":{"type":"string","description":"Specifies the PublisherName of the ServicePrincipal.","title":"PublisherName"},"ReplyUrls":{"type":"array","items":{"type":"string"},"description":"The URLs that user tokens are sent to for sign in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application.","title":"ReplyUrls"},"SamlMetadataUrl":{"type":"string","description":"The URL for the SAML metadata of the ServicePrincipal.","title":"SamlMetadataUrl"},"ServicePrincipalNames":{"type":"array","items":{"type":"string"},"description":"Specifies an array of service principal names. Based on the identifierURIs collection, plus the application's appId property, these URIs are used to reference an application's service principal.","title":"ServicePrincipalNames"},"ServicePrincipalType":{"type":"string","description":"The type of the service principal.","title":"ServicePrincipalType"},"Tags":{"type":"array","items":{"type":"string"},"description":"Tags linked to this service principal.Note that if you intend for this service principal to show up in the All Applications list in the admin portal, you need to set this value to {WindowsAzureActiveDirectoryIntegratedApp}","title":"Tags"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Azure AD App should exist or not.","title":"Ensure"}},"required":["AppId"]},"microsoft.entra.socialidentityprovider":{"type":"object","description":"Represents identity providers with External Identities for both Microsoft Entra ID and Azure AD B2C tenants. For Microsoft Entra B2B scenarios in a Microsoft Entra tenant, the identity provider type can be Google or Facebook.","title":"Schema for microsoft.entra.socialidentityprovider","properties":{"ClientId":{"type":"string","description":"The client identifier for the application obtained when registering the application with the identity provider.","title":"ClientId"},"ClientSecret":{"type":"string","description":"The client secret for the application that is obtained when the application is registered with the identity provider. This is write-only. A read operation returns ****.","title":"ClientSecret"},"DisplayName":{"type":"string","description":"The display name of the identity provider.","title":"DisplayName"},"IdentityProviderType":{"enum":["AADSignup","EmailOTP","Microsoft","MicrosoftAccount","Google","Amazon","LinkedIn","Facebook","GitHub","Twitter","Weibo","QQ","WeChat"],"description":"For a B2B scenario, possible values: Google, Facebook. For a B2C scenario, possible values: Microsoft, Google, Amazon, LinkedIn, Facebook, GitHub, Twitter, Weibo, QQ, WeChat.","title":"IdentityProviderType"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["ClientId"]},"microsoft.entra.tenantdetails":{"type":"object","description":"This resource configures the Azure AD Tenant Details","title":"Schema for microsoft.entra.tenantdetails","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"MarketingNotificationEmails":{"type":"array","items":{"type":"string"},"description":"Email-addresses from the people who should receive Marketing Notifications","title":"MarketingNotificationEmails"},"SecurityComplianceNotificationMails":{"type":"array","items":{"type":"string"},"description":"Email-addresses from the people who should receive Security Compliance Notifications","title":"SecurityComplianceNotificationMails"},"SecurityComplianceNotificationPhones":{"type":"array","items":{"type":"string"},"description":"Phone Numbers from the people who should receive Security Notifications","title":"SecurityComplianceNotificationPhones"},"TechnicalNotificationMails":{"type":"array","items":{"type":"string"},"description":"Email-addresses from the people who should receive Technical Notifications","title":"TechnicalNotificationMails"}},"required":["IsSingleInstance"]},"microsoft.entra.tokenlifetimepolicy":{"type":"object","description":"This resource configures the Azure AD Token Lifetime Policies","title":"Schema for microsoft.entra.tokenlifetimepolicy","properties":{"DisplayName":{"type":"string","description":"DisplayName of the Policy","title":"DisplayName"},"Id":{"type":"string","description":"ObjectID of the Policy.","title":"Id"},"Description":{"type":"string","description":"Description of the Policy.","title":"Description"},"Definition":{"type":"array","items":{"type":"string"},"description":"Definition of the Policy.","title":"Definition"},"IsOrganizationDefault":{"type":"boolean","description":"IsOrganizationDefault of the Policy.","title":"IsOrganizationDefault"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if the Azure AD Policy should exist or not.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.entra.user":{"type":"object","description":"This resource allows users to create Azure AD Users and assign them licenses, roles and/or groups.\r\n\r\nIf using with AADGroup, be aware that if AADUser->MemberOf is being specified and the referenced group is configured with AADGroup->Member then a conflict may arise if the two don't match. It is usually best to choose only one of them. See AADGroup","title":"Schema for microsoft.entra.user","properties":{"UserPrincipalName":{"type":"string","description":"The login name of the user","title":"UserPrincipalName"},"DisplayName":{"type":"string","description":"The display name for the user","title":"DisplayName"},"FirstName":{"type":"string","description":"The first name of the user","title":"FirstName"},"LastName":{"type":"string","description":"The last name of the user","title":"LastName"},"Roles":{"type":"array","items":{"type":"string"},"description":"The list of Azure Active Directory roles assigned to the user.","title":"Roles"},"UsageLocation":{"type":"string","description":"The country code the user will be assigned to","title":"UsageLocation"},"LicenseAssignment":{"type":"array","items":{"type":"string"},"description":"The account SKU Id for the license to be assigned to the user","title":"LicenseAssignment"},"City":{"type":"string","description":"The City name of the user","title":"City"},"Country":{"type":"string","description":"The Country name of the user","title":"Country"},"Department":{"type":"string","description":"The Department name of the user","title":"Department"},"Fax":{"type":"string","description":"The Fax Number of the user","title":"Fax"},"MemberOf":{"type":"array","items":{"type":"string"},"description":"The Groups that the user is a direct member of","title":"MemberOf"},"MobilePhone":{"type":"string","description":"The Mobile Phone Number of the user","title":"MobilePhone"},"Office":{"type":"string","description":"The Office Name of the user","title":"Office"},"PasswordNeverExpires":{"type":"boolean","description":"Specifies whether the user password expires periodically. Default value is false","title":"PasswordNeverExpires"},"PasswordPolicies":{"type":"string","description":"Specifies password policies for the user.","title":"PasswordPolicies"},"PhoneNumber":{"type":"string","description":"The Phone Number of the user","title":"PhoneNumber"},"PostalCode":{"type":"string","description":"The Postal Code of the user","title":"PostalCode"},"PreferredLanguage":{"type":"string","description":"The Preferred Language of the user","title":"PreferredLanguage"},"State":{"type":"string","description":"Specifies the state or province where the user is located","title":"State"},"StreetAddress":{"type":"string","description":"Specifies the street address of the user","title":"StreetAddress"},"Title":{"type":"string","description":"Specifies the title of the user","title":"Title"},"UserType":{"enum":["Guest","Member","Other","Viral"],"description":"Specifies the title of the user","title":"UserType"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the user exists, absent ensures it is removed","title":"Ensure"}},"required":["UserPrincipalName"]},"microsoft.teams.apppermissionpolicy":{"type":"object","description":"Manages the Teams App Permission Policies.","title":"Schema for microsoft.teams.apppermissionpolicy","properties":{"Identity":{"type":"string","description":"Unique identifier to be assigned to the new Teams app permission policy. Use the 'Global' Identity if you wish to assign this policy to the entire tenant.","title":"Identity"},"Description":{"type":"string","description":"Enables administrators to provide explanatory text to accompany a Teams app permission policy.","title":"Description"},"GlobalCatalogAppsType":{"type":"string","description":"The types of apps for the Global Catalog.","title":"GlobalCatalogAppsType"},"PrivateCatalogAppsType":{"type":"string","description":"The types of apps for the Private Catalog.","title":"PrivateCatalogAppsType"},"DefaultCatalogAppsType":{"type":"string","description":"The types of apps for the Default Catalog.","title":"DefaultCatalogAppsType"},"GlobalCatalogApps":{"type":"array","items":{"type":"string"},"description":"The list of apps for the Global Catalog.","title":"GlobalCatalogApps"},"PrivateCatalogApps":{"type":"array","items":{"type":"string"},"description":"The list of apps for the Private Catalog.","title":"PrivateCatalogApps"},"DefaultCatalogApps":{"type":"array","items":{"type":"string"},"description":"The list of apps for the Default Catalog.","title":"DefaultCatalogApps"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.appsetuppolicy":{"type":"object","description":"Manages Teams app setup policies in your tenant.","title":"Schema for microsoft.teams.appsetuppolicy","properties":{"Identity":{"type":"string","description":"Unique identifier to be assigned to the new Teams app setup policy. Use the 'Global' Identity if you wish to assign this policy to the entire tenant.","title":"Identity"},"Description":{"type":"string","description":"Enables administrators to provide explanatory text to accompany a Teams app setup policy.","title":"Description"},"AppPresetList":{"type":"array","items":{"type":"string"},"description":"Choose which apps and messaging extensions you want to be installed in your users' personal Teams environment and in meetings they create. Users can install other available apps from the Teams app store.","title":"AppPresetList"},"AppPresetMeetingList":{"type":"array","items":{"type":"string"},"description":"Choose which apps and meeting extensions you want to be installed in your users' personal Teams environment and in meetings they create. Users can install other available apps from the Teams app store.","title":"AppPresetMeetingList"},"PinnedAppBarApps":{"type":"array","items":{"type":"string"},"description":"Pinning an app displays the app in the app bar in Teams client. Admins can pin apps and they can allow users to pin apps. Pinning is used to highlight apps that are needed the most by users and promote ease of access.","title":"PinnedAppBarApps"},"PinnedMessageBarApps":{"type":"array","items":{"type":"string"},"description":"Apps are pinned in messaging extensions and into the ellipsis menu.","title":"PinnedMessageBarApps"},"AllowUserPinning":{"type":"boolean","description":"If you turn this on, the user's existing app pins will be added to the list of pinned apps set in this policy. Users can rearrange, add, and remove pins as they choose. If you turn this off, the user's existing app pins will be removed and replaced with the apps defined in this policy.","title":"AllowUserPinning"},"AllowSideLoading":{"type":"boolean","description":"This is also known as side loading. This setting determines if a user can upload a custom app package in the Teams app. Turning it on lets you create or develop a custom app to be used personally or across your organization without having to submit it to the Teams app store. Uploading a custom app also lets you test an app before you distribute it more widely by only assigning it to a single user or group of users.","title":"AllowSideLoading"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.audioconferencingpolicy":{"type":"object","description":"Configures a Teams Audio Conferencing Policy.","title":"Schema for microsoft.teams.audioconferencingpolicy","properties":{"Identity":{"type":"string","description":"Specify the name of the policy that you are creating","title":"Identity"},"AllowTollFreeDialin":{"type":"boolean","description":"Determines whether users of the Policy can have Toll free numbers","title":"AllowTollFreeDialin"},"MeetingInvitePhoneNumbers":{"type":"string","description":"Determines the list of audio-conferencing Toll- and Toll-free telephone numbers that will be included in meetings invites created by users of this policy.","title":"MeetingInvitePhoneNumbers"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.callholdpolicy":{"type":"object","description":"Creates a new Teams call hold policy in your tenant. The Teams call hold policy is used to customize the call hold experience for Teams clients.","title":"Schema for microsoft.teams.callholdpolicy","properties":{"Identity":{"type":"string","description":"Unique identifier to be assigned to the new Teams call hold policy. Use the 'Global' Identity if you wish to assign this policy to the entire tenant.","title":"Identity"},"AudioFileId":{"type":"string","description":"A string representing the ID referencing an audio file uploaded via the Import-CsOnlineAudioFile cmdlet.","title":"AudioFileId"},"Description":{"type":"string","description":"Enables administrators to provide explanatory text to accompany a Teams call hold policy.","title":"Description"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.callingpolicy":{"type":"object","description":"This resource configures a Teams Calling Policy.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/teams-calling-policy","title":"Schema for microsoft.teams.callingpolicy","properties":{"Identity":{"type":"string","description":"Identity of the Teams Calling Policy.","title":"Identity"},"Description":{"type":"string","description":"Description of the Teams Calling Policy.","title":"Description"},"AllowPrivateCalling":{"type":"boolean","description":"Controls all calling capabilities in Teams. Turning this off will turn off all calling functionality in Teams. If you use Skype for Business for calling, this policy will not affect calling functionality in Skype for Business.","title":"AllowPrivateCalling"},"AllowVoicemail":{"enum":["AlwaysEnabled","AlwaysDisabled","UserOverride"],"description":"Enables inbound calls to be routed to voice mail. Valid options are: AlwaysEnabled, AlwaysDisabled, UserOverride.","title":"AllowVoicemail"},"AllowCallGroups":{"type":"boolean","description":"Enables inbound calls to be routed to call groups.","title":"AllowCallGroups"},"AllowDelegation":{"type":"boolean","description":"Enables inbound calls to be routed to delegates; allows delegates to make outbound calls on behalf of the users for whom they have delegated permissions.","title":"AllowDelegation"},"AllowCallForwardingToUser":{"type":"boolean","description":"Enables call forwarding or simultaneous ringing of inbound calls to other users in your tenant.","title":"AllowCallForwardingToUser"},"AllowCallForwardingToPhone":{"type":"boolean","description":"Enables call forwarding or simultaneous ringing of inbound calls to any phone number.","title":"AllowCallForwardingToPhone"},"AllowCallRedirect":{"enum":["Enabled","Disabled","UserOverride"],"description":"Setting this parameter provides the ability to configure call redirection capabilities on Teams phones.","title":"AllowCallRedirect"},"AllowSIPDevicesCalling":{"type":"boolean","description":"Determines whether the user is allowed to use SIP devices for calling on behalf of a Teams client.","title":"AllowSIPDevicesCalling"},"AllowWebPSTNCalling":{"type":"boolean","description":"Allows PSTN calling from the Team web client","title":"AllowWebPSTNCalling"},"PreventTollBypass":{"type":"boolean","description":"Setting this parameter to True will send calls through PSTN and incur charges rather than going through the network and bypassing the tolls.","title":"PreventTollBypass"},"BusyOnBusyEnabledType":{"enum":["Enabled","Disabled","Unanswered","UserOverride"],"description":"Setting this parameter lets you configure how incoming calls are handled when a user is already in a call or conference or has a call placed on hold. New or incoming calls will be rejected with a busy signal. Valid options are: Enabled, Disabled and Unanswered.","title":"BusyOnBusyEnabledType"},"CallRecordingExpirationDays":{"type":"integer","description":"Sets the expiration of the recorded 1:1 calls.","title":"CallRecordingExpirationDays"},"MusicOnHoldEnabledType":{"enum":["Enabled","Disabled","UserOverride"],"description":"Setting this parameter allows you to turn on or turn off music on hold when a PSTN caller is placed on hold. It is turned on by default. Valid options are: Enabled, Disabled, UserOverride. For now setting the value to UserOverride is the same as Enabled. This setting does not apply to call park and SLA boss delegate features. Valid options are: Enabled, Disabled, UserOverride.","title":"MusicOnHoldEnabledType"},"SafeTransferEnabled":{"enum":["Enabled","Disabled","UserOverride"],"description":"This parameter is not available for use. Valid options are: Enabled, Disabled, UserOverride.","title":"SafeTransferEnabled"},"AllowCloudRecordingForCalls":{"type":"boolean","description":"Setting this parameter to True will allows 1:1 Calls to be recorded.","title":"AllowCloudRecordingForCalls"},"AllowTranscriptionforCalling":{"type":"boolean","description":"Determines whether post-meeting captions and transcriptions are allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowTranscriptionforCalling"},"LiveCaptionsEnabledTypeForCalling":{"enum":["DisabledUserOverride","Disabled"],"description":"Determines whether real-time captions are available for the user in Teams meetings. Set this to DisabledUserOverride to allow user to turn on live captions. Set this to Disabled to prohibit.","title":"LiveCaptionsEnabledTypeForCalling"},"AutoAnswerEnabledType":{"enum":["Enabled","Disabled"],"description":"This setting allows the tenant admin to enable or disable the Auto-Answer setting. Valid options are: Enabled, Disabled.","title":"AutoAnswerEnabledType"},"SpamFilteringEnabledType":{"enum":["Enabled","Disabled"],"description":"Setting this parameter determines whether calls identified as Spam will be rejected or not (probably). Valid options are: Enabled, Disabled.","title":"SpamFilteringEnabledType"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policyexists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.callparkpolicy":{"type":"object","description":"The TeamsCallParkPolicy controls whether or not users are able to leverage the call park feature in Microsoft Teams. Call park allows enterprise voice customers to place a call on hold and then perform a number of actions on that call: transfer to another department, retrieve via the same phone, or retrieve via a different Teams phone. The New-CsTeamsCallParkPolicy resource lets you create a new custom policy that can then be assigned to one or more specific users.","title":"Schema for microsoft.teams.callparkpolicy","properties":{"Identity":{"type":"string","description":"A unique identifier for the policy - this will be used to retrieve the policy later on to assign it to specific users.","title":"Identity"},"AllowCallPark":{"type":"boolean","description":"If set to true, customers will be able to leverage the call park feature to place calls on hold and then decide how the call should be handled - transferred to another department, retrieved using the same phone, or retrieved using a different phone.","title":"AllowCallPark"},"Description":{"type":"string","description":"Description of the Teams Call Park Policy.","title":"Description"},"ParkTimeoutSeconds":{"type":"integer","description":"Specify the number of seconds to wait before ringing the parker when the parked call hasn't been picked up. Value can be from 120 to 1800 (seconds).","title":"ParkTimeoutSeconds"},"PickupRangeEnd":{"type":"integer","description":"Specify the maximum value that a rendered pickup code can take. Value can be from 10 to 9999. Note: PickupRangeStart must be smaller than PickupRangeEnd.","title":"PickupRangeEnd"},"PickupRangeStart":{"type":"integer","description":"Specify the minimum value that a rendered pickup code can take. Value can be from 10 to 9999.","title":"PickupRangeStart"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.callqueue":{"type":"object","description":"This resource is used to manage Call Queue in your Skype for Business Online organization.","title":"Schema for microsoft.teams.callqueue","properties":{"Name":{"type":"string","description":"The Name parameter specifies a unique name for the Call Queue.","title":"Name"},"AgentAlertTime":{"type":"integer","description":"The Name parameter specifies a unique name for the Call Queue.","title":"AgentAlertTime"},"AllowOptOut":{"type":"boolean","description":"The AllowOptOut parameter indicates whether or not agents can opt in or opt out from taking calls from a Call Queue.","title":"AllowOptOut"},"DistributionLists":{"type":"array","items":{"type":"string"},"description":"The DistributionLists parameter lets you add all the members of the distribution lists to the Call Queue. This is a list of distribution list GUIDs. A service wide configurable maximum number of DLs per Call Queue are allowed. Only the first N (service wide configurable) agents from all distribution lists combined are considered for accepting the call. Nested DLs are supported. O365 Groups can also be used to add members to the Call Queue.","title":"DistributionLists"},"UseDefaultMusicOnHold":{"type":"boolean","description":"The UseDefaultMusicOnHold parameter indicates that this Call Queue uses the default music on hold. This parameter cannot be specified together with MusicOnHoldAudioFileId.","title":"UseDefaultMusicOnHold"},"WelcomeMusicAudioFileId":{"type":"string","description":"The WelcomeMusicAudioFileId parameter represents the audio file to play when callers are connected with the Call Queue. This is the unique identifier of the audio file.","title":"WelcomeMusicAudioFileId"},"MusicOnHoldAudioFileId":{"type":"string","description":"The MusicOnHoldFileContent parameter represents music to play when callers are placed on hold. This is the unique identifier of the audio file. This parameter is required if the UseDefaultMusicOnHold parameter is not specified.","title":"MusicOnHoldAudioFileId"},"OverflowAction":{"enum":["DisconnectWithBusy","Forward","Voicemail","SharedVoicemail"],"description":"The OverflowAction parameter designates the action to take if the overflow threshold is reached. The OverflowAction property must be set to one of the following values: DisconnectWithBusy, Forward, Voicemail, and SharedVoicemail. The default value is DisconnectWithBusy.","title":"OverflowAction"},"OverflowActionTarget":{"type":"string","description":"The OverflowActionTarget parameter represents the target of the overflow action. If the OverFlowAction is set to Forward, this parameter must be set to a Guid or a telephone number with a mandatory 'tel:' prefix. If the OverflowAction is set to SharedVoicemail, this parameter must be set to a group ID (Microsoft 365, Distribution list, or Mail-enabled security). Otherwise, this parameter is optional.","title":"OverflowActionTarget"},"OverflowThreshold":{"type":"integer","description":"The OverflowThreshold parameter defines the number of calls that can be in the queue at any one time before the overflow action is triggered. The OverflowThreshold can be any integer value between 0 and 200, inclusive. A value of 0 causes calls not to reach agents and the overflow action to be taken immediately.","title":"OverflowThreshold"},"TimeoutAction":{"enum":["Disconnect","Forward","Voicemail","SharedVoicemail"],"description":"The TimeoutAction parameter defines the action to take if the timeout threshold is reached. The TimeoutAction property must be set to one of the following values: Disconnect, Forward, Voicemail, and SharedVoicemail. The default value is Disconnect.","title":"TimeoutAction"},"TimeoutActionTarget":{"type":"string","description":"The TimeoutActionTarget represents the target of the timeout action. If the TimeoutAction is set to Forward, this parameter must be set to a Guid or a telephone number with a mandatory 'tel:' prefix. If the TimeoutAction is set to SharedVoicemail, this parameter must be set to an Office 365 Group ID. Otherwise, this field is optional.","title":"TimeoutActionTarget"},"TimeoutThreshold":{"type":"integer","description":"The TimeoutThreshold parameter defines the time (in seconds) that a call can be in the queue before that call times out. At that point, the system will take the action specified by the TimeoutAction parameter. The TimeoutThreshold can be any integer value between 0 and 2700 seconds (inclusive), and is rounded to the nearest 15th interval. For example, if set to 47 seconds, then it is rounded down to 45. If set to 0, welcome music is played, and then the timeout action will be taken.","title":"TimeoutThreshold"},"RoutingMethod":{"enum":["Attendant","Serial","RoundRobin","LongestIdle"],"description":"The RoutingMethod defines how agents will be called in a Call Queue. If the routing method is set to Serial, then agents will be called one at a time. If the routing method is set to Attendant, then agents will be called in parallel. If routing method is set to RoundRobin, the agents will be called using Round Robin strategy so that all agents share the call-load equally. If routing method is set to LongestIdle, the agents will be called based on their idle time, i.e., the agent that has been idle for the longest period will be called.","title":"RoutingMethod"},"PresenceBasedRouting":{"type":"boolean","description":"The PresenceBasedRouting parameter indicates whether or not presence based routing will be applied while call being routed to Call Queue agents. When set to False, calls will be routed to agents who have opted in to receive calls, regardless of their presence state. When set to True, opted-in agents will receive calls only when their presence state is Available.","title":"PresenceBasedRouting"},"ConferenceMode":{"type":"boolean","description":"The ConferenceMode parameter indicates whether or not Conference mode will be applied on calls for this Call queue. Conference mode significantly reduces the amount of time it takes for a caller to be connected to an agent, after the agent accepts the call.","title":"ConferenceMode"},"Users":{"type":"array","items":{"type":"string"},"description":"The Users parameter lets you add agents to the Call Queue. This parameter expects a list of user unique identifiers (GUID).","title":"Users"},"LanguageId":{"type":"string","description":"The LanguageId parameter indicates the language that is used to play shared voicemail prompts. This parameter becomes a required parameter If either OverflowAction or TimeoutAction is set to SharedVoicemail. You can query the supported languages using the Get-CsAutoAttendantSupportedLanguage cmdlet.","title":"LanguageId"},"OboResourceAccountIds":{"type":"array","items":{"type":"string"},"description":"The OboResourceAccountIds parameter lets you add resource account with phone number to the Call Queue. The agents in the Call Queue will be able to make outbound calls using the phone number on the resource accounts. This is a list of resource account GUIDs. Only Call Queue managed by a Teams Channel will be able to use this feature.","title":"OboResourceAccountIds"},"OverflowDisconnectTextToSpeechPrompt":{"type":"string","description":"The OverflowDisconnectTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being disconnected due to overflow.","title":"OverflowDisconnectTextToSpeechPrompt"},"OverflowDisconnectAudioFilePrompt":{"type":"string","description":"The OverflowDisconnectAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being disconnected due to overflow.","title":"OverflowDisconnectAudioFilePrompt"},"OverflowRedirectPersonTextToSpeechPrompt":{"type":"string","description":"The OverflowRedirectPersonTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person in the organization due to overflow.","title":"OverflowRedirectPersonTextToSpeechPrompt"},"OverflowRedirectPersonAudioFilePrompt":{"type":"string","description":"The OverflowRedirectPersonAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person in the organization due to overflow.","title":"OverflowRedirectPersonAudioFilePrompt"},"OverflowRedirectVoiceAppTextToSpeechPrompt":{"type":"string","description":"The OverflowRedirectVoiceAppsTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a voice application due to overflow.","title":"OverflowRedirectVoiceAppTextToSpeechPrompt"},"OverflowRedirectVoiceAppAudioFilePrompt":{"type":"string","description":"The OverflowRedirectVoiceAppAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a voice application due to overflow.","title":"OverflowRedirectVoiceAppAudioFilePrompt"},"OverflowRedirectPhoneNumberTextToSpeechPrompt":{"type":"string","description":"The OverflowRedirectPhoneNumberTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to an external PSTN phone number due to overflow.","title":"OverflowRedirectPhoneNumberTextToSpeechPrompt"},"OverflowRedirectPhoneNumberAudioFilePrompt":{"type":"string","description":"The OverflowRedirectPhoneNumberAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to an external PSTN phone number due to overflow.","title":"OverflowRedirectPhoneNumberAudioFilePrompt"},"OverflowRedirectVoicemailTextToSpeechPrompt":{"type":"string","description":"The OverflowRedirectVoicemailTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person's voicemail due to overflow.","title":"OverflowRedirectVoicemailTextToSpeechPrompt"},"OverflowRedirectVoicemailAudioFilePrompt":{"type":"string","description":"The OverflowRedirectVoiceMailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person's voicemail due to overflow.","title":"OverflowRedirectVoicemailAudioFilePrompt"},"OverflowSharedVoicemailTextToSpeechPrompt":{"type":"string","description":"The OverflowRedirectVoicemailTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person's voicemail due to overflow.","title":"OverflowSharedVoicemailTextToSpeechPrompt"},"OverflowSharedVoicemailAudioFilePrompt":{"type":"string","description":"The OverflowSharedVoicemailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is to be played as a greeting to the caller when transferred to shared voicemail on overflow. This parameter becomes a required parameter when OverflowAction is SharedVoicemail and OverflowSharedVoicemailTextToSpeechPrompt is null.","title":"OverflowSharedVoicemailAudioFilePrompt"},"EnableOverflowSharedVoicemailTranscription":{"type":"boolean","description":"The EnableOverflowSharedVoicemailTranscription parameter is used to turn on transcription for voicemails left by a caller on overflow. This parameter is only applicable when OverflowAction is set to SharedVoicemail.","title":"EnableOverflowSharedVoicemailTranscription"},"TimeoutDisconnectTextToSpeechPrompt":{"type":"string","description":"The TimeoutDisconnectTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being disconnected due to timeout.","title":"TimeoutDisconnectTextToSpeechPrompt"},"TimeoutDisconnectAudioFilePrompt":{"type":"string","description":"The TimeoutDisconnectAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being disconnected due to timeout.","title":"TimeoutDisconnectAudioFilePrompt"},"TimeoutRedirectPersonTextToSpeechPrompt":{"type":"string","description":"The TimeoutRedirectPersonTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person in the organization due to timeout.","title":"TimeoutRedirectPersonTextToSpeechPrompt"},"TimeoutRedirectPersonAudioFilePrompt":{"type":"string","description":"The TimeoutRedirectPersonAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person in the organization due to timeout.","title":"TimeoutRedirectPersonAudioFilePrompt"},"TimeoutRedirectVoiceAppTextToSpeechPrompt":{"type":"string","description":"The TimeoutRedirectVoiceAppsTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a voice application due to timeout.","title":"TimeoutRedirectVoiceAppTextToSpeechPrompt"},"TimeoutRedirectVoiceAppAudioFilePrompt":{"type":"string","description":"The TimeoutRedirectVoiceAppAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a voice application due to timeout.","title":"TimeoutRedirectVoiceAppAudioFilePrompt"},"TimeoutRedirectPhoneNumberTextToSpeechPrompt":{"type":"string","description":"The TimeoutRedirectPhoneNumberTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to an external PSTN phone number due to timeout.","title":"TimeoutRedirectPhoneNumberTextToSpeechPrompt"},"TimeoutRedirectPhoneNumberAudioFilePrompt":{"type":"string","description":"The TimeoutRedirectPhoneNumberAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to an external PSTN phone number due to timeout.","title":"TimeoutRedirectPhoneNumberAudioFilePrompt"},"TimeoutRedirectVoicemailTextToSpeechPrompt":{"type":"string","description":"The TimeoutRedirectVoicemailTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person's voicemail due to timeout.","title":"TimeoutRedirectVoicemailTextToSpeechPrompt"},"TimeoutRedirectVoicemailAudioFilePrompt":{"type":"string","description":"The TimeoutRedirectVoiceMailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person's voicemail due to timeout.","title":"TimeoutRedirectVoicemailAudioFilePrompt"},"TimeoutSharedVoicemailTextToSpeechPrompt":{"type":"string","description":"The TimeoutSharedVoicemailTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is to be played as a greeting to the caller when transferred to shared voicemail on timeout. This parameter becomes a required parameter when TimeoutAction is SharedVoicemail and TimeoutSharedVoicemailAudioFilePrompt is null.","title":"TimeoutSharedVoicemailTextToSpeechPrompt"},"TimeoutSharedVoicemailAudioFilePrompt":{"type":"string","description":"The TimeoutSharedVoicemailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is to be played as a greeting to the caller when transferred to shared voicemail on timeout. This parameter becomes a required parameter when TimeoutAction is SharedVoicemail and TimeoutSharedVoicemailTextToSpeechPrompt is null.","title":"TimeoutSharedVoicemailAudioFilePrompt"},"EnableTimeoutSharedVoicemailTranscription":{"type":"boolean","description":"The EnableTimeoutSharedVoicemailTranscription parameter is used to turn on transcription for voicemails left by a caller on timeout. This parameter is only applicable when TimeoutAction is set to SharedVoicemail.","title":"EnableTimeoutSharedVoicemailTranscription"},"ChannelId":{"type":"string","description":"Id of the channel to connect a call queue to.","title":"ChannelId"},"ChannelUserObjectId":{"type":"string","description":"Guid should contain 32 digits with 4 dashes (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). This is the GUID of one of the owners of the team the channels belongs to.","title":"ChannelUserObjectId"},"AuthorizedUsers":{"type":"array","items":{"type":"string"},"description":"This is a list of GUIDs for users who are authorized to make changes to this call queue. The users must also have a TeamsVoiceApplications policy assigned. The GUID should contain 32 digits with 4 dashes (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx).","title":"AuthorizedUsers"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the Team Message Policy exists, absent ensures it is removed","title":"Ensure"}},"required":["Name"]},"microsoft.teams.channelspolicy":{"type":"object","description":"This resource configures a Teams Channel Policy.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/teams-policies","title":"Schema for microsoft.teams.channelspolicy","properties":{"Identity":{"type":"string","description":"Identity of the Teams Channel Policy.","title":"Identity"},"Description":{"type":"string","description":"Description of the Teams Channel Policy.","title":"Description"},"AllowChannelSharingToExternalUser":{"type":"boolean","description":"Determines whether a user is allowed to share a shared channel with an external user. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"AllowChannelSharingToExternalUser"},"AllowOrgWideTeamCreation":{"type":"boolean","description":"Determines whether a user is allowed to create an org-wide team. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"AllowOrgWideTeamCreation"},"EnablePrivateTeamDiscovery":{"type":"boolean","description":"Determines whether a user is allowed to discover private teams in suggestions and search results. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"EnablePrivateTeamDiscovery"},"AllowPrivateChannelCreation":{"type":"boolean","description":"Determines whether a user is allowed to create a private channel. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"AllowPrivateChannelCreation"},"AllowSharedChannelCreation":{"type":"boolean","description":"Determines whether a user is allowed to create a shared channel. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"AllowSharedChannelCreation"},"AllowUserToParticipateInExternalSharedChannel":{"type":"boolean","description":"Determines whether a user is allowed to participate in a shared channel that has been shared by an external user. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"AllowUserToParticipateInExternalSharedChannel"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.channel":{"type":"object","description":"This resource is used to add and update channels in existing Teams.","title":"Schema for microsoft.teams.channel","properties":{"DisplayName":{"type":"string","description":"Current channel name","title":"DisplayName"},"TeamName":{"type":"string","description":"Name of the team the Channel belongs to","title":"TeamName"},"GroupID":{"type":"string","description":"Team group ID, only used to target a Team when duplicated display names occurs.","title":"GroupID"},"NewDisplayName":{"type":"string","description":"Used to update current channel name","title":"NewDisplayName"},"Description":{"type":"string","description":"Channel description","title":"Description"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the Team channel exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName","TeamName"]},"microsoft.teams.channeltab":{"type":"object","description":"This resource configures a new Custom tab in a Channel.","title":"Schema for microsoft.teams.channeltab","properties":{"DisplayName":{"type":"string","description":"Display Name of the Channel Tab.","title":"DisplayName"},"TeamName":{"type":"string","description":"Display Name of the Team.","title":"TeamName"},"ChannelName":{"type":"string","description":"Display Name of the Channel.","title":"ChannelName"},"TeamId":{"type":"string","description":"Unique Id of the Team of the instance on the source tenant.","title":"TeamId"},"TeamsApp":{"type":"string","description":"Id of the Teams App associated with the custom tab.","title":"TeamsApp"},"SortOrderIndex":{"type":"integer","description":"Index of the sort order for the custom tab.","title":"SortOrderIndex"},"WebSiteUrl":{"type":"string","description":"Url of the website linked to the Channel Tab.","title":"WebSiteUrl"},"ContentUrl":{"type":"string","description":"Url of the content linked to the Channel Tab.","title":"ContentUrl"},"RemoveUrl":{"type":"string","description":"Url of the location used to remove the app.","title":"RemoveUrl"},"EntityId":{"type":"string","description":"Id of the Entity linked to the Channel Tab.","title":"EntityId"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the Tab exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName","TeamName","ChannelName"]},"microsoft.teams.clientconfiguration":{"type":"object","description":"This resource is used to configure the Teams client settings.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/enable-features-office-365#teams-settings-and-teams-upgrade-settings-in-the-microsoft-teams-admin-center","title":"Schema for microsoft.teams.clientconfiguration","properties":{"Identity":{"enum":["Global"],"description":"The only valid input is Global - the tenant wide configuration","title":"Identity"},"AllowBox":{"type":"boolean","description":"Designates whether users are able to leverage Box as a third party storage solution in Microsoft Teams. If $true, users will be able to add Box in the client and interact with the files stored there.","title":"AllowBox"},"AllowDropBox":{"type":"boolean","description":"Designates whether users are able to leverage DropBox as a third party storage solution in Microsoft Teams. If $true, users will be able to add DropBox in the client and interact with the files stored there.","title":"AllowDropBox"},"AllowEmailIntoChannel":{"type":"boolean","description":"When set to $true, mail hooks are enabled, and users can post messages to a channel by sending an email to the email address of Teams channel.","title":"AllowEmailIntoChannel"},"AllowGoogleDrive":{"type":"boolean","description":"Designates whether users are able to leverage GoogleDrive as a third party storage solution in Microsoft Teams. If $true, users will be able to add Google Drive in the client and interact with the files stored there.","title":"AllowGoogleDrive"},"AllowGuestUser":{"type":"boolean","description":"Designates whether or not guest users in your organization will have access to the Teams client. If $true, guests in your tenant will be able to access the Teams client. Note that this setting has a core dependency on Guest Access being enabled in your Office 365 tenant.","title":"AllowGuestUser"},"AllowOrganizationTab":{"type":"boolean","description":"When set to $true, users will be able to see the organizational chart icon other users' contact cards, and when clicked, this icon will display the detailed organizational chart.","title":"AllowOrganizationTab"},"AllowResourceAccountSendMessage":{"type":"boolean","description":"Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the from party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed anonymous because it originated from the Surface Hub's device account. If set to $true, these device accounts will be able to send chat messages in Skype for Business Online (does not apply to Microsoft Teams).","title":"AllowResourceAccountSendMessage"},"AllowScopedPeopleSearchandAccess":{"type":"boolean","description":"If set to $true, the Exchange address book policy (ABP) will be used to provide customized view of the global address book for each user. This is only a virtual separation and not a legal separation.","title":"AllowScopedPeopleSearchandAccess"},"AllowShareFile":{"type":"boolean","description":"Designates whether users are able to leverage ShareFile as a third party storage solution in Microsoft Teams. If $true, users will be able to add ShareFile in the client and interact with the files stored there.","title":"AllowShareFile"},"AllowSkypeBusinessInterop":{"type":"boolean","description":"When set to $true, Teams conversations automatically show up in Skype for Business for users that aren't enabled for Teams.","title":"AllowSkypeBusinessInterop"},"AllowEgnyte":{"type":"boolean","description":"Designates whether users are able to leverage Egnyte as a third party storage solution in Microsoft Teams. If $true, users will be able to add Egnyte in the client and interact with the files stored there.","title":"AllowEgnyte"},"ContentPin":{"enum":["NotRequired","RequiredOutsideScheduleMeeting","AlwaysRequired"],"description":"This setting applies only to Skype for Business Online (not Microsoft Teams) and defines whether the user must provide a secondary form of authentication to access the meeting content from a resource device account. Meeting content is defined as files that are shared to the Content Bin - files that have been attached to the meeting.","title":"ContentPin"},"ResourceAccountContentAccess":{"enum":["NoAccess","PartialAccess","FullAccess"],"description":"Require a secondary form of authentication to access meeting content.","title":"ResourceAccountContentAccess"},"RestrictedSenderList":{"type":"array","items":{"type":"string"},"description":"Senders domains can be further restricted to ensure that only allowed SMTP domains can send emails to the Teams channels. This is a comma-separated string of the domains you'd like to allow to send emails to Teams channels.","title":"RestrictedSenderList"}},"required":["Identity"]},"microsoft.teams.compliancerecordingpolicy":{"type":"object","description":"Creates a new Teams recording policy for governing automatic policy-based recording in your tenant. Automatic policy-based recording is only applicable to Microsoft Teams users.","title":"Schema for microsoft.teams.compliancerecordingpolicy","properties":{"Identity":{"type":"string","description":"Unique identifier of the application instance of a policy-based recording application to be retrieved.","title":"Identity"},"ComplianceRecordingApplications":{"type":"array","items":{"type":"string"},"description":"A list of application instances of policy-based recording applications to assign to this policy. The Id of each of these application instances must be the ObjectId of the application instance as obtained by the Get-CsOnlineApplicationInstance cmdlet.","title":"ComplianceRecordingApplications"},"Description":{"type":"string","description":"Enables administrators to provide explanatory text to accompany a Teams recording policy. For example, the Description might include information about the users the policy should be assigned to.","title":"Description"},"DisableComplianceRecordingAudioNotificationForCalls":{"type":"boolean","description":"Setting this attribute to true disables recording audio notifications for 1:1 calls that are under compliance recording.","title":"DisableComplianceRecordingAudioNotificationForCalls"},"Enabled":{"type":"boolean","description":"Controls whether this Teams recording policy is active or not.","title":"Enabled"},"WarnUserOnRemoval":{"type":"boolean","description":"This parameter is reserved for future use.","title":"WarnUserOnRemoval"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.cortanapolicy":{"type":"object","description":"The CsTeamsCortanaPolicy resources enable administrators to control settings for Cortana voice assistant in Microsoft Teams.","title":"Schema for microsoft.teams.cortanapolicy","properties":{"Identity":{"type":"string","description":"Unique identifier for Teams cortana policy you're creating.","title":"Identity"},"CortanaVoiceInvocationMode":{"enum":["Disabled","PushToTalkUserOverride","WakeWordPushToTalkUserOverride"],"description":"The value of this field indicates if Cortana is enabled and mode of invocation.","title":"CortanaVoiceInvocationMode"},"Description":{"type":"string","description":"Provide a description of your policy to identify purpose of creating it.","title":"Description"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.dialinconferencingtenantsettings":{"type":"object","description":"This resource configures a Teams User's Calling Settings.\r\n\r\nMore information: https://learn.microsoft.com/en-us/microsoftteams/user-call-settings","title":"Schema for microsoft.teams.dialinconferencingtenantsettings","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only accepted value is Yes.","title":"IsSingleInstance"},"AllowPSTNOnlyMeetingsByDefault":{"type":"boolean","description":"Specifies the default value that gets assigned to the 'AllowPSTNOnlyMeetings' setting of users when they are enabled for dial-in conferencing, or when a user's dial-in conferencing provider is set to Microsoft. If set to $true, the 'AllowPSTNOnlyMeetings' setting of the user will also be set to true. If $false, the user setting will be false. The default value for AllowPSTNOnlyMeetingsByDefault is $false.","title":"AllowPSTNOnlyMeetingsByDefault"},"AutomaticallyMigrateUserMeetings":{"type":"boolean","description":"Automatically Migrate User Meetings.","title":"AutomaticallyMigrateUserMeetings"},"AutomaticallyReplaceAcpProvider":{"type":"boolean","description":"Automatically replace ACP Provider.","title":"AutomaticallyReplaceAcpProvider"},"AutomaticallySendEmailsToUsers":{"type":"boolean","description":"Specifies whether advisory emails will be sent to users when the events listed below occur. Setting the parameter to $true enables the emails to be sent, $false disables the emails. The default is $true.","title":"AutomaticallySendEmailsToUsers"},"EnableDialOutJoinConfirmation":{"type":"boolean","description":"Enable Dial out join confirmation.","title":"EnableDialOutJoinConfirmation"},"EnableEntryExitNotifications":{"type":"boolean","description":"Specifies if, by default, announcements are made as users enter and exit a conference call. Set to $true to enable notifications, $false to disable notifications. The default is $true.","title":"EnableEntryExitNotifications"},"EntryExitAnnouncementsType":{"type":"string","description":"Supported entry and exit announcement type.","title":"EntryExitAnnouncementsType"},"MaskPstnNumbersType":{"enum":["MaskedForExternalUsers","MaskedForAllUsers","NoMasking"],"description":"This parameter allows tenant administrators to configure masking of PSTN participant phone numbers in the roster view for Microsoft Teams meetings enabled for Audio Conferencing, scheduled within the organization. Possible values are MaskedForExternalUsers, MaskedForAllUsers or NoMasking","title":"MaskPstnNumbersType"},"PinLength":{"type":"integer","description":"Specifies the number of digits in the automatically generated PINs. Organizers can enter their PIN to start a meeting they scheduled if they join via phone and are the first person to join. The minimum value is 4, the maximum is 12, and the default is 5.","title":"PinLength"}},"required":["IsSingleInstance"]},"microsoft.teams.emergencycallingpolicy":{"type":"object","description":"This resource configures the Teams Emergency Calling Policies.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/manage-emergency-calling-policies","title":"Schema for microsoft.teams.emergencycallingpolicy","properties":{"Identity":{"type":"string","description":"Identity of the Teams Emergency Calling Policy.","title":"Identity"},"Description":{"type":"string","description":"Description of the Teams Emergency Calling Policy.","title":"Description"},"EnhancedEmergencyServiceDisclaimer":{"type":"string","description":"Allows the tenant administrator to configure a text string, which is shown at the top of the Calls app.","title":"EnhancedEmergencyServiceDisclaimer"},"ExternalLocationLookupMode":{"enum":["Disabled","Enabled"],"description":"Enables ExternalLocationLookupMode. This mode allows users to set Emergency addresses for remote locations.","title":"ExternalLocationLookupMode"},"NotificationDialOutNumber":{"type":"string","description":"This parameter represents PSTN number which can be dialed out if NotificationMode is set to either of the two Conference values.","title":"NotificationDialOutNumber"},"NotificationGroup":{"type":"string","description":"NotificationGroup is a email list of users and groups to be notified of an emergency call.","title":"NotificationGroup"},"NotificationMode":{"enum":["NotificationOnly","ConferenceMuted","ConferenceUnMuted"],"description":"The type of conference experience for security desk notification.","title":"NotificationMode"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.emergencycallroutingpolicy":{"type":"object","description":"This resource configures the Teams Emergency Call Routing Policies.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/manage-emergency-call-routing-policies","title":"Schema for microsoft.teams.emergencycallroutingpolicy","properties":{"Identity":{"type":"string","description":"Identity of the Teams Emergency Call Routing Policy.","title":"Identity"},"Description":{"type":"string","description":"Description of the Teams Emergency Call Routing Policy.","title":"Description"},"EmergencyNumbers":{"type":"array","items":{"type":"object","description":"This resource configures the Teams Emergency Call Routing Policies.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/manage-emergency-call-routing-policies","title":"Schema for MSFT_TeamsEmergencyNumber","properties":{"EmergencyDialString":{"type":"string","description":"Specifies the emergency phone number.","title":"EmergencyDialString"},"EmergencyDialMask":{"type":"string","description":"For each Teams emergency number, you can specify zero or more emergency dial masks. A dial mask is a number that you want to translate into the value of the emergency dial number value when it is dialed.","title":"EmergencyDialMask"},"OnlinePSTNUsage":{"type":"string","description":"Specify the online public switched telephone network (PSTN) usage","title":"OnlinePSTNUsage"}},"required":[]},"description":"Emergency number(s) associated with the policy.","title":"EmergencyNumbers"},"AllowEnhancedEmergencyServices":{"type":"boolean","description":"Flag to enable Enhanced Emergency Services","title":"AllowEnhancedEmergencyServices"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.enhancedencryptionpolicy":{"type":"object","description":"Use this resource to create a new Teams enhanced encryption policy.","title":"Schema for microsoft.teams.enhancedencryptionpolicy","properties":{"Identity":{"type":"string","description":"Unique identifier assigned to the Teams enhanced encryption policy.","title":"Identity"},"CallingEndtoEndEncryptionEnabledType":{"type":"string","description":"Determines whether End-to-end encrypted calling is available for the user in Teams. Set this to DisabledUserOverride to allow user to turn on End-to-end encrypted calls. Set this to Disabled to prohibit.","title":"CallingEndtoEndEncryptionEnabledType"},"Description":{"type":"string","description":"Enables administrators to provide explanatory text to accompany a Teams enhanced encryption policy.","title":"Description"},"MeetingEndToEndEncryption":{"type":"string","description":"N/A","title":"MeetingEndToEndEncryption"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.eventspolicy":{"type":"object","description":"This resource configures the Teams Events Policies.","title":"Schema for microsoft.teams.eventspolicy","properties":{"Identity":{"type":"string","description":"Identity of the Teams Events Policy.","title":"Identity"},"Description":{"type":"string","description":"Description of the Teams Events Policy.","title":"Description"},"AllowEmailEditing":{"enum":["Disabled","Enabled"],"description":"This setting governs if a user is allowed to edit the communication emails in Teams Town Hall or Teams Webinar events.","title":"AllowEmailEditing"},"AllowEventIntegrations":{"type":"boolean","description":"This setting governs access to the integrations tab in the event creation workflow.","title":"AllowEventIntegrations"},"AllowWebinars":{"enum":["Disabled","Enabled"],"description":"Determines if webinars are allowed by the policy or not.","title":"AllowWebinars"},"AllowTownhalls":{"enum":["Disabled","Enabled"],"description":"This setting governs if a user can create town halls using Teams Events.","title":"AllowTownhalls"},"AllowedQuestionTypesInRegistrationForm":{"enum":["DefaultOnly","DefaultAndPredefinedOnly","AllQuestions"],"description":"This setting governs which users in a tenant can add which registration form questions to an event registration page for attendees to answer when registering for the event.","title":"AllowedQuestionTypesInRegistrationForm"},"AllowedTownhallTypesForRecordingPublish":{"enum":["None","InviteOnly","EveryoneInCompanyIncludingGuests","Everyone"],"description":"This setting describes how IT admins can control which types of Town Hall attendees can have their recordings published.","title":"AllowedTownhallTypesForRecordingPublish"},"AllowedWebinarTypesForRecordingPublish":{"enum":["None","InviteOnly","EveryoneInCompanyIncludingGuests","Everyone"],"description":"This setting describes how IT admins can control which types of webinar attendees can have their recordings published.","title":"AllowedWebinarTypesForRecordingPublish"},"EventAccessType":{"enum":["Everyone","EveryoneInCompanyExcludingGuests"],"description":"Defines who is allowed to join the event.","title":"EventAccessType"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"},"TownhallChatExperience":{"enum":["Optimized","None"],"description":"This setting governs whether the user can enable the Comment Stream chat experience for Town Halls.","title":"TownhallChatExperience"},"UseMicrosoftECDN":{"type":"boolean","description":"This setting governs whether the global admin disables this property and prevents the organizers from creating town halls that use Microsoft eCDN even though they have been assigned a Teams Premium license.","title":"UseMicrosoftECDN"}},"required":["Identity"]},"microsoft.teams.federationconfiguration":{"type":"object","description":"This resource is used to configure the Teams Federation Configuration (CsTenantFederationConfiguration).\r\nIn the Teams admin center this is available in 'External access' in the Users section.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/manage-external-access","title":"Schema for microsoft.teams.federationconfiguration","properties":{"Identity":{"enum":["Global"],"description":"The only valid input is Global - the tenant wide configuration","title":"Identity"},"AllowFederatedUsers":{"type":"boolean","description":"When set to True users will be potentially allowed to communicate with users from other domains.","title":"AllowFederatedUsers"},"AllowedDomains":{"type":"array","items":{"type":"string"},"description":"List of federated domains to allow.","title":"AllowedDomains"},"BlockedDomains":{"type":"array","items":{"type":"string"},"description":"List of federated domains to block.","title":"BlockedDomains"},"AllowPublicUsers":{"type":"boolean","description":"When set to True users will be potentially allowed to communicate with users who have accounts on public IM and presence providers.","title":"AllowPublicUsers"},"AllowTeamsConsumer":{"type":"boolean","description":"Allows federation with people using Teams with an account that's not managed by an organization.","title":"AllowTeamsConsumer"},"AllowTeamsConsumerInbound":{"type":"boolean","description":"Allows people using Teams with an account that's not managed by an organization, to discover and start communication with users in your organization.","title":"AllowTeamsConsumerInbound"},"ExternalAccessWithTrialTenants":{"enum":["Allowed","Blocked"],"description":"When set to Blocked, all external access with users from Teams subscriptions that contain only trial licenses will be blocked. This means users from these trial-only tenants will not be able to reach to your users via chats, Teams calls, and meetings (using the users authenticated identity) and your users will not be able to reach users in these trial-only tenants. If this setting is set to Blocked, users from the trial-only tenant will also be removed from existing chats.","title":"ExternalAccessWithTrialTenants"},"TreatDiscoveredPartnersAsUnverified":{"type":"boolean","description":"When set to True, messages sent from discovered partners are considered unverified. That means that those messages will be delivered only if they were sent from a person who is on the recipient's Contacts list.","title":"TreatDiscoveredPartnersAsUnverified"},"SharedSipAddressSpace":{"type":"boolean","description":"When set to True, indicates that the users homed on Skype for Business Online use the same SIP domain as users homed on the on-premises version of Skype for Business Server.","title":"SharedSipAddressSpace"},"RestrictTeamsConsumerToExternalUserProfiles":{"type":"boolean","description":"When set to True, Teamsconsumer have access only to external user profiles","title":"RestrictTeamsConsumerToExternalUserProfiles"}},"required":["Identity"]},"microsoft.teams.feedbackpolicy":{"type":"object","description":"New-CsTeamsFeedbackPolicy [-Identity] <string> [-UserInitiatedMode <string>] [-ReceiveSurveysMode <string>] [-AllowScreenshotCollection <bool>] [-AllowEmailCollection <bool>] [-AllowLogCollection <bool>] [-EnableFeatureSuggestions <bool>] [-Force] [-WhatIf] [-Confirm] [<CommonParameters>]","title":"Schema for microsoft.teams.feedbackpolicy","properties":{"Identity":{"type":"string","description":"Specify the name of the Teams Feedback Policy.","title":"Identity"},"UserInitiatedMode":{"type":"string","description":"Specifies if users are allowed to give feedback.","title":"UserInitiatedMode"},"ReceiveSurveysMode":{"enum":["Enabled","Disabled","EnabledUserOverride"],"description":"Specifies if users are allowed to receive the survey.","title":"ReceiveSurveysMode"},"AllowScreenshotCollection":{"type":"boolean","description":"Specifies if Screenshot Collection is enabled or not.","title":"AllowScreenshotCollection"},"AllowEmailCollection":{"type":"boolean","description":"Specifies if Email Collection is enabled or not.","title":"AllowEmailCollection"},"AllowLogCollection":{"type":"boolean","description":"Specifies if Log Collection is enabled or not.","title":"AllowLogCollection"},"EnableFeatureSuggestions":{"type":"boolean","description":"Specifies if users are allowed to provide feature suggestions","title":"EnableFeatureSuggestions"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.filespolicy":{"type":"object","description":"New-CsTeamsFilesPolicy [-Identity] <string> [-NativeFileEntryPoints <string>] [-SPChannelFilesTab <string>] [-MsftInternalProcessingMode <string>] [-WhatIf] [-Confirm] [<CommonParameters>]","title":"Schema for microsoft.teams.filespolicy","properties":{"Identity":{"type":"string","description":"Specifies the policy instance name","title":"Identity"},"NativeFileEntryPoints":{"enum":["Enabled","Disabled"],"description":"Specifies whether users see the options to upload files from OneDrive for Business, other cloud storage services configured for the user account, and SharePoint Online","title":"NativeFileEntryPoints"},"SPChannelFilesTab":{"enum":["Enabled","Disabled"],"description":"Specifies whether users see the Teams Files channel tab in any channel or in Teams chat.","title":"SPChannelFilesTab"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.grouppolicyassignment":{"type":"object","description":"This resource is used to assign Teams policy to a specified group","title":"Schema for microsoft.teams.grouppolicyassignment","properties":{"GroupDisplayName":{"type":"string","description":"Group Displayname of the group the policies are assigned to","title":"GroupDisplayName"},"GroupId":{"type":"string","description":"GroupId, alternatively to Group Displayname","title":"GroupId"},"PolicyType":{"enum":["ApplicationAccessPolicy","CallingLineIdentity","OnlineAudioConferencingRoutingPolicy","OnlineVoicemailPolicy","OnlineVoiceRoutingPolicy","TeamsAudioConferencingPolicy","TeamsCallHoldPolicy","TeamsCallParkPolicy","TeamsChannelsPolicy","TeamsComplianceRecordingPolicy","TeamsCortanaPolicy","TeamsEmergencyCallingPolicy","TeamsEnhancedEncryptionPolicy","TeamsFeedbackPolicy","TeamsFilesPolicy","TeamsIPPhonePolicy","TeamsMediaLoggingPolicy","TeamsMeetingBroadcastPolicy","TeamsMeetingPolicy","TeamsMessagingPolicy","TeamsMobilityPolicy","TeamsRoomVideoTeleConferencingPolicy","TeamsShiftsPolicy","TeamsUpdateManagementPolicy","TeamsVdiPolicy","TeamsVideoInteropServicePolicy","TenantDialPlan","ExternalAccessPolicy","TeamsAppSetupPolicy","TeamsCallingPolicy","TeamsEventsPolicy","TeamsMeetingBrandingPolicy","TeamsMeetingTemplatePermissionPolicy","TeamsVerticalPackagePolicy"],"description":"Teams PolicyType. The type of the policy to be assigned. Possible values:","title":"PolicyType"},"PolicyName":{"type":"string","description":"Teams PolicyName. The name of the policy to be assigned.","title":"PolicyName"},"Priority":{"type":"string","description":"Teams Priority. The rank of the policy assignment, relative to other group policy assignments for the same policy type","title":"Priority"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the group policy assignment exists, absent ensures it is removed.","title":"Ensure"}},"required":["GroupDisplayName","PolicyType"]},"microsoft.teams.guestcallingconfiguration":{"type":"object","description":"This resource is used to configure the Teams guest calling configuration.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/set-up-guests","title":"Schema for microsoft.teams.guestcallingconfiguration","properties":{"Identity":{"enum":["Global"],"description":"The only valid input is Global - the tenant wide configuration","title":"Identity"},"AllowPrivateCalling":{"type":"boolean","description":"Designates whether guests who have been enabled for Teams can use calling functionality. If $false, guests cannot call.","title":"AllowPrivateCalling"}},"required":["Identity","AllowPrivateCalling"]},"microsoft.teams.guestmeetingconfiguration":{"type":"object","description":"This resource is used to configure the Teams Guest Meetings Configuration.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/set-up-guests","title":"Schema for microsoft.teams.guestmeetingconfiguration","properties":{"Identity":{"enum":["Global"],"description":"The only valid input is Global - the tenant wide configuration","title":"Identity"},"AllowIPVideo":{"type":"boolean","description":"Determines whether video is enabled in a user's meetings or calls. Set this to TRUE to allow guests to share their video. Set this to FALSE to prohibit guests from sharing their video.","title":"AllowIPVideo"},"LiveCaptionsEnabledType":{"enum":["Disabled","DisabledUserOverride"],"description":"Determines whether real-time captions are available for guests in Teams meetings.","title":"LiveCaptionsEnabledType"},"ScreenSharingMode":{"enum":["Disabled","EntireScreen","SingleApplication"],"description":"Determines the mode in which guests can share a screen in calls or meetings. Set this to SingleApplication to allow the user to share an application at a given point in time. Set this to EntireScreen to allow the user to share anything on their screens. Set this to Disabled to prohibit the user from sharing their screens.","title":"ScreenSharingMode"},"AllowMeetNow":{"type":"boolean","description":"Determines whether guests can start ad-hoc meetings. Set this to TRUE to allow guests to start ad-hoc meetings. Set this to FALSE to prohibit guests from starting ad-hoc meetings.","title":"AllowMeetNow"},"AllowTranscription":{"type":"boolean","description":"Determines whether guests can enable post-meeting captions and transcriptions in meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowTranscription"}},"required":["Identity"]},"microsoft.teams.guestmessagingconfiguration":{"type":"object","description":"This resource is used to configure the Teams Guest Messaging Configuration.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/set-up-guests","title":"Schema for microsoft.teams.guestmessagingconfiguration","properties":{"Identity":{"enum":["Global"],"description":"The only valid input is Global - the tenant wide configuration","title":"Identity"},"AllowUserEditMessage":{"type":"boolean","description":"Determines if a user is allowed to edit their own messages.","title":"AllowUserEditMessage"},"AllowUserDeleteMessage":{"type":"boolean","description":"Determines if a user is allowed to delete their own messages.","title":"AllowUserDeleteMessage"},"AllowUserChat":{"type":"boolean","description":"Determines if a user is allowed to chat.","title":"AllowUserChat"},"AllowUserDeleteChat":{"type":"boolean","description":"Turn this setting on to allow users to permanently delete their one-on-one chat, group chat, and meeting chat as participants (this deletes the chat only for them, not other users in the chat).","title":"AllowUserDeleteChat"},"GiphyRatingType":{"enum":["Moderate","Strict","NoRestriction"],"description":"Determines Giphy content restrictions. Default value is Moderate, other options are Strict and NoRestriction.","title":"GiphyRatingType"},"AllowMemes":{"type":"boolean","description":"Determines if memes are available for use.","title":"AllowMemes"},"AllowStickers":{"type":"boolean","description":"Determines if stickers are available for use.","title":"AllowStickers"},"AllowGiphy":{"type":"boolean","description":"Determines if Giphy are available for use.","title":"AllowGiphy"},"AllowImmersiveReader":{"type":"boolean","description":"Determines if Immersive Reader is enabled.","title":"AllowImmersiveReader"}},"required":["Identity"]},"microsoft.teams.ipphonepolicy":{"type":"object","description":"New-CsTeamsIPPhonePolicy allows you to create a policy to manage features related to Teams phone experiences. Teams phone policies determine the features that are available to users.","title":"Schema for microsoft.teams.ipphonepolicy","properties":{"Identity":{"type":"string","description":"Specifies the policy instance name","title":"Identity"},"AllowBetterTogether":{"enum":["Enabled","Disabled"],"description":"Determines whether Better Together mode is enabled, phones can lock and unlock in an integrated fashion when connected to their Windows PC running a 64-bit Teams desktop client.","title":"AllowBetterTogether"},"AllowHomeScreen":{"enum":["Enabled","EnabledUserOverride","Disabled"],"description":"Determines whether the Home Screen feature of the Teams IP Phones is enabled.","title":"AllowHomeScreen"},"AllowHotDesking":{"type":"boolean","description":"Determines whether hot desking mode is enabled.","title":"AllowHotDesking"},"Description":{"type":"string","description":"Specifies the description of the policy","title":"Description"},"HotDeskingIdleTimeoutInMinutes":{"type":"integer","description":"Determines the idle timeout value in minutes for the signed in user account. When the timeout is reached, the account is logged out.","title":"HotDeskingIdleTimeoutInMinutes"},"SearchOnCommonAreaPhoneMode":{"enum":["Enabled","Disabled"],"description":"Determines whether a user can search the Global Address List in Common Area Phone Mode.","title":"SearchOnCommonAreaPhoneMode"},"SignInMode":{"enum":["UserSignIn","CommonAreaPhoneSignIn","MeetingSignIn"],"description":"Determines the sign in mode for the device when signing in to Teams.","title":"SignInMode"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.meetingbroadcastconfiguration":{"type":"object","description":"This resource is used to configure the Teams Meeting Broadcast Settings.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/teams-live-events/configure-teams-live-events","title":"Schema for microsoft.teams.meetingbroadcastconfiguration","properties":{"Identity":{"enum":["Global"],"description":"The only valid input is Global - the tenant wide configuration","title":"Identity"},"SupportURL":{"type":"string","description":"Specifies a URL where broadcast event attendees can find support information or FAQs specific to that event. The URL will be displayed to the attendees during the broadcast.","title":"SupportURL"},"AllowSdnProviderForBroadcastMeeting":{"type":"boolean","description":"If set to $true, Teams meeting broadcast streams are enabled to take advantage of the network and bandwidth management capabilities of your Software Defined Network (SDN) provider.","title":"AllowSdnProviderForBroadcastMeeting"},"SdnProviderName":{"type":"string","description":"Specifies the Software Defined Network (SDN) provider's name. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.","title":"SdnProviderName"},"SdnLicenseId":{"type":"string","description":"Specifies the Software Defined Network (SDN) license identifier. This is required and provided by some SDN providers. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.","title":"SdnLicenseId"},"SdnApiTemplateUrl":{"type":"string","description":"Specifies the Software Defined Network (SDN) provider's HTTP API endpoint. This information is provided to you by the SDN provider. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.","title":"SdnApiTemplateUrl"},"SdnApiToken":{"type":"string","description":"Specifies the Software Defined Network (SDN) provider's authentication token which is required to use their SDN license. This is required by some SDN providers who will give you the required token. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.","title":"SdnApiToken"}},"required":["Identity"]},"microsoft.teams.meetingbroadcastpolicy":{"type":"object","description":"This resource is used to configure the Teams Meeting Broadcast Policies.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/teams-live-events/set-up-for-teams-live-events","title":"Schema for microsoft.teams.meetingbroadcastpolicy","properties":{"Identity":{"type":"string","description":"The identifier of the Teams Meeting Broadcast Policy.","title":"Identity"},"AllowBroadcastScheduling":{"type":"boolean","description":"Specifies whether this user can create broadcast events in Teams. This setting impacts broadcasts that use both self-service and external encoder production methods.","title":"AllowBroadcastScheduling"},"AllowBroadcastTranscription":{"type":"boolean","description":"Specifies whether real-time transcription and translation can be enabled in the broadcast event. Note: this setting is applicable to broadcast events that use Teams Meeting production only and does not apply when external encoder is used as production method.","title":"AllowBroadcastTranscription"},"BroadcastAttendeeVisibilityMode":{"enum":["Everyone","EveryoneInCompany","InvitedUsersInCompany","EveryoneInCompanyAndExternal","InvitedUsersInCompanyAndExternal"],"description":"Specifies the attendee visibility mode of the broadcast events created by this user.  This setting controls who can watch the broadcast event - e.g. anyone can watch this event including anonymous users or only authenticated users in my company can watch the event.  Note: this setting is applicable to broadcast events that use Teams Meeting production only and does not apply when external encoder is used as production method.","title":"BroadcastAttendeeVisibilityMode"},"BroadcastRecordingMode":{"enum":["AlwaysEnabled","AlwaysDisabled","UserOverride"],"description":"Specifies whether broadcast events created by this user are always recorded, never recorded or user can choose whether to record or not. Note: this setting is applicable to broadcast events that use Teams Meeting production only and does not apply when external encoder is used as production method.","title":"BroadcastRecordingMode"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the Policy exists, absent ensures it is removed","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.meetingconfiguration":{"type":"object","description":"This resource is used to configure the Teams Meeting Configuration.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/meeting-settings-in-teams","title":"Schema for microsoft.teams.meetingconfiguration","properties":{"Identity":{"enum":["Global"],"description":"The only valid input is Global - the tenant wide configuration","title":"Identity"},"LogoURL":{"type":"string","description":"URL to a logo image. This would be included in the meeting invite. Please ensure this URL is publicly accessible for invites that go beyond your federation boundaries.","title":"LogoURL"},"LegalURL":{"type":"string","description":"URL to a website containing legal information and meeting disclaimers. This would be included in the meeting invite. Please ensure this URL is publicly accessible for invites that go beyond your federation boundaries.","title":"LegalURL"},"HelpURL":{"type":"string","description":"URL to a website where users can obtain assistance on joining the meeting.This would be included in the meeting invite. Please ensure this URL is publicly accessible for invites that go beyond your federation boundaries.","title":"HelpURL"},"CustomFooterText":{"type":"string","description":"Text to be used on custom meeting invitations.","title":"CustomFooterText"},"DisableAnonymousJoin":{"type":"boolean","description":"Determines whether anonymous users are blocked from joining meetings in the tenant. Set this to TRUE to block anonymous users from joining. Set this to FALSE to allow anonymous users to join meetings.","title":"DisableAnonymousJoin"},"EnableQoS":{"type":"boolean","description":"Determines whether Quality of Service Marking for real-time media (audio, video, screen/app sharing) is enabled in the tenant. Set this to TRUE to enable and FALSE to disable.","title":"EnableQoS"},"ClientAudioPort":{"type":"integer","description":"Determines the starting port number for client audio. Minimum allowed value: 1024 Maximum allowed value: 65535 Default value: 50000.","title":"ClientAudioPort"},"ClientAudioPortRange":{"type":"integer","description":"Determines the total number of ports available for client audio. Default value is 20.","title":"ClientAudioPortRange"},"ClientVideoPort":{"type":"integer","description":"Determines the starting port number for client video. Minimum allowed value: 1024 Maximum allowed value: 65535 Default value: 50020.","title":"ClientVideoPort"},"ClientVideoPortRange":{"type":"integer","description":"Determines the total number of ports available for client video. Default value is 20.","title":"ClientVideoPortRange"},"ClientAppSharingPort":{"type":"integer","description":"Determines the starting port number for client screen sharing or application sharing. Minimum allowed value: 1024 Maximum allowed value: 65535 Default value: 50040.","title":"ClientAppSharingPort"},"ClientMediaPortRangeEnabled":{"type":"boolean","description":"Determines whether custom media port and range selections need to be enforced. When set to True, clients will use the specified port range for media traffic. When set to False (the default value) for any available port (from port 1024 through port 65535) will be used to accommodate media traffic.","title":"ClientMediaPortRangeEnabled"},"ClientAppSharingPortRange":{"type":"integer","description":"Determines the total number of ports available for client sharing or application sharing. Default value is 20.","title":"ClientAppSharingPortRange"}},"required":["Identity"]},"microsoft.teams.meetingpolicy":{"type":"object","description":"This resource configures the Teams Meeting Policies.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/meeting-policies-overview","title":"Schema for microsoft.teams.meetingpolicy","properties":{"Identity":{"type":"string","description":"Identity of the Teams Meeting Policy.","title":"Identity"},"Description":{"type":"string","description":"Description of the Teams Meeting Policy.","title":"Description"},"AllowChannelMeetingScheduling":{"type":"boolean","description":"Determines whether a user can schedule channel meetings. Set this to TRUE to allow a user to schedule channel meetings. Set this to FALSE to prohibit the user from scheduling channel meetings. Note this only restricts from scheduling and not from joining a meeting scheduled by another user.","title":"AllowChannelMeetingScheduling"},"AllowMeetNow":{"type":"boolean","description":"Determines whether a user can start ad-hoc meetings. Set this to TRUE to allow a user to start ad-hoc meetings. Set this to FALSE to prohibit the user from starting ad-hoc meetings.","title":"AllowMeetNow"},"AllowPrivateMeetNow":{"type":"boolean","description":"Determines whether a user can start private ad-hoc meetings. Set this to TRUE to allow a user to start private ad-hoc meetings. Set this to FALSE to prohibit the user from starting private ad-hoc meetings.","title":"AllowPrivateMeetNow"},"MeetingChatEnabledType":{"enum":["Disabled","Enabled","EnabledExceptAnonymous"],"description":"Determines whether or not Chat will be enabled, enabled except anonymous or disabled for meetings.","title":"MeetingChatEnabledType"},"LiveCaptionsEnabledType":{"enum":["Disabled","DisabledUserOverride"],"description":"Determines whether a user should have the option to view live captions or not in a meeting.","title":"LiveCaptionsEnabledType"},"AllowIPAudio":{"type":"boolean","description":"Determines whether audio is enabled in a user's meetings or calls. Set this to TRUE to allow the user to share their audioo. Set this to FALSE to prohibit the user from sharing their audio.","title":"AllowIPAudio"},"AllowIPVideo":{"type":"boolean","description":"Determines whether video is enabled in a user's meetings or calls. Set this to TRUE to allow the user to share their video. Set this to FALSE to prohibit the user from sharing their video.","title":"AllowIPVideo"},"AllowEngagementReport":{"enum":["Enabled","Disabled"],"description":"Determines whether or not a meeting Organizer can track join and leave times for all users within their meetings as well as download a roster.","title":"AllowEngagementReport"},"IPAudioMode":{"enum":["EnabledOutgoingIncoming","Disabled"],"description":"Determines whether or not a user can use audio in a meeting that supports it.","title":"IPAudioMode"},"IPVideoMode":{"enum":["EnabledOutgoingIncoming","Disabled"],"description":"Determines whether or not a user can use video in a meeting that supports it.  Can only be enabled if IPAudioMode is enabled","title":"IPVideoMode"},"AllowAnonymousUsersToDialOut":{"type":"boolean","description":"CURRENTLY DISABLED: Determines whether anonymous users can use the Call Me At feature for meeting audio.","title":"AllowAnonymousUsersToDialOut"},"AllowAnonymousUsersToStartMeeting":{"type":"boolean","description":"Determines whether anonymous users can initiate a meeting. Set this to TRUE to allow anonymous users to initiate a meeting. Set this to FALSE to prohibit them from initiating a meeting.","title":"AllowAnonymousUsersToStartMeeting"},"AllowPrivateMeetingScheduling":{"type":"boolean","description":"Determines whether a user can schedule private meetings. Set this to TRUE to allow a user to schedule private meetings. Set this to FALSE to prohibit the user from scheduling private meetings. Note this only restricts from scheduling and not from joining a meeting scheduled by another user.","title":"AllowPrivateMeetingScheduling"},"AutoAdmittedUsers":{"enum":["EveryoneInCompany","Everyone","EveryoneInSameAndFederatedCompany","OrganizerOnly","InvitedUsers","EveryoneInCompanyExcludingGuests"],"description":"Determines what types of participants will automatically be added to meetings organized by this user. Set this to EveryoneInCompany if you would like meetings to place every external user in the lobby but allow all users in the company to join the meeting immediately. Set this to Everyone if you'd like to admit anonymous users by default. Set this to EveryoneInSameAndFederatedCompany if you would like meetings to allow federated users to join like your company's users, but place all other external users in a lobby. Set this to InvitedUsers if you would like meetings to allow only the invited users.","title":"AutoAdmittedUsers"},"AllowPSTNUsersToBypassLobby":{"type":"boolean","description":"Determines whether PSTN users should be automatically admitted to the meetings. Set this to TRUE to allow the PSTN user to be able bypass the meetinglobby. Set this to FALSE to prohibit the PSTN user from bypassing the meetinglobby.","title":"AllowPSTNUsersToBypassLobby"},"AllowCloudRecording":{"type":"boolean","description":"Determines whether cloud recording is allowed in a user's meetings. Set this to TRUE to allow the user to be able to record meetings. Set this to FALSE to prohibit the user from recording meetings.","title":"AllowCloudRecording"},"AllowRecordingStorageOutsideRegion":{"type":"boolean","description":"Determines whether cloud recording can be stored out of region for go-local tenants where recording is not yet enabled.","title":"AllowRecordingStorageOutsideRegion"},"DesignatedPresenterRoleMode":{"enum":["OrganizerOnlyUserOverride","EveryoneInCompanyUserOverride","EveryoneUserOverride"],"description":"Determines if users can change the default value of the Who can present? setting in Meeting options in the Teams client. This policy setting affects all meetings, including Meet Now meetings.","title":"DesignatedPresenterRoleMode"},"AllowOutlookAddIn":{"type":"boolean","description":"Determines whether a user can schedule Teams Meetings in Outlook desktop client. Set this to TRUE to allow the user to be able to schedule Teams meetings in Outlook client. Set this to FALSE to prohibit a user from scheduling Teams meeting in Outlook client.","title":"AllowOutlookAddIn"},"AllowPowerPointSharing":{"type":"boolean","description":"Determines whether Powerpoint sharing is allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowPowerPointSharing"},"AllowParticipantGiveRequestControl":{"type":"boolean","description":"Determines whether participants can request or give control of screen sharing during meetings scheduled by this user. Set this to TRUE to allow the user to be able to give or request control. Set this to FALSE to prohibit the user from giving, requesting control in a meeting.","title":"AllowParticipantGiveRequestControl"},"AllowExternalParticipantGiveRequestControl":{"type":"boolean","description":"Determines whether external participants can request or give control of screen sharing during meetings scheduled by this user. Set this to TRUE to allow the user to be able to give or request control. Set this to FALSE to prohibit an external user from giving or requesting control in a meeting.","title":"AllowExternalParticipantGiveRequestControl"},"AllowSharedNotes":{"type":"boolean","description":"Determines whether users are allowed to take shared notes. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowSharedNotes"},"AllowWhiteboard":{"type":"boolean","description":"Determines whether whiteboard is allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowWhiteboard"},"AllowTranscription":{"type":"boolean","description":"Determines whether real-time and/or post-meeting captions and transcriptions are allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowTranscription"},"MediaBitRateKb":{"type":"integer","description":"Determines the media bit rate for audio/video/app sharing transmissions in meetings.","title":"MediaBitRateKb"},"ScreenSharingMode":{"enum":["SingleApplication","EntireScreen","Disabled"],"description":"Determines the mode in which a user can share a screen in calls or meetings. Set this to SingleApplication to allow the user to share an application at a given point in time. Set this to EntireScreen to allow the user to share anything on their screens. Set this to Disabled to prohibit the user from sharing their screens.","title":"ScreenSharingMode"},"VideoFiltersMode":{"enum":["NoFilters","BlurOnly","BlurAndDefaultBackgrounds","AllFilters"],"description":"Determines which background filters are available to meeting attendees.","title":"VideoFiltersMode"},"AllowOrganizersToOverrideLobbySettings":{"type":"boolean","description":"Determines whether organizers can override lobby settings for both VOIP and PSTN. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowOrganizersToOverrideLobbySettings"},"PreferredMeetingProviderForIslandsMode":{"enum":["TeamsAndSfb","Teams"],"description":"Determines which Outlook Add-in the user will get as preferred Meeting provider(TeamsAndSfb or Teams).","title":"PreferredMeetingProviderForIslandsMode"},"AllowNDIStreaming":{"type":"boolean","description":"Determines whether a user is able to use NDI (Network Device Interface) in meetings - both for output and input streams.","title":"AllowNDIStreaming"},"AllowUserToJoinExternalMeeting":{"enum":["Enabled","FederatedOnly","Disabled"],"description":"Determines what types of external meetings users can join. Enabled is able join all external meetings.","title":"AllowUserToJoinExternalMeeting"},"EnrollUserOverride":{"enum":["Disabled","Enabled"],"description":"Determines whether or not users will be able to enroll/capture their Biometric data: Face & Voice.","title":"EnrollUserOverride"},"RoomAttributeUserOverride":{"enum":["Off","Distinguish","Attribute"],"description":"Determines whether or not biometric data will be used to distinguish and or attribute in the transcript.","title":"RoomAttributeUserOverride"},"StreamingAttendeeMode":{"enum":["Disabled","Enabled"],"description":"Determines whether or not meetings created by users with this policy are able to utilize the meeting overflow capability.","title":"StreamingAttendeeMode"},"TeamsCameraFarEndPTZMode":{"enum":["Disabled","AutoAcceptInTenant","AutoAcceptAll"],"description":"Determines whether or not meetings created by users with this policy are able to utilize the Camera Far-End PTZ Mode.","title":"TeamsCameraFarEndPTZMode"},"AllowMeetingReactions":{"type":"boolean","description":"Determines whether or not meetings created by users with this policy are able to utilize the Meeting Reactions feature.","title":"AllowMeetingReactions"},"WhoCanRegister":{"enum":["Everyone","EveryoneInCompany"],"description":"Specifies who can attend and register for webinars.","title":"WhoCanRegister"},"AllowAnnotations":{"type":"boolean","description":"N/A","title":"AllowAnnotations"},"AllowAnonymousUsersToJoinMeeting":{"type":"boolean","description":"Determines whether anonymous users can join the meetings that impacted users organize. Set this to TRUE to allow anonymous users to join a meeting. Set this to FALSE to prohibit them from joining a meeting.","title":"AllowAnonymousUsersToJoinMeeting"},"AllowMeetingCoach":{"type":"boolean","description":"N/A","title":"AllowMeetingCoach"},"AllowMeetingRegistration":{"type":"boolean","description":"Controls if a user can create a webinar meeting. The default value is True.","title":"AllowMeetingRegistration"},"AllowNetworkConfigurationSettingsLookup":{"type":"boolean","description":"Determines whether network configuration setting lookups can be made by users who are not Enterprise Voice enabled. It is used to enable Network Roaming policies.","title":"AllowNetworkConfigurationSettingsLookup"},"AllowWatermarkForCameraVideo":{"type":"boolean","description":"N/A","title":"AllowWatermarkForCameraVideo"},"AllowWatermarkForScreenSharing":{"type":"boolean","description":"N/A","title":"AllowWatermarkForScreenSharing"},"NewMeetingRecordingExpirationDays":{"type":"integer","description":"Specifies the number of days before meeting recordings will expire and move to the recycle bin. Value can be from 1 to 99,999 days. NOTE: You may opt to set Meeting Recordings to never expire by entering the value -1.","title":"NewMeetingRecordingExpirationDays"},"AllowCartCaptionsScheduling":{"enum":["EnabledUserOverride","DisabledUserOverride","Disabled"],"description":"Determines whether a user can add a URL for captions from a Communications Access Real-Time Translation (CART) captioner for providing real-time captions in meetings.","title":"AllowCartCaptionsScheduling"},"AllowDocumentCollaboration":{"type":"string","description":"N/A","title":"AllowDocumentCollaboration"},"AllowedStreamingMediaInput":{"type":"string","description":"N/A","title":"AllowedStreamingMediaInput"},"BlockedAnonymousJoinClientTypes":{"type":"string","description":"A user can join a Teams meeting anonymously using a Teams client or using a custom application built using Azure Communication Services. When anonymous meeting join is enabled, both types of clients may be used by default. This optional parameter can be used to block one of the client types that can be used. The allowed values are ACS (to block the use of Azure Communication Services clients) or Teams (to block the use of Teams clients). Both can also be specified, separated by a comma, but this is equivalent to disabling anonymous join completely.","title":"BlockedAnonymousJoinClientTypes"},"ChannelRecordingDownload":{"type":"string","description":"Determines how channel meeting recordings are saved, permissioned, and who can download them.","title":"ChannelRecordingDownload"},"ExplicitRecordingConsent":{"type":"string","description":"N/A","title":"ExplicitRecordingConsent"},"ForceStreamingAttendeeMode":{"type":"string","description":"N/A","title":"ForceStreamingAttendeeMode"},"InfoShownInReportMode":{"type":"string","description":"N/A","title":"InfoShownInReportMode"},"LiveInterpretationEnabledType":{"type":"string","description":"Determines how meeting organizers can configure a meeting for language interpretation, select attendees of the meeting to become interpreters that other attendees can select and listen to the real-time translation they provide.","title":"LiveInterpretationEnabledType"},"LiveStreamingMode":{"enum":["Disabled","Enabled"],"description":"Determines whether you provide support for your users to stream their Teams meetings to large audiences through Real-Time Messaging Protocol (RTMP).","title":"LiveStreamingMode"},"MeetingInviteLanguages":{"type":"string","description":"Controls how the join information in meeting invitations is displayed by enforcing a common language or enabling up to two languages to be displayed. Note: All Teams supported languages can be specified using language codes.","title":"MeetingInviteLanguages"},"QnAEngagementMode":{"type":"string","description":"N/A","title":"QnAEngagementMode"},"RoomPeopleNameUserOverride":{"type":"string","description":"N/A","title":"RoomPeopleNameUserOverride"},"SpeakerAttributionMode":{"enum":["Disabled","EnabledUserOverride"],"description":"Possible values: EnabledUserOverride or Disabled.","title":"SpeakerAttributionMode"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.messagingpolicy":{"type":"object","description":"This resource is used to configure the Teams messaging policy.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/messaging-policies-in-teams","title":"Schema for microsoft.teams.messagingpolicy","properties":{"Identity":{"type":"string","description":"Identity for the teams messaging policy you're modifying. To modify the global policy, use this syntax: -Identity global. To modify a per-user policy, use syntax similar to this: -Identity TeamsMessagingPolicy.","title":"Identity"},"AllowCommunicationComplianceEndUserReporting":{"type":"boolean","description":"Report inappropriate content.","title":"AllowCommunicationComplianceEndUserReporting"},"AllowFluidCollaborate":{"type":"boolean","description":"Determines is Fluid Collaboration should be enabled or not.","title":"AllowFluidCollaborate"},"AllowSecurityEndUserReporting":{"type":"boolean","description":"Report a security concern.","title":"AllowSecurityEndUserReporting"},"AllowGiphy":{"type":"boolean","description":"Determines whether a user is allowed to access and post Giphys. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"AllowGiphy"},"AllowMemes":{"type":"boolean","description":"Determines whether a user is allowed to access and post memes. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"AllowMemes"},"AllowOwnerDeleteMessage":{"type":"boolean","description":"Determines whether owners are allowed to delete all the messages in their team. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowOwnerDeleteMessage"},"AllowUserEditMessage":{"type":"boolean","description":"Determines whether a user is allowed to edit their own messages. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowUserEditMessage"},"AllowSmartCompose":{"type":"boolean","description":"Turn on this setting to let a user get text predictions for chat messages.","title":"AllowSmartCompose"},"AllowSmartReply":{"type":"boolean","description":"Turn this setting on to enable suggested replies for chat messages. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowSmartReply"},"AllowStickers":{"type":"boolean","description":"Determines whether a user is allowed to access and post stickers. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"AllowStickers"},"AllowUrlPreviews":{"type":"boolean","description":"Use this setting to turn automatic URL previewing on or off in messages. Set this to TRUE to turn on. Set this to FALSE to turn off.","title":"AllowUrlPreviews"},"AllowUserChat":{"type":"boolean","description":"Determines whether a user is allowed to chat. Set this to TRUE to allow a user to chat across private chat, group chat and in meetings. Set this to FALSE to prohibit all chat.","title":"AllowUserChat"},"AllowUserDeleteMessage":{"type":"boolean","description":"Determines whether a user is allowed to delete their own messages. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowUserDeleteMessage"},"AllowUserTranslation":{"type":"boolean","description":"Determines whether a user is allowed to translate messages to their client languages. Set this to TRUE to allow. Set this to FALSE to prohibit.","title":"AllowUserTranslation"},"AllowImmersiveReader":{"type":"boolean","description":"Determines whether a user is allowed to use Immersive Reader for reading conversation messages. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"AllowImmersiveReader"},"AllowRemoveUser":{"type":"boolean","description":"Determines whether a user is allowed to remove a user from a conversation. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"AllowRemoveUser"},"AllowPriorityMessages":{"type":"boolean","description":"Determines whether a user is allowed to send priorities messages. Set this to TRUE to allow. Set this FALSE to prohibit.","title":"AllowPriorityMessages"},"AllowUserDeleteChat":{"type":"boolean","description":"Turn this setting on to allow users to permanently delete their 1:1, group chat, and meeting chat as participants (this deletes the chat only for them, not other users in the chat).","title":"AllowUserDeleteChat"},"AllowVideoMessages":{"type":"boolean","description":"Determines whether a user is allowed to send video messages in Chat. Set this to TRUE to allow a user to send video messages. Set this to FALSE to prohibit sending video messages.","title":"AllowVideoMessages"},"Description":{"type":"string","description":"Provide a description of your policy to identify purpose of creating it.","title":"Description"},"GiphyRatingType":{"enum":["STRICT","MODERATE","NORESTRICTION"],"description":"Determines the Giphy content restrictions applicable to a user. Set this to STRICT, MODERATE or NORESTRICTION.","title":"GiphyRatingType"},"ReadReceiptsEnabledType":{"enum":["UserPreference","Everyone","None"],"description":"Use this setting to specify whether read receipts are user controlled, enabled for everyone, or disabled. Set this to UserPreference, Everyone or None.","title":"ReadReceiptsEnabledType"},"ChannelsInChatListEnabledType":{"enum":["DisabledUserOverride","EnabledUserOverride"],"description":"Possible values are: DisabledUserOverride,EnabledUserOverride.","title":"ChannelsInChatListEnabledType"},"AudioMessageEnabledType":{"enum":["ChatsAndChannels","ChatsOnly","Disabled"],"description":"Determines whether a user is allowed to send audio messages. Possible values are: ChatsAndChannels,ChatsOnly,Disabled.","title":"AudioMessageEnabledType"},"Tenant":{"type":"string","description":"Globally unique identifier (GUID) of the tenant account whose external user communication policy are being created.","title":"Tenant"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the Team Message Policy exists, absent ensures it is removed","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.mobilitypolicy":{"type":"object","description":"The TeamsMobilityPolicy allows Admins to control Teams mobile usage for users.","title":"Schema for microsoft.teams.mobilitypolicy","properties":{"Identity":{"type":"string","description":"Specify the name of the Teams Mobility Policy.","title":"Identity"},"Description":{"type":"string","description":"Enables administrators to provide explanatory text about the policy. For example, the Description might indicate the users the policy should be assigned to.","title":"Description"},"IPAudioMobileMode":{"enum":["WifiOnly","AllNetworks"],"description":"When set to WifiOnly, prohibits the user from making and receiving calls or joining meetings using VoIP calls on the mobile device while on a cellular data connection. Possible values are: WifiOnly, AllNetworks.","title":"IPAudioMobileMode"},"IPVideoMobileMode":{"enum":["WifiOnly","AllNetworks"],"description":"When set to WifiOnly, prohibits the user from making and receiving video calls or enabling video in meetings using VoIP calls on the mobile device while on a cellular data connection. Possible values are: WifiOnly, AllNetworks.","title":"IPVideoMobileMode"},"MobileDialerPreference":{"enum":["Teams","Native","UserOverride"],"description":"Determines the mobile dialer preference, possible values are: Teams, Native, UserOverride.","title":"MobileDialerPreference"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.networkroamingpolicy":{"type":"object","description":"New-CsTeamsNetworkRoamingPolicy allows IT Admins to create policies for Network Roaming and Bandwidth Control experiences in Microsoft Teams.","title":"Schema for microsoft.teams.networkroamingpolicy","properties":{"Identity":{"type":"string","description":"Specify the name of the Teams Network Roaming Policy.","title":"Identity"},"AllowIPVideo":{"type":"boolean","description":"Determines whether video is enabled in a user's meetings or calls. Set this to TRUE to allow the user to share their video. Set this to FALSE to prohibit the user from sharing their video.","title":"AllowIPVideo"},"Description":{"type":"string","description":"Description of the new policy to be created.","title":"Description"},"MediaBitRateKb":{"type":"integer","description":"Determines the media bit rate for audio/video/app sharing transmissions in meetings.","title":"MediaBitRateKb"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.onlinevoicemailpolicy":{"type":"object","description":"This resource configures the Teams Online Voicemail Policies.\r\n\r\nMore information: https://learn.microsoft.com/en-us/microsoftteams/manage-voicemail-policies","title":"Schema for microsoft.teams.onlinevoicemailpolicy","properties":{"Identity":{"type":"string","description":"Identity of the Teams Online Voicemail Policy.","title":"Identity"},"EnableEditingCallAnswerRulesSetting":{"type":"boolean","description":"Controls if editing call answer rule settings are enabled or disabled for a user. Possible values are $true or $false.","title":"EnableEditingCallAnswerRulesSetting"},"EnableTranscription":{"type":"boolean","description":"Allows you to disable or enable voicemail transcription. Possible values are $true or $false.","title":"EnableTranscription"},"EnableTranscriptionProfanityMasking":{"type":"boolean","description":"Allows you to disable or enable profanity masking for the voicemail transcriptions. Possible values are $true or $false.","title":"EnableTranscriptionProfanityMasking"},"EnableTranscriptionTranslation":{"type":"boolean","description":"Allows you to disable or enable translation for the voicemail transcriptions. Possible values are $true or $false.","title":"EnableTranscriptionTranslation"},"MaximumRecordingLength":{"type":"string","description":"A duration of voicemail maximum recording length. The length should be between 30 seconds to 600 seconds.","title":"MaximumRecordingLength"},"PrimarySystemPromptLanguage":{"type":"string","description":"The primary (or first) language that voicemail system prompts will be presented in. Must also set SecondarySystemPromptLanguage. When set, this overrides the user language choice.","title":"PrimarySystemPromptLanguage"},"SecondarySystemPromptLanguage":{"type":"string","description":"The secondary language that voicemail system prompts will be presented in. Must also set PrimarySystemPromptLanguage and may not be the same value as PrimarySystemPromptanguage. When set, this overrides the user language choice. ","title":"SecondarySystemPromptLanguage"},"ShareData":{"type":"string","description":"Specifies whether voicemail and transcription data are shared with the service for training and improving accuracy. Possible values are Defer and Deny.","title":"ShareData"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.onlinevoicemailusersettings":{"type":"object","description":"This resource configures a Teams User's Online Voicemail Settings.","title":"Schema for microsoft.teams.onlinevoicemailusersettings","properties":{"Identity":{"type":"string","description":"The Identity parameter represents the ID of the specific user in your organization; this can be either a SIP URI or an Object ID.","title":"Identity"},"CallAnswerRule":{"enum":["DeclineCall","PromptOnly","PromptOnlyWithTransfer","RegularVoicemail","VoicemailWithTransferOption"],"description":"The CallAnswerRule parameter represents the value of the call answer rule, which can be any of the following: DeclineCall, PromptOnly, PromptOnlyWithTransfer, RegularVoicemail, VoicemailWithTransferOption.","title":"CallAnswerRule"},"DefaultGreetingPromptOverwrite":{"type":"string","description":"The DefaultGreetingPromptOverwrite parameter represents the contents that overwrite the default normal greeting prompt. If the user's normal custom greeting is not set and DefaultGreetingPromptOverwrite is not empty, the voicemail service will play this overwrite greeting instead of the default normal greeting in the voicemail deposit scenario.","title":"DefaultGreetingPromptOverwrite"},"DefaultOofGreetingPromptOverwrite":{"type":"string","description":"The DefaultOofGreetingPromptOverwrite parameter represents the contents that overwrite the default out-of-office greeting prompt. If the user's out-of-office custom greeting is not set and DefaultOofGreetingPromptOverwrite is not empty, the voicemail service will play this overwrite greeting instead of the default out-of-office greeting in the voicemail deposit scenario.","title":"DefaultOofGreetingPromptOverwrite"},"OofGreetingEnabled":{"type":"boolean","description":"The OofGreetingEnabled parameter represents whether to play out-of-office greeting in voicemail deposit scenario.","title":"OofGreetingEnabled"},"OofGreetingFollowAutomaticRepliesEnabled":{"type":"boolean","description":"The OofGreetingFollowAutomaticRepliesEnabled parameter represents whether to play out-of-office greeting in voicemail deposit scenario when user set automatic replies in Outlook.","title":"OofGreetingFollowAutomaticRepliesEnabled"},"OofGreetingFollowCalendarEnabled":{"type":"boolean","description":"The OofGreetingFollowCalendarEnabled parameter represents whether to play out-of-office greeting in voicemail deposit scenario when user set out-of-office in calendar.","title":"OofGreetingFollowCalendarEnabled"},"PromptLanguage":{"type":"string","description":"The PromptLanguage parameter represents the language that is used to play voicemail prompts.","title":"PromptLanguage"},"ShareData":{"type":"boolean","description":"Specifies whether voicemail and transcription data is shared with the service for training and improving accuracy.","title":"ShareData"},"TransferTarget":{"type":"string","description":"The TransferTarget parameter represents the target to transfer the call when call answer rule set to PromptOnlyWithTransfer or VoicemailWithTransferOption. Value of this parameter should be a SIP URI of another user in your organization. For user with Enterprise Voice enabled, a valid telephone number could also be accepted as TransferTarget.","title":"TransferTarget"},"VoicemailEnabled":{"type":"boolean","description":"The VoicemailEnabled parameter represents whether to enable voicemail service. If set to $false, the user has no voicemail service.","title":"VoicemailEnabled"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.onlinevoiceuser":{"type":"object","description":"This resource configures the Teams Online Voice User.","title":"Schema for microsoft.teams.onlinevoiceuser","properties":{"Identity":{"type":"string","description":"Specifies the identity of the target user.","title":"Identity"},"LocationID":{"type":"string","description":"Specifies the unique identifier of the emergency location to assign to the user. Location identities can be discovered by using the Get-CsOnlineLisLocation cmdlet.","title":"LocationID"},"TelephoneNumber":{"type":"string","description":"Specifies the telephone number to be assigned to the user. The value must be in E.164 format: +14255043920. Setting the value to $Null clears the user's telephone number.","title":"TelephoneNumber"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the online voice user exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.orgwideappsettings":{"type":"object","description":"This resource configures Org-Wide App Settings for Teams.","title":"Schema for microsoft.teams.orgwideappsettings","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Specifies the resource is a single instance, the value must be 'Yes'","title":"IsSingleInstance"},"IsSideloadedAppsInteractionEnabled":{"type":"boolean","description":"Determines whether or not to allow interaction with custom apps.","title":"IsSideloadedAppsInteractionEnabled"}},"required":["IsSingleInstance"]},"microsoft.teams.pstnusage":{"type":"object","description":"This resource configures a Teams PSTN Usage.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/direct-routing-voice-routing","title":"Schema for microsoft.teams.pstnusage","properties":{"Usage":{"type":"string","description":"An online PSTN usage (such as Local or Long Distance) that can be used in conjunction with voice routes and voice routing policies.","title":"Usage"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Usage"]},"microsoft.teams.shiftspolicy":{"type":"object","description":"This resource allows you to create a new TeamsShiftPolicy instance and set it's properties.","title":"Schema for microsoft.teams.shiftspolicy","properties":{"Identity":{"type":"string","description":"Specifies the policy instance name","title":"Identity"},"AccessGracePeriodMinutes":{"type":"integer","description":"Determines the grace period time in minutes between when the first shift starts or last shift ends and when access is blocked","title":"AccessGracePeriodMinutes"},"AccessType":{"enum":["UnrestrictedAccess_TeamsApp"],"description":"Determines the Teams access type granted to the user. Today, only unrestricted access to Teams app is supported.","title":"AccessType"},"EnableScheduleOwnerPermissions":{"type":"boolean","description":"Determines whether a user can manage a Shifts schedule as a team member.","title":"EnableScheduleOwnerPermissions"},"EnableShiftPresence":{"type":"boolean","description":"Determines whether a user is given shift-based presence (On shift, Off shift, or Busy). This must be set in order to have any off shift warning message-specific settings.","title":"EnableShiftPresence"},"ShiftNoticeFrequency":{"enum":["Always","ShowOnceOnChange","Never"],"description":"Determines the frequency of warning dialog displayed when user opens Teams.","title":"ShiftNoticeFrequency"},"ShiftNoticeMessageCustom":{"type":"string","description":"Specifies a custom message. Must set ShiftNoticeMessageType to 'CustomMessage' to enforce this","title":"ShiftNoticeMessageCustom"},"ShiftNoticeMessageType":{"enum":["DefaultMessage","Message1","Message2","Message3","Message4","Message5","Message6","Message7","CustomMessage"],"description":"Specifies the warning message is shown in the blocking dialog when a user access Teams off shift hours. Select one of 7 Microsoft provided messages, a default message or a custom message.","title":"ShiftNoticeMessageType"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.templatespolicy":{"type":"object","description":"This resource configures a Teams Templates Policy.\r\n\r\nMore information: https://learn.microsoft.com/en-us/microsoftteams/templates-policies","title":"Schema for microsoft.teams.templatespolicy","properties":{"Identity":{"type":"string","description":"Identity of the Teams Templates Policy.","title":"Identity"},"Description":{"type":"string","description":"Description of the Teams Templates Policy.","title":"Description"},"HiddenTemplates":{"type":"array","items":{"type":"string"},"description":"The list of Teams templates to hide.","title":"HiddenTemplates"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.tenantdialplan":{"type":"object","description":"This resource is used to configure the tenant-wide dial plans for Microsoft Teams.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/create-and-manage-dial-plans","title":"Schema for microsoft.teams.tenantdialplan","properties":{"Identity":{"type":"string","description":"The Identity parameter is a unique identifier that designates the name of the tenant dial plan. Identity is an alphanumeric string that cannot exceed 49 characters. Valid characters are alphabetic or numeric characters, hyphen (-) and dot (.). The value should not begin with a (.).","title":"Identity"},"Description":{"type":"string","description":"The Description parameter describes the tenant dial plan - what it's for, what type of user it applies to and any other information that helps to identify the purpose of the tenant dial plan. Maximum characters: 512.","title":"Description"},"NormalizationRules":{"type":"array","items":{"type":"object","description":"This resource is used to configure the tenant-wide dial plans for Microsoft Teams.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/create-and-manage-dial-plans","title":"Schema for MSFT_TeamsVoiceNormalizationRule","properties":{"Identity":{"type":"string","description":"A unique identifier for the rule. The Identity specified must include the scope followed by a slash and then the name; for example: site:Redmond/Rule1, where site:Redmond is the scope and Rule1 is the name. The name portion will automatically be stored in the Name property. You cannot specify values for Identity and Name in the same command.","title":"Identity"},"Priority":{"type":"integer","description":"The order in which rules are applied. A phone number might match more than one rule. This parameter sets the order in which the rules are tested against the number.","title":"Priority"},"Description":{"type":"string","description":"A friendly description of the normalization rule.","title":"Description"},"Pattern":{"type":"string","description":"A regular expression that the dialed number must match in order for this rule to be applied.","title":"Pattern"},"Translation":{"type":"string","description":"The regular expression pattern that will be applied to the number to convert it to E.164 format.","title":"Translation"},"IsInternalExtension":{"type":"boolean","description":"If True, the result of applying this rule will be a number internal to the organization. If False, applying the rule results in an external number. This value is ignored if the value of the OptimizeDeviceDialing property of the associated dial plan is set to False.","title":"IsInternalExtension"}},"required":[]},"description":"List of normalization rules that are applied to this dial plan.","title":"NormalizationRules"},"ExternalAccessPrefix":{"type":"string","description":"The ExternalAccessPrefix parameter is a number (or set of numbers) that designates the call as external to the organization. (For example, to tenant-dial an outside line, first press 9.) This prefix is ignored by the normalization rules, although these rules are applied to the remainder of the number. The OptimizeDeviceDialing parameter must be set to True for this value to take effect. This parameter must match the regular expression [0-9]{1,4}: that is, it must be a value 0 through 9 and one to four digits in length. The default value is 9.","title":"ExternalAccessPrefix"},"OptimizeDeviceDialing":{"type":"boolean","description":"Specifies if the dial plan should optimize device dialing or not.","title":"OptimizeDeviceDialing"},"SimpleName":{"type":"string","description":"The SimpleName parameter is a display name for the tenant dial plan. This name must be unique among all tenant dial plans within the Skype for Business Server deployment.This string can be up to 49 characters long. Valid characters are alphabetic or numeric characters, hyphen (-), dot (.) and parentheses (()).","title":"SimpleName"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this dial plan should exist or not.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.tenantnetworkregion":{"type":"object","description":"As an Admin, you can use the Windows PowerShell command, New-CsTenantNetworkRegion to define network regions. A network region interconnects various parts of a network across multiple geographic areas. The RegionID parameter is a logical name that represents the geography of the region, and has no dependencies or restrictions. Tenant network region is used for Location Based Routing.","title":"Schema for microsoft.teams.tenantnetworkregion","properties":{"Identity":{"type":"string","description":"Unique identifier for the network region to be created.","title":"Identity"},"CentralSite":{"type":"string","description":"Name of the associated Central Site.","title":"CentralSite"},"Description":{"type":"string","description":"Provide a description of the network region to identify purpose of creating it.","title":"Description"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.tenantnetworksite":{"type":"object","description":"As an Admin, you can use the Windows PowerShell command, New-CsTenantNetworkSite to define network sites. Network sites are defined as a collection of IP subnets. Each network site must be associated with a network region. Tenant network site is used for Location Based Routing.","title":"Schema for microsoft.teams.tenantnetworksite","properties":{"Identity":{"type":"string","description":"Unique identifier for the network site to be created.","title":"Identity"},"Description":{"type":"string","description":"Provide a description of the network site to identify purpose of creating it.","title":"Description"},"EmergencyCallingPolicy":{"type":"string","description":"This parameter is used to assign a custom emergency calling policy to a network site","title":"EmergencyCallingPolicy"},"EmergencyCallRoutingPolicy":{"type":"string","description":"This parameter is used to assign a custom emergency call routing policy to a network site","title":"EmergencyCallRoutingPolicy"},"EnableLocationBasedRouting":{"type":"boolean","description":"This parameter determines whether the current site is enabled for location based routing.","title":"EnableLocationBasedRouting"},"LocationPolicy":{"type":"string","description":"LocationPolicy is the identifier for the location policy which the current network site is associating to.","title":"LocationPolicy"},"NetworkRegionID":{"type":"string","description":"NetworkRegionID is the identifier for the network region which the current network site is associating to.","title":"NetworkRegionID"},"NetworkRoamingPolicy":{"type":"string","description":"NetworkRoamingPolicy is the identifier for the network roaming policy to which the network site will associate to.","title":"NetworkRoamingPolicy"},"SiteAddress":{"type":"string","description":"The address of current network site.","title":"SiteAddress"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.tenantnetworksubnet":{"type":"object","description":"As an Admin, you can use the Windows PowerShell command, New-CsTenantNetworkSubnet to define network subnets and assign them to network sites. Each internal subnet may only be associated with one site. Tenant network subnet is used for Location Based Routing.","title":"Schema for microsoft.teams.tenantnetworksubnet","properties":{"MaskBits":{"type":"integer","description":"This parameter determines the length of bits to mask to the subnet. IPv4 format subnet accepts maskbits from 0 to 32 inclusive. IPv6 format subnet accepts maskbits from 0 to 128 inclusive.","title":"MaskBits"},"Identity":{"type":"string","description":"Unique identifier for the network subnet to be created.","title":"Identity"},"Description":{"type":"string","description":"Provide a description of the network subnet to identify purpose of creating it.","title":"Description"},"NetworkSiteID":{"type":"string","description":"NetworkSiteID is the identifier for the network site which the current network subnet is associating to.","title":"NetworkSiteID"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["MaskBits","Identity"]},"microsoft.teams.tenanttrustedipaddress":{"type":"object","description":"As an Admin, you can use the Windows PowerShell command, New-CsTenantTrustedIPAddress to define external subnets and assign them to the tenant. You can define an unlimited number of external subnets for a tenant.","title":"Schema for microsoft.teams.tenanttrustedipaddress","properties":{"Identity":{"type":"string","description":"Unique identifier for the IP address to be created.","title":"Identity"},"Description":{"type":"string","description":"Provide a description of the trusted IP address to identify purpose of creating it.","title":"Description"},"MaskBits":{"type":"integer","description":"This parameter determines the length of bits to mask to the subnet.","title":"MaskBits"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.translationrule":{"type":"object","description":"Cmdlet to create a new telephone number manipulation rule.","title":"Schema for microsoft.teams.translationrule","properties":{"Identity":{"type":"string","description":"The Identifier of the rule. This parameter is required and later used to assign the rule to the Inbound or Outbound Trunk Normalization policy.","title":"Identity"},"Description":{"type":"string","description":"A friendly description of the normalization rule.","title":"Description"},"Pattern":{"type":"string","description":"A regular expression that caller or callee number must match in order for this rule to be applied.","title":"Pattern"},"Translation":{"type":"string","description":"The regular expression pattern that will be applied to the number to convert it.","title":"Translation"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.unassignednumbertreatment":{"type":"object","description":"Creates a new treatment for how calls to an unassigned number range should be routed. The call can be routed to a user, an application or to an announcement service where a custom message will be played to the caller.","title":"Schema for microsoft.teams.unassignednumbertreatment","properties":{"Identity":{"type":"string","description":"The Id of the treatment.","title":"Identity"},"Description":{"type":"string","description":"Free format description of this treatment.","title":"Description"},"Pattern":{"type":"string","description":"A regular expression that the called number must match in order for the treatment to take effect. It is best practice to start the regular expression with the hat character and end it with the dollar character. You can use various regular expression test sites on the Internet to validate the expression.","title":"Pattern"},"Target":{"type":"string","description":"The identity of the destination the call should be routed to. Depending on the TargetType it should either be the ObjectId of the user or application instance/resource account or the AudioFileId of the uploaded audio file.","title":"Target"},"TargetType":{"enum":["User","ResourceAccount","Announcement"],"description":"The type of target used for the treatment. Allowed values are User, ResourceAccount and Announcement.","title":"TargetType"},"TreatmentPriority":{"type":"integer","description":"The priority of the treatment. Used to distinguish identical patterns. The lower the priority the higher preference. The priority needs to be unique.","title":"TreatmentPriority"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.updatemanagementpolicy":{"type":"object","description":"This resource configures the Teams Update policies. For additional information, please refer to https://docs.microsoft.com/en-us/MicrosoftTeams/public-preview-doc-updates#set-the-update-policy","title":"Schema for microsoft.teams.updatemanagementpolicy","properties":{"Identity":{"type":"string","description":"Identity of the Teams Update Management Policy.","title":"Identity"},"Description":{"type":"string","description":"The description of the Teams Update Management Policy.","title":"Description"},"AllowManagedUpdates":{"type":"boolean","description":"Determines if managed updates should be allowed or not.","title":"AllowManagedUpdates"},"AllowPreview":{"type":"boolean","description":"Determines if preview builds should be allowed or not.","title":"AllowPreview"},"AllowPublicPreview":{"enum":["Disabled","Enabled","Forced","FollowOfficePreview"],"description":"Determines the ring of public previews to subscribes to.","title":"AllowPublicPreview"},"UpdateDayOfWeek":{"type":"integer","description":"Determines the day of week to perform the updates. Value should be between 0 and 6.","title":"UpdateDayOfWeek"},"UpdateTime":{"type":"string","description":"Determines the time of day to perform the updates. Must be a valid HH:MM format string with leading 0. For instance 08:30.","title":"UpdateTime"},"UpdateTimeOfDay":{"type":"string","description":"Determines the time of day to perform the updates. Accepts a DateTime as string. Only the time will be considered.","title":"UpdateTimeOfDay"},"UseNewTeamsClient":{"enum":["NewTeamsAsDefault","UserChoice","MicrosoftChoice","AdminDisabled","NewTeamsOnly"],"description":"Determines whether or not users will use the new Teams client.","title":"UseNewTeamsClient"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.upgradeconfiguration":{"type":"object","description":"This resource configures the Teams Upgrade settings.\r\n\r\nMore information: https://docs.microsoft.com/en-us/MicrosoftTeams/migration-interop-guidance-for-teams-with-skype","title":"Schema for microsoft.teams.upgradeconfiguration","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Specifies the resource is a single instance, the value must be 'Yes'","title":"IsSingleInstance"},"DownloadTeams":{"type":"boolean","description":"The DownloadTeams property allows admins to control whether the Skype for Business client should automatically download Teams in the background. This Boolean setting is only honored on Windows clients, and only for certain values of the user's TeamsUpgradePolicy. If NotifySfbUser=true or if Mode=TeamsOnly in TeamsUpgradePolicy, this setting is honored. Otherwise it is ignored.","title":"DownloadTeams"},"SfBMeetingJoinUx":{"enum":["SkypeMeetingsApp","NativeLimitedClient"],"description":"The SfBMeetingJoinUx property allows admins to specify which app is used to join Skype for Business meetings, even after the user has been upgraded to Teams. Allowed values are: 'SkypeMeetingsApp' and 'NativeLimitedClient'. 'NativeLimitedClient' means the existing Skype for Business rich client will be used, but since the user is upgraded, only meeting functionality is available. Calling and Messaging are done via Teams. 'SkypeMeetingsApp' means use the web-downloadable app. This setting can be useful for organizations that have upgraded to Teams and no longer want to install Skype for Business on their users' computers.","title":"SfBMeetingJoinUx"}},"required":["IsSingleInstance"]},"microsoft.teams.upgradepolicy":{"type":"object","description":"This resource configures the Teams Upgrade policies.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/meetings-first#prepare-for-teams-meetings-in-meetings-first","title":"Schema for microsoft.teams.upgradepolicy","properties":{"Identity":{"type":"string","description":"Identity of the Teams Upgrade Policy.","title":"Identity"},"Users":{"type":"array","items":{"type":"string"},"description":"List of users that will be granted the Upgrade Policy to.","title":"Users"},"MigrateMeetingsToTeams":{"type":"boolean","description":"Specifies whether to move existing Skype for Business meetings organized by the user to Teams. This parameter can only be true if the mode of the specified policy instance is either TeamsOnly or SfBWithTeamsCollabAndMeetings, and if the policy instance is being granted to a specific user. It not possible to trigger meeting migration when granting TeamsUpgradePolicy to the entire tenant.","title":"MigrateMeetingsToTeams"}},"required":["Identity"]},"microsoft.teams.user":{"type":"object","description":"This resource is used to add new users to a team","title":"Schema for microsoft.teams.user","properties":{"TeamName":{"type":"string","description":"Team NAme","title":"TeamName"},"User":{"type":"string","description":"UPN of user to add to Team","title":"User"},"Role":{"enum":["Guest","Member","Owner"],"description":"User role in Team","title":"Role"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the Team user exists, absent ensures it is removed","title":"Ensure"}},"required":["TeamName","User"]},"microsoft.teams.usercallingsettings":{"type":"object","description":"This resource configures a Teams User's Calling Settings.\r\n\r\nMore information: https://learn.microsoft.com/en-us/microsoftteams/user-call-settings","title":"Schema for microsoft.teams.usercallingsettings","properties":{"Identity":{"type":"string","description":"The Identity of the user to set call forwarding, simultaneous ringing and call group settings for. Can be specified using the ObjectId or the SIP address.","title":"Identity"},"GroupNotificationOverride":{"enum":["Ring","Mute","Banner"],"description":"The group notification override that will be set on the specified user. The supported values are Ring, Mute and Banner.","title":"GroupNotificationOverride"},"CallGroupOrder":{"type":"string","description":"The order in which to call members of the Call Group. The supported values are Simultaneous and InOrder.","title":"CallGroupOrder"},"CallGroupTargets":{"type":"array","items":{"type":"string"},"description":"The members of the Call Group. You need to always specify the full set of members as the parameter value. What you set here will overwrite the current call group membership.","title":"CallGroupTargets"},"IsUnansweredEnabled":{"type":"boolean","description":"This parameter controls whether forwarding for unasnwered calls is enabled or not.","title":"IsUnansweredEnabled"},"UnansweredDelay":{"type":"string","description":"The time the call will ring the user before it is forwarded to the unanswered target. The supported format is hh:mm:ss and the delay range needs to be between 10 and 60 seconds in 10 seconds increments, i.e. 00:00:10, 00:00:20, 00:00:30, 00:00:40, 00:00:50 and 00:01:00. The default value is 20 seconds.","title":"UnansweredDelay"},"UnansweredTarget":{"type":"string","description":"The unanswered target. Supported type of values are ObjectId, SIP address and phone number. For phone numbers we support the following types of formats: E.164 (+12065551234 or +1206555000;ext=1234) or non-E.164 like 1234.","title":"UnansweredTarget"},"UnansweredTargetType":{"enum":["Group","MyDelegates","SingleTarget","Voicemail"],"description":"The unanswered target type. Supported values are Voicemail, SingleTarget, MyDelegates and Group.","title":"UnansweredTargetType"},"IsForwardingEnabled":{"type":"boolean","description":"This parameter controls whether forwarding is enabled or not.","title":"IsForwardingEnabled"},"ForwardingType":{"enum":["Immediate","Simultaneous"],"description":"The type of forwarding to set. Supported values are Immediate and Simultaneous","title":"ForwardingType"},"ForwardingTargetType":{"enum":["Group","MyDelegates","SingleTarget","Voicemail"],"description":"The forwarding target type. Supported values are Voicemail, SingleTarget, MyDelegates and Group. Voicemail is only supported for Immediate forwarding.","title":"ForwardingTargetType"},"ForwardingTarget":{"type":"string","description":"The forwarding target. Supported types of values are ObjectId's, SIP addresses and phone numbers. For phone numbers we support the following types of formats: E.164 (+12065551234 or +1206555000;ext=1234) or non-E.164 like 1234.","title":"ForwardingTarget"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.userpolicyassignment":{"type":"object","description":"This resource is used to assign Teams policy to a specified user.","title":"Schema for microsoft.teams.userpolicyassignment","properties":{"User":{"type":"string","description":"User Principal Name of the user representing the policy assignments.","title":"User"},"CallingLineIdentity":{"type":"string","description":"Name of the Calling Line Policy.","title":"CallingLineIdentity"},"ExternalAccessPolicy":{"type":"string","description":"Name of the External Access Policy.","title":"ExternalAccessPolicy"},"OnlineVoicemailPolicy":{"type":"string","description":"Name of the Online Voicemail Policy.","title":"OnlineVoicemailPolicy"},"OnlineVoiceRoutingPolicy":{"type":"string","description":"Name of the Online VOice Routing Policy.","title":"OnlineVoiceRoutingPolicy"},"TeamsAppPermissionPolicy":{"type":"string","description":"Name of the Teams App Permission Policy.","title":"TeamsAppPermissionPolicy"},"TeamsAppSetupPolicy":{"type":"string","description":"Name of the Teams App Setup Policy.","title":"TeamsAppSetupPolicy"},"TeamsAudioConferencingPolicy":{"type":"string","description":"Name of the Teams Audio Conferencing Policy.","title":"TeamsAudioConferencingPolicy"},"TeamsCallHoldPolicy":{"type":"string","description":"Name of the Teams Call Hold Policy.","title":"TeamsCallHoldPolicy"},"TeamsCallingPolicy":{"type":"string","description":"Name of the Teams Calling Policy.","title":"TeamsCallingPolicy"},"TeamsCallParkPolicy":{"type":"string","description":"Name of the Teams Call Park Policy.","title":"TeamsCallParkPolicy"},"TeamsChannelsPolicy":{"type":"string","description":"Name of the Teams Channel Policy.","title":"TeamsChannelsPolicy"},"TeamsEmergencyCallingPolicy":{"type":"string","description":"Name of the Teams Emergency Calling Policy.","title":"TeamsEmergencyCallingPolicy"},"TeamsEmergencyCallRoutingPolicy":{"type":"string","description":"Name of the Teams Emergency Call Routing Policy.","title":"TeamsEmergencyCallRoutingPolicy"},"TeamsEnhancedEncryptionPolicy":{"type":"string","description":"Name of the Teams Enhanced Encryption Policy.","title":"TeamsEnhancedEncryptionPolicy"},"TeamsEventsPolicy":{"type":"string","description":"Name of the Teams Events Policy.","title":"TeamsEventsPolicy"},"TeamsMeetingBroadcastPolicy":{"type":"string","description":"Name of the Teams Meeting Broadcast Policy.","title":"TeamsMeetingBroadcastPolicy"},"TeamsMeetingPolicy":{"type":"string","description":"Name of the Teams Meeting Policy.","title":"TeamsMeetingPolicy"},"TeamsMessagingPolicy":{"type":"string","description":"Name of the Teams Messaging Policy.","title":"TeamsMessagingPolicy"},"TeamsMobilityPolicy":{"type":"string","description":"Name of the Teams Mobility Policy.","title":"TeamsMobilityPolicy"},"TeamsUpdateManagementPolicy":{"type":"string","description":"Name of the Teams Update Management Policy.","title":"TeamsUpdateManagementPolicy"},"TeamsUpgradePolicy":{"type":"string","description":"Name of the Teams Upgrade Policy.","title":"TeamsUpgradePolicy"},"TenantDialPlan":{"type":"string","description":"Name of the Tenant Dial Plan Policy.","title":"TenantDialPlan"}},"required":["User"]},"microsoft.teams.vdipolicy":{"type":"object","description":"This resource implements Teams VDI Policies.","title":"Schema for microsoft.teams.vdipolicy","properties":{"Identity":{"type":"string","description":"Unique identity of the VDI Policy.","title":"Identity"},"DisableAudioVideoInCallsAndMeetings":{"type":"boolean","description":"Disables Audio and Video in Calls and Meeting.","title":"DisableAudioVideoInCallsAndMeetings"},"DisableCallsAndMeetings":{"type":"boolean","description":"Disables Calls and Meetings.","title":"DisableCallsAndMeetings"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.voiceroute":{"type":"object","description":"This resource configures a Teams Voice Route.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/direct-routing-voice-routing","title":"Schema for microsoft.teams.voiceroute","properties":{"Identity":{"type":"string","description":"Identity of the Teams Voice Route.","title":"Identity"},"Description":{"type":"string","description":"A description of what this online voice route is for.","title":"Description"},"NumberPattern":{"type":"string","description":"A regular expression that specifies the phone numbers to which this route applies. Numbers matching this pattern will be routed according to the rest of the routing settings.","title":"NumberPattern"},"OnlinePstnGatewayList":{"type":"array","items":{"type":"string"},"description":"This parameter contains a list of online gateways associated with this online voice route.  Each member of this list must be the service Identity of the online PSTN gateway.","title":"OnlinePstnGatewayList"},"OnlinePstnUsages":{"type":"array","items":{"type":"string"},"description":"A list of online PSTN usages (such as Local, Long Distance, etc.) that can be applied to this online voice route. The PSTN usage must be an existing usage (PSTN usages can be retrieved by calling the Get-CsOnlinePstnUsage cmdlet).","title":"OnlinePstnUsages"},"Priority":{"type":"integer","description":"A number could resolve to multiple online voice routes. The priority determines the order in which the routes will be applied if more than one route is possible.","title":"Priority"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the route exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.voiceroutingpolicy":{"type":"object","description":"This resource configures a Teams Voice Routing Policy.\r\n\r\nMore information: https://docs.microsoft.com/en-us/microsoftteams/manage-voice-routing-policies","title":"Schema for microsoft.teams.voiceroutingpolicy","properties":{"Identity":{"type":"string","description":"Identity of the Teams Voice Routing Policy.","title":"Identity"},"OnlinePstnUsages":{"type":"array","items":{"type":"string"},"description":"A list of online PSTN usages (such as Local or Long Distance) that can be applied to this online voice routing policy. The online PSTN usage must be an existing usage (PSTN usages can be retrieved by calling the Get-CsOnlinePstnUsage cmdlet).","title":"OnlinePstnUsages"},"Description":{"type":"string","description":"Enables administrators to provide explanatory text to accompany an online voice routing policy. For example, the Description might include information about the users the policy should be assigned to.","title":"Description"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.workloadpolicy":{"type":"object","description":"This resources implements a Teams workload policy.","title":"Schema for microsoft.teams.workloadpolicy","properties":{"Identity":{"type":"string","description":"Unique identity for the Teams workload policy","title":"Identity"},"AllowCalling":{"type":"boolean","description":"Allows calling.","title":"AllowCalling"},"AllowCallingPinned":{"type":"boolean","description":"Allows pinning a call.","title":"AllowCallingPinned"},"AllowMeeting":{"type":"boolean","description":"Allows meetins.","title":"AllowMeeting"},"AllowMeetingPinned":{"type":"boolean","description":"Allows pinning meetings.","title":"AllowMeetingPinned"},"AllowMessaging":{"type":"boolean","description":"Allows messaging.","title":"AllowMessaging"},"AllowMessagingPinned":{"type":"boolean","description":"Allows pinning a message.","title":"AllowMessagingPinned"},"Description":{"type":"string","description":"Description of the policy.","title":"Description"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the instance exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity"]},"microsoft.teams.team":{"type":"object","description":"This resource configures or creates a new Team.","title":"Schema for microsoft.teams.team","properties":{"DisplayName":{"type":"string","description":"Display Name of the Team","title":"DisplayName"},"Description":{"type":"string","description":"Description of Team.","title":"Description"},"GroupID":{"type":"string","description":"Team group ID, only used to target a Team when duplicated display names occurs.","title":"GroupID"},"MailNickName":{"type":"string","description":"MailNickName of O365 Group associated with Team","title":"MailNickName"},"Owner":{"type":"array","items":{"type":"string"},"description":"Owners of the Team","title":"Owner"},"Visibility":{"enum":["Public","Private","HiddenMembership"],"description":"Visibility of the Team","title":"Visibility"},"AllowAddRemoveApps":{"type":"boolean","description":"Allow add or remove apps from the Team.","title":"AllowAddRemoveApps"},"AllowGiphy":{"type":"boolean","description":"Allow giphy in Team.","title":"AllowGiphy"},"GiphyContentRating":{"enum":["Strict","Moderate"],"description":"Giphy content rating of the Team.","title":"GiphyContentRating"},"AllowStickersAndMemes":{"type":"boolean","description":"Allow stickers and mimes in the Team.","title":"AllowStickersAndMemes"},"AllowCustomMemes":{"type":"boolean","description":"Allow custom memes in Team.","title":"AllowCustomMemes"},"AllowUserEditMessages":{"type":"boolean","description":"Allow members to edit messages within Team.","title":"AllowUserEditMessages"},"AllowUserDeleteMessages":{"type":"boolean","description":"Allow members to delete messages within Team.","title":"AllowUserDeleteMessages"},"AllowOwnerDeleteMessages":{"type":"boolean","description":"Allow owners to delete messages within Team.","title":"AllowOwnerDeleteMessages"},"AllowDeleteChannels":{"type":"boolean","description":"Allow members to delete channels within Team.","title":"AllowDeleteChannels"},"AllowCreateUpdateRemoveConnectors":{"type":"boolean","description":"Allow members to manage connectors within Team.","title":"AllowCreateUpdateRemoveConnectors"},"AllowCreateUpdateRemoveTabs":{"type":"boolean","description":"Allow members to manage tabs within Team.","title":"AllowCreateUpdateRemoveTabs"},"AllowTeamMentions":{"type":"boolean","description":"Allow mentions in Team.","title":"AllowTeamMentions"},"AllowChannelMentions":{"type":"boolean","description":"Allow channel mention in Team.","title":"AllowChannelMentions"},"AllowGuestCreateUpdateChannels":{"type":"boolean","description":"Allow guests to create and update channels in Team.","title":"AllowGuestCreateUpdateChannels"},"AllowGuestDeleteChannels":{"type":"boolean","description":"Allow guests to delete channel in Team.","title":"AllowGuestDeleteChannels"},"AllowCreateUpdateChannels":{"type":"boolean","description":"Allow members to create and update channels within Team.","title":"AllowCreateUpdateChannels"},"ShowInTeamsSearchAndSuggestions":{"type":"boolean","description":"determines whether or not private teams should be searchable from Teams clients for users who do not belong to that team.  Set to $false to make those teams not discoverable from Teams clients.","title":"ShowInTeamsSearchAndSuggestions"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the Team exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.accountprotectionlocaladministratorpasswordsolutionpolicy":{"type":"object","description":"This resource configures an Intune Account Protection Local Administrator Password Solution Policy.","title":"Schema for microsoft.intune.accountprotectionlocaladministratorpasswordsolutionpolicy","properties":{"Identity":{"type":"string","description":"Identity of the account protection local administrator password solution policy.","title":"Identity"},"DisplayName":{"type":"string","description":"Display name of the account protection local administrator password solution policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the account protection local administrator password solution policy.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Account Protection Local Administrator Password Solution Policy.","title":"Schema for MSFT_IntuneAccountProtectionLocalAdministratorPasswordSolutionPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the account protection local administrator password solution policy.","title":"Assignments"},"BackupDirectory":{"enum":[0,1,2],"description":"Configures which directory the local admin account password is backed up to. 0 - Disabled, 1 - Azure AD, 2 - AD","title":"BackupDirectory"},"PasswordAgeDays_AAD":{"type":"integer","description":"Configures the maximum password age of the managed local administrator account for Azure AD. Minimum - 7, Maximum - 365","title":"PasswordAgeDays_AAD"},"PasswordAgeDays":{"type":"integer","description":"Configures the maximum password age of the managed local administrator account for Active Directory. Minimum - 1, Maximum - 365","title":"PasswordAgeDays"},"PasswordExpirationProtectionEnabled":{"type":"boolean","description":"Configures additional enforcement of maximum password age for the managed local administrator account.","title":"PasswordExpirationProtectionEnabled"},"AdEncryptedPasswordHistorySize":{"type":"integer","description":"Configures how many previous encrypted passwords will be remembered in Active Directory. Minimum - 0, Maximum - 12","title":"AdEncryptedPasswordHistorySize"},"AdPasswordEncryptionEnabled":{"type":"boolean","description":"Configures whether the password is encrypted before being stored in Active Directory.","title":"AdPasswordEncryptionEnabled"},"AdPasswordEncryptionPrincipal":{"type":"string","description":"Configures the name or SID of a user or group that can decrypt the password stored in Active Directory.","title":"AdPasswordEncryptionPrincipal"},"AdministratorAccountName":{"type":"string","description":"Configures the name of the managed local administrator account.","title":"AdministratorAccountName"},"PasswordComplexity":{"enum":[1,2,3,4,5],"description":"Configures the password complexity of the managed local administrator account. 1 - Large letters, 2 - Large + small letters, 3 - Large + small letters + numbers, 4 - Large + small letters + numbers + special characters, 5 - Large letters + small letters + numbers + special characters (improved readability)","title":"PasswordComplexity"},"PasswordLength":{"type":"integer","description":"Configures the length of the password of the managed local administrator account. Minimum - 8, Maximum - 64","title":"PasswordLength"},"PostAuthenticationActions":{"enum":[1,3,5],"description":"Specifies the actions to take upon expiration of the configured grace period. 1 - Reset password, 3 - Reset password and log off, 5 - Reset password and restart","title":"PostAuthenticationActions"},"PostAuthenticationResetDelay":{"type":"integer","description":"Specifies the amount of time (in hours) to wait after an authentication before executing the specified post-authentication actions. Minimum - 0, Maximum - 24","title":"PostAuthenticationResetDelay"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.accountprotectionlocalusergroupmembershippolicy":{"type":"object","description":"This resource configures a Intune Account Protection Local User Group Membership policy.","title":"Schema for microsoft.intune.accountprotectionlocalusergroupmembershippolicy","properties":{"Identity":{"type":"string","description":"Identity of the account protection policy.","title":"Identity"},"DisplayName":{"type":"string","description":"Display name of the account protection rules policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the account protection rules policy.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures a Intune Account Protection Local User Group Membership policy.","title":"Schema for MSFT_IntuneAccountProtectionLocalUserGroupMembershipPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the Intune Policy.","title":"Assignments"},"LocalUserGroupCollection":{"type":"array","items":{"type":"object","description":"This resource configures a Intune Account Protection Local User Group Membership policy.","title":"Schema for MSFT_IntuneAccountProtectionLocalUserGroupCollection","properties":{"Action":{"enum":["add_update","remove_update","add_replace"],"description":"The action to use for adding / removing members.","title":"Action"},"LocalGroups":{"type":"array","items":{"type":"string"},"description":"The local groups to add / remove the members to / from. List of the following values: `administrators`, `users`, `guests`, `powerusers`, `remotedesktopusers`, `remotemanagementusers`","title":"LocalGroups"},"Members":{"type":"array","items":{"type":"string"},"description":"The members to add / remove to / from the group. For AzureAD Users, use the format `AzureAD\\\\<UserPrincipalName>`. For groups, use the security identifier (SID).","title":"Members"},"UserSelectionType":{"enum":["users","manual"],"description":"The type of the selection. Either users / groups from AzureAD, or by manual identifier.","title":"UserSelectionType"}},"required":[]},"description":"Local User Group Collections of the Intune Policy.","title":"LocalUserGroupCollection"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the site collection exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.accountprotectionpolicy":{"type":"object","description":"This resource configures a Intune Account Protection policy.","title":"Schema for microsoft.intune.accountprotectionpolicy","properties":{"Identity":{"type":"string","description":"Identity of the account protection policy.","title":"Identity"},"DisplayName":{"type":"string","description":"Display name of the account protection rules policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the account protection rules policy.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures a Intune Account Protection policy.","title":"Schema for MSFT_IntuneAccountProtectionPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the Intune Policy.","title":"Assignments"},"WindowsHelloForBusinessBlocked":{"enum":["notConfigured","true","false"],"description":"Block Windows Hello for Business.","title":"WindowsHelloForBusinessBlocked"},"PinMinimumLength":{"type":"integer","description":"Minimum PIN length must be between 4 and 127. (4-127)","title":"PinMinimumLength"},"PinMaximumLength":{"type":"integer","description":"Maximum PIN length must be between 4 and 127. (4-127)","title":"PinMaximumLength"},"PinLowercaseCharactersUsage":{"enum":["notConfigured","blocked","required","allowed"],"description":"If required, user PIN must include at least one lowercase letter.","title":"PinLowercaseCharactersUsage"},"PinUppercaseCharactersUsage":{"enum":["notConfigured","blocked","required","allowed"],"description":"If required, user PIN must include at least one uppercase letter.","title":"PinUppercaseCharactersUsage"},"PinSpecialCharactersUsage":{"enum":["notConfigured","blocked","required","allowed"],"description":"If required, user PIN must include at least one special character.","title":"PinSpecialCharactersUsage"},"PinExpirationInDays":{"type":"integer","description":"If configured, the user will be forced to change their PIN after the set number of days. (0, 730), 0 = Never","title":"PinExpirationInDays"},"PinPreviousBlockCount":{"type":"integer","description":"If configured, the user will not be able to reuse this number of previous PINs. (0, 50), 0 = Do not remember.","title":"PinPreviousBlockCount"},"PinRecoveryEnabled":{"type":"boolean","description":"If enabled, the PIN recovery secret will be stored on the device and the user can change their PIN if needed. If disabled or not configured, the recovery secret will not be created or stored.","title":"PinRecoveryEnabled"},"SecurityDeviceRequired":{"type":"boolean","description":"If you enable this policy setting, only devices with a usable TPM provision Windows Hello for Business. If you disable or do not configure this policy setting, the TPM is still preferred, but all devices provision Windows Hello for Business.","title":"SecurityDeviceRequired"},"UnlockWithBiometricsEnabled":{"type":"boolean","description":"If allowed, Windows Hello for Business can authenticate using gestures, such as face and fingerprint. Users must still configure a PIN in case of failure.","title":"UnlockWithBiometricsEnabled"},"EnhancedAntiSpoofingForFacialFeaturesEnabled":{"type":"boolean","description":"If enabled, devices will use enhanced anti-spoofing, when available. If not configured, the client configuration for anti-spoofing will be honored.","title":"EnhancedAntiSpoofingForFacialFeaturesEnabled"},"UseCertificatesForOnPremisesAuthEnabled":{"type":"boolean","description":"If configured, Windows Hello for Business can use certificates to authenticate to on-premise resources.","title":"UseCertificatesForOnPremisesAuthEnabled"},"UseSecurityKeyForSignin":{"type":"boolean","description":"Enable Windows Hello security key as a logon credential for all PCs in the tenant.","title":"UseSecurityKeyForSignin"},"DeviceGuardLocalSystemAuthorityCredentialGuardSettings":{"enum":["notConfigured","disable","enableWithUEFILock","enableWithoutUEFILock"],"description":"Setting this Disable will disable the use of Credential Guard, which is the Windows default. Setting this to Enable with UEFI lock will enable Credential Guard and not allow it to be disabled remotely, as the UEFI persisted configuration must be manually cleared. Setting this to Enable without UEFI lock will enable Credential Guard and allow it to be turned off without physical access to the machine.","title":"DeviceGuardLocalSystemAuthorityCredentialGuardSettings"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the site collection exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.antiviruspolicywindows10settingcatalog":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for microsoft.intune.antiviruspolicywindows10settingcatalog","properties":{"DisplayName":{"type":"string","description":"Display name of the endpoint protection policy for Windows 10.","title":"DisplayName"},"Identity":{"type":"string","description":"Identity of the endpoint protection policy for Windows 10.","title":"Identity"},"Description":{"type":"string","description":"Description of the endpoint protection policy for Windows 10.","title":"Description"},"tamperprotection":{"enum":["0","1"],"description":"Allows or disallows scanning of archives. (0: enable feature. 1: disable feature)","title":"tamperprotection"},"disableaccountprotectionui":{"enum":["0","1"],"description":"Use this policy setting to specify if to display the Account protection area in Windows Defender Security Center. (0: disable feature. 1: enable feature)","title":"disableaccountprotectionui"},"disableappbrowserui":{"enum":["0","1"],"description":"Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. (0: disable feature. 1: enable feature)","title":"disableappbrowserui"},"disablecleartpmbutton":{"enum":["0","1"],"description":"Disable the Clear TPM button in Windows Security. (0: disable feature. 1: enable feature)","title":"disablecleartpmbutton"},"disabledevicesecurityui":{"enum":["0","1"],"description":"Use this policy setting if you want to disable the display of the Device security area in the Windows Defender Security Center. (0: disable feature. 1: enable feature)","title":"disabledevicesecurityui"},"disablefamilyui":{"enum":["0","1"],"description":"Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. (0: disable feature. 1: enable feature)","title":"disablefamilyui"},"disablehealthui":{"enum":["0","1"],"description":"Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. (0: disable feature. 1: enable feature)","title":"disablehealthui"},"disablenetworkui":{"enum":["0","1"],"description":"Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. (0: disable feature. 1: enable feature)","title":"disablenetworkui"},"disableenhancednotifications":{"enum":["0","1"],"description":"Use this policy setting if you want to disable the display of Windows Defender Security Center notifications. (0: disable feature. 1: enable feature)","title":"disableenhancednotifications"},"disabletpmfirmwareupdatewarning":{"enum":["0","1"],"description":"Hide the recommendation to update TPM Firmware when a vulnerable firmware is detected. (0: disable feature. 1: enable feature)","title":"disabletpmfirmwareupdatewarning"},"disablevirusui":{"enum":["0","1"],"description":"Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center.  (0: disable feature. 1: enable feature)","title":"disablevirusui"},"hideransomwaredatarecovery":{"enum":["0","1"],"description":"Use this policy setting to hide the Ransomware data recovery area in Windows Defender Security Center. (0: disable feature. 1: enable feature)","title":"hideransomwaredatarecovery"},"hidewindowssecuritynotificationareacontrol":{"enum":["0","1"],"description":"This policy setting hides the Windows Security notification area control. (0: disable feature. 1: enable feature)","title":"hidewindowssecuritynotificationareacontrol"},"enablecustomizedtoasts":{"enum":["0","1"],"description":"Enable this policy to display your company name and contact options in the notifications. (0: disable feature. 1: enable feature)","title":"enablecustomizedtoasts"},"enableinappcustomization":{"enum":["0","1"],"description":"Enable this policy to have your company name and contact options displayed in a contact card fly out in Windows Defender Security Center. (0: disable feature. 1: enable feature)","title":"enableinappcustomization"},"companyname":{"type":"string","description":"The company name that is displayed to the users. CompanyName is required for both EnableCustomizedToasts and EnableInAppCustomization.","title":"companyname"},"email":{"type":"string","description":"The email address that is displayed to users. The default mail application is used to initiate email actions.","title":"email"},"phone":{"type":"string","description":"The phone number or Skype ID that is displayed to users. Skype is used to initiate the call.","title":"phone"},"url":{"type":"string","description":"The help portal URL that is displayed to users. The default browser is used to initiate this action.","title":"url"},"allowarchivescanning":{"enum":["0","1"],"description":"Allows or disallows scanning of archives. (0: disable feature. 1: enable feature)","title":"allowarchivescanning"},"allowbehaviormonitoring":{"enum":["0","1"],"description":"Allows or disallows Windows Defender Behavior Monitoring functionality. (0: disable feature. 1: enable feature)","title":"allowbehaviormonitoring"},"allowcloudprotection":{"enum":["0","1"],"description":"To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. (0: disable feature. 1: enable feature)","title":"allowcloudprotection"},"allowdatagramprocessingonwinserver":{"enum":["0","1"],"description":"Allows or disallows Network Protection to enable datagram processing on Windows Server. (0: disable feature. 1: enable feature)","title":"allowdatagramprocessingonwinserver"},"allowemailscanning":{"enum":["0","1"],"description":"Allows or disallows scanning of email. (0: disable feature. 1: enable feature)","title":"allowemailscanning"},"allowfullscanonmappednetworkdrives":{"enum":["0","1"],"description":"Allows or disallows a full scan of mapped network drives. (0: disable feature. 1: enable feature)","title":"allowfullscanonmappednetworkdrives"},"allowfullscanremovabledrivescanning":{"enum":["0","1"],"description":"Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned. (0: disable feature. 1: enable feature)","title":"allowfullscanremovabledrivescanning"},"allowintrusionpreventionsystem":{"enum":["0","1"],"description":"https://github.com/MicrosoftDocs/memdocs/issues/2250 (0: disable feature. 1: enable feature)","title":"allowintrusionpreventionsystem"},"allowioavprotection":{"enum":["0","1"],"description":"Allows or disallows Windows Defender IOAVP Protection functionality. (0: disable feature. 1: enable feature)","title":"allowioavprotection"},"allownetworkprotectiondownlevel":{"enum":["0","1"],"description":"Allows or disallows Network Protection to be configured into block or audit mode on windows downlevel of RS3. (0: disable feature. 1: enable feature)","title":"allownetworkprotectiondownlevel"},"allowrealtimemonitoring":{"enum":["0","1"],"description":"Allows or disallows Windows Defender real-time Monitoring functionality. (0: disable feature. 1: enable feature)","title":"allowrealtimemonitoring"},"allowscanningnetworkfiles":{"enum":["0","1"],"description":"Allows or disallows a scanning of network files. (0: disable feature. 1: enable feature)","title":"allowscanningnetworkfiles"},"allowscriptscanning":{"enum":["0","1"],"description":"Allows or disallows Windows Defender Script Scanning functionality. (0: disable feature. 1: enable feature)","title":"allowscriptscanning"},"allowuseruiaccess":{"enum":["0","1"],"description":"Allows or disallows user access to the Windows Defender UI. I disallowed, all Windows Defender notifications will also be suppressed. (0: Prevents users from accessing UI. 1: Lets users access UI)","title":"allowuseruiaccess"},"avgcpuloadfactor":{"type":"integer","description":"Represents the average CPU load factor for the Windows Defender scan (in percent).","title":"avgcpuloadfactor"},"archivemaxdepth":{"type":"integer","description":"Specify the maximum folder depth to extract from archive files for scanning.","title":"archivemaxdepth"},"archivemaxsize":{"type":"integer","description":"Specify the maximum size, in KB, of archive files to be extracted and scanned.","title":"archivemaxsize"},"checkforsignaturesbeforerunningscan":{"enum":["0","1"],"description":"This policy setting allows you to manage whether a check for new virus and spyware definitions will occur before running a scan. (0: disable feature. 1: enable feature)","title":"checkforsignaturesbeforerunningscan"},"cloudblocklevel":{"enum":["0","2","4","6"],"description":"This policy setting determines how aggressive Microsoft Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer.(0: Default windows defender blocking level, 2: High blocking level, 4:High+ blocking level, 6:Zero tolerance blocking level)","title":"cloudblocklevel"},"cloudextendedtimeout":{"type":"integer","description":"This feature allows Microsoft Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50.","title":"cloudextendedtimeout"},"daystoretaincleanedmalware":{"type":"integer","description":"Time period (in days) that quarantine items will be stored on the system.","title":"daystoretaincleanedmalware"},"disablecatchupfullscan":{"enum":["0","1"],"description":"This policy setting allows you to configure catch-up scans for scheduled full scans.  (1: disabled, 0: enabled)","title":"disablecatchupfullscan"},"disablecatchupquickscan":{"enum":["0","1"],"description":"This policy setting allows you to configure catch-up scans for scheduled quick scans.  (1: disabled, 0: enabled)","title":"disablecatchupquickscan"},"disablednsovertcpparsing":{"enum":["0","1"],"description":"Disables or enables DNS over TCP Parsing for Network Protection. (0: enable feature. 1: disable feature)","title":"disablednsovertcpparsing"},"disablehttpparsing":{"enum":["0","1"],"description":"Disables or enables HTTP Parsing for Network Protection. (0: enable feature. 1: disable feature)","title":"disablehttpparsing"},"DisableSshParsing":{"enum":["1","0"],"description":"Disable Ssh Parsing (1: SSH parsing is disabled, 0: SSH parsing is enabled)","title":"DisableSshParsing"},"enablelowcpupriority":{"enum":["0","1"],"description":"This policy setting allows you to enable or disable low CPU priority for scheduled scans. (0: disable feature. 1: enable feature)","title":"enablelowcpupriority"},"enablenetworkprotection":{"enum":["0","1","2"],"description":"This policy allows you to turn on network protection (block/audit) or off. (0: disabled, 1: block mode, 2: audit mode)","title":"enablenetworkprotection"},"excludedextensions":{"type":"array","items":{"type":"string"},"description":"Allows an administrator to specify a list of file type extensions to ignore during a scan.","title":"excludedextensions"},"excludedpaths":{"type":"array","items":{"type":"string"},"description":"Allows an administrator to specify a list of directory paths to ignore during a scan.","title":"excludedpaths"},"excludedprocesses":{"type":"array","items":{"type":"string"},"description":"Allows an administrator to specify a list of files opened by processes to ignore during a scan.","title":"excludedprocesses"},"puaprotection":{"enum":["0","1","2"],"description":"Specifies the level of detection for potentially unwanted applications (PUAs). (0: disabled, 1: block mode, 2: audit mode)","title":"puaprotection"},"engineupdateschannel":{"enum":["0","2","3","4","5","6"],"description":"Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. (0: Not configured, 2: Beta Channel, 3: Current Channel (Preview), 4: Current Channel (Staged), 5: Current Channel (Broad), 6: Critical)","title":"engineupdateschannel"},"meteredconnectionupdates":{"type":"string","description":"Allow managed devices to update through metered connections. (0: disabled, 1: enabled)","title":"meteredconnectionupdates"},"platformupdateschannel":{"enum":["0","2","3","4","5","6"],"description":"Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout. (0: Not configured, 2: Beta Channel, 3: Current Channel (Preview), 4: Current Channel (Staged), 5: Current Channel (Broad), 6: Critical)","title":"platformupdateschannel"},"securityintelligenceupdateschannel":{"enum":["0","4","5"],"description":"Enable this policy to specify when devices receive Microsoft Defender security intelligence updates during the daily gradual rollout. (0: Not configured, 4: Current Channel (Staged), 5: Current Channel (Broad))","title":"securityintelligenceupdateschannel"},"realtimescandirection":{"enum":["0","1","2"],"description":"Controls which sets of files should be monitored. (0: Monitor all files (bi-directional), 1: Monitor incoming files, 2: Monitor outgoing files)","title":"realtimescandirection"},"scanparameter":{"enum":["1","2"],"description":"Selects whether to perform a quick scan or full scan. (1: Quick scan, 2: Full scan)","title":"scanparameter"},"schedulequickscantime":{"type":"integer","description":"Selects the time of day that the Windows Defender quick scan should run.","title":"schedulequickscantime"},"schedulescanday":{"enum":["0","1","2","3","4","5","6","7","8"],"description":"Selects the day that the Windows Defender scan should run. (0: Every day, 1: Sunday, 2: Monday, 3: Tuesday, 4: Wednesday, 5: Thursday, 6: Friday, 7: Saturday, 8: No scheduled scan)","title":"schedulescanday"},"schedulescantime":{"type":"integer","description":"Selects the time of day that the Windows Defender scan should run. Must be between 0 and 1380 minutes.","title":"schedulescantime"},"disabletlsparsing":{"enum":["0","1"],"description":"This setting disables TLS Parsing for Network Protection. (0: enabled, 1: disabled)","title":"disabletlsparsing"},"randomizescheduletasktimes":{"enum":["0","1"],"description":"Specifies if the start time of the scan is randomized. (0: no randomization, 1: randomized)","title":"randomizescheduletasktimes"},"schedulerrandomizationtime":{"type":"integer","description":"This setting allows you to configure the scheduler randomization in hours. The randomization interval is [1 - 23] hours.","title":"schedulerrandomizationtime"},"signatureupdatefallbackorder":{"type":"array","items":{"type":"string"},"description":"This policy setting allows you to define the order in which different definition update sources should be contacted.","title":"signatureupdatefallbackorder"},"signatureupdatefilesharessources":{"type":"array","items":{"type":"string"},"description":"This policy setting allows you to configure UNC file share sources for downloading definition updates.","title":"signatureupdatefilesharessources"},"signatureupdateinterval":{"type":"integer","description":"Specifies the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. Must be between 0 and 24 hours.","title":"signatureupdateinterval"},"submitsamplesconsent":{"enum":["0","1","2","3"],"description":"Checks for the user consent level in Windows Defender to send data. (0: Always prompt, 1: Send safe samples automatically, 2: Never send, 3: Send all samples automatically)","title":"submitsamplesconsent"},"disablelocaladminmerge":{"enum":["0","1"],"description":"This policy setting controls whether or not complex list settings configured by a local administrator are merged with managed settings. (0: enable local admin merge, 1: disable local admin merge)","title":"disablelocaladminmerge"},"allowonaccessprotection":{"enum":["0","1"],"description":"Allows or disallows Windows Defender On Access Protection functionality. (0: disable feature. 1: enable feature)","title":"allowonaccessprotection"},"lowseveritythreats":{"enum":["clean","quarantine","remove","allow","userdefined","block"],"description":"Allows an administrator to specify low severity threats corresponding action ID to take.","title":"lowseveritythreats"},"moderateseveritythreats":{"enum":["clean","quarantine","remove","allow","userdefined","block"],"description":"Allows an administrator to specify moderate severity threats corresponding action ID to take.","title":"moderateseveritythreats"},"severethreats":{"enum":["clean","quarantine","remove","allow","userdefined","block"],"description":"Allows an administrator to specify high severity threats corresponding action ID to take.","title":"severethreats"},"highseveritythreats":{"enum":["clean","quarantine","remove","allow","userdefined","block"],"description":"Allows an administrator to specify severe threats corresponding action ID to take.","title":"highseveritythreats"},"templateId":{"enum":["d948ff9b-99cb-4ee0-8012-1fbc09685377_1","e3f74c5a-a6de-411d-aef6-eb15628f3a0a_1","45fea5e9-280d-4da1-9792-fb5736da0ca9_1","804339ad-1553-4478-a742-138fb5807418_1"],"description":"Template Id of the policy. 0: Windows Security Experience, 1: Defender Update controls, 2: Microsoft Defender Antivirus exclusions, 3: Microsoft Defender Antivirus","title":"templateId"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.appconfigurationpolicy":{"type":"object","description":"This resource configures the Intune App configuration policies.","title":"Schema for microsoft.intune.appconfigurationpolicy","properties":{"Id":{"type":"string","description":"Key of the entity. Read-Only.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the app configuration policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the app configuration policy.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the Intune Policy.","title":"Assignments"},"CustomSettings":{"type":"array","items":{"type":"object","description":"This resource configures the Intune App configuration policies.","title":"Schema for MSFT_IntuneAppConfigurationPolicyCustomSetting","properties":{"name":{"type":"string","description":"Name of the custom setting.","title":"name"},"value":{"type":"string","description":"Value of the custom setting.","title":"value"}},"required":[]},"description":"Custom settings for the app configuration policy.","title":"CustomSettings"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.applicationcontrolpolicywindows10":{"type":"object","description":"This resource configures a Intune Endpoint Protection Application Control policy for an Windows 10 Device.","title":"Schema for microsoft.intune.applicationcontrolpolicywindows10","properties":{"DisplayName":{"type":"string","description":"Display name of the endpoint protection application control policy for Windows 10.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the endpoint protection application control policy for Windows 10.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the Intune Policy.","title":"Assignments"},"AppLockerApplicationControl":{"enum":["notConfigured","enforceComponentsAndStoreApps","auditComponentsAndStoreApps","enforceComponentsStoreAppsAndSmartlocker","auditComponentsStoreAppsAndSmartlocker"],"description":"App locker application control mode","title":"AppLockerApplicationControl"},"SmartScreenBlockOverrideForFiles":{"type":"boolean","description":"Indicates whether or not SmartScreen will not present an option for the user to disregard the warning and run the app.","title":"SmartScreenBlockOverrideForFiles"},"SmartScreenEnableInshell":{"type":"boolean","description":"Enforce the use of SmartScreen for all users.","title":"SmartScreenEnableInshell"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the site collection exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.appprotectionpolicyandroid":{"type":"object","description":"This resource configures an Intune app protection policy for an Android Device.","title":"Schema for microsoft.intune.appprotectionpolicyandroid","properties":{"DisplayName":{"type":"string","description":"Display name of the Android App Protection Policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Android App Protection Policy.","title":"Description"},"PeriodOfflineBeforeAccessCheck":{"type":"string","description":"The period after which access is checked when the device is not connected to the internet.","title":"PeriodOfflineBeforeAccessCheck"},"PeriodOnlineBeforeAccessCheck":{"type":"string","description":"The period after which access is checked when the device is connected to the internet.","title":"PeriodOnlineBeforeAccessCheck"},"AllowedInboundDataTransferSources":{"enum":["allApps","managedApps","none"],"description":"Sources from which data is allowed to be transferred. Possible values are: allApps, managedApps, none.","title":"AllowedInboundDataTransferSources"},"AllowedOutboundDataTransferDestinations":{"enum":["allApps","managedApps","none"],"description":"Destinations to which data is allowed to be transferred. Possible values are: allApps, managedApps, none.","title":"AllowedOutboundDataTransferDestinations"},"OrganizationalCredentialsRequired":{"type":"boolean","description":"Indicates whether organizational credentials are required for app use.","title":"OrganizationalCredentialsRequired"},"AllowedOutboundClipboardSharingLevel":{"enum":["allApps","managedAppsWithPasteIn","managedApps","blocked"],"description":"The level to which the clipboard may be shared between apps on the managed device. Possible values are: allApps, managedAppsWithPasteIn, managedApps, blocked.","title":"AllowedOutboundClipboardSharingLevel"},"DataBackupBlocked":{"type":"boolean","description":"Indicates whether the backup of a managed app's data is blocked.","title":"DataBackupBlocked"},"DeviceComplianceRequired":{"type":"boolean","description":"Indicates whether device compliance is required.","title":"DeviceComplianceRequired"},"ManagedBrowserToOpenLinksRequired":{"type":"boolean","description":"Indicates whether internet links should be opened in the managed browser app, or any custom browser specified by CustomBrowserProtocol (for Android) or CustomBrowserPackageId/CustomBrowserDisplayName (for Android).","title":"ManagedBrowserToOpenLinksRequired"},"SaveAsBlocked":{"type":"boolean","description":"Indicates whether users may use the Save As menu item to save a copy of protected files.","title":"SaveAsBlocked"},"PeriodOfflineBeforeWipeIsEnforced":{"type":"string","description":"The amount of time an app is allowed to remain disconnected from the internet before all managed data it is wiped.","title":"PeriodOfflineBeforeWipeIsEnforced"},"PinRequired":{"type":"boolean","description":"Indicates whether an app-level pin is required.","title":"PinRequired"},"DisableAppPinIfDevicePinIsSet":{"type":"boolean","description":"Indicates whether use of the app pin is required if the device pin is set.","title":"DisableAppPinIfDevicePinIsSet"},"MaximumPinRetries":{"type":"integer","description":"Maximum number of incorrect pin retry attempts before the managed app is either blocked or wiped.","title":"MaximumPinRetries"},"SimplePinBlocked":{"type":"boolean","description":"Block simple PIN and require complex PIN to be set.","title":"SimplePinBlocked"},"MinimumPinLength":{"type":"integer","description":"Minimum pin length required for an app-level pin if PinRequired is set to True.","title":"MinimumPinLength"},"PinCharacterSet":{"enum":["numeric","alphanumericAndSymbol"],"description":"Character set which may be used for an app-level pin if PinRequired is set to True. Possible values are: numeric, alphanumericAndSymbol.","title":"PinCharacterSet"},"AllowedDataStorageLocations":{"type":"array","items":{"type":"string"},"description":"Data storage locations where a user may store managed data.","title":"AllowedDataStorageLocations"},"ContactSyncBlocked":{"type":"boolean","description":"Indicates whether contacts can be synced to the user's device.","title":"ContactSyncBlocked"},"PeriodBeforePinReset":{"type":"string","description":"TimePeriod before the all-level pin must be reset if PinRequired is set to True.","title":"PeriodBeforePinReset"},"PrintBlocked":{"type":"boolean","description":"Indicates whether printing is allowed from managed apps.","title":"PrintBlocked"},"RequireClass3Biometrics":{"type":"boolean","description":"Require user to apply Class 3 Biometrics on their Android device.","title":"RequireClass3Biometrics"},"RequirePinAfterBiometricChange":{"type":"boolean","description":"A PIN prompt will override biometric prompts if class 3 biometrics are updated on the device.","title":"RequirePinAfterBiometricChange"},"FingerprintBlocked":{"type":"boolean","description":"Indicates whether use of the fingerprint reader is allowed in place of a pin if PinRequired is set to True.","title":"FingerprintBlocked"},"Apps":{"type":"array","items":{"type":"string"},"description":"List of IDs representing the Android apps controlled by this protection policy.","title":"Apps"},"Assignments":{"type":"array","items":{"type":"string"},"description":"List of IDs of the groups assigned to this Android Protection Policy.","title":"Assignments"},"ExcludedGroups":{"type":"array","items":{"type":"string"},"description":"List of IDs of the groups that are excluded from this Android Protection Policy.","title":"ExcludedGroups"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"},"ManagedBrowser":{"enum":["notConfigured","microsoftEdge"],"description":"Indicates in which managed browser(s) that internet links should be opened. Used in conjunction with CustomBrowserPackageId, CustomBrowserDisplayName and ManagedBrowserToOpenLinksRequired. Possible values are: notConfigured, microsoftEdge.","title":"ManagedBrowser"},"MinimumRequiredAppVersion":{"type":"string","description":"Versions less than the specified version will block the managed app from accessing company data.","title":"MinimumRequiredAppVersion"},"MinimumRequiredOSVersion":{"type":"string","description":"Versions less than the specified version will block the managed app from accessing company data.","title":"MinimumRequiredOSVersion"},"MinimumRequiredPatchVersion":{"type":"string","description":"Versions less than the specified version will block the managed app from accessing company data.","title":"MinimumRequiredPatchVersion"},"MinimumWarningAppVersion":{"type":"string","description":"Versions less than the specified version will result in warning message on the managed app","title":"MinimumWarningAppVersion"},"MinimumWarningOSVersion":{"type":"string","description":"Versions less than the specified version will result in warning message on the managed app","title":"MinimumWarningOSVersion"},"MinimumWarningPatchVersion":{"type":"string","description":"Versions less than the specified version will result in warning message on the managed app","title":"MinimumWarningPatchVersion"},"AppGroupType":{"enum":["allApps","allMicrosoftApps","allCoreMicrosoftApps","selectedPublicApps"],"description":"The apps controlled by this protection policy, overrides any values in Apps unless this value is 'selectedPublicApps'.","title":"AppGroupType"},"IsAssigned":{"type":"boolean","description":"Indicates if the policy is deployed to any inclusion groups or not. Inherited from targetedManagedAppProtection.","title":"IsAssigned"},"ScreenCaptureBlocked":{"type":"boolean","description":"Indicates whether or not to Block the user from taking Screenshots.","title":"ScreenCaptureBlocked"},"EncryptAppData":{"type":"boolean","description":"Indicates whether or not the 'Encrypt org data' value is enabled.  True = require","title":"EncryptAppData"},"DisableAppEncryptionIfDeviceEncryptionIsEnabled":{"type":"boolean","description":"Indicates whether or not the 'Encrypt org data on enrolled devices' value is enabled.  False = require.  Only functions if EncryptAppData is set to True","title":"DisableAppEncryptionIfDeviceEncryptionIsEnabled"},"CustomBrowserDisplayName":{"type":"string","description":"The application name for browser associated with the 'Unmanaged Browser ID'. This name will be displayed to users if the specified browser is not installed.","title":"CustomBrowserDisplayName"},"CustomBrowserPackageId":{"type":"string","description":"The application ID for a single browser. Web content (http/s) from policy managed applications will open in the specified browser.","title":"CustomBrowserPackageId"},"Id":{"type":"string","description":"Id of the Intune policy. To avoid creation of duplicate policies DisplayName will be searched for if the ID is not found","title":"Id"}},"required":["DisplayName"]},"microsoft.intune.appprotectionpolicyios":{"type":"object","description":"This resource configures an Intune app protection policy for an iOS Device.","title":"Schema for microsoft.intune.appprotectionpolicyios","properties":{"DisplayName":{"type":"string","description":"Display name of the iOS App Protection Policy.","title":"DisplayName"},"Identity":{"type":"string","description":"Identity of the iOS App Protection Policy.","title":"Identity"},"Description":{"type":"string","description":"Description of the iOS App Protection Policy.","title":"Description"},"PeriodOfflineBeforeAccessCheck":{"type":"string","description":"The period after which access is checked when the device is not connected to the internet.","title":"PeriodOfflineBeforeAccessCheck"},"PeriodOnlineBeforeAccessCheck":{"type":"string","description":"The period after which access is checked when the device is connected to the internet.","title":"PeriodOnlineBeforeAccessCheck"},"AllowedInboundDataTransferSources":{"enum":["allApps","managedApps","none"],"description":"Sources from which data is allowed to be transferred. Possible values are: allApps, managedApps, none.","title":"AllowedInboundDataTransferSources"},"AllowedOutboundDataTransferDestinations":{"enum":["allApps","managedApps","none"],"description":"Destinations to which data is allowed to be transferred. Possible values are: allApps, managedApps, none.","title":"AllowedOutboundDataTransferDestinations"},"OrganizationalCredentialsRequired":{"type":"boolean","description":"Indicates whether organizational credentials are required for app use.","title":"OrganizationalCredentialsRequired"},"AllowedOutboundClipboardSharingLevel":{"enum":["allApps","managedAppsWithPasteIn","managedApps","blocked"],"description":"The level to which the clipboard may be shared between apps on the managed device. Possible values are: allApps, managedAppsWithPasteIn, managedApps, blocked.","title":"AllowedOutboundClipboardSharingLevel"},"DataBackupBlocked":{"type":"boolean","description":"Indicates whether the backup of a managed app's data is blocked.","title":"DataBackupBlocked"},"DeviceComplianceRequired":{"type":"boolean","description":"Indicates whether device compliance is required.","title":"DeviceComplianceRequired"},"ManagedBrowserToOpenLinksRequired":{"type":"boolean","description":"Indicates whether internet links should be opened in the managed browser app, or any custom browser specified by CustomBrowserProtocol (for iOS) or CustomBrowserPackageId/CustomBrowserDisplayName (for Android).","title":"ManagedBrowserToOpenLinksRequired"},"SaveAsBlocked":{"type":"boolean","description":"Indicates whether users may use the Save As menu item to save a copy of protected files.","title":"SaveAsBlocked"},"PeriodOfflineBeforeWipeIsEnforced":{"type":"string","description":"The amount of time an app is allowed to remain disconnected from the internet before all managed data it is wiped.","title":"PeriodOfflineBeforeWipeIsEnforced"},"PinRequired":{"type":"boolean","description":"Indicates whether an app-level pin is required.","title":"PinRequired"},"DisableAppPinIfDevicePinIsSet":{"type":"boolean","description":"Indicates whether use of the app pin is required if the device pin is set.","title":"DisableAppPinIfDevicePinIsSet"},"MaximumPinRetries":{"type":"integer","description":"Maximum number of incorrect pin retry attempts before the managed app is either blocked or wiped.","title":"MaximumPinRetries"},"SimplePinBlocked":{"type":"boolean","description":"Block simple PIN and require complex PIN to be set.","title":"SimplePinBlocked"},"MinimumPinLength":{"type":"integer","description":"Minimum pin length required for an app-level pin if PinRequired is set to True.","title":"MinimumPinLength"},"PinCharacterSet":{"enum":["numeric","alphanumericAndSymbol"],"description":"Character set which may be used for an app-level pin if PinRequired is set to True. Possible values are: numeric, alphanumericAndSymbol.","title":"PinCharacterSet"},"AllowedDataStorageLocations":{"type":"array","items":{"type":"string"},"description":"Data storage locations where a user may store managed data.","title":"AllowedDataStorageLocations"},"ContactSyncBlocked":{"type":"boolean","description":"Indicates whether contacts can be synced to the user's device.","title":"ContactSyncBlocked"},"PeriodBeforePinReset":{"type":"string","description":"TimePeriod before the all-level pin must be reset if PinRequired is set to True.","title":"PeriodBeforePinReset"},"PrintBlocked":{"type":"boolean","description":"Indicates whether printing is allowed from managed apps.","title":"PrintBlocked"},"FingerprintBlocked":{"type":"boolean","description":"Indicates whether use of the fingerprint reader is allowed in place of a pin if PinRequired is set to True.","title":"FingerprintBlocked"},"FaceIdBlocked":{"type":"boolean","description":"Indicates whether use of the FaceID is allowed in place of a pin if PinRequired is set to True.","title":"FaceIdBlocked"},"ManagedBrowser":{"enum":["notConfigured","microsoftEdge"],"description":"Indicates in which managed browser(s) that internet links should be opened. When this property is configured, ManagedBrowserToOpenLinksRequired should be true. Possible values are: notConfigured, microsoftEdge.","title":"ManagedBrowser"},"MinimumRequiredAppVersion":{"type":"string","description":"Versions less than the specified version will block the managed app from accessing company data.","title":"MinimumRequiredAppVersion"},"MinimumWarningAppVersion":{"type":"string","description":"Versions less than the specified version will result in warning message on the managed app from accessing company data.","title":"MinimumWarningAppVersion"},"MinimumRequiredOSVersion":{"type":"string","description":"Versions less than the specified version will block the managed app from accessing company data.","title":"MinimumRequiredOSVersion"},"MinimumWarningOSVersion":{"type":"string","description":"Versions less than the specified version will result in warning message on the managed app from accessing company data.","title":"MinimumWarningOSVersion"},"MinimumRequiredSdkVersion":{"type":"string","description":"Versions less than the specified version will block the managed app from accessing company data.","title":"MinimumRequiredSdkVersion"},"MinimumWipeOSVersion":{"type":"string","description":"Versions less than or equal to the specified version will wipe the managed app and the associated company data.","title":"MinimumWipeOSVersion"},"MinimumWipeAppVersion":{"type":"string","description":"Versions less than or equal to the specified version will wipe the managed app and the associated company data.","title":"MinimumWipeAppVersion"},"AppActionIfDeviceComplianceRequired":{"enum":["block","wipe","warn"],"description":"Defines a managed app behavior, either block or wipe, when the device is either rooted or jailbroken, if DeviceComplianceRequired is set to true.","title":"AppActionIfDeviceComplianceRequired"},"AppActionIfMaximumPinRetriesExceeded":{"enum":["block","wipe","warn"],"description":"Defines a managed app behavior, either block or wipe, based on maximum number of incorrect pin retry attempts.","title":"AppActionIfMaximumPinRetriesExceeded"},"PinRequiredInsteadOfBiometricTimeout":{"type":"string","description":"Timeout in minutes for an app pin instead of non biometrics passcode .","title":"PinRequiredInsteadOfBiometricTimeout"},"AllowedOutboundClipboardSharingExceptionLength":{"type":"integer","description":"Specify the number of characters that may be cut or copied from Org data and accounts to any application. This setting overrides the AllowedOutboundClipboardSharingLevel restriction. Default value of '0' means no exception is allowed.","title":"AllowedOutboundClipboardSharingExceptionLength"},"NotificationRestriction":{"enum":["allow","blockOrganizationalData","block"],"description":"Specify app notification restriction.","title":"NotificationRestriction"},"TargetedAppManagementLevels":{"enum":["unspecified","unmanaged","mdm","androidEnterprise"],"description":"The intended app management levels for this policy.","title":"TargetedAppManagementLevels"},"AppDataEncryptionType":{"enum":["useDeviceSettings","afterDeviceRestart","whenDeviceLockedExceptOpenFiles","whenDeviceLocked"],"description":"Require app data to be encrypted.","title":"AppDataEncryptionType"},"ExemptedAppProtocols":{"type":"array","items":{"type":"string"},"description":"Apps in this list will be exempt from the policy and will be able to receive data from managed apps.","title":"ExemptedAppProtocols"},"MinimumWipeSdkVersion":{"type":"string","description":"Versions less than the specified version will block the managed app from accessing company data.","title":"MinimumWipeSdkVersion"},"AllowedIosDeviceModels":{"type":"array","items":{"type":"string"},"description":"Semicolon separated list of device models allowed, as a string, for the managed app to work.","title":"AllowedIosDeviceModels"},"AppActionIfIosDeviceModelNotAllowed":{"enum":["block","wipe","warn"],"description":"Defines a managed app behavior, either block or wipe, if the specified device model is not allowed.","title":"AppActionIfIosDeviceModelNotAllowed"},"FilterOpenInToOnlyManagedApps":{"type":"boolean","description":"Defines if open-in operation is supported from the managed app to the filesharing locations selected. This setting only applies when AllowedOutboundDataTransferDestinations is set to ManagedApps and DisableProtectionOfManagedOutboundOpenInData is set to False.","title":"FilterOpenInToOnlyManagedApps"},"DisableProtectionOfManagedOutboundOpenInData":{"type":"boolean","description":"Disable protection of data transferred to other apps through IOS 'OpenIn' option. This setting is only allowed to be True when AllowedOutboundDataTransferDestinations is set to ManagedApps.","title":"DisableProtectionOfManagedOutboundOpenInData"},"ProtectInboundDataFromUnknownSources":{"type":"boolean","description":"Protect incoming data from unknown source. This setting is only allowed to be True when AllowedInboundDataTransferSources is set to AllApps.","title":"ProtectInboundDataFromUnknownSources"},"CustomBrowserProtocol":{"type":"string","description":"A custom browser protocol to open weblink on iOS.","title":"CustomBrowserProtocol"},"Apps":{"type":"array","items":{"type":"string"},"description":"List of IDs representing the iOS apps controlled by this protection policy.","title":"Apps"},"Assignments":{"type":"array","items":{"type":"string"},"description":"List of IDs of the groups assigned to this iOS Protection Policy.","title":"Assignments"},"ExcludedGroups":{"type":"array","items":{"type":"string"},"description":"List of IDs of the groups that are excluded from this iOS Protection Policy.","title":"ExcludedGroups"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.asrrulespolicywindows10":{"type":"object","description":"This resource configures a Intune Endpoint Protection Attack Surface Reduction rules policy for a Windows 10 Device.\r\nThis resource returns ASR rules created using deviceConfiguration Graph settings.","title":"Schema for microsoft.intune.asrrulespolicywindows10","properties":{"Identity":{"type":"string","description":"Identity of the endpoint protection attack surface protection rules policy for Windows 10.","title":"Identity"},"DisplayName":{"type":"string","description":"Display name of the endpoint protection attack surface protection rules policy for Windows 10.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the endpoint protection attack surface protection rules policy for Windows 10.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the Intune Policy.","title":"Assignments"},"ProcessCreationType":{"enum":["notConfigured","userDefined","block","auditMode","warn","disable"],"description":"This rule blocks processes created through PsExec and WMI from running.","title":"ProcessCreationType"},"AdvancedRansomewareProtectionType":{"enum":["notConfigured","userDefined","enable","auditMode"],"description":"This rule provides an extra layer of protection against ransomware.","title":"AdvancedRansomewareProtectionType"},"BlockPersistenceThroughWmiType":{"enum":["notConfigured","userDefined","block","auditMode","warn","disable"],"description":"This rule prevents malware from abusing WMI to attain persistence on a device.","title":"BlockPersistenceThroughWmiType"},"ScriptObfuscatedMacroCodeType":{"enum":["notConfigured","userDefined","block","auditMode","warn","disable"],"description":"This rule detects suspicious properties within an obfuscated script.","title":"ScriptObfuscatedMacroCodeType"},"OfficeMacroCodeAllowWin32ImportsType":{"enum":["notConfigured","userDefined","block","auditMode","warn","disable"],"description":"This rule prevents VBA macros from calling Win32 APIs.","title":"OfficeMacroCodeAllowWin32ImportsType"},"OfficeAppsLaunchChildProcessType":{"enum":["notConfigured","userDefined","block","auditMode","warn","disable"],"description":"This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access.","title":"OfficeAppsLaunchChildProcessType"},"GuardMyFoldersType":{"enum":["notConfigured","userDefined","enable","auditMode","blockDiskModification","auditDiskModification"],"description":"This rule enable Controlled folder access which protects your data by checking apps against a list of known, trusted apps.","title":"GuardMyFoldersType"},"UntrustedUSBProcessType":{"enum":["notConfigured","userDefined","block","auditMode","warn","disable"],"description":"With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards.","title":"UntrustedUSBProcessType"},"AttackSurfaceReductionExcludedPaths":{"type":"array","items":{"type":"string"},"description":"Exclude files and paths from attack surface reduction rules","title":"AttackSurfaceReductionExcludedPaths"},"UntrustedExecutableType":{"enum":["notConfigured","userDefined","block","auditMode","warn","disable"],"description":"This rule blocks executable files that don't meet a prevalence, age, or trusted list criteria, such as .exe, .dll, or .scr, from launching.","title":"UntrustedExecutableType"},"OfficeCommunicationAppsLaunchChildProcess":{"enum":["notConfigured","userDefined","enable","auditMode","warn","disable"],"description":"This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.","title":"OfficeCommunicationAppsLaunchChildProcess"},"EmailContentExecutionType":{"enum":["notConfigured","userDefined","block","auditMode","warn","disable"],"description":"This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers.","title":"EmailContentExecutionType"},"ScriptDownloadedPayloadExecutionType":{"enum":["notConfigured","userDefined","block","auditMode","warn","disable"],"description":"This rule prevents scripts from launching potentially malicious downloaded content.","title":"ScriptDownloadedPayloadExecutionType"},"AdditionalGuardedFolders":{"type":"array","items":{"type":"string"},"description":"List of additional folders that need to be protected","title":"AdditionalGuardedFolders"},"AdobeReaderLaunchChildProcess":{"enum":["notConfigured","userDefined","enable","auditMode","warn"],"description":"This rule prevents attacks by blocking Adobe Reader from creating processes.","title":"AdobeReaderLaunchChildProcess"},"OfficeAppsExecutableContentCreationOrLaunchType":{"enum":["notConfigured","userDefined","block","auditMode","warn","disable"],"description":"This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.","title":"OfficeAppsExecutableContentCreationOrLaunchType"},"PreventCredentialStealingType":{"enum":["notConfigured","userDefined","enable","auditMode","warn"],"description":"This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS).","title":"PreventCredentialStealingType"},"OfficeAppsOtherProcessInjectionType":{"enum":["notConfigured","userDefined","block","auditMode","warn","disable"],"description":"This rule blocks code injection attempts from Office apps into other processes.","title":"OfficeAppsOtherProcessInjectionType"},"GuardedFoldersAllowedAppPaths":{"type":"array","items":{"type":"string"},"description":"List of apps that have access to protected folders.","title":"GuardedFoldersAllowedAppPaths"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the site collection exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.attacksurfacereductionrulespolicywindows10configmanager":{"type":"object","description":"This resource configures an Intune Endpoint Protection Attack Surface Reduction Rules policy for a Windows 10 Device for Configuration Manager.\r\nThis policy setting enables setting the state (Block/Audit/Off/Warn) for each attack surface reduction (ASR) rule. Each ASR rule listed can be set to one of the following states (Block/Audit/Off/Warn). The ASR rule ID and state should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid ASR rule ID, while the value contains the status ID indicating the status of the rule.\r\n\r\nFor more information about ASR rule ID and status ID, see Enable Attack Surface Reduction: https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.","title":"Schema for microsoft.intune.attacksurfacereductionrulespolicywindows10configmanager","properties":{"Identity":{"type":"string","description":"Identity of the endpoint protection attack surface protection rules policy for Windows 10.","title":"Identity"},"DisplayName":{"type":"string","description":"Display name of the endpoint protection attack surface protection rules policy for Windows 10.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the endpoint protection attack surface protection rules policy for Windows 10.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the endpoint protection attack surface protection rules policy for Windows 10.","title":"Assignments"},"AttackSurfaceReductionOnlyExclusions":{"type":"array","items":{"type":"string"},"description":"Exclude files and paths from attack surface reduction rules","title":"AttackSurfaceReductionOnlyExclusions"},"BlockAbuseOfExploitedVulnerableSignedDrivers":{"enum":["off","block","audit","warn"],"description":"This rule prevents an application from writing a vulnerable signed driver to disk.","title":"BlockAbuseOfExploitedVulnerableSignedDrivers"},"BlockAdobeReaderFromCreatingChildProcesses":{"enum":["off","block","audit","warn"],"description":"This rule prevents attacks by blocking Adobe Reader from creating processes.","title":"BlockAdobeReaderFromCreatingChildProcesses"},"BlockAllOfficeApplicationsFromCreatingChildProcesses":{"enum":["off","block","audit","warn"],"description":"This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access.","title":"BlockAllOfficeApplicationsFromCreatingChildProcesses"},"BlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem":{"enum":["off","block","audit","warn"],"description":"This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS).","title":"BlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem"},"BlockExecutableContentFromEmailClientAndWebmail":{"enum":["off","block","audit","warn"],"description":"This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers.","title":"BlockExecutableContentFromEmailClientAndWebmail"},"BlockExecutableFilesRunningUnlessTheyMeetPrevalenceAgeTrustedListCriterion":{"enum":["off","block","audit","warn"],"description":"This rule blocks executable files that don't meet a prevalence, age, or trusted list criteria, such as .exe, .dll, or .scr, from launching.","title":"BlockExecutableFilesRunningUnlessTheyMeetPrevalenceAgeTrustedListCriterion"},"BlockExecutionOfPotentiallyObfuscatedScripts":{"enum":["off","block","audit","warn"],"description":"This rule detects suspicious properties within an obfuscated script.","title":"BlockExecutionOfPotentiallyObfuscatedScripts"},"BlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent":{"enum":["off","block","audit","warn"],"description":"This rule prevents scripts from launching potentially malicious downloaded content.","title":"BlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent"},"BlockOfficeApplicationsFromCreatingExecutableContent":{"enum":["off","block","audit","warn"],"description":"This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.","title":"BlockOfficeApplicationsFromCreatingExecutableContent"},"BlockOfficeApplicationsFromInjectingCodeIntoOtherProcesses":{"enum":["off","block","audit","warn"],"description":"This rule blocks code injection attempts from Office apps into other processes.","title":"BlockOfficeApplicationsFromInjectingCodeIntoOtherProcesses"},"BlockOfficeCommunicationAppFromCreatingChildProcesses":{"enum":["off","block","audit","warn"],"description":"This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.","title":"BlockOfficeCommunicationAppFromCreatingChildProcesses"},"BlockPersistenceThroughWMIEventSubscription":{"enum":["off","block","audit","warn"],"description":"This rule prevents malware from abusing WMI to attain persistence on a device.","title":"BlockPersistenceThroughWMIEventSubscription"},"BlockProcessCreationsFromPSExecAndWMICommands":{"enum":["off","block","audit","warn"],"description":"This rule blocks processes created through PsExec and WMI from running.","title":"BlockProcessCreationsFromPSExecAndWMICommands"},"BlockUntrustedUnsignedProcessesThatRunFromUSB":{"enum":["off","block","audit","warn"],"description":"With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards.","title":"BlockUntrustedUnsignedProcessesThatRunFromUSB"},"BlockWin32APICallsFromOfficeMacros":{"enum":["off","block","audit","warn"],"description":"This rule prevents VBA macros from calling Win32 APIs.","title":"BlockWin32APICallsFromOfficeMacros"},"UseAdvancedProtectionAgainstRansomware":{"enum":["off","block","audit","warn"],"description":"This rule provides an extra layer of protection against ransomware.","title":"UseAdvancedProtectionAgainstRansomware"},"ControlledFolderAccessProtectedFolders":{"type":"array","items":{"type":"string"},"description":"List of additional folders that need to be protected","title":"ControlledFolderAccessProtectedFolders"},"ControlledFolderAccessAllowedApplications":{"type":"array","items":{"type":"string"},"description":"List of apps that have access to protected folders.","title":"ControlledFolderAccessAllowedApplications"},"EnableControlledFolderAccess":{"enum":["0","1","2","3","4"],"description":"This rule enable Controlled folder access which protects your data by checking apps against a list of known, trusted apps.values 0:disable, 1:enable, 2:audit, 3: Block disk modification only, 4: Audit disk modification only","title":"EnableControlledFolderAccess"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceandappmanagementassignmentfilter":{"type":"object","description":"This resource represents the properties of the Intune Assignment Filter.\r\nFor more information: https://docs.microsoft.com/en-us/graph/api/resources/intune-policyset-deviceandappmanagementassignmentfilter?view=graph-rest-beta","title":"Schema for microsoft.intune.deviceandappmanagementassignmentfilter","properties":{"DisplayName":{"type":"string","description":"DisplayName of the Assignment Filter.","title":"DisplayName"},"Identity":{"type":"string","description":"Key of the Assignment Filter.","title":"Identity"},"Description":{"type":"string","description":"Description of the Assignment Filter.","title":"Description"},"Rule":{"type":"string","description":"Rule definition of the Assignment Filter.","title":"Rule"},"Platform":{"type":"string","description":null,"title":"Platform"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.devicecategory":{"type":"object","description":"This resource configures the Intune device categories.","title":"Schema for microsoft.intune.devicecategory","properties":{"DisplayName":{"type":"string","description":"Display name of the device category.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the device category.","title":"Description"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the category exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.devicecleanuprule":{"type":"object","description":"This resource configures the Intune device cleanup rule.","title":"Schema for microsoft.intune.devicecleanuprule","properties":{"IsSingleInstance":{"enum":["Yes"],"description":"Only valid value is 'Yes'.","title":"IsSingleInstance"},"Enabled":{"type":"boolean","description":"Indicates whether the cleanup rule is enabled.","title":"Enabled"},"DeviceInactivityBeforeRetirementInDays":{"type":"integer","description":"Number of days until Intune devices are deleted. Minimum: 30, Maximum: 270.","title":"DeviceInactivityBeforeRetirementInDays"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the category exists, absent ensures it is removed.","title":"Ensure"}},"required":["IsSingleInstance","Enabled"]},"microsoft.intune.devicecompliancepolicyandroid":{"type":"object","description":"This resource configures the settings of Android device compliance policies\r\nin your cloud-based organization.\r\n\r\n## Parameters\r\n\r\n### Microsoft Defender for Endpoint\r\n\r\n* **Require the device to be at or under the machine risk score**\r\n  Select the maximum allowed machine risk score for devices evaluated by Microsoft Defender for Endpoint. Devices that exceed this score get marked as noncompliant.\r\n    * Not configured (_default_)\r\n    * Clear\r\n    * Low\r\n    * Medium\r\n    * High\r\n\r\n### Device Health\r\n\r\n* **Devices managed with device administrator**\r\n  Device administrator capabilities are superseded by Android Enterprise.\r\n    * Not configured (_default_)\r\n    * Block - Blocking device administrator will guide users to move to Android Enterprise Personally-Owned and Corporate-Owned Work Profile management to regain access.\r\n\r\n### Rooted devices\r\n* **Prevent rooted devices from having corporate access. (This compliance check is supported for Android 4.0 and above.)**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Block - Mark rooted (jailbroken) devices as not compliant.\r\n\r\n* **Require the device to be at or under the Device Threat Level**\r\n  Use this setting to take the risk assessment from a connected Mobile Threat Defense service as a condition for compliance.\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Secured - This option is the most secure, as the device can't have any threats. If the device is detected with any level of threats, it's evaluated as noncompliant.\r\n    * Low - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a noncompliant status.\r\n    * Medium - The device is evaluated as compliant if existing threats on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be noncompliant.\r\n    * High - This option is the least secure, and allows all threat levels. It may be useful if you're using this solution only for reporting purposes.\r\n\r\n### Google Play Protect\r\n* **Google Play Services is configured**\r\n  Google Play services allows security updates, and is a base-level dependency for many security features on certified-Google devices.\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Require - Require that the Google Play services app is installed and enabled.\r\n\r\n* **Up-to-date security provider**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Require - Require that an up-to-date security provider can protect a device from known vulnerabilities.\r\n\r\n* **Threat scan on apps**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Require - Require that the Android Verify Apps feature is enabled.\r\n\r\n* **SafetyNet device attestation**\r\n  Enter the level of SafetyNet attestation that must be met. Your options:\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Check basic integrity\r\n    * Check basic integrity & certified devices\r\n\r\n### Device Properties\r\n* **Operating System Version**\r\n    * Minimum OS version\r\n  When a device doesn't meet the minimum OS version requirement, it's reported as noncompliant. A link with information about how to upgrade is shown. The end user can choose to upgrade their device, and then get access to company resources.\r\n\r\n  _By default, no version is configured._\r\n\r\n    * Maximum OS version\r\n  When a device is using an OS version later than the version specified in the rule, access to company resources is blocked. The user is asked to contact their IT admin. Until a rule is changed to allow the OS version, this device can't access company resources.\r\n\r\n  _By default, no version is configured._\r\n\r\n### System Security\r\n* **Encryption**\r\n  Encryption of data storage on a device\r\n  Supported on Android 4.0 and later, or KNOX 4.0 and later.\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Require - Encrypt data storage on your devices. Devices are encrypted when you choose the Require a password to unlock mobile devices setting.\r\n\r\n* **Device Security**\r\n  Block apps from unknown sources\r\n  Supported on Android 4.0 to Android 7.x. Not supported by Android 8.0 and later\r\n    * Not configured (_default_) - this setting isn't evaluated for compliance or non-compliance.\r\n    * Block - Block devices with Security > Unknown Sources enabled sources (_supported on Android 4.0 through Android 7.x. Not supported on Android 8.0 and later._).\r\n\r\n  To side-load apps, unknown sources must be allowed. If you're not side-loading Android apps, then set this feature to Block to enable this compliance policy.\r\n\r\n* **Company portal app runtime integrity**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Require - Choose Require to confirm the Company Portal app meets all the following requirements:\r\n        * Has the default runtime environment installed\r\n        * Is properly signed\r\n        * Isn't in debug-mode\r\n\r\n* **Block USB debugging on device**\r\n  _(Supported on Android 4.2 or later)_\r\n\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Block - Prevent devices from using the USB debugging feature.\r\n\r\n* **Minimum security patch level**\r\n  _(Supported on Android 6.0 or later)_\r\n\r\n  Select the oldest security patch level a device can have. Devices that aren't at least at this patch level are noncompliant. The date must be entered in the YYYY-MM-DD format.\r\n\r\n  _By default, no date is configured._\r\n\r\n* **Restricted apps**\r\n  Enter the App name and App bundle ID for apps that should be restricted, and then select Add. A device with at least one restricted app installed is marked as non-compliant.\r\n\r\n### Password\r\n\r\nThe available settings for passwords vary by the version of Android on the device.\r\n\r\n#### All Android devices\r\nThe following settings are supported on Android 4.0 or later, and Knox 4.0 and later.\r\n\r\n* **Maximum minutes of inactivity before password is required**\r\n  This setting specifies the length of time without user input after which the mobile device screen is locked. Options range from 1 Minute to 8 Hours. The recommended value is 15 Minutes.\r\n    * Not configured (_default_)\r\n\r\n#### Android 10 and later\r\nThe following settings are supported on Android 10 or later, but not on Knox.\r\n\r\n* **Password complexity**\r\n  _This setting is supported on Android 10 or later, but not on Samsung Knox. On devices that run Android 9 and earlier or Samsung Knox, settings for the password length and type override this setting for complexity._\r\n\r\n  Specify the required password complexity.\r\n    * None (_default_) - No password required.\r\n    * Low - The password satisfies one of the following conditions:\r\n        * Pattern\r\n        * Numeric PIN has a repeating (4444) or ordered (1234, 4321, 2468) sequence.\r\n    * Medium - The password satisfies one of the following conditions:\r\n        * Numeric PIN doesn\u2019t have a repeating (4444) or ordered (1234, 4321, 2468) sequence, and has minimum length of 4.\r\n        * Alphabetic, with a minimum length of 4.\r\n        * Alphanumeric, with a minimum length of 4.\r\n    * High - The password satisfies one of the following conditions:\r\n        * Numeric PIN doesn\u2019t have a repeating (4444) or ordered (1234, 4321, 2468) sequence, and has minimum length of 8.\r\n        * Alphabetic, with a minimum length of 6.\r\n        * Alphanumeric, with a minimum length of 6.\r\n\r\n#### Android 9 and earlier or Samsung Knox\r\n_The following settings are supported on Android 9.0 and earlier, and any version of Samsung Knox._\r\n\r\n* **Require a password to unlock mobile devices**\r\n  This setting specifies whether to require users to enter a password before access is granted to information on their mobile devices. Recommended value: Require\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Require - Users must enter a password before they can access their device.\r\n\r\nWhen set to Require, the following setting can be configured:\r\n\r\n* **Required password type**\r\n  Choose if a password should include only numeric characters, or a mix of numerals and other characters.\r\n    * Device Default - To evaluate password compliance, be sure to select a password strength other than Device default.\r\n    * Low security biometric\r\n    * At least numeric\r\n    * Numeric complex - Repeated or consecutive numerals, such as 1111 or 1234, aren't allowed.\r\n    * At least alphabetic\r\n    * At least alphanumeric\r\n    * At least alphanumeric with symbols\r\n\r\n  Based on the configuration of this setting, one or more of the following options are available:\r\n    * Minimum password length\r\n    Enter the minimum number of digits or characters that the user's password must have.\r\n    * Maximum minutes of inactivity before password is required\r\n    Enter the idle time before the user must reenter their password. When you choose Not configured (_default_), this setting isn't evaluated for compliance or non-compliance.\r\n    * Number of days until password expires\r\n    Select the number of days before the password expires and the user must create a new password.\r\n    * Number of previous passwords to prevent reuse\r\n    Enter the number of recent passwords that can't be reused. Use this setting to restrict the user from creating previously used passwords.","title":"Schema for microsoft.intune.devicecompliancepolicyandroid","properties":{"DisplayName":{"type":"string","description":"Display name of the Android device compliance policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Android device compliance policy.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the Intune Policy.","title":"Assignments"},"PasswordRequired":{"type":"boolean","description":"PasswordRequired of the Android device compliance policy.","title":"PasswordRequired"},"PasswordMinimumLength":{"type":"integer","description":"PasswordMinimumLength of the Android device compliance policy.","title":"PasswordMinimumLength"},"PasswordRequiredType":{"enum":["deviceDefault","alphabetic","alphanumeric","alphanumericWithSymbols","lowSecurityBiometric","numeric","numericComplex","any"],"description":"PasswordRequiredType of the Android device compliance policy.","title":"PasswordRequiredType"},"RequiredPasswordComplexity":{"enum":["none","low","medium","high"],"description":"RequiredPasswordComplexity of the Android device compliance policy.","title":"RequiredPasswordComplexity"},"PasswordMinutesOfInactivityBeforeLock":{"type":"integer","description":"PasswordMinutesOfInactivityBeforeLock of the Android device compliance policy.","title":"PasswordMinutesOfInactivityBeforeLock"},"PasswordExpirationDays":{"type":"integer","description":"PasswordExpirationDays of the Android device compliance policy.","title":"PasswordExpirationDays"},"PasswordPreviousPasswordBlockCount":{"type":"integer","description":"PasswordPreviousPasswordBlockCount of the Android device compliance policy.","title":"PasswordPreviousPasswordBlockCount"},"PasswordSignInFailureCountBeforeFactoryReset":{"type":"integer","description":"PasswordSignInFailureCountBeforeFactoryReset of the Android device compliance policy.","title":"PasswordSignInFailureCountBeforeFactoryReset"},"SecurityPreventInstallAppsFromUnknownSources":{"type":"boolean","description":"SecurityPreventInstallAppsFromUnknownSources of the Android device compliance policy.","title":"SecurityPreventInstallAppsFromUnknownSources"},"SecurityDisableUsbDebugging":{"type":"boolean","description":"SecurityDisableUsbDebugging of the Android device compliance policy.","title":"SecurityDisableUsbDebugging"},"SecurityRequireVerifyApps":{"type":"boolean","description":"SecurityRequireVerifyApps of the Android device compliance policy.","title":"SecurityRequireVerifyApps"},"DeviceThreatProtectionEnabled":{"type":"boolean","description":"DeviceThreatProtectionEnabled of the Android device compliance policy.","title":"DeviceThreatProtectionEnabled"},"DeviceThreatProtectionRequiredSecurityLevel":{"enum":["unavailable","secured","low","medium","high","notSet"],"description":"DeviceThreatProtectionRequiredSecurityLevel of the Android device compliance policy.","title":"DeviceThreatProtectionRequiredSecurityLevel"},"AdvancedThreatProtectionRequiredSecurityLevel":{"enum":["unavailable","secured","low","medium","high","notSet"],"description":"AdvancedThreatProtectionRequiredSecurityLevel of the Android device compliance policy.","title":"AdvancedThreatProtectionRequiredSecurityLevel"},"SecurityBlockJailbrokenDevices":{"type":"boolean","description":"SecurityBlockJailbrokenDevices of the Android device compliance policy.","title":"SecurityBlockJailbrokenDevices"},"SecurityBlockDeviceAdministratorManagedDevices":{"type":"boolean","description":"SecurityBlockDeviceAdministratorManagedDevices of the Android device compliance policy.","title":"SecurityBlockDeviceAdministratorManagedDevices"},"OsMinimumVersion":{"type":"string","description":"OsMinimumVersion of the Android device compliance policy.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"OsMaximumVersion of the Android device compliance policy.","title":"OsMaximumVersion"},"MinAndroidSecurityPatchLevel":{"type":"string","description":"MinAndroidSecurityPatchLevel of the Android device compliance policy.","title":"MinAndroidSecurityPatchLevel"},"StorageRequireEncryption":{"type":"boolean","description":"StorageRequireEncryption of the Android device compliance policy.","title":"StorageRequireEncryption"},"SecurityRequireSafetyNetAttestationBasicIntegrity":{"type":"boolean","description":"SecurityRequireSafetyNetAttestationBasicIntegrity of the Android device compliance policy.","title":"SecurityRequireSafetyNetAttestationBasicIntegrity"},"SecurityRequireSafetyNetAttestationCertifiedDevice":{"type":"boolean","description":"SecurityRequireSafetyNetAttestationCertifiedDevice of the Android device compliance policy.","title":"SecurityRequireSafetyNetAttestationCertifiedDevice"},"SecurityRequireGooglePlayServices":{"type":"boolean","description":"SecurityRequireGooglePlayServices of the Android device compliance policy.","title":"SecurityRequireGooglePlayServices"},"SecurityRequireUpToDateSecurityProviders":{"type":"boolean","description":"SecurityRequireUpToDateSecurityProviders of the Android device compliance policy.","title":"SecurityRequireUpToDateSecurityProviders"},"SecurityRequireCompanyPortalAppIntegrity":{"type":"boolean","description":"SecurityRequireCompanyPortalAppIntegrity of the Android device compliance policy.","title":"SecurityRequireCompanyPortalAppIntegrity"},"ConditionStatementId":{"type":"string","description":"ConditionStatementId of the Android device compliance policy.","title":"ConditionStatementId"},"RestrictedApps":{"type":"string","description":"RestrictedApps of the Android device compliance policy.","title":"RestrictedApps"},"RoleScopeTagIds":{"type":"string","description":"RoleScopeTagIds of the Android device compliance policy.","title":"RoleScopeTagIds"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.devicecompliancepolicyandroiddeviceowner":{"type":"object","description":"This resource configures the settings of Android Work Profile device compliance policies\r\nin your cloud-based organization.\r\n\r\n## Parameters\r\n\r\n### Microsoft Defender for Endpoint - _for Personally-Owned Work Profile_\r\n\r\n* **Require the device to be at or under the machine risk score**\r\n  Select the maximum allowed machine risk score for devices evaluated by Microsoft Defender for Endpoint. Devices which exceed this score get marked as noncompliant.\r\n    * Not configured (_default_)\r\n    * Clear\r\n    * Low\r\n    * Medium\r\n    * High\r\n\r\n### Device Health - _for Personally-Owned Work Profile_\r\n* **Rooted devices**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Block - Mark rooted (jailbroken) devices as not compliant.\r\n\r\n* **Require the device to be at or under the Device Threat Level**\r\nSelect the maximum allowed device threat level evaluated by your mobile threat defense service. Devices that exceed this threat level are marked noncompliant. To use this setting, choose the allowed threat level:\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Secured - This option is the most secure, and means that the device can't have any threats. If the device is detected with any level of threats, it's evaluated as noncompliant.\r\n    * Low - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a noncompliant status.\r\n    * Medium - The device is evaluated as compliant if the threats that are present on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be noncompliant.\r\n    * High - This option is the least secure, as it allows all threat levels. It may be useful if you're using this solution only for reporting purposes.\r\n\r\n### Google Play Protect - _for Personally-Owned Work Profile_\r\n\r\n* **Google Play Services is configured**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Require - Require that the Google Play services app is installed and enabled. Google Play services allows security updates, and is a base-level dependency for many security features on certified-Google devices.\r\n\r\n* **Up-to-date security provider**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Require - Require that an up-to-date security provider can protect a device from known vulnerabilities.\r\n\r\n* **SafetyNet device attestation**\r\n  Enter the level of SafetyNet attestation that must be met. Your options:\r\n    * Not configured (_default_) - Setting isn't evaluated for compliance or non-compliance.\r\n    * Check basic integrity\r\n    * Check basic integrity & certified devices\r\n\r\nNote:\r\n* On Android Enterprise devices, Threat scan on apps is a device configuration policy. Using a configuration policy, administrators can enable the setting on a device. See Android Enterprise device restriction settings.\r\n\r\n### Device Properties - _for Personally-Owned Work Profile_\r\n\r\n* **Operating System Version - *for Personally-Owned Work Profile***\r\n    * Minimum OS version\r\n      When a device doesn't meet the minimum OS version requirement, it's reported as non-compliant. A link with information on how to upgrade is shown. The end user can upgrade their device, and then access organization resources.\r\n\r\n  _By default, no version is configured._\r\n\r\n* **Maximum OS version**\r\n  When a device is using an OS version later than the version in the rule, access to organization resources is blocked. The user is asked to contact their IT administrator. Until a rule is changed to allow the OS version, this device can't access organization resources.\r\n\r\n  _By default, no version is configured._\r\n\r\n### System security - for _Personally-Owned Work Profile_\r\n\r\n* **Require a password to unlock mobile devices**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Require - Users must enter a password before they can access their device.\r\n\r\n  _This setting applies at the device level. If you only need to require a password at the Personally-Owned Work Profile level, then use a configuration policy. See Android Enterprise device configuration settings._\r\n\r\n* **Required password type**\r\n  Choose if a password should include only numeric characters, or a mix of numerals and other characters. Your options:\r\n    * Device Default\r\n    * Low security biometric\r\n    * At least numeric (_default_): Enter the minimum password length a user must enter, between 4 and 16 characters.\r\n    * Numeric complex: Enter the minimum password length a user must enter, between 4 and 16 characters.\r\n    * At least alphabetic: Enter the minimum password length a user must enter, between 4 and 16 characters.\r\n    * At least alphanumeric: Enter the minimum password length a user must enter, between 4 and 16 characters.\r\n    * At least alphanumeric with symbols: Enter the minimum password length a user must enter, between 4 and 16 characters.\r\n\r\n  Depending on the password type you select, the following settings are available:\r\n    * Maximum minutes of inactivity before password is required\r\n    Enter the idle time before the user must reenter their password. Options include the default of Not configured, and from 1 Minute to 8 hours.\r\n    * Number of days until password expires\r\n    Enter the number of days, between 1-365, until the device password must be changed. For example, to change the password after 60 days, enter 60. When the password expires, users are prompted to create a new password.\r\n    * Minimum password length\r\n    Enter the minimum length the password must have, between 4 and 16 characters.\r\n    * Number of previous passwords to prevent reuse\r\n    Enter the number of recent passwords that can't be reused. Use this setting to restrict the user from creating previously used passwords.\r\n\r\n### Encryption - _for Personally-Owned Work Profile_\r\n* **Encryption of data storage on device**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Require - Encrypt data storage on your devices.\r\n\r\n  You don't have to configure this setting because Android Enterprise devices enforce encryption.\r\n\r\n### Device Security - _for Personally-Owned Work Profile_\r\n\r\n* **Block apps from unknown sources**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Block - Block devices with Security > Unknown Sources enabled sources (supported on Android 4.0 through Android 7.x. Not supported by Android 8.0 and later).\r\n\r\n  _To side-load apps, unknown sources must be allowed. If you're not side-loading Android apps, then set this feature to Block to enable this compliance policy._\r\n\r\n* **Company portal app runtime integrity**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Require - Choose Require to confirm the Company Portal app meets all the following requirements:\r\n        * Has the default runtime environment installed\r\n        * Is properly signed\r\n        * Isn't in debug-mode\r\n        * Is installed from a known source\r\n\r\n* **Block USB debugging on device**\r\n    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n    * Block - Prevent devices from using the USB debugging feature.\r\n\r\n_You don't have to configure this setting because USB debugging is already disabled on Android Enterprise devices._\r\n\r\n* **Minimum security patch level**\r\nSelect the oldest security patch level a device can have. Devices that aren't at least at this patch level are noncompliant. The date must be entered in the YYYY-MM-DD format.\r\n\r\n_By default, no date is configured._","title":"Schema for microsoft.intune.devicecompliancepolicyandroiddeviceowner","properties":{"DisplayName":{"type":"string","description":"Display name of the Android Device Owner device compliance policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Android Device Owner device compliance policy.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the Intune Policy.","title":"Assignments"},"DeviceThreatProtectionEnabled":{"type":"boolean","description":"DeviceThreatProtectionEnabled of the Android Device Owner device compliance policy.","title":"DeviceThreatProtectionEnabled"},"DeviceThreatProtectionRequiredSecurityLevel":{"type":"string","description":"DeviceThreatProtectionRequiredSecurityLevel of the Android Device Owner device compliance policy.","title":"DeviceThreatProtectionRequiredSecurityLevel"},"AdvancedThreatProtectionRequiredSecurityLevel":{"type":"string","description":"AdvancedThreatProtectionRequiredSecurityLevel of the Android Device Owner device compliance policy.","title":"AdvancedThreatProtectionRequiredSecurityLevel"},"SecurityRequireSafetyNetAttestationBasicIntegrity":{"type":"boolean","description":"SecurityRequireSafetyNetAttestationBasicIntegrity of the Android Device Owner device compliance policy.","title":"SecurityRequireSafetyNetAttestationBasicIntegrity"},"SecurityRequireSafetyNetAttestationCertifiedDevice":{"type":"boolean","description":"SecurityRequireSafetyNetAttestationCertifiedDevice of the Android Device Owner device compliance policy.","title":"SecurityRequireSafetyNetAttestationCertifiedDevice"},"osMinimumVersion":{"type":"string","description":"osMinimumVersion of the Android Device Owner device compliance policy.","title":"osMinimumVersion"},"osMaximumVersion":{"type":"string","description":"osMaximumVersion of the Android Device Owner device compliance policy.","title":"osMaximumVersion"},"passwordRequired":{"type":"boolean","description":"PasswordRequired of the Android Device Owner device compliance policy.","title":"passwordRequired"},"passwordMinimumLength":{"type":"integer","description":"PasswordMinimumLength of the Android Device Owner device compliance policy.","title":"passwordMinimumLength"},"PasswordRequiredType":{"enum":["deviceDefault","alphabetic","alphanumeric","alphanumericWithSymbols","lowSecurityBiometric","numeric","numericComplex","any"],"description":"PasswordRequiredType of the Android Device Owner device compliance policy.","title":"PasswordRequiredType"},"PasswordMinutesOfInactivityBeforeLock":{"type":"integer","description":"PasswordMinutesOfInactivityBeforeLock of the Android Device Owner device compliance policy.","title":"PasswordMinutesOfInactivityBeforeLock"},"PasswordExpirationDays":{"type":"integer","description":"PasswordExpirationDays of the Android Device Owner device compliance policy.","title":"PasswordExpirationDays"},"PasswordPreviousPasswordCountToBlock":{"type":"integer","description":"PasswordPreviousPasswordCountToBlock of the Android Device Owner device compliance policy.","title":"PasswordPreviousPasswordCountToBlock"},"StorageRequireEncryption":{"type":"boolean","description":"StorageRequireEncryption of the Android Device Owner device compliance policy.","title":"StorageRequireEncryption"},"SecurityRequireIntuneAppIntegrity":{"type":"boolean","description":"SecurityRequireIntuneAppIntegrity of the Android Device Owner device compliance policy.","title":"SecurityRequireIntuneAppIntegrity"},"RoleScopeTagIds":{"type":"array","items":{"type":"string"},"description":"List of Scope Tags for this Entity instance. Inherited from deviceConfiguration","title":"RoleScopeTagIds"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.devicecompliancepolicyandroidworkprofile":{"type":"object","description":"This resource configures the settings of Android Work Profile device compliance policies\r\nin your cloud-based organization.\r\n\r\n## Parameters\r\n\r\n### Microsoft Defender for Endpoint - _for Personally-Owned Work Profile_\r\n\r\n* **Require the device to be at or under the machine risk score**\r\n  Select the maximum allowed machine risk score for devices evaluated by Microsoft Defender for Endpoint. Devices which exceed this score get marked as noncompliant.\r\n  * Not configured (_default_)\r\n  * Clear\r\n  * Low\r\n  * Medium\r\n  * High\r\n\r\n### Device Health - _for Personally-Owned Work Profile_\r\n* **Rooted devices**\r\n  * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n  * Block - Mark rooted (jailbroken) devices as not compliant.\r\n\r\n* **Require the device to be at or under the Device Threat Level**\r\n  Select the maximum allowed device threat level evaluated by your mobile threat defense service. Devices that exceed this threat level are marked noncompliant. To use this setting, choose the allowed threat level:\r\n  * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n  * Secured - This option is the most secure, and means that the device can't have any threats. If the device is detected with any level of threats, it's evaluated as noncompliant.\r\n  * Low - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a noncompliant status.\r\n  * Medium - The device is evaluated as compliant if the threats that are present on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be noncompliant.\r\n  * High - This option is the least secure, as it allows all threat levels. It may be useful if you're using this solution only for reporting purposes.\r\n\r\n### Google Play Protect - _for Personally-Owned Work Profile_\r\n\r\n* **Google Play Services is configured**\r\n  * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n  * Require - Require that the Google Play services app is installed and enabled. Google Play services allows security updates, and is a base-level dependency for many security features on certified-Google devices.\r\n\r\n* **Up-to-date security provider**\r\n  * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n  * Require - Require that an up-to-date security provider can protect a device from known vulnerabilities.\r\n\r\n* **SafetyNet device attestation**\r\n  Enter the level of SafetyNet attestation that must be met. Your options:\r\n  * Not configured (_default_) - Setting isn't evaluated for compliance or non-compliance.\r\n  * Check basic integrity\r\n  * Check basic integrity & certified devices\r\n\r\n  Note:\r\n    * On Android Enterprise devices, Threat scan on apps is a device configuration policy. Using a configuration policy, administrators can enable the setting on a device. See Android Enterprise device restriction settings.\r\n\r\n### Device Properties - _for Personally-Owned Work Profile_\r\n\r\n* **Operating System Version - *for Personally-Owned Work Profile***\r\n  * Minimum OS version\r\n    When a device doesn't meet the minimum OS version requirement, it's reported as non-compliant. A link with information on how to upgrade is shown. The end user can upgrade their device, and then access organization resources.\r\n\r\n  _By default, no version is configured._\r\n\r\n* **Maximum OS version**\r\n  When a device is using an OS version later than the version in the rule, access to organization resources is blocked. The user is asked to contact their IT administrator. Until a rule is changed to allow the OS version, this device can't access organization resources.\r\n\r\n  _By default, no version is configured._\r\n\r\n### System security - for _Personally-Owned Work Profile_\r\n\r\n* **Require a password to unlock mobile devices**\r\n  * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n  * Require - Users must enter a password before they can access their device.\r\n\r\n  _This setting applies at the device level. If you only need to require a password at the Personally-Owned Work Profile level, then use a configuration policy. See Android Enterprise device configuration settings._\r\n\r\n* **Required password type**\r\n  Choose if a password should include only numeric characters, or a mix of numerals and other characters. Your options:\r\n  * Device Default\r\n  * Low security biometric\r\n  * At least numeric (_default_): Enter the minimum password length a user must enter, between 4 and 16 characters.\r\n  * Numeric complex: Enter the minimum password length a user must enter, between 4 and 16 characters.\r\n  * At least alphabetic: Enter the minimum password length a user must enter, between 4 and 16 characters.\r\n  * At least alphanumeric: Enter the minimum password length a user must enter, between 4 and 16 characters.\r\n  * At least alphanumeric with symbols: Enter the minimum password length a user must enter, between 4 and 16 characters.\r\n\r\n  Depending on the password type you select, the following settings are available:\r\n  * Maximum minutes of inactivity before password is required\r\n  Enter the idle time before the user must reenter their password. Options include the default of Not configured, and from 1 Minute to 8 hours.\r\n  * Number of days until password expires\r\n  Enter the number of days, between 1-365, until the device password must be changed. For example, to change the password after 60 days, enter 60. When the password expires, users are prompted to create a new password.\r\n  * Minimum password length\r\n  Enter the minimum length the password must have, between 4 and 16 characters.\r\n  * Number of previous passwords to prevent reuse\r\n  Enter the number of recent passwords that can't be reused. Use this setting to restrict the user from creating previously used passwords.\r\n\r\n### Encryption - _for Personally-Owned Work Profile_\r\n* **Encryption of data storage on device**\r\n  * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n  * Require - Encrypt data storage on your devices.\r\n\r\n  You don't have to configure this setting because Android Enterprise devices enforce encryption.\r\n\r\n### Device Security - _for Personally-Owned Work Profile_\r\n\r\n* **Block apps from unknown sources**\r\n  * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n  * Block - Block devices with Security > Unknown Sources enabled sources (supported on Android 4.0 through Android 7.x. Not supported by Android 8.0 and later).\r\n\r\n  _To side-load apps, unknown sources must be allowed. If you're not side-loading Android apps, then set this feature to Block to enable this compliance policy._\r\n\r\n* **Company portal app runtime integrity**\r\n  * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n  * Require - Choose Require to confirm the Company Portal app meets all the following requirements:\r\n    * Has the default runtime environment installed\r\n    * Is properly signed\r\n    * Isn't in debug-mode\r\n    * Is installed from a known source\r\n\r\n* **Block USB debugging on device**\r\n  * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.\r\n  * Block - Prevent devices from using the USB debugging feature.\r\n\r\n_You don't have to configure this setting because USB debugging is already disabled on Android Enterprise devices._\r\n\r\n* **Minimum security patch level**\r\nSelect the oldest security patch level a device can have. Devices that aren't at least at this patch level are noncompliant. The date must be entered in the YYYY-MM-DD format.\r\n\r\n_By default, no date is configured._","title":"Schema for microsoft.intune.devicecompliancepolicyandroidworkprofile","properties":{"DisplayName":{"type":"string","description":"Display name of the AndroidWorkProfile device compliance policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the AndroidWorkProfile device compliance policy.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the Intune Policy.","title":"Assignments"},"PasswordRequired":{"type":"boolean","description":"PasswordRequired of the AndroidWorkProfile device compliance policy.","title":"PasswordRequired"},"PasswordMinimumLength":{"type":"integer","description":"PasswordMinimumLength of the AndroidWorkProfile device compliance policy.","title":"PasswordMinimumLength"},"PasswordRequiredType":{"enum":["deviceDefault","alphabetic","alphanumeric","alphanumericWithSymbols","lowSecurityBiometric","numeric","numericComplex","any"],"description":"PasswordRequiredType of the AndroidWorkProfile device compliance policy.","title":"PasswordRequiredType"},"PasswordMinutesOfInactivityBeforeLock":{"type":"integer","description":"PasswordMinutesOfInactivityBeforeLock of the AndroidWorkProfile device compliance policy.","title":"PasswordMinutesOfInactivityBeforeLock"},"PasswordExpirationDays":{"type":"integer","description":"PasswordExpirationDays of the AndroidWorkProfile device compliance policy.","title":"PasswordExpirationDays"},"PasswordPreviousPasswordBlockCount":{"type":"integer","description":"PasswordPreviousPasswordBlockCount of the AndroidWorkProfile device compliance policy.","title":"PasswordPreviousPasswordBlockCount"},"PasswordSignInFailureCountBeforeFactoryReset":{"type":"integer","description":"PasswordSignInFailureCountBeforeFactoryReset of the AndroidWorkProfile device compliance policy.","title":"PasswordSignInFailureCountBeforeFactoryReset"},"SecurityPreventInstallAppsFromUnknownSources":{"type":"boolean","description":"SecurityPreventInstallAppsFromUnknownSources of the AndroidWorkProfile device compliance policy.","title":"SecurityPreventInstallAppsFromUnknownSources"},"SecurityDisableUsbDebugging":{"type":"boolean","description":"SecurityDisableUsbDebugging of the AndroidWorkProfile device compliance policy.","title":"SecurityDisableUsbDebugging"},"SecurityRequireVerifyApps":{"type":"boolean","description":"SecurityRequireVerifyApps of the AndroidWorkProfile device compliance policy.","title":"SecurityRequireVerifyApps"},"DeviceThreatProtectionEnabled":{"type":"boolean","description":"DeviceThreatProtectionEnabled of the AndroidWorkProfile device compliance policy.","title":"DeviceThreatProtectionEnabled"},"DeviceThreatProtectionRequiredSecurityLevel":{"enum":["unavailable","secured","low","medium","high","notSet"],"description":"DeviceThreatProtectionRequiredSecurityLevel of the AndroidWorkProfile device compliance policy.","title":"DeviceThreatProtectionRequiredSecurityLevel"},"AdvancedThreatProtectionRequiredSecurityLevel":{"enum":["unavailable","secured","low","medium","high","notSet"],"description":"AdvancedThreatProtectionRequiredSecurityLevel of the AndroidWorkProfile device compliance policy.","title":"AdvancedThreatProtectionRequiredSecurityLevel"},"SecurityBlockJailbrokenDevices":{"type":"boolean","description":"SecurityBlockJailbrokenDevices of the AndroidWorkProfile device compliance policy.","title":"SecurityBlockJailbrokenDevices"},"OsMinimumVersion":{"type":"string","description":"OsMinimumVersion of the AndroidWorkProfile device compliance policy.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"OsMaximumVersion of the AndroidWorkProfile device compliance policy.","title":"OsMaximumVersion"},"MinAndroidSecurityPatchLevel":{"type":"string","description":"MinAndroidSecurityPatchLevel of the AndroidWorkProfile device compliance policy.","title":"MinAndroidSecurityPatchLevel"},"StorageRequireEncryption":{"type":"boolean","description":"StorageRequireEncryption of the AndroidWorkProfile device compliance policy.","title":"StorageRequireEncryption"},"SecurityRequireSafetyNetAttestationBasicIntegrity":{"type":"boolean","description":"SecurityRequireSafetyNetAttestationBasicIntegrity of the AndroidWorkProfile device compliance policy.","title":"SecurityRequireSafetyNetAttestationBasicIntegrity"},"SecurityRequireSafetyNetAttestationCertifiedDevice":{"type":"boolean","description":"SecurityRequireSafetyNetAttestationCertifiedDevice of the AndroidWorkProfile device compliance policy.","title":"SecurityRequireSafetyNetAttestationCertifiedDevice"},"SecurityRequireGooglePlayServices":{"type":"boolean","description":"SecurityRequireGooglePlayServices of the AndroidWorkProfile device compliance policy.","title":"SecurityRequireGooglePlayServices"},"SecurityRequireUpToDateSecurityProviders":{"type":"boolean","description":"SecurityRequireUpToDateSecurityProviders of the AndroidWorkProfile device compliance policy.","title":"SecurityRequireUpToDateSecurityProviders"},"SecurityRequireCompanyPortalAppIntegrity":{"type":"boolean","description":"SecurityRequireCompanyPortalAppIntegrity of the AndroidWorkProfile device compliance policy.","title":"SecurityRequireCompanyPortalAppIntegrity"},"SecurityRequiredAndroidSafetyNetEvaluationType":{"enum":["basic","hardwareBacked"],"description":"Require a specific SafetyNet evaluation type for compliance.","title":"SecurityRequiredAndroidSafetyNetEvaluationType"},"RoleScopeTagIds":{"type":"string","description":"RoleScopeTagIds of the AndroidWorkProfile device compliance policy.","title":"RoleScopeTagIds"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.devicecompliancepolicyios":{"type":"object","description":"This resource configures the Intune compliance policies for iOs devices.","title":"Schema for microsoft.intune.devicecompliancepolicyios","properties":{"DisplayName":{"type":"string","description":"Display name of the iOS device compliance policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the iOS device compliance policy.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the Intune Policy.","title":"Assignments"},"PasscodeBlockSimple":{"type":"boolean","description":"PasscodeBlockSimple of the iOS device compliance policy.","title":"PasscodeBlockSimple"},"PasscodeExpirationDays":{"type":"integer","description":"PasscodeExpirationDays of the iOS device compliance policy.","title":"PasscodeExpirationDays"},"PasscodeMinimumLength":{"type":"integer","description":"PasscodeMinimumLength of the iOS device compliance policy.","title":"PasscodeMinimumLength"},"PasscodeMinutesOfInactivityBeforeLock":{"type":"integer","description":"PasscodeMinutesOfInactivityBeforeLock of the iOS device compliance policy.","title":"PasscodeMinutesOfInactivityBeforeLock"},"PasscodeMinutesOfInactivityBeforeScreenTimeout":{"type":"integer","description":"Minutes of inactivity before the screen times out.","title":"PasscodeMinutesOfInactivityBeforeScreenTimeout"},"PasscodePreviousPasscodeBlockCount":{"type":"integer","description":"PasscodePreviousPasscodeBlockCount of the iOS device compliance policy.","title":"PasscodePreviousPasscodeBlockCount"},"PasscodeMinimumCharacterSetCount":{"type":"integer","description":"PasscodeMinimumCharacterSetCount of the iOS device compliance policy.","title":"PasscodeMinimumCharacterSetCount"},"PasscodeRequiredType":{"enum":["deviceDefault","alphanumeric","numeric"],"description":"PasscodeRequiredType of the iOS device compliance policy.","title":"PasscodeRequiredType"},"PasscodeRequired":{"type":"boolean","description":"PasscodeRequired of the iOS device compliance policy.","title":"PasscodeRequired"},"OsMinimumVersion":{"type":"string","description":"OsMinimumVersion of the iOS device compliance policy.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"OsMaximumVersion of the iOS device compliance policy.","title":"OsMaximumVersion"},"OsMinimumBuildVersion":{"type":"string","description":"Minimum IOS build version.","title":"OsMinimumBuildVersion"},"OsMaximumBuildVersion":{"type":"string","description":"Maximum IOS build version.","title":"OsMaximumBuildVersion"},"SecurityBlockJailbrokenDevices":{"type":"boolean","description":"SecurityBlockJailbrokenDevices of the iOS device compliance policy.","title":"SecurityBlockJailbrokenDevices"},"DeviceThreatProtectionEnabled":{"type":"boolean","description":"DeviceThreatProtectionEnabled of the iOS device compliance policy.","title":"DeviceThreatProtectionEnabled"},"DeviceThreatProtectionRequiredSecurityLevel":{"enum":["unavailable","secured","low","medium","high","notSet"],"description":"Require Mobile Threat Protection minimum risk level to report noncompliance.","title":"DeviceThreatProtectionRequiredSecurityLevel"},"AdvancedThreatProtectionRequiredSecurityLevel":{"enum":["unavailable","secured","low","medium","high","notSet"],"description":"MDATP Require Mobile Threat Protection minimum risk level to report noncompliance.","title":"AdvancedThreatProtectionRequiredSecurityLevel"},"ManagedEmailProfileRequired":{"type":"boolean","description":"ManagedEmailProfileRequired of the iOS device compliance policy.","title":"ManagedEmailProfileRequired"},"RestrictedApps":{"type":"array","items":{"type":"object","description":"This resource configures the Intune compliance policies for iOs devices.","title":"Schema for MSFT_appListItem","properties":{"name":{"type":"string","description":"The application name.","title":"name"},"publisher":{"type":"string","description":"The publisher of the application.","title":"publisher"},"appStoreUrl":{"type":"string","description":"The Store URL of the application.","title":"appStoreUrl"},"appId":{"type":"string","description":"The application or bundle identifier of the application.","title":"appId"}},"required":[]},"description":"Credentials of the Intune Admin","title":"RestrictedApps"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.devicecompliancepolicymacos":{"type":"object","description":"This resource configures the settings of MacOS compliance policies\r\nin your cloud-based organization.\r\n\r\n## Parameters\r\n\r\n### Device Health\r\n* **Require a system integrity protection**\r\n  *  Not configured _(default)_ - This setting isn't evaluated for compliance or non-compliance.\r\n  *  Require - Require macOS devices to have System Integrity Protection enabled.\r\n\r\n### Device Properties\r\n* **Minimum OS required**\r\n  When a device doesn't meet the minimum OS version requirement, it's reported as non-compliant. A link with information on how to upgrade is shown. The device user can choose to upgrade their device. After that, they can access organization resources.\r\n\r\n* **Maximum OS version allowed**\r\n  When a device uses an OS version later than the version in the rule, access to organization resources is blocked. The device user is asked to contact their IT administrator. The device can't access organization resources until a rule changes to allow the OS version.\r\n\r\n* **Minimum OS build version**\r\n  When Apple publishes security updates, the build number is typically updated, not the OS version. Use this feature to enter a minimum allowed build number on the device.\r\n\r\n* **Maximum OS build version**\r\n  When Apple publishes security updates, the build number is typically updated, not the OS version. Use this feature to enter a maximum allowed build number on the device.\r\n\r\n## System security settings\r\n### Password\r\n* **Require a password to unlock mobile devices**\r\n  * Not configured _(default)_\r\n  * Require Users must enter a password before they can access their device.\r\n\r\n* **Simple passwords**\r\n  * Not configured _(default)_ - Users can create passwords simple like 1234 or 1111.\r\n  * Block - Users can't create simple passwords, such as 1234 or 1111.\r\n\r\n* **Minimum password length**\r\n  * Enter the minimum number of digits or characters that the password must have.\r\n\r\n* **Password type**\r\n  * Choose if a password should have only Numeric characters, or if there should be a mix of numbers and other characters (Alphanumeric).\r\n\r\n* **Number of non-alphanumeric characters in password**\r\n  * Enter the minimum number of special characters, such as &, #, %, !, and so on, that must be in the password.\r\n\r\n  Setting a higher number requires the user to create a password that is more complex.\r\n\r\n* **Maximum minutes of inactivity before password is required**\r\n  * Enter the idle time before the user must reenter their password.\r\n\r\n* **Password expiration (days)**\r\n  * Select the number of days before the password expires, and they must create a new one.\r\n\r\n* **Number of previous passwords to prevent reuse**\r\n  * Enter the number of previously used passwords that can't be used.\r\n\r\n### Encryption\r\n* **Encryption of data storage on device**\r\n  * Not configured (_default_)\r\n  * Require - Use _Require_ to encrypt data storage on your devices.\r\n\r\n### Device Security\r\nFirewall protects devices from unauthorized network access. You can use Firewall to control connections on a per-application basis.\r\n\r\n* **Firewall**\r\n  * Not configured _(default)_ - This setting leaves the firewall turned off, and network traffic is allowed (not blocked).\r\n  * Enable - Use Enable to help protect devices from unauthorized access. Enabling this feature allows you to handle incoming internet connections, and use stealth mode.\r\n\r\n* **Incoming connections**\r\n  * Not configured _(default)_ - Allows incoming connections and sharing services.\r\n  * Block - Block all incoming network connections except the connections required for basic internet services, such as DHCP, Bonjour, and IPSec. This setting also blocks all sharing services, including screen sharing, remote access, iTunes music sharing, and more.\r\n\r\n* **Stealth Mode**\r\n  * Not configured _(default)_ - This setting leaves stealth mode turned off.\r\n  * Enable - Turn on stealth mode to prevent devices from responding to probing requests, which can be made my malicious users. When enabled, the device continues to answer incoming requests for authorized apps.\r\n\r\n### Gatekeeper\r\nFor more information, see Gatekeeper on macOS.\r\n\r\n* **Allow apps downloaded from these locations**\r\n  Allows supported applications to be installed on your devices from different locations. Your location options:\r\n  * Not configured _(default)_ - The gatekeeper option has no impact on compliance or non-compliance.\r\n  * Mac App Store - Only install apps for the Mac app store. Apps can't be installed from third parties nor identified developers. If a user selects Gatekeeper to install apps outside the Mac App Store, then the device is considered not compliant.\r\n  * Mac App Store and identified developers - Install apps for the Mac app store and from identified developers. macOS checks the identity of developers, and does some other checks to verify app integrity. If a user selects Gatekeeper to install apps outside these options, then the device is considered not compliant.\r\n  * Anywhere - Apps can be installed from anywhere, and by any developer. This option is the least secure.","title":"Schema for microsoft.intune.devicecompliancepolicymacos","properties":{"DisplayName":{"type":"string","description":"Display name of the MacOS device compliance policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the MacOS device compliance policy.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the Intune Policy.","title":"Assignments"},"PasswordRequired":{"type":"boolean","description":"PasswordRequired of the MacOS device compliance policy.","title":"PasswordRequired"},"PasswordBlockSimple":{"type":"boolean","description":"PasswordBlockSimple of the MacOS device compliance policy.","title":"PasswordBlockSimple"},"PasswordExpirationDays":{"type":"integer","description":"PasswordExpirationDays of the MacOS device compliance policy.","title":"PasswordExpirationDays"},"PasswordMinimumLength":{"type":"integer","description":"PasswordMinimumLength of the MacOS device compliance policy.","title":"PasswordMinimumLength"},"PasswordMinutesOfInactivityBeforeLock":{"type":"integer","description":"PasswordMinutesOfInactivityBeforeLock of the MacOS device compliance policy.","title":"PasswordMinutesOfInactivityBeforeLock"},"PasswordPreviousPasswordBlockCount":{"type":"integer","description":"PasswordPreviousPasswordBlockCount of the MacOS device compliance policy.","title":"PasswordPreviousPasswordBlockCount"},"PasswordMinimumCharacterSetCount":{"type":"integer","description":"PasswordMinimumCharacterSetCount of the MacOS device compliance policy.","title":"PasswordMinimumCharacterSetCount"},"PasswordRequiredType":{"enum":["DeviceDefault","Alphanumeric","Numeric"],"description":"PasswordRequiredType of the MacOS device compliance policy.","title":"PasswordRequiredType"},"OsMinimumVersion":{"type":"string","description":"OsMinimumVersion of the MacOS device compliance policy.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"OsMaximumVersion of the MacOS device compliance policy.","title":"OsMaximumVersion"},"OsMinimumBuildVersion":{"type":"string","description":"Minimum MacOS build version.","title":"OsMinimumBuildVersion"},"OsMaximumBuildVersion":{"type":"string","description":"Maximum MacOS build version.","title":"OsMaximumBuildVersion"},"SystemIntegrityProtectionEnabled":{"type":"boolean","description":"SystemIntegrityProtectionEnabled of the MacOS device compliance policy.","title":"SystemIntegrityProtectionEnabled"},"DeviceThreatProtectionEnabled":{"type":"boolean","description":"DeviceThreatProtectionEnabled of the MacOS device compliance policy.","title":"DeviceThreatProtectionEnabled"},"DeviceThreatProtectionRequiredSecurityLevel":{"enum":["Unavailable","Secured","Low","Medium","High","NotSet"],"description":"DeviceThreatProtectionRequiredSecurityLevel of the MacOS device compliance policy.","title":"DeviceThreatProtectionRequiredSecurityLevel"},"AdvancedThreatProtectionRequiredSecurityLevel":{"enum":["Unavailable","Secured","Low","Medium","High","NotSet"],"description":"AdvancedThreatProtectionRequiredSecurityLevel of the MacOS device compliance policy.","title":"AdvancedThreatProtectionRequiredSecurityLevel"},"StorageRequireEncryption":{"type":"boolean","description":"StorageRequireEncryption of the MacOS device compliance policy.","title":"StorageRequireEncryption"},"GatekeeperAllowedAppSource":{"enum":["notConfigured","macAppStore","macAppStoreAndIdentifiedDevelopers","anywhere"],"description":"System and Privacy setting that determines which download locations apps can be run from on a macOS device.","title":"GatekeeperAllowedAppSource"},"FirewallEnabled":{"type":"boolean","description":"FirewallEnabled of the MacOS device compliance policy.","title":"FirewallEnabled"},"FirewallBlockAllIncoming":{"type":"boolean","description":"FirewallBlockAllIncoming of the MacOS device compliance policy.","title":"FirewallBlockAllIncoming"},"FirewallEnableStealthMode":{"type":"boolean","description":"FirewallEnableStealthMode of the MacOS device compliance policy.","title":"FirewallEnableStealthMode"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.devicecompliancepolicywindows10":{"type":"object","description":"This resource configures the settings of Windows 10 compliance policies\r\nin your cloud-based organization.\r\n\r\n## Parameters\r\n\r\n### Device Health\r\n#### Windows Health Attestation Service evaluation rules\r\n* **Require BitLocker:**\r\n  Windows BitLocker Drive Encryption encrypts all data stored on the Windows operating system volume. BitLocker uses the Trusted Platform Module (TPM) to help protect the Windows operating system and user data. It also helps confirm that a computer isn't tampered with, even if its left unattended, lost, or stolen. If the computer is equipped with a compatible TPM, BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys can't be accessed until the TPM verifies the state of the computer.\r\n  * Not configured _(default)_ - This setting isn't evaluated for compliance or non-compliance.\r\n  * Require - The device can protect data that's stored on the drive from unauthorized access when the system is off, or hibernates.\r\n\r\n  Device HealthAttestation CSP - BitLockerStatus\r\n\r\n* **Require Secure Boot to be enabled on the device:**\r\n  * Not configured _(default)_ - This setting isn't evaluated for compliance or non-compliance.\r\n  * Require - The system is forced to boot to a factory trusted state. The core components that are used to boot the machine must have correct cryptographic signatures that are trusted by the organization that manufactured the device. The UEFI firmware verifies the signature before it lets the machine start. If any files are tampered with, which breaks their signature, the system doesn't boot.\r\n\r\n### Device Properties\r\n#### Operating System Version\r\nTo discover build versions for all Windows 10 Feature Updates and Cumulative Updates (to be used in some of the fields below), see Windows 10 release information. Be sure to include the 10.0. prefix before the build numbers, as the following examples illustrate.\r\n\r\n* **Minimum OS version:**\r\n  Enter the minimum allowed version in the major.minor.build.revision number format. To get the correct value, open a command prompt, and type ver. The ver command returns the version in the following format:\r\n\r\n  Microsoft Windows [Version 10.0.17134.1]\r\n\r\n  When a device has an earlier version than the OS version you enter, it's reported as noncompliant. A link with information on how to upgrade is shown. The end user can choose to upgrade their device. After they upgrade, they can access company resources.\r\n\r\n* **Maximum OS version:**\r\n  Enter the maximum allowed version, in the major.minor.build.revision number format. To get the correct value, open a command prompt, and type ver. The ver command returns the version in the following format:\r\n\r\n  Microsoft Windows [Version 10.0.17134.1]\r\n\r\n  When a device is using an OS version later than the version entered, access to organization resources is blocked. The end user is asked to contact their IT administrator. The device can't access organization resources until the rule is changed to allow the OS version.\r\n\r\n* **Minimum OS required for mobile devices:**\r\n  Enter the minimum allowed version, in the major.minor.build number format.\r\n\r\n  When a device has an earlier version that the OS version you enter, it's reported as noncompliant. A link with information on how to upgrade is shown. The end user can choose to upgrade their device. After they upgrade, they can access company resources.\r\n\r\n* **Maximum OS required for mobile devices:**\r\n  Enter the maximum allowed version, in the major.minor.build number.\r\n\r\n  When a device is using an OS version later than the version entered, access to organization resources is blocked. The end user is asked to contact their IT administrator. The device can't access organization resources until the rule is changed to allow the OS version.\r\n\r\n* **Valid operating system builds:**\r\n  Specify a list of minimum and maximum operating system builds. Valid operating system builds provides additional flexibility when compared against minimum and maximum OS versions. Consider a scenario where minimum OS version is set to 10.0.18362.xxx (Windows 10 1903) and maximum OS version is set to 10.0.18363.xxx (Windows 10 1909). This configuration can allow a Windows 10 1903 device that doesn't have recent cumulative updates installed to be identified as compliant. Minimum and maximum OS versions might be suitable if you have standardized on a single Windows 10 release, but might not address your requirements if you need to use multiple builds, each with specific patch levels. In such a case, consider leveraging valid operating system builds instead, which allows multiple builds to be specified as per the following example.\r\n\r\n  Example:\r\n  The following table is an example of a range for the acceptable operating systems versions for different Windows 10 releases. In this example, three different Feature Updates have been allowed (1809, 1909 and 2004). Specifically, only those versions of Windows and which have applied cumulative updates from June to September 2020 will be considered to be compliant. This is sample data only. The table includes a first column that includes any text you want to describe the entry, followed by the minimum and maximum OS version for that entry. The second and third columns must adhere to valid OS build versions in the major.minor.build.revision number format. After you define one or more entries, you can Export the list as a comma-separated values (CSV) file.\r\n\r\n  | Description                 | Minimum OS version | Maximum OS version |\r\n  |-----------------------------|--------------------|--------------------|\r\n  | Win 10 2004 (Jun-Sept 2020) | 10.0.19041.329     | 10.0.19041.508     |\r\n  | Win 10 1909 (Jun-Sept 2020) | 10.0.18363.900     | 10.0.18363.1110    |\r\n  | Win 10 1809 (Jun-Sept 2020) | 10.0.17763.1282    | 10.0.17763.1490    |\r\n\r\n### Configuration Manager Compliance\r\nApplies only to co-managed devices running Windows 10 and later. Intune-only devices return a not available status.\r\n\r\n* **Require device compliance from Configuration Manager:**\r\n  * Not configured _(default)_ - Intune doesn't check for any of the Configuration Manager settings for compliance.\r\n  * Require - Require all settings (configuration items) in Configuration Manager to be compliant.\r\n\r\n### System Security\r\n#### Password\r\n* **Require a password to unlock mobile devices:**\r\n  * Not configured _(default)_ - This setting isn't evaluated for compliance or non-compliance.\r\n  * Require - Users must enter a password before they can access their device.\r\n\r\n* **Simple passwords:**\r\n  * Not configured _(default)_ - Users can create simple passwords, such as 1234 or 1111.\r\n  * Block - Users can't create simple passwords, such as 1234 or 1111.\r\n\r\n* **Password type:**\r\n  Choose the type of password or PIN required. Your options:\r\n  * Device _(default)_  - Require a password, numeric PIN, or alphanumeric PIN\r\n  * Numeric - Require a password or numeric PIN\r\n  * Alphanumeric - Require a password, or alphanumeric PIN.\r\n  When set to Alphanumeric, the following settings are available:\r\n\r\n  * Password complexity:\r\n    Your options:\r\n    * Require digits and lowercase letters _(default)_\r\n    * Require digits, lowercase letters, and uppercase letters\r\n    * Require digits, lowercase letters, uppercase letters, and special characters\r\n\r\n* **Minimum password length:**\r\n    Enter the minimum number of digits or characters that the password must have.\r\n\r\n* **Maximum minutes of inactivity before password is required:**\r\n    Enter the idle time before the user must reenter their password.\r\n\r\n* **Password expiration (days):**\r\n    Enter the number of days before the password expires, and they must create a new one, from 1-730.\r\n\r\n* **Number of previous passwords to prevent reuse:**\r\n    Enter the number of previously used passwords that can't be used.\r\n\r\n* **Require password when device returns from idle state (Mobile and Holographic):**\r\n    * Not configured _(default)_\r\n    * Require - Require device users to enter the password every time the device returns from an idle state.\r\n\r\n  **Important**\r\n  When the password requirement is changed on a Windows desktop, users are impacted the next time they sign in, as that's when the device goes from idle to active. Users with passwords that meet the requirement are still prompted to change their passwords.\r\n\r\n### Encryption\r\n\r\n* **Encryption of data storage on a device:**\r\n  This setting applies to all drives on a device.\r\n  * Not configured _(default)_\r\n  * Require - Use Require to encrypt data storage on your devices.\r\n\r\n  **Note**\r\n  The Encryption of data storage on a device setting generically checks for the presence of encryption on the device, more specifically at the OS drive level. Currently, Intune supports only the encryption check with BitLocker. For a more robust encryption setting, consider using Require BitLocker, which leverages Windows Device Health Attestation to validate Bitlocker status at the TPM level.\r\n\r\n### Device Security\r\n\r\n* **Firewall:**\r\n  * Not configured _(default)_ - Intune doesn't control the Microsoft Defender Firewall, nor change existing settings.\r\n  * Require - Turn on the Microsoft Defender Firewall, and prevent users from turning it off.\r\n\r\n  **Note**\r\n  If the device immediately syncs after a reboot, or immediately syncs waking from sleep, then this setting may report as an Error. This scenario might not affect the overall device compliance status. To re-evaluate the compliance status, manually sync the device.\r\n\r\n* **Trusted Platform Module (TPM):**\r\n  * Not configured _(default)_ - Intune doesn't check the device for a TPM chip version.\r\n  * Require - Intune checks the TPM chip version for compliance. The device is compliant if the TPM chip version is greater than 0 (zero). The device isn't compliant if there isn't a TPM version on the device.\r\n\r\n* **Antivirus:**\r\n  * Not configured _(default)_ - Intune doesn't check for any antivirus solutions installed on the device.\r\n  * Require - Check compliance using antivirus solutions that are registered with Windows Security Center, such as Symantec and Microsoft Defender.\r\n\r\n* **Antispyware:**\r\n  * Not configured _(default)_ - Intune doesn't check for any antispyware solutions installed on the device.\r\n  * Require - Check compliance using antispyware solutions that are registered with Windows Security Center, such as Symantec and Microsoft Defender.\r\n\r\n### Defender\r\nThe following compliance settings are supported with Windows 10 Desktop.\r\n\r\n* **Microsoft Defender Antimalware:**\r\n  * Not configured _(default)_ - Intune doesn't control the service, nor change existing settings.\r\n  * Require - Turn on the Microsoft Defender anti-malware service, and prevent users from turning it off.\r\n\r\n* **Microsoft Defender Antimalware minimum version:**\r\n  Enter the minimum allowed version of Microsoft Defender anti-malware service. For example, enter 4.11.0.0. When left blank, any version of the Microsoft Defender anti-malware service can be used.\r\n\r\n  By _(default)_, no version is configured.\r\n\r\n* **Microsoft Defender Antimalware security intelligence up-to-date:**\r\n  Controls the Windows Security virus and threat protection updates on the devices.\r\n  * Not configured _(default)_ - Intune doesn't enforce any requirements.\r\n  * Require - Force the Microsoft Defender security intelligence be up-to-date.\r\n\r\n* **Real-time protection:**\r\n  * Not configured (_(default)_) - Intune doesn't control this feature, nor change existing settings.\r\n  * Require - Turn on real-time protection, which scans for malware, spyware, and other unwanted software.\r\n\r\n### Microsoft Defender for Endpoint\r\n#### Microsoft Defender for Endpoint rules\r\nFor additional information on Microsoft Defender for Endpoint integration in conditional access scenarios, see Configure Conditional Access in Microsoft Defender for Endpoint.\r\n\r\n* **Require the device to be at or under the machine risk score:**\r\n  Use this setting to take the risk assessment from your defense threat services as a condition for compliance. Choose the maximum allowed threat level:\r\n  * Not configured (_(default)_)\r\n  * Clear -This option is the most secure, as the device can't have any threats. If the device is detected as having any level of threats, it's evaluated as non-compliant.\r\n  * Low - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a non-compliant status.\r\n  * Medium - The device is evaluated as compliant if existing threats on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be non-compliant.\r\n  * High - This option is the least secure, and allows all threat levels. It may be useful if you're using this solution only for reporting purposes.\r\n\r\n### Windows Holographic for Business\r\nWindows Holographic for Business uses the Windows 10 and later platform. Windows Holographic for Business supports the following setting:\r\n\r\n**System Security > Encryption > Encryption of data storage on device.**\r\nTo verify device encryption on the Microsoft HoloLens, see Verify device encryption.\r\n\r\n### Surface Hub\r\nSurface Hub uses the Windows 10 and later platform. Surface Hubs are supported for both compliance and Conditional Access. To enable these features on Surface Hubs, we recommend you enable Windows 10 automatic enrollment in Intune (requires Azure Active Directory (Azure AD)), and target the Surface Hub devices as device groups. Surface Hubs are required to be Azure AD joined for compliance and Conditional Access to work.\r\n\r\nFor guidance, see set up enrollment for Windows devices.\r\n\r\nSpecial consideration for Surface Hubs running Windows 10 Team OS:\r\nSurface Hubs that run Windows 10 Team OS do not support the Microsoft Defender for Endpoint and Password compliance policies at this time. Therefore, for Surface Hubs that run Windows 10 Team OS set the following two settings to their _(default)_ of _Not configured_:\r\n* In the category Password, set Require a password to unlock mobile devices to the _(default)_ of Not configured.\r\n* In the category Microsoft Defender for Endpoint, set Require the device to be at or under the machine risk score to the _(default)_ of Not configured.","title":"Schema for microsoft.intune.devicecompliancepolicywindows10","properties":{"DisplayName":{"type":"string","description":"Display name of the Windows 10 device compliance policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Windows 10 device compliance policy.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"PasswordRequired":{"type":"boolean","description":"PasswordRequired of the Windows 10 device compliance policy.","title":"PasswordRequired"},"PasswordBlockSimple":{"type":"boolean","description":"PasswordBlockSimple of the Windows 10 device compliance policy.","title":"PasswordBlockSimple"},"PasswordRequiredToUnlockFromIdle":{"type":"boolean","description":"PasswordRequiredToUnlockFromIdle of the Windows 10 device compliance policy.","title":"PasswordRequiredToUnlockFromIdle"},"PasswordMinutesOfInactivityBeforeLock":{"type":"integer","description":"PasswordMinutesOfInactivityBeforeLock of the Windows 10 device compliance policy.","title":"PasswordMinutesOfInactivityBeforeLock"},"PasswordExpirationDays":{"type":"integer","description":"PasswordExpirationDays of the Windows 10 device compliance policy.","title":"PasswordExpirationDays"},"PasswordMinimumLength":{"type":"integer","description":"PasswordMinimumLength of the Windows 10 device compliance policy.","title":"PasswordMinimumLength"},"PasswordMinimumCharacterSetCount":{"type":"integer","description":"PasswordMinimumCharacterSetCount of the Windows 10 device compliance policy.","title":"PasswordMinimumCharacterSetCount"},"PasswordRequiredType":{"enum":["DeviceDefault","Alphanumeric","Numeric"],"description":"PasswordRequiredType of the Windows 10 device compliance policy.","title":"PasswordRequiredType"},"PasswordPreviousPasswordBlockCount":{"type":"integer","description":"PasswordPreviousPasswordBlockCount of the Windows 10 device compliance policy.","title":"PasswordPreviousPasswordBlockCount"},"RequireHealthyDeviceReport":{"type":"boolean","description":"RequireHealthyDeviceReport of the Windows 10 device compliance policy.","title":"RequireHealthyDeviceReport"},"OsMinimumVersion":{"type":"string","description":"OsMinimumVersion of the Windows 10 device compliance policy.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"OsMaximumVersion of the Windows 10 device compliance policy.","title":"OsMaximumVersion"},"MobileOsMinimumVersion":{"type":"string","description":"MobileOsMinimumVersion of the Windows 10 device compliance policy.","title":"MobileOsMinimumVersion"},"MobileOsMaximumVersion":{"type":"string","description":"MobileOsMaximumVersion of the Windows 10 device compliance policy.","title":"MobileOsMaximumVersion"},"EarlyLaunchAntiMalwareDriverEnabled":{"type":"boolean","description":"EarlyLaunchAntiMalwareDriverEnabled of the Windows 10 device compliance policy.","title":"EarlyLaunchAntiMalwareDriverEnabled"},"BitLockerEnabled":{"type":"boolean","description":"BitLockerEnabled of the Windows 10 device compliance policy.","title":"BitLockerEnabled"},"SecureBootEnabled":{"type":"boolean","description":"SecureBootEnabled of the Windows 10 device compliance policy.","title":"SecureBootEnabled"},"CodeIntegrityEnabled":{"type":"boolean","description":"CodeIntegrityEnabled of the Windows 10 device compliance policy.","title":"CodeIntegrityEnabled"},"StorageRequireEncryption":{"type":"boolean","description":"StorageRequireEncryption of the Windows 10 device compliance policy.","title":"StorageRequireEncryption"},"ActiveFirewallRequired":{"type":"boolean","description":"ActiveFirewallRequired of the Windows 10 device compliance policy.","title":"ActiveFirewallRequired"},"DefenderEnabled":{"type":"boolean","description":"DefenderEnabled of the Windows 10 device compliance policy.","title":"DefenderEnabled"},"DefenderVersion":{"type":"string","description":"DefenderVersion of the Windows 10 device compliance policy.","title":"DefenderVersion"},"SignatureOutOfDate":{"type":"boolean","description":"SignatureOutOfDate of the Windows 10 device compliance policy.","title":"SignatureOutOfDate"},"RTPEnabled":{"type":"boolean","description":"RTPEnabled of the Windows 10 device compliance policy.","title":"RTPEnabled"},"AntivirusRequired":{"type":"boolean","description":"AntivirusRequired of the Windows 10 device compliance policy.","title":"AntivirusRequired"},"AntiSpywareRequired":{"type":"boolean","description":"AntiSpywareRequired of the Windows 10 device compliance policy.","title":"AntiSpywareRequired"},"DeviceThreatProtectionEnabled":{"type":"boolean","description":"DeviceThreatProtectionEnabled of the Windows 10 device compliance policy.","title":"DeviceThreatProtectionEnabled"},"DeviceThreatProtectionRequiredSecurityLevel":{"enum":["Unavailable","Secured","Low","Medium","High","NotSet"],"description":"DeviceThreatProtectionRequiredSecurityLevel of the Windows 10 device compliance policy.","title":"DeviceThreatProtectionRequiredSecurityLevel"},"ConfigurationManagerComplianceRequired":{"type":"boolean","description":"ConfigurationManagerComplianceRequired of the Windows 10 device compliance policy.","title":"ConfigurationManagerComplianceRequired"},"TpmRequired":{"type":"boolean","description":"TpmRequired of the Windows 10 device compliance policy.","title":"TpmRequired"},"DeviceCompliancePolicyScript":{"type":"string","description":"DeviceCompliancePolicyScript of the Windows 10 device compliance policy.","title":"DeviceCompliancePolicyScript"},"ValidOperatingSystemBuildRanges":{"type":"array","items":{"type":"string"},"description":"ValidOperatingSystemBuildRanges of the Windows 10 device compliance policy.","title":"ValidOperatingSystemBuildRanges"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationadministrativetemplatepolicywindows10":{"type":"object","description":"Intune Device Configuration Administrative Template Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationadministrativetemplatepolicywindows10","properties":{"Description":{"type":"string","description":"User provided description for the resource object.","title":"Description"},"DisplayName":{"type":"string","description":"User provided name for the resource object.","title":"DisplayName"},"PolicyConfigurationIngestionType":{"enum":["unknown","custom","builtIn","mixed","unknownFutureValue"],"description":"Type of definitions configured for this policy. Possible values are: unknown, custom, builtIn, mixed, unknownFutureValue.","title":"PolicyConfigurationIngestionType"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"DefinitionValues":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Administrative Template Policy for Windows10","title":"Schema for MSFT_IntuneGroupPolicyDefinitionValue","properties":{"ConfigurationType":{"enum":["policy","preference"],"description":"Specifies how the value should be configured. This can be either as a Policy or as a Preference. Possible values are: policy, preference.","title":"ConfigurationType"},"Enabled":{"type":"boolean","description":"Enables or disables the associated group policy definition.","title":"Enabled"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Definition":{"type":"object","description":"The associated group policy definition with the value. Read-Only.","title":"Definition","properties":{"CategoryPath":{"type":"string","description":"The localized full category path for the policy.","title":"CategoryPath"},"ClassType":{"enum":["user","machine"],"description":"Identifies the type of groups the policy can be applied to. Possible values are: user, machine.","title":"ClassType"},"DisplayName":{"type":"string","description":"The localized policy name.","title":"DisplayName"},"ExplainText":{"type":"string","description":"The localized explanation or help text associated with the policy. The default value is empty.","title":"ExplainText"},"GroupPolicyCategoryId":{"type":"string","description":"The category id of the parent category","title":"GroupPolicyCategoryId"},"HasRelatedDefinitions":{"type":"boolean","description":"Signifies whether or not there are related definitions to this definition","title":"HasRelatedDefinitions"},"MinDeviceCspVersion":{"type":"string","description":"Minimum required CSP version for device configuration in this definition","title":"MinDeviceCspVersion"},"MinUserCspVersion":{"type":"string","description":"Minimum required CSP version for user configuration in this definition","title":"MinUserCspVersion"},"PolicyType":{"enum":["admxBacked","admxIngested"],"description":"Specifies the type of group policy. Possible values are: admxBacked, admxIngested.","title":"PolicyType"},"SupportedOn":{"type":"string","description":"Localized string used to specify what operating system or application version is affected by the policy.","title":"SupportedOn"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"}},"required":[]},"PresentationValues":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Administrative Template Policy for Windows10","title":"Schema for MSFT_IntuneGroupPolicyDefinitionValuePresentationValue","properties":{"BooleanValue":{"type":"boolean","description":"A value for the associated presentation.","title":"BooleanValue"},"DecimalValue":{"type":"integer","description":"A value for the associated presentation.","title":"DecimalValue"},"StringValue":{"type":"string","description":"A value for the associated presentation.","title":"StringValue"},"KeyValuePairValues":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Administrative Template Policy for Windows10","title":"Schema for MSFT_IntuneGroupPolicyDefinitionValuePresentationValueKeyValuePair","properties":{"Value":{"type":"string","description":"Value for this key-value pair.","title":"Value"},"Name":{"type":"string","description":"Name for this key-value pair.","title":"Name"}},"required":[]},"description":"A list of pairs for the associated presentation.","title":"KeyValuePairValues"},"StringValues":{"type":"array","items":{"type":"string"},"description":"A list of pairs for the associated presentation.","title":"StringValues"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"PresentationDefinitionId":{"type":"string","description":"The unique identifier for presentation definition. Read-only.","title":"PresentationDefinitionId"},"PresentationDefinitionLabel":{"type":"string","description":"The label of the presentation definition. Read-only.","title":"PresentationDefinitionLabel"},"odataType":{"enum":["#microsoft.graph.groupPolicyPresentationValueBoolean","#microsoft.graph.groupPolicyPresentationValueDecimal","#microsoft.graph.groupPolicyPresentationValueList","#microsoft.graph.groupPolicyPresentationValueLongDecimal","#microsoft.graph.groupPolicyPresentationValueMultiText","#microsoft.graph.groupPolicyPresentationValueText"],"description":"A value for the associated presentation.","title":"odataType"}},"required":[]},"description":"The associated group policy presentation values with the definition value.","title":"PresentationValues"}},"required":[]},"description":"The list of enabled or disabled group policy definition values for the configuration.","title":"DefinitionValues"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationcustompolicywindows10":{"type":"object","description":"Intune Device Configuration Custom Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationcustompolicywindows10","properties":{"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"OmaSettings":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Custom Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphOmaSetting","properties":{"Description":{"type":"string","description":"Description.","title":"Description"},"DisplayName":{"type":"string","description":"Display Name.","title":"DisplayName"},"IsEncrypted":{"type":"boolean","description":"Indicates whether the value field is encrypted. This property is read-only.","title":"IsEncrypted"},"OmaUri":{"type":"string","description":"OMA.","title":"OmaUri"},"SecretReferenceValueId":{"type":"string","description":"ReferenceId for looking up secret for decryption. This property is read-only.","title":"SecretReferenceValueId"},"FileName":{"type":"string","description":"File name associated with the Value property (.cer)","title":"FileName"},"Value":{"type":"string","description":"Value. (Base64 encoded string)","title":"Value"},"IsReadOnly":{"type":"boolean","description":"By setting to true, the CSP (configuration service provider) specified in the OMA-URI will perform a get, instead of set","title":"IsReadOnly"},"odataType":{"enum":["#microsoft.graph.omaSettingBase64","#microsoft.graph.omaSettingBoolean","#microsoft.graph.omaSettingDateTime","#microsoft.graph.omaSettingFloatingPoint","#microsoft.graph.omaSettingInteger","#microsoft.graph.omaSettingString","#microsoft.graph.omaSettingStringXml"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"description":"OMA settings. This collection can contain a maximum of 1000 elements.","title":"OmaSettings"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"SupportsScopeTags":{"type":"boolean","description":"Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.","title":"SupportsScopeTags"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationdefenderforendpointonboardingpolicywindows10":{"type":"object","description":"Intune Device Configuration Defender For Endpoint Onboarding Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationdefenderforendpointonboardingpolicywindows10","properties":{"AdvancedThreatProtectionAutoPopulateOnboardingBlob":{"type":"boolean","description":"Auto populate onboarding blob programmatically from Advanced Threat protection service","title":"AdvancedThreatProtectionAutoPopulateOnboardingBlob"},"AdvancedThreatProtectionOffboardingBlob":{"type":"string","description":"Windows Defender AdvancedThreatProtection Offboarding Blob.","title":"AdvancedThreatProtectionOffboardingBlob"},"AdvancedThreatProtectionOffboardingFilename":{"type":"string","description":"Name of the file from which AdvancedThreatProtectionOffboardingBlob was obtained.","title":"AdvancedThreatProtectionOffboardingFilename"},"AdvancedThreatProtectionOnboardingBlob":{"type":"string","description":"Windows Defender AdvancedThreatProtection Onboarding Blob.","title":"AdvancedThreatProtectionOnboardingBlob"},"AdvancedThreatProtectionOnboardingFilename":{"type":"string","description":"Name of the file from which AdvancedThreatProtectionOnboardingBlob was obtained.","title":"AdvancedThreatProtectionOnboardingFilename"},"AllowSampleSharing":{"type":"boolean","description":"Windows Defender AdvancedThreatProtection 'Allow Sample Sharing' Rule","title":"AllowSampleSharing"},"EnableExpeditedTelemetryReporting":{"type":"boolean","description":"Expedite Windows Defender Advanced Threat Protection telemetry reporting frequency.","title":"EnableExpeditedTelemetryReporting"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationdeliveryoptimizationpolicywindows10":{"type":"object","description":"Intune Device Configuration Delivery Optimization Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationdeliveryoptimizationpolicywindows10","properties":{"BackgroundDownloadFromHttpDelayInSeconds":{"type":"integer","description":"Specifies number of seconds to delay an HTTP source in a background download that is allowed to use peer-to-peer. Valid values 0 to 4294967295","title":"BackgroundDownloadFromHttpDelayInSeconds"},"BandwidthMode":{"type":"object","description":"Specifies foreground and background bandwidth usage using percentages, absolutes, or hours.","title":"BandwidthMode","properties":{"MaximumDownloadBandwidthInKilobytesPerSecond":{"type":"integer","description":"Specifies the maximum download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. Valid values 0 to 4294967295","title":"MaximumDownloadBandwidthInKilobytesPerSecond"},"MaximumUploadBandwidthInKilobytesPerSecond":{"type":"integer","description":"Specifies the maximum upload bandwidth in KiloBytes/second that a device will use across all concurrent upload activity using Delivery Optimization (0-4000000). Valid values 0 to 4000000 The default value is 0, which permits unlimited possible bandwidth (optimized for minimal usage of upload bandwidth). Valid values 0 to 4000000","title":"MaximumUploadBandwidthInKilobytesPerSecond"},"BandwidthBackgroundPercentageHours":{"type":"object","description":"Background download percentage hours.","title":"BandwidthBackgroundPercentageHours","properties":{"BandwidthBeginBusinessHours":{"type":"integer","description":"Specifies the beginning of business hours using a 24-hour clock (0-23). Valid values 0 to 23","title":"BandwidthBeginBusinessHours"},"BandwidthEndBusinessHours":{"type":"integer","description":"Specifies the end of business hours using a 24-hour clock (0-23). Valid values 0 to 23","title":"BandwidthEndBusinessHours"},"BandwidthPercentageDuringBusinessHours":{"type":"integer","description":"Specifies the percentage of bandwidth to limit during business hours (0-100). Valid values 0 to 100","title":"BandwidthPercentageDuringBusinessHours"},"BandwidthPercentageOutsideBusinessHours":{"type":"integer","description":"Specifies the percentage of bandwidth to limit outsidse business hours (0-100). Valid values 0 to 100","title":"BandwidthPercentageOutsideBusinessHours"}},"required":[]},"BandwidthForegroundPercentageHours":{"type":"object","description":"Foreground download percentage hours.","title":"BandwidthForegroundPercentageHours","properties":{"BandwidthBeginBusinessHours":{"type":"integer","description":"Specifies the beginning of business hours using a 24-hour clock (0-23). Valid values 0 to 23","title":"BandwidthBeginBusinessHours"},"BandwidthEndBusinessHours":{"type":"integer","description":"Specifies the end of business hours using a 24-hour clock (0-23). Valid values 0 to 23","title":"BandwidthEndBusinessHours"},"BandwidthPercentageDuringBusinessHours":{"type":"integer","description":"Specifies the percentage of bandwidth to limit during business hours (0-100). Valid values 0 to 100","title":"BandwidthPercentageDuringBusinessHours"},"BandwidthPercentageOutsideBusinessHours":{"type":"integer","description":"Specifies the percentage of bandwidth to limit outsidse business hours (0-100). Valid values 0 to 100","title":"BandwidthPercentageOutsideBusinessHours"}},"required":[]},"MaximumBackgroundBandwidthPercentage":{"type":"integer","description":"Specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth (0-100). Valid values 0 to 100","title":"MaximumBackgroundBandwidthPercentage"},"MaximumForegroundBandwidthPercentage":{"type":"integer","description":"Specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth (0-100). Valid values 0 to 100 The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. Valid values 0 to 100","title":"MaximumForegroundBandwidthPercentage"},"odataType":{"enum":["#microsoft.graph.deliveryOptimizationBandwidthAbsolute","#microsoft.graph.deliveryOptimizationBandwidthHoursWithPercentage","#microsoft.graph.deliveryOptimizationBandwidthPercentage"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"CacheServerBackgroundDownloadFallbackToHttpDelayInSeconds":{"type":"integer","description":"Specifies number of seconds to delay a fall back from cache servers to an HTTP source for a background download. Valid values 0 to 2592000.","title":"CacheServerBackgroundDownloadFallbackToHttpDelayInSeconds"},"CacheServerForegroundDownloadFallbackToHttpDelayInSeconds":{"type":"integer","description":"Specifies number of seconds to delay a fall back from cache servers to an HTTP source for a foreground download. Valid values 0 to 2592000.","title":"CacheServerForegroundDownloadFallbackToHttpDelayInSeconds"},"CacheServerHostNames":{"type":"array","items":{"type":"string"},"description":"Specifies cache servers host names.","title":"CacheServerHostNames"},"DeliveryOptimizationMode":{"enum":["userDefined","httpOnly","httpWithPeeringNat","httpWithPeeringPrivateGroup","httpWithInternetPeering","simpleDownload","bypassMode"],"description":"Specifies the download method that delivery optimization can use to manage network bandwidth consumption for large content distribution scenarios. Possible values are: userDefined, httpOnly, httpWithPeeringNat, httpWithPeeringPrivateGroup, httpWithInternetPeering, simpleDownload, bypassMode.","title":"DeliveryOptimizationMode"},"ForegroundDownloadFromHttpDelayInSeconds":{"type":"integer","description":"Specifies number of seconds to delay an HTTP source in a foreground download that is allowed to use peer-to-peer (0-86400). Valid values 0 to 86400 Specifying 0 sets Delivery Optimization to manage this setting using the cloud service. Valid values 0 to 86400","title":"ForegroundDownloadFromHttpDelayInSeconds"},"GroupIdSource":{"type":"object","description":"Specifies to restrict peer selection to a specific source. The options set in this policy only apply to Delivery Optimization mode Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. For option 3 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID.","title":"GroupIdSource","properties":{"GroupIdCustom":{"type":"string","description":"Specifies an arbitrary group ID that the device belongs to","title":"GroupIdCustom"},"GroupIdSourceOption":{"enum":["notConfigured","adSite","authenticatedDomainSid","dhcpUserOption","dnsSuffix"],"description":"Set this policy to restrict peer selection to a specific source. Possible values are: notConfigured, adSite, authenticatedDomainSid, dhcpUserOption, dnsSuffix.","title":"GroupIdSourceOption"},"odataType":{"enum":["#microsoft.graph.deliveryOptimizationGroupIdCustom","#microsoft.graph.deliveryOptimizationGroupIdSourceOptions"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"MaximumCacheAgeInDays":{"type":"integer","description":"Specifies the maximum time in days that each file is held in the Delivery Optimization cache after downloading successfully (0-3650). Valid values 0 to 3650","title":"MaximumCacheAgeInDays"},"MaximumCacheSize":{"type":"object","description":"Specifies the maximum cache size that Delivery Optimization either as a percentage or in GB.","title":"MaximumCacheSize","properties":{"MaximumCacheSizeInGigabytes":{"type":"integer","description":"Specifies the maximum size in GB of Delivery Optimization cache. Valid values 0 to 4294967295","title":"MaximumCacheSizeInGigabytes"},"MaximumCacheSizePercentage":{"type":"integer","description":"Specifies the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). Valid values 1 to 100","title":"MaximumCacheSizePercentage"},"odataType":{"enum":["#microsoft.graph.deliveryOptimizationMaxCacheSizeAbsolute","#microsoft.graph.deliveryOptimizationMaxCacheSizePercentage"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"MinimumBatteryPercentageAllowedToUpload":{"type":"integer","description":"Specifies the minimum battery percentage to allow the device to upload data (0-100). Valid values 0 to 100 The default value is 0. The value 0 (zero) means 'not limited' and the cloud service default value will be used. Valid values 0 to 100","title":"MinimumBatteryPercentageAllowedToUpload"},"MinimumDiskSizeAllowedToPeerInGigabytes":{"type":"integer","description":"Specifies the minimum disk size in GB to use Peer Caching (1-100000). Valid values 1 to 100000 Recommended values: 64 GB to 256 GB. Valid values 1 to 100000","title":"MinimumDiskSizeAllowedToPeerInGigabytes"},"MinimumFileSizeToCacheInMegabytes":{"type":"integer","description":"Specifies the minimum content file size in MB enabled to use Peer Caching (1-100000). Valid values 1 to 100000 Recommended values: 1 MB to 100,000 MB. Valid values 1 to 100000","title":"MinimumFileSizeToCacheInMegabytes"},"MinimumRamAllowedToPeerInGigabytes":{"type":"integer","description":"Specifies the minimum RAM size in GB to use Peer Caching (1-100000). Valid values 1 to 100000","title":"MinimumRamAllowedToPeerInGigabytes"},"ModifyCacheLocation":{"type":"string","description":"Specifies the drive that Delivery Optimization should use for its cache.","title":"ModifyCacheLocation"},"RestrictPeerSelectionBy":{"enum":["notConfigured","subnetMask"],"description":"Specifies to restrict peer selection via selected option.","title":"RestrictPeerSelectionBy"},"VpnPeerCaching":{"enum":["notConfigured","enabled","disabled"],"description":"Specifies whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network.","title":"VpnPeerCaching"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"SupportsScopeTags":{"type":"boolean","description":"Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.","title":"SupportsScopeTags"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationdomainjoinpolicywindows10":{"type":"object","description":"Intune Device Configuration Domain Join Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationdomainjoinpolicywindows10","properties":{"ActiveDirectoryDomainName":{"type":"string","description":"Active Directory domain name to join.","title":"ActiveDirectoryDomainName"},"ComputerNameStaticPrefix":{"type":"string","description":"Fixed prefix to be used for computer name.","title":"ComputerNameStaticPrefix"},"ComputerNameSuffixRandomCharCount":{"type":"integer","description":"Dynamically generated characters used as suffix for computer name. Valid values 3 to 14","title":"ComputerNameSuffixRandomCharCount"},"OrganizationalUnit":{"type":"string","description":"Organizational unit (OU) where the computer account will be created. If this parameter is NULL, the well known computer object container will be used as published in the domain.","title":"OrganizationalUnit"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"SupportsScopeTags":{"type":"boolean","description":"Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.","title":"SupportsScopeTags"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationemailprofilepolicywindows10":{"type":"object","description":"Intune Device Configuration Email Profile Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationemailprofilepolicywindows10","properties":{"AccountName":{"type":"string","description":"Account name.","title":"AccountName"},"DurationOfEmailToSync":{"enum":["userDefined","oneDay","threeDays","oneWeek","twoWeeks","oneMonth","unlimited"],"description":"Duration of email to sync. Possible values are: userDefined, oneDay, threeDays, oneWeek, twoWeeks, oneMonth, unlimited.","title":"DurationOfEmailToSync"},"EmailAddressSource":{"enum":["userPrincipalName","primarySmtpAddress"],"description":"Email attribute that is picked from AAD and injected into this profile before installing on the device. Possible values are: userPrincipalName, primarySmtpAddress.","title":"EmailAddressSource"},"EmailSyncSchedule":{"enum":["userDefined","asMessagesArrive","manual","fifteenMinutes","thirtyMinutes","sixtyMinutes","basedOnMyUsage"],"description":"Email sync schedule. Possible values are: userDefined, asMessagesArrive, manual, fifteenMinutes, thirtyMinutes, sixtyMinutes, basedOnMyUsage.","title":"EmailSyncSchedule"},"HostName":{"type":"string","description":"Exchange location that (URL) that the native mail app connects to.","title":"HostName"},"RequireSsl":{"type":"boolean","description":"Indicates whether or not to use SSL.","title":"RequireSsl"},"SyncCalendar":{"type":"boolean","description":"Whether or not to sync the calendar.","title":"SyncCalendar"},"SyncContacts":{"type":"boolean","description":"Whether or not to sync contacts.","title":"SyncContacts"},"SyncTasks":{"type":"boolean","description":"Whether or not to sync tasks.","title":"SyncTasks"},"CustomDomainName":{"type":"string","description":"Custom domain name value used while generating an email profile before installing on the device.","title":"CustomDomainName"},"UserDomainNameSource":{"enum":["fullDomainName","netBiosDomainName"],"description":"UserDomainname attribute that is picked from AAD and injected into this profile before installing on the device. Possible values are: fullDomainName, netBiosDomainName.","title":"UserDomainNameSource"},"UsernameAADSource":{"enum":["userPrincipalName","primarySmtpAddress","samAccountName"],"description":"Name of the AAD field, that will be used to retrieve UserName for email profile. Possible values are: userPrincipalName, primarySmtpAddress, samAccountName.","title":"UsernameAADSource"},"UsernameSource":{"enum":["userPrincipalName","primarySmtpAddress"],"description":"Username attribute that is picked from AAD and injected into this profile before installing on the device. Possible values are: userPrincipalName, primarySmtpAddress.","title":"UsernameSource"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationendpointprotectionpolicywindows10":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationendpointprotectionpolicywindows10","properties":{"ApplicationGuardAllowCameraMicrophoneRedirection":{"type":"boolean","description":"Gets or sets whether applications inside Microsoft Defender Application Guard can access the devices camera and microphone.","title":"ApplicationGuardAllowCameraMicrophoneRedirection"},"ApplicationGuardAllowFileSaveOnHost":{"type":"boolean","description":"Allow users to download files from Edge in the application guard container and save them on the host file system","title":"ApplicationGuardAllowFileSaveOnHost"},"ApplicationGuardAllowPersistence":{"type":"boolean","description":"Allow persisting user generated data inside the App Guard Container (favorites, cookies, web passwords, etc.)","title":"ApplicationGuardAllowPersistence"},"ApplicationGuardAllowPrintToLocalPrinters":{"type":"boolean","description":"Allow printing to Local Printers from Container","title":"ApplicationGuardAllowPrintToLocalPrinters"},"ApplicationGuardAllowPrintToNetworkPrinters":{"type":"boolean","description":"Allow printing to Network Printers from Container","title":"ApplicationGuardAllowPrintToNetworkPrinters"},"ApplicationGuardAllowPrintToPDF":{"type":"boolean","description":"Allow printing to PDF from Container","title":"ApplicationGuardAllowPrintToPDF"},"ApplicationGuardAllowPrintToXPS":{"type":"boolean","description":"Allow printing to XPS from Container","title":"ApplicationGuardAllowPrintToXPS"},"ApplicationGuardAllowVirtualGPU":{"type":"boolean","description":"Allow application guard to use virtual GPU","title":"ApplicationGuardAllowVirtualGPU"},"ApplicationGuardBlockClipboardSharing":{"enum":["notConfigured","blockBoth","blockHostToContainer","blockContainerToHost","blockNone"],"description":"Block clipboard to share data from Host to Container, or from Container to Host, or both ways, or neither ways. Possible values are: notConfigured, blockBoth, blockHostToContainer, blockContainerToHost, blockNone.","title":"ApplicationGuardBlockClipboardSharing"},"ApplicationGuardBlockFileTransfer":{"enum":["notConfigured","blockImageAndTextFile","blockImageFile","blockNone","blockTextFile"],"description":"Block clipboard to transfer image file, text file or neither of them. Possible values are: notConfigured, blockImageAndTextFile, blockImageFile, blockNone, blockTextFile.","title":"ApplicationGuardBlockFileTransfer"},"ApplicationGuardBlockNonEnterpriseContent":{"type":"boolean","description":"Block enterprise sites to load non-enterprise content, such as third party plug-ins","title":"ApplicationGuardBlockNonEnterpriseContent"},"ApplicationGuardCertificateThumbprints":{"type":"array","items":{"type":"string"},"description":"Allows certain device level Root Certificates to be shared with the Microsoft Defender Application Guard container.","title":"ApplicationGuardCertificateThumbprints"},"ApplicationGuardEnabled":{"type":"boolean","description":"Enable Windows Defender Application Guard","title":"ApplicationGuardEnabled"},"ApplicationGuardEnabledOptions":{"enum":["notConfigured","enabledForEdge","enabledForOffice","enabledForEdgeAndOffice"],"description":"Enable Windows Defender Application Guard for newer Windows builds. Possible values are: notConfigured, enabledForEdge, enabledForOffice, enabledForEdgeAndOffice.","title":"ApplicationGuardEnabledOptions"},"ApplicationGuardForceAuditing":{"type":"boolean","description":"Force auditing will persist Windows logs and events to meet security/compliance criteria (sample events are user login-logoff, use of privilege rights, software installation, system changes, etc.)","title":"ApplicationGuardForceAuditing"},"AppLockerApplicationControl":{"enum":["notConfigured","enforceComponentsAndStoreApps","auditComponentsAndStoreApps","enforceComponentsStoreAppsAndSmartlocker","auditComponentsStoreAppsAndSmartlocker"],"description":"Enables the Admin to choose what types of app to allow on devices. Possible values are: notConfigured, enforceComponentsAndStoreApps, auditComponentsAndStoreApps, enforceComponentsStoreAppsAndSmartlocker, auditComponentsStoreAppsAndSmartlocker.","title":"AppLockerApplicationControl"},"BitLockerAllowStandardUserEncryption":{"type":"boolean","description":"Allows the admin to allow standard users to enable encryption during Azure AD Join.","title":"BitLockerAllowStandardUserEncryption"},"BitLockerDisableWarningForOtherDiskEncryption":{"type":"boolean","description":"Allows the Admin to disable the warning prompt for other disk encryption on the user machines.","title":"BitLockerDisableWarningForOtherDiskEncryption"},"BitLockerEnableStorageCardEncryptionOnMobile":{"type":"boolean","description":"Allows the admin to require encryption to be turned on using BitLocker. This policy is valid only for a mobile SKU.","title":"BitLockerEnableStorageCardEncryptionOnMobile"},"BitLockerEncryptDevice":{"type":"boolean","description":"Allows the admin to require encryption to be turned on using BitLocker.","title":"BitLockerEncryptDevice"},"BitLockerFixedDrivePolicy":{"type":"object","description":"BitLocker Fixed Drive Policy.","title":"BitLockerFixedDrivePolicy","properties":{"EncryptionMethod":{"enum":["aesCbc128","aesCbc256","xtsAes128","xtsAes256"],"description":"Select the encryption method for fixed drives. Possible values are: aesCbc128, aesCbc256, xtsAes128, xtsAes256.","title":"EncryptionMethod"},"RecoveryOptions":{"type":"object","description":"This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker.","title":"RecoveryOptions","properties":{"BlockDataRecoveryAgent":{"type":"boolean","description":"Indicates whether to block certificate-based data recovery agent.","title":"BlockDataRecoveryAgent"},"EnableBitLockerAfterRecoveryInformationToStore":{"type":"boolean","description":"Indicates whether or not to enable BitLocker until recovery information is stored in AD DS.","title":"EnableBitLockerAfterRecoveryInformationToStore"},"EnableRecoveryInformationSaveToStore":{"type":"boolean","description":"Indicates whether or not to allow BitLocker recovery information to store in AD DS.","title":"EnableRecoveryInformationSaveToStore"},"HideRecoveryOptions":{"type":"boolean","description":"Indicates whether or not to allow showing recovery options in BitLocker Setup Wizard for fixed or system disk.","title":"HideRecoveryOptions"},"RecoveryInformationToStore":{"enum":["passwordAndKey","passwordOnly"],"description":"Configure what pieces of BitLocker recovery information are stored to AD DS. Possible values are: passwordAndKey, passwordOnly.","title":"RecoveryInformationToStore"},"RecoveryKeyUsage":{"enum":["blocked","required","allowed","notConfigured"],"description":"Indicates whether users are allowed or required to generate a 256-bit recovery key for fixed or system disk. Possible values are: blocked, required, allowed, notConfigured.","title":"RecoveryKeyUsage"},"RecoveryPasswordUsage":{"enum":["blocked","required","allowed","notConfigured"],"description":"Indicates whether users are allowed or required to generate a 48-digit recovery password for fixed or system disk. Possible values are: blocked, required, allowed, notConfigured.","title":"RecoveryPasswordUsage"}},"required":[]},"RequireEncryptionForWriteAccess":{"type":"boolean","description":"This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer.","title":"RequireEncryptionForWriteAccess"}},"required":[]},"BitLockerRecoveryPasswordRotation":{"enum":["notConfigured","disabled","enabledForAzureAd","enabledForAzureAdAndHybrid"],"description":"This setting initiates a client-driven recovery password rotation after an OS drive recovery (either by using bootmgr or WinRE). Possible values are: notConfigured, disabled, enabledForAzureAd, enabledForAzureAdAndHybrid.","title":"BitLockerRecoveryPasswordRotation"},"BitLockerRemovableDrivePolicy":{"type":"object","description":"BitLocker Removable Drive Policy.","title":"BitLockerRemovableDrivePolicy","properties":{"BlockCrossOrganizationWriteAccess":{"type":"boolean","description":"This policy setting determines whether BitLocker protection is required for removable data drives to be writable on a computer.","title":"BlockCrossOrganizationWriteAccess"},"EncryptionMethod":{"enum":["aesCbc128","aesCbc256","xtsAes128","xtsAes256"],"description":"Select the encryption method for removable  drives. Possible values are: aesCbc128, aesCbc256, xtsAes128, xtsAes256.","title":"EncryptionMethod"},"RequireEncryptionForWriteAccess":{"type":"boolean","description":"Indicates whether to block write access to devices configured in another organization.  If requireEncryptionForWriteAccess is false, this value does not affect.","title":"RequireEncryptionForWriteAccess"}},"required":[]},"BitLockerSystemDrivePolicy":{"type":"object","description":"BitLocker System Drive Policy.","title":"BitLockerSystemDrivePolicy","properties":{"EncryptionMethod":{"enum":["aesCbc128","aesCbc256","xtsAes128","xtsAes256"],"description":"Select the encryption method for operating system drives. Possible values are: aesCbc128, aesCbc256, xtsAes128, xtsAes256.","title":"EncryptionMethod"},"MinimumPinLength":{"type":"integer","description":"Indicates the minimum length of startup pin. Valid values 4 to 20","title":"MinimumPinLength"},"PrebootRecoveryEnableMessageAndUrl":{"type":"boolean","description":"Enable pre-boot recovery message and Url. If requireStartupAuthentication is false, this value does not affect.","title":"PrebootRecoveryEnableMessageAndUrl"},"PrebootRecoveryMessage":{"type":"string","description":"Defines a custom recovery message.","title":"PrebootRecoveryMessage"},"PrebootRecoveryUrl":{"type":"string","description":"Defines a custom recovery URL.","title":"PrebootRecoveryUrl"},"RecoveryOptions":{"type":"object","description":"Allows to recover BitLocker encrypted operating system drives in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker.","title":"RecoveryOptions","properties":{"BlockDataRecoveryAgent":{"type":"boolean","description":"Indicates whether to block certificate-based data recovery agent.","title":"BlockDataRecoveryAgent"},"EnableBitLockerAfterRecoveryInformationToStore":{"type":"boolean","description":"Indicates whether or not to enable BitLocker until recovery information is stored in AD DS.","title":"EnableBitLockerAfterRecoveryInformationToStore"},"EnableRecoveryInformationSaveToStore":{"type":"boolean","description":"Indicates whether or not to allow BitLocker recovery information to store in AD DS.","title":"EnableRecoveryInformationSaveToStore"},"HideRecoveryOptions":{"type":"boolean","description":"Indicates whether or not to allow showing recovery options in BitLocker Setup Wizard for fixed or system disk.","title":"HideRecoveryOptions"},"RecoveryInformationToStore":{"enum":["passwordAndKey","passwordOnly"],"description":"Configure what pieces of BitLocker recovery information are stored to AD DS. Possible values are: passwordAndKey, passwordOnly.","title":"RecoveryInformationToStore"},"RecoveryKeyUsage":{"enum":["blocked","required","allowed","notConfigured"],"description":"Indicates whether users are allowed or required to generate a 256-bit recovery key for fixed or system disk. Possible values are: blocked, required, allowed, notConfigured.","title":"RecoveryKeyUsage"},"RecoveryPasswordUsage":{"enum":["blocked","required","allowed","notConfigured"],"description":"Indicates whether users are allowed or required to generate a 48-digit recovery password for fixed or system disk. Possible values are: blocked, required, allowed, notConfigured.","title":"RecoveryPasswordUsage"}},"required":[]},"StartupAuthenticationBlockWithoutTpmChip":{"type":"boolean","description":"Indicates whether to allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive).","title":"StartupAuthenticationBlockWithoutTpmChip"},"StartupAuthenticationRequired":{"type":"boolean","description":"Require additional authentication at startup.","title":"StartupAuthenticationRequired"},"StartupAuthenticationTpmKeyUsage":{"enum":["blocked","required","allowed","notConfigured"],"description":"Indicates if TPM startup key is allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.","title":"StartupAuthenticationTpmKeyUsage"},"StartupAuthenticationTpmPinAndKeyUsage":{"enum":["blocked","required","allowed","notConfigured"],"description":"Indicates if TPM startup pin key and key are allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.","title":"StartupAuthenticationTpmPinAndKeyUsage"},"StartupAuthenticationTpmPinUsage":{"enum":["blocked","required","allowed","notConfigured"],"description":"Indicates if TPM startup pin is allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.","title":"StartupAuthenticationTpmPinUsage"},"StartupAuthenticationTpmUsage":{"enum":["blocked","required","allowed","notConfigured"],"description":"Indicates if TPM startup is allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.","title":"StartupAuthenticationTpmUsage"}},"required":[]},"DefenderAdditionalGuardedFolders":{"type":"array","items":{"type":"string"},"description":"List of folder paths to be added to the list of protected folders","title":"DefenderAdditionalGuardedFolders"},"DefenderAdobeReaderLaunchChildProcess":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating the behavior of Adobe Reader from creating child processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderAdobeReaderLaunchChildProcess"},"DefenderAdvancedRansomewareProtectionType":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating use of advanced protection against ransomeware. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderAdvancedRansomewareProtectionType"},"DefenderAllowBehaviorMonitoring":{"type":"boolean","description":"Allows or disallows Windows Defender Behavior Monitoring functionality.","title":"DefenderAllowBehaviorMonitoring"},"DefenderAllowCloudProtection":{"type":"boolean","description":"To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.","title":"DefenderAllowCloudProtection"},"DefenderAllowEndUserAccess":{"type":"boolean","description":"Allows or disallows user access to the Windows Defender UI. If disallowed, all Windows Defender notifications will also be suppressed.","title":"DefenderAllowEndUserAccess"},"DefenderAllowIntrusionPreventionSystem":{"type":"boolean","description":"Allows or disallows Windows Defender Intrusion Prevention functionality.","title":"DefenderAllowIntrusionPreventionSystem"},"DefenderAllowOnAccessProtection":{"type":"boolean","description":"Allows or disallows Windows Defender On Access Protection functionality.","title":"DefenderAllowOnAccessProtection"},"DefenderAllowRealTimeMonitoring":{"type":"boolean","description":"Allows or disallows Windows Defender Realtime Monitoring functionality.","title":"DefenderAllowRealTimeMonitoring"},"DefenderAllowScanArchiveFiles":{"type":"boolean","description":"Allows or disallows scanning of archives.","title":"DefenderAllowScanArchiveFiles"},"DefenderAllowScanDownloads":{"type":"boolean","description":"Allows or disallows Windows Defender IOAVP Protection functionality.","title":"DefenderAllowScanDownloads"},"DefenderAllowScanNetworkFiles":{"type":"boolean","description":"Allows or disallows a scanning of network files.","title":"DefenderAllowScanNetworkFiles"},"DefenderAllowScanRemovableDrivesDuringFullScan":{"type":"boolean","description":"Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned.","title":"DefenderAllowScanRemovableDrivesDuringFullScan"},"DefenderAllowScanScriptsLoadedInInternetExplorer":{"type":"boolean","description":"Allows or disallows Windows Defender Script Scanning functionality.","title":"DefenderAllowScanScriptsLoadedInInternetExplorer"},"DefenderAttackSurfaceReductionExcludedPaths":{"type":"array","items":{"type":"string"},"description":"List of exe files and folders to be excluded from attack surface reduction rules","title":"DefenderAttackSurfaceReductionExcludedPaths"},"DefenderBlockEndUserAccess":{"type":"boolean","description":"Allows or disallows user access to the Windows Defender UI. If disallowed, all Windows Defender notifications will also be suppressed.","title":"DefenderBlockEndUserAccess"},"DefenderBlockPersistenceThroughWmiType":{"enum":["userDefined","block","auditMode","warn","disable"],"description":"Value indicating the behavior ofBlock persistence through WMI event subscription. Possible values are: userDefined, block, auditMode, warn, disable.","title":"DefenderBlockPersistenceThroughWmiType"},"DefenderCheckForSignaturesBeforeRunningScan":{"type":"boolean","description":"This policy setting allows you to manage whether a check for new virus and spyware definitions will occur before running a scan.","title":"DefenderCheckForSignaturesBeforeRunningScan"},"DefenderCloudBlockLevel":{"enum":["notConfigured","high","highPlus","zeroTolerance"],"description":"Added in Windows 10, version 1709. This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. This feature requires the 'Join Microsoft MAPS' setting enabled in order to function. Possible values are: notConfigured, high, highPlus, zeroTolerance.","title":"DefenderCloudBlockLevel"},"DefenderCloudExtendedTimeoutInSeconds":{"type":"integer","description":"Added in Windows 10, version 1709. This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. This feature depends on three other MAPS settings the must all be enabled- 'Configure the 'Block at First Sight' feature 'Join Microsoft MAPS' 'Send file samples when further analysis is required'. Valid values 0 to 50","title":"DefenderCloudExtendedTimeoutInSeconds"},"DefenderDaysBeforeDeletingQuarantinedMalware":{"type":"integer","description":"Time period (in days) that quarantine items will be stored on the system. Valid values 0 to 90","title":"DefenderDaysBeforeDeletingQuarantinedMalware"},"DefenderDetectedMalwareActions":{"type":"object","description":"Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take.","title":"DefenderDetectedMalwareActions","properties":{"HighSeverity":{"enum":["deviceDefault","clean","quarantine","remove","allow","userDefined","block"],"description":"Indicates a Defender action to take for high severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.","title":"HighSeverity"},"LowSeverity":{"enum":["deviceDefault","clean","quarantine","remove","allow","userDefined","block"],"description":"Indicates a Defender action to take for low severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.","title":"LowSeverity"},"ModerateSeverity":{"enum":["deviceDefault","clean","quarantine","remove","allow","userDefined","block"],"description":"Indicates a Defender action to take for moderate severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.","title":"ModerateSeverity"},"SevereSeverity":{"enum":["deviceDefault","clean","quarantine","remove","allow","userDefined","block"],"description":"Indicates a Defender action to take for severe severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.","title":"SevereSeverity"}},"required":[]},"DefenderDisableBehaviorMonitoring":{"type":"boolean","description":"Allows or disallows Windows Defender Behavior Monitoring functionality.","title":"DefenderDisableBehaviorMonitoring"},"DefenderDisableCatchupFullScan":{"type":"boolean","description":"This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time.","title":"DefenderDisableCatchupFullScan"},"DefenderDisableCatchupQuickScan":{"type":"boolean","description":"This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time.","title":"DefenderDisableCatchupQuickScan"},"DefenderDisableCloudProtection":{"type":"boolean","description":"To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.","title":"DefenderDisableCloudProtection"},"DefenderDisableIntrusionPreventionSystem":{"type":"boolean","description":"Allows or disallows Windows Defender Intrusion Prevention functionality.","title":"DefenderDisableIntrusionPreventionSystem"},"DefenderDisableOnAccessProtection":{"type":"boolean","description":"Allows or disallows Windows Defender On Access Protection functionality.","title":"DefenderDisableOnAccessProtection"},"DefenderDisableRealTimeMonitoring":{"type":"boolean","description":"Allows or disallows Windows Defender Realtime Monitoring functionality.","title":"DefenderDisableRealTimeMonitoring"},"DefenderDisableScanArchiveFiles":{"type":"boolean","description":"Allows or disallows scanning of archives.","title":"DefenderDisableScanArchiveFiles"},"DefenderDisableScanDownloads":{"type":"boolean","description":"Allows or disallows Windows Defender IOAVP Protection functionality.","title":"DefenderDisableScanDownloads"},"DefenderDisableScanNetworkFiles":{"type":"boolean","description":"Allows or disallows a scanning of network files.","title":"DefenderDisableScanNetworkFiles"},"DefenderDisableScanRemovableDrivesDuringFullScan":{"type":"boolean","description":"Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned.","title":"DefenderDisableScanRemovableDrivesDuringFullScan"},"DefenderDisableScanScriptsLoadedInInternetExplorer":{"type":"boolean","description":"Allows or disallows Windows Defender Script Scanning functionality.","title":"DefenderDisableScanScriptsLoadedInInternetExplorer"},"DefenderEmailContentExecution":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating if execution of executable content (exe, dll, ps, js, vbs, etc) should be dropped from email (webmail/mail-client). Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderEmailContentExecution"},"DefenderEmailContentExecutionType":{"enum":["userDefined","block","auditMode","warn","disable"],"description":"Value indicating if execution of executable content (exe, dll, ps, js, vbs, etc) should be dropped from email (webmail/mail-client). Possible values are: userDefined, block, auditMode, warn, disable.","title":"DefenderEmailContentExecutionType"},"DefenderEnableLowCpuPriority":{"type":"boolean","description":"This policy setting allows you to enable or disable low CPU priority for scheduled scans.","title":"DefenderEnableLowCpuPriority"},"DefenderEnableScanIncomingMail":{"type":"boolean","description":"Allows or disallows scanning of email.","title":"DefenderEnableScanIncomingMail"},"DefenderEnableScanMappedNetworkDrivesDuringFullScan":{"type":"boolean","description":"Allows or disallows a full scan of mapped network drives.","title":"DefenderEnableScanMappedNetworkDrivesDuringFullScan"},"DefenderExploitProtectionXml":{"type":"string","description":"Xml content containing information regarding exploit protection details.","title":"DefenderExploitProtectionXml"},"DefenderExploitProtectionXmlFileName":{"type":"string","description":"Name of the file from which DefenderExploitProtectionXml was obtained.","title":"DefenderExploitProtectionXmlFileName"},"DefenderFileExtensionsToExclude":{"type":"array","items":{"type":"string"},"description":"File extensions to exclude from scans and real time protection.","title":"DefenderFileExtensionsToExclude"},"DefenderFilesAndFoldersToExclude":{"type":"array","items":{"type":"string"},"description":"Files and folder to exclude from scans and real time protection.","title":"DefenderFilesAndFoldersToExclude"},"DefenderGuardedFoldersAllowedAppPaths":{"type":"array","items":{"type":"string"},"description":"List of paths to exe that are allowed to access protected folders","title":"DefenderGuardedFoldersAllowedAppPaths"},"DefenderGuardMyFoldersType":{"enum":["userDefined","enable","auditMode","blockDiskModification","auditDiskModification"],"description":"Value indicating the behavior of protected folders. Possible values are: userDefined, enable, auditMode, blockDiskModification, auditDiskModification.","title":"DefenderGuardMyFoldersType"},"DefenderNetworkProtectionType":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating the behavior of NetworkProtection. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderNetworkProtectionType"},"DefenderOfficeAppsExecutableContentCreationOrLaunch":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating the behavior of Office applications/macros creating or launching executable content. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderOfficeAppsExecutableContentCreationOrLaunch"},"DefenderOfficeAppsExecutableContentCreationOrLaunchType":{"enum":["userDefined","block","auditMode","warn","disable"],"description":"Value indicating the behavior of Office applications/macros creating or launching executable content. Possible values are: userDefined, block, auditMode, warn, disable.","title":"DefenderOfficeAppsExecutableContentCreationOrLaunchType"},"DefenderOfficeAppsLaunchChildProcess":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating the behavior of Office application launching child processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderOfficeAppsLaunchChildProcess"},"DefenderOfficeAppsLaunchChildProcessType":{"enum":["userDefined","block","auditMode","warn","disable"],"description":"Value indicating the behavior of Office application launching child processes. Possible values are: userDefined, block, auditMode, warn, disable.","title":"DefenderOfficeAppsLaunchChildProcessType"},"DefenderOfficeAppsOtherProcessInjection":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating the behavior of Office applications injecting into other processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderOfficeAppsOtherProcessInjection"},"DefenderOfficeAppsOtherProcessInjectionType":{"enum":["userDefined","block","auditMode","warn","disable"],"description":"Value indicating the behavior ofOffice applications injecting into other processes. Possible values are: userDefined, block, auditMode, warn, disable.","title":"DefenderOfficeAppsOtherProcessInjectionType"},"DefenderOfficeCommunicationAppsLaunchChildProcess":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating the behavior of Office communication applications, including Microsoft Outlook, from creating child processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderOfficeCommunicationAppsLaunchChildProcess"},"DefenderOfficeMacroCodeAllowWin32Imports":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating the behavior of Win32 imports from Macro code in Office. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderOfficeMacroCodeAllowWin32Imports"},"DefenderOfficeMacroCodeAllowWin32ImportsType":{"enum":["userDefined","block","auditMode","warn","disable"],"description":"Value indicating the behavior of Win32 imports from Macro code in Office. Possible values are: userDefined, block, auditMode, warn, disable.","title":"DefenderOfficeMacroCodeAllowWin32ImportsType"},"DefenderPotentiallyUnwantedAppAction":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Added in Windows 10, version 1607. Specifies the level of detection for potentially unwanted applications (PUAs). Windows Defender alerts you when potentially unwanted software is being downloaded or attempts to install itself on your computer. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderPotentiallyUnwantedAppAction"},"DefenderPreventCredentialStealingType":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating if credential stealing from the Windows local security authority subsystem is permitted. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderPreventCredentialStealingType"},"DefenderProcessCreation":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating response to process creations originating from PSExec and WMI commands. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderProcessCreation"},"DefenderProcessCreationType":{"enum":["userDefined","block","auditMode","warn","disable"],"description":"Value indicating response to process creations originating from PSExec and WMI commands. Possible values are: userDefined, block, auditMode, warn, disable.","title":"DefenderProcessCreationType"},"DefenderProcessesToExclude":{"type":"array","items":{"type":"string"},"description":"Processes to exclude from scans and real time protection.","title":"DefenderProcessesToExclude"},"DefenderScanDirection":{"enum":["monitorAllFiles","monitorIncomingFilesOnly","monitorOutgoingFilesOnly"],"description":"Controls which sets of files should be monitored. Possible values are: monitorAllFiles, monitorIncomingFilesOnly, monitorOutgoingFilesOnly.","title":"DefenderScanDirection"},"DefenderScanMaxCpuPercentage":{"type":"integer","description":"Represents the average CPU load factor for the Windows Defender scan (in percent). The default value is 50. Valid values 0 to 100","title":"DefenderScanMaxCpuPercentage"},"DefenderScanType":{"enum":["userDefined","disabled","quick","full"],"description":"Selects whether to perform a quick scan or full scan. Possible values are: userDefined, disabled, quick, full.","title":"DefenderScanType"},"DefenderScheduledQuickScanTime":{"type":"string","description":"Selects the time of day that the Windows Defender quick scan should run. For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM. The default value is 120","title":"DefenderScheduledQuickScanTime"},"DefenderScheduledScanDay":{"enum":["userDefined","everyday","sunday","monday","tuesday","wednesday","thursday","friday","saturday","noScheduledScan"],"description":"Selects the day that the Windows Defender scan should run. Possible values are: userDefined, everyday, sunday, monday, tuesday, wednesday, thursday, friday, saturday, noScheduledScan.","title":"DefenderScheduledScanDay"},"DefenderScheduledScanTime":{"type":"string","description":"Selects the time of day that the Windows Defender scan should run.","title":"DefenderScheduledScanTime"},"DefenderScriptDownloadedPayloadExecution":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating the behavior of js/vbs executing payload downloaded from Internet. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderScriptDownloadedPayloadExecution"},"DefenderScriptDownloadedPayloadExecutionType":{"enum":["userDefined","block","auditMode","warn","disable"],"description":"Value indicating the behavior of js/vbs executing payload downloaded from Internet. Possible values are: userDefined, block, auditMode, warn, disable.","title":"DefenderScriptDownloadedPayloadExecutionType"},"DefenderScriptObfuscatedMacroCode":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating the behavior of obfuscated js/vbs/ps/macro code. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderScriptObfuscatedMacroCode"},"DefenderScriptObfuscatedMacroCodeType":{"enum":["userDefined","block","auditMode","warn","disable"],"description":"Value indicating the behavior of obfuscated js/vbs/ps/macro code. Possible values are: userDefined, block, auditMode, warn, disable.","title":"DefenderScriptObfuscatedMacroCodeType"},"DefenderSecurityCenterBlockExploitProtectionOverride":{"type":"boolean","description":"Indicates whether or not to block user from overriding Exploit Protection settings.","title":"DefenderSecurityCenterBlockExploitProtectionOverride"},"DefenderSecurityCenterDisableAccountUI":{"type":"boolean","description":"Used to disable the display of the account protection area.","title":"DefenderSecurityCenterDisableAccountUI"},"DefenderSecurityCenterDisableAppBrowserUI":{"type":"boolean","description":"Used to disable the display of the app and browser protection area.","title":"DefenderSecurityCenterDisableAppBrowserUI"},"DefenderSecurityCenterDisableClearTpmUI":{"type":"boolean","description":"Used to disable the display of the Clear TPM button.","title":"DefenderSecurityCenterDisableClearTpmUI"},"DefenderSecurityCenterDisableFamilyUI":{"type":"boolean","description":"Used to disable the display of the family options area.","title":"DefenderSecurityCenterDisableFamilyUI"},"DefenderSecurityCenterDisableHardwareUI":{"type":"boolean","description":"Used to disable the display of the hardware protection area.","title":"DefenderSecurityCenterDisableHardwareUI"},"DefenderSecurityCenterDisableHealthUI":{"type":"boolean","description":"Used to disable the display of the device performance and health area.","title":"DefenderSecurityCenterDisableHealthUI"},"DefenderSecurityCenterDisableNetworkUI":{"type":"boolean","description":"Used to disable the display of the firewall and network protection area.","title":"DefenderSecurityCenterDisableNetworkUI"},"DefenderSecurityCenterDisableNotificationAreaUI":{"type":"boolean","description":"Used to disable the display of the notification area control. The user needs to either sign out and sign in or reboot the computer for this setting to take effect.","title":"DefenderSecurityCenterDisableNotificationAreaUI"},"DefenderSecurityCenterDisableRansomwareUI":{"type":"boolean","description":"Used to disable the display of the ransomware protection area.","title":"DefenderSecurityCenterDisableRansomwareUI"},"DefenderSecurityCenterDisableSecureBootUI":{"type":"boolean","description":"Used to disable the display of the secure boot area under Device security.","title":"DefenderSecurityCenterDisableSecureBootUI"},"DefenderSecurityCenterDisableTroubleshootingUI":{"type":"boolean","description":"Used to disable the display of the security process troubleshooting under Device security.","title":"DefenderSecurityCenterDisableTroubleshootingUI"},"DefenderSecurityCenterDisableVirusUI":{"type":"boolean","description":"Used to disable the display of the virus and threat protection area.","title":"DefenderSecurityCenterDisableVirusUI"},"DefenderSecurityCenterDisableVulnerableTpmFirmwareUpdateUI":{"type":"boolean","description":"Used to disable the display of update TPM Firmware when a vulnerable firmware is detected.","title":"DefenderSecurityCenterDisableVulnerableTpmFirmwareUpdateUI"},"DefenderSecurityCenterHelpEmail":{"type":"string","description":"The email address that is displayed to users.","title":"DefenderSecurityCenterHelpEmail"},"DefenderSecurityCenterHelpPhone":{"type":"string","description":"The phone number or Skype ID that is displayed to users.","title":"DefenderSecurityCenterHelpPhone"},"DefenderSecurityCenterHelpURL":{"type":"string","description":"The help portal URL this is displayed to users.","title":"DefenderSecurityCenterHelpURL"},"DefenderSecurityCenterITContactDisplay":{"enum":["notConfigured","displayInAppAndInNotifications","displayOnlyInApp","displayOnlyInNotifications"],"description":"Configure where to display IT contact information to end users. Possible values are: notConfigured, displayInAppAndInNotifications, displayOnlyInApp, displayOnlyInNotifications.","title":"DefenderSecurityCenterITContactDisplay"},"DefenderSecurityCenterNotificationsFromApp":{"enum":["notConfigured","blockNoncriticalNotifications","blockAllNotifications"],"description":"Notifications to show from the displayed areas of app. Possible values are: notConfigured, blockNoncriticalNotifications, blockAllNotifications.","title":"DefenderSecurityCenterNotificationsFromApp"},"DefenderSecurityCenterOrganizationDisplayName":{"type":"string","description":"The company name that is displayed to the users.","title":"DefenderSecurityCenterOrganizationDisplayName"},"DefenderSignatureUpdateIntervalInHours":{"type":"integer","description":"Specifies the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. Valid values 0 to 24","title":"DefenderSignatureUpdateIntervalInHours"},"DefenderSubmitSamplesConsentType":{"enum":["sendSafeSamplesAutomatically","alwaysPrompt","neverSend","sendAllSamplesAutomatically"],"description":"Checks for the user consent level in Windows Defender to send data. Possible values are: sendSafeSamplesAutomatically, alwaysPrompt, neverSend, sendAllSamplesAutomatically.","title":"DefenderSubmitSamplesConsentType"},"DefenderUntrustedExecutable":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating response to executables that don't meet a prevalence, age, or trusted list criteria. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderUntrustedExecutable"},"DefenderUntrustedExecutableType":{"enum":["userDefined","block","auditMode","warn","disable"],"description":"Value indicating response to executables that don't meet a prevalence, age, or trusted list criteria. Possible values are: userDefined, block, auditMode, warn, disable.","title":"DefenderUntrustedExecutableType"},"DefenderUntrustedUSBProcess":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Value indicating response to untrusted and unsigned processes that run from USB. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderUntrustedUSBProcess"},"DefenderUntrustedUSBProcessType":{"enum":["userDefined","block","auditMode","warn","disable"],"description":"Value indicating response to untrusted and unsigned processes that run from USB. Possible values are: userDefined, block, auditMode, warn, disable.","title":"DefenderUntrustedUSBProcessType"},"DeviceGuardEnableSecureBootWithDMA":{"type":"boolean","description":"This property will be deprecated in May 2019 and will be replaced with property DeviceGuardSecureBootWithDMA. Specifies whether Platform Security Level is enabled at next reboot.","title":"DeviceGuardEnableSecureBootWithDMA"},"DeviceGuardEnableVirtualizationBasedSecurity":{"type":"boolean","description":"Turns On Virtualization Based Security(VBS).","title":"DeviceGuardEnableVirtualizationBasedSecurity"},"DeviceGuardLaunchSystemGuard":{"enum":["notConfigured","enabled","disabled"],"description":"Allows the IT admin to configure the launch of System Guard. Possible values are: notConfigured, enabled, disabled.","title":"DeviceGuardLaunchSystemGuard"},"DeviceGuardLocalSystemAuthorityCredentialGuardSettings":{"enum":["notConfigured","enableWithUEFILock","enableWithoutUEFILock","disable"],"description":"Turn on Credential Guard when Platform Security Level with Secure Boot and Virtualization Based Security are both enabled. Possible values are: notConfigured, enableWithUEFILock, enableWithoutUEFILock, disable.","title":"DeviceGuardLocalSystemAuthorityCredentialGuardSettings"},"DeviceGuardSecureBootWithDMA":{"enum":["notConfigured","withoutDMA","withDMA"],"description":"Specifies whether Platform Security Level is enabled at next reboot. Possible values are: notConfigured, withoutDMA, withDMA.","title":"DeviceGuardSecureBootWithDMA"},"DmaGuardDeviceEnumerationPolicy":{"enum":["deviceDefault","blockAll","allowAll"],"description":"This policy is intended to provide additional security against external DMA capable devices. It allows for more control over the enumeration of external DMA capable devices incompatible with DMA Remapping/device memory isolation and sandboxing. This policy only takes effect when Kernel DMA Protection is supported and enabled by the system firmware. Kernel DMA Protection is a platform feature that cannot be controlled via policy or by end user. It has to be supported by the system at the time of manufacturing. To check if the system supports Kernel DMA Protection, please check the Kernel DMA Protection field in the Summary page of MSINFO32.exe. Possible values are: deviceDefault, blockAll, allowAll.","title":"DmaGuardDeviceEnumerationPolicy"},"FirewallBlockStatefulFTP":{"type":"boolean","description":"Blocks stateful FTP connections to the device","title":"FirewallBlockStatefulFTP"},"FirewallCertificateRevocationListCheckMethod":{"enum":["deviceDefault","none","attempt","require"],"description":"Specify how the certificate revocation list is to be enforced. Possible values are: deviceDefault, none, attempt, require.","title":"FirewallCertificateRevocationListCheckMethod"},"FirewallIdleTimeoutForSecurityAssociationInSeconds":{"type":"integer","description":"Configures the idle timeout for security associations, in seconds, from 300 to 3600 inclusive. This is the period after which security associations will expire and be deleted. Valid values 300 to 3600","title":"FirewallIdleTimeoutForSecurityAssociationInSeconds"},"FirewallIPSecExemptionsAllowDHCP":{"type":"boolean","description":"Configures IPSec exemptions to allow both IPv4 and IPv6 DHCP traffic","title":"FirewallIPSecExemptionsAllowDHCP"},"FirewallIPSecExemptionsAllowICMP":{"type":"boolean","description":"Configures IPSec exemptions to allow ICMP","title":"FirewallIPSecExemptionsAllowICMP"},"FirewallIPSecExemptionsAllowNeighborDiscovery":{"type":"boolean","description":"Configures IPSec exemptions to allow neighbor discovery IPv6 ICMP type-codes","title":"FirewallIPSecExemptionsAllowNeighborDiscovery"},"FirewallIPSecExemptionsAllowRouterDiscovery":{"type":"boolean","description":"Configures IPSec exemptions to allow router discovery IPv6 ICMP type-codes","title":"FirewallIPSecExemptionsAllowRouterDiscovery"},"FirewallIPSecExemptionsNone":{"type":"boolean","description":"Configures IPSec exemptions to no exemptions","title":"FirewallIPSecExemptionsNone"},"FirewallMergeKeyingModuleSettings":{"type":"boolean","description":"If an authentication set is not fully supported by a keying module, direct the module to ignore only unsupported authentication suites rather than the entire set","title":"FirewallMergeKeyingModuleSettings"},"FirewallPacketQueueingMethod":{"enum":["deviceDefault","disabled","queueInbound","queueOutbound","queueBoth"],"description":"Configures how packet queueing should be applied in the tunnel gateway scenario. Possible values are: deviceDefault, disabled, queueInbound, queueOutbound, queueBoth.","title":"FirewallPacketQueueingMethod"},"FirewallPreSharedKeyEncodingMethod":{"enum":["deviceDefault","none","utF8"],"description":"Select the preshared key encoding to be used. Possible values are: deviceDefault, none, utF8.","title":"FirewallPreSharedKeyEncodingMethod"},"FirewallProfileDomain":{"type":"object","description":"Configures the firewall profile settings for domain networks","title":"FirewallProfileDomain","properties":{"AuthorizedApplicationRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.","title":"AuthorizedApplicationRulesFromGroupPolicyMerged"},"AuthorizedApplicationRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.","title":"AuthorizedApplicationRulesFromGroupPolicyNotMerged"},"ConnectionSecurityRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.","title":"ConnectionSecurityRulesFromGroupPolicyMerged"},"ConnectionSecurityRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.","title":"ConnectionSecurityRulesFromGroupPolicyNotMerged"},"FirewallEnabled":{"enum":["notConfigured","blocked","allowed"],"description":"Configures the host device to allow or block the firewall and advanced security enforcement for the network profile. Possible values are: notConfigured, blocked, allowed.","title":"FirewallEnabled"},"GlobalPortRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.","title":"GlobalPortRulesFromGroupPolicyMerged"},"GlobalPortRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.","title":"GlobalPortRulesFromGroupPolicyNotMerged"},"InboundConnectionsBlocked":{"type":"boolean","description":"Configures the firewall to block all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.","title":"InboundConnectionsBlocked"},"InboundConnectionsRequired":{"type":"boolean","description":"Configures the firewall to allow all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.","title":"InboundConnectionsRequired"},"InboundNotificationsBlocked":{"type":"boolean","description":"Prevents the firewall from displaying notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.","title":"InboundNotificationsBlocked"},"InboundNotificationsRequired":{"type":"boolean","description":"Allows the firewall to display notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.","title":"InboundNotificationsRequired"},"IncomingTrafficBlocked":{"type":"boolean","description":"Configures the firewall to block all incoming traffic regardless of other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.","title":"IncomingTrafficBlocked"},"IncomingTrafficRequired":{"type":"boolean","description":"Configures the firewall to allow incoming traffic pursuant to other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.","title":"IncomingTrafficRequired"},"OutboundConnectionsBlocked":{"type":"boolean","description":"Configures the firewall to block all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.","title":"OutboundConnectionsBlocked"},"OutboundConnectionsRequired":{"type":"boolean","description":"Configures the firewall to allow all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.","title":"OutboundConnectionsRequired"},"PolicyRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.","title":"PolicyRulesFromGroupPolicyMerged"},"PolicyRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.","title":"PolicyRulesFromGroupPolicyNotMerged"},"SecuredPacketExemptionAllowed":{"type":"boolean","description":"Configures the firewall to allow the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.","title":"SecuredPacketExemptionAllowed"},"SecuredPacketExemptionBlocked":{"type":"boolean","description":"Configures the firewall to block the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.","title":"SecuredPacketExemptionBlocked"},"StealthModeBlocked":{"type":"boolean","description":"Prevent the server from operating in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.","title":"StealthModeBlocked"},"StealthModeRequired":{"type":"boolean","description":"Allow the server to operate in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.","title":"StealthModeRequired"},"UnicastResponsesToMulticastBroadcastsBlocked":{"type":"boolean","description":"Configures the firewall to block unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.","title":"UnicastResponsesToMulticastBroadcastsBlocked"},"UnicastResponsesToMulticastBroadcastsRequired":{"type":"boolean","description":"Configures the firewall to allow unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.","title":"UnicastResponsesToMulticastBroadcastsRequired"}},"required":[]},"FirewallProfilePrivate":{"type":"object","description":"Configures the firewall profile settings for private networks","title":"FirewallProfilePrivate","properties":{"AuthorizedApplicationRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.","title":"AuthorizedApplicationRulesFromGroupPolicyMerged"},"AuthorizedApplicationRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.","title":"AuthorizedApplicationRulesFromGroupPolicyNotMerged"},"ConnectionSecurityRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.","title":"ConnectionSecurityRulesFromGroupPolicyMerged"},"ConnectionSecurityRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.","title":"ConnectionSecurityRulesFromGroupPolicyNotMerged"},"FirewallEnabled":{"enum":["notConfigured","blocked","allowed"],"description":"Configures the host device to allow or block the firewall and advanced security enforcement for the network profile. Possible values are: notConfigured, blocked, allowed.","title":"FirewallEnabled"},"GlobalPortRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.","title":"GlobalPortRulesFromGroupPolicyMerged"},"GlobalPortRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.","title":"GlobalPortRulesFromGroupPolicyNotMerged"},"InboundConnectionsBlocked":{"type":"boolean","description":"Configures the firewall to block all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.","title":"InboundConnectionsBlocked"},"InboundConnectionsRequired":{"type":"boolean","description":"Configures the firewall to allow all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.","title":"InboundConnectionsRequired"},"InboundNotificationsBlocked":{"type":"boolean","description":"Prevents the firewall from displaying notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.","title":"InboundNotificationsBlocked"},"InboundNotificationsRequired":{"type":"boolean","description":"Allows the firewall to display notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.","title":"InboundNotificationsRequired"},"IncomingTrafficBlocked":{"type":"boolean","description":"Configures the firewall to block all incoming traffic regardless of other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.","title":"IncomingTrafficBlocked"},"IncomingTrafficRequired":{"type":"boolean","description":"Configures the firewall to allow incoming traffic pursuant to other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.","title":"IncomingTrafficRequired"},"OutboundConnectionsBlocked":{"type":"boolean","description":"Configures the firewall to block all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.","title":"OutboundConnectionsBlocked"},"OutboundConnectionsRequired":{"type":"boolean","description":"Configures the firewall to allow all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.","title":"OutboundConnectionsRequired"},"PolicyRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.","title":"PolicyRulesFromGroupPolicyMerged"},"PolicyRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.","title":"PolicyRulesFromGroupPolicyNotMerged"},"SecuredPacketExemptionAllowed":{"type":"boolean","description":"Configures the firewall to allow the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.","title":"SecuredPacketExemptionAllowed"},"SecuredPacketExemptionBlocked":{"type":"boolean","description":"Configures the firewall to block the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.","title":"SecuredPacketExemptionBlocked"},"StealthModeBlocked":{"type":"boolean","description":"Prevent the server from operating in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.","title":"StealthModeBlocked"},"StealthModeRequired":{"type":"boolean","description":"Allow the server to operate in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.","title":"StealthModeRequired"},"UnicastResponsesToMulticastBroadcastsBlocked":{"type":"boolean","description":"Configures the firewall to block unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.","title":"UnicastResponsesToMulticastBroadcastsBlocked"},"UnicastResponsesToMulticastBroadcastsRequired":{"type":"boolean","description":"Configures the firewall to allow unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.","title":"UnicastResponsesToMulticastBroadcastsRequired"}},"required":[]},"FirewallProfilePublic":{"type":"object","description":"Configures the firewall profile settings for public networks","title":"FirewallProfilePublic","properties":{"AuthorizedApplicationRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.","title":"AuthorizedApplicationRulesFromGroupPolicyMerged"},"AuthorizedApplicationRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.","title":"AuthorizedApplicationRulesFromGroupPolicyNotMerged"},"ConnectionSecurityRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.","title":"ConnectionSecurityRulesFromGroupPolicyMerged"},"ConnectionSecurityRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.","title":"ConnectionSecurityRulesFromGroupPolicyNotMerged"},"FirewallEnabled":{"enum":["notConfigured","blocked","allowed"],"description":"Configures the host device to allow or block the firewall and advanced security enforcement for the network profile. Possible values are: notConfigured, blocked, allowed.","title":"FirewallEnabled"},"GlobalPortRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.","title":"GlobalPortRulesFromGroupPolicyMerged"},"GlobalPortRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.","title":"GlobalPortRulesFromGroupPolicyNotMerged"},"InboundConnectionsBlocked":{"type":"boolean","description":"Configures the firewall to block all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.","title":"InboundConnectionsBlocked"},"InboundConnectionsRequired":{"type":"boolean","description":"Configures the firewall to allow all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.","title":"InboundConnectionsRequired"},"InboundNotificationsBlocked":{"type":"boolean","description":"Prevents the firewall from displaying notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.","title":"InboundNotificationsBlocked"},"InboundNotificationsRequired":{"type":"boolean","description":"Allows the firewall to display notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.","title":"InboundNotificationsRequired"},"IncomingTrafficBlocked":{"type":"boolean","description":"Configures the firewall to block all incoming traffic regardless of other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.","title":"IncomingTrafficBlocked"},"IncomingTrafficRequired":{"type":"boolean","description":"Configures the firewall to allow incoming traffic pursuant to other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.","title":"IncomingTrafficRequired"},"OutboundConnectionsBlocked":{"type":"boolean","description":"Configures the firewall to block all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.","title":"OutboundConnectionsBlocked"},"OutboundConnectionsRequired":{"type":"boolean","description":"Configures the firewall to allow all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.","title":"OutboundConnectionsRequired"},"PolicyRulesFromGroupPolicyMerged":{"type":"boolean","description":"Configures the firewall to merge Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.","title":"PolicyRulesFromGroupPolicyMerged"},"PolicyRulesFromGroupPolicyNotMerged":{"type":"boolean","description":"Configures the firewall to prevent merging Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.","title":"PolicyRulesFromGroupPolicyNotMerged"},"SecuredPacketExemptionAllowed":{"type":"boolean","description":"Configures the firewall to allow the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.","title":"SecuredPacketExemptionAllowed"},"SecuredPacketExemptionBlocked":{"type":"boolean","description":"Configures the firewall to block the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.","title":"SecuredPacketExemptionBlocked"},"StealthModeBlocked":{"type":"boolean","description":"Prevent the server from operating in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.","title":"StealthModeBlocked"},"StealthModeRequired":{"type":"boolean","description":"Allow the server to operate in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.","title":"StealthModeRequired"},"UnicastResponsesToMulticastBroadcastsBlocked":{"type":"boolean","description":"Configures the firewall to block unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.","title":"UnicastResponsesToMulticastBroadcastsBlocked"},"UnicastResponsesToMulticastBroadcastsRequired":{"type":"boolean","description":"Configures the firewall to allow unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.","title":"UnicastResponsesToMulticastBroadcastsRequired"}},"required":[]},"FirewallRules":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphWindowsFirewallRule","properties":{"Action":{"enum":["notConfigured","blocked","allowed"],"description":"The action the rule enforces. If not specified, the default is Allowed. Possible values are: notConfigured, blocked, allowed.","title":"Action"},"Description":{"type":"string","description":"The description of the rule.","title":"Description"},"DisplayName":{"type":"string","description":"The display name of the rule. Does not need to be unique.","title":"DisplayName"},"EdgeTraversal":{"enum":["notConfigured","blocked","allowed"],"description":"Indicates whether edge traversal is enabled or disabled for this rule. The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address. New rules have the EdgeTraversal property disabled by default. Possible values are: notConfigured, blocked, allowed.","title":"EdgeTraversal"},"FilePath":{"type":"string","description":"The full file path of an app that's affected by the firewall rule.","title":"FilePath"},"InterfaceTypes":{"type":"array","items":{"enum":["notConfigured","remoteAccess","wireless","lan"]},"description":"The interface types of the rule. Possible values are: notConfigured, remoteAccess, wireless, lan.","title":"InterfaceTypes"},"LocalAddressRanges":{"type":"array","items":{"type":"string"},"description":"List of local addresses covered by the rule. Default is any address. Valid tokens include:'' indicates any local address. If present, this must be the only token included.A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask nor a network prefix is specified, the subnet mask defaults to 255.255.255.255.A valid IPv6 address.An IPv4 address range in the format of 'start address - end address' with no spaces included.An IPv6 address range in the format of 'start address - end address' with no spaces included.","title":"LocalAddressRanges"},"LocalPortRanges":{"type":"array","items":{"type":"string"},"description":"List of local port ranges. For example, '100-120', '200', '300-320'. If not specified, the default is All.","title":"LocalPortRanges"},"LocalUserAuthorizations":{"type":"string","description":"Specifies the list of authorized local users for the app container. This is a string in Security Descriptor Definition Language (SDDL) format.","title":"LocalUserAuthorizations"},"PackageFamilyName":{"type":"string","description":"The package family name of a Microsoft Store application that's affected by the firewall rule.","title":"PackageFamilyName"},"ProfileTypes":{"type":"string","description":"Specifies the profiles to which the rule belongs. If not specified, the default is All. Possible values are: notConfigured, domain, private, public.","title":"ProfileTypes"},"Protocol":{"type":"integer","description":"0-255 number representing the IP protocol (TCP = 6, UDP = 17). If not specified, the default is All. Valid values 0 to 255","title":"Protocol"},"RemoteAddressRanges":{"type":"array","items":{"type":"string"},"description":"List of tokens specifying the remote addresses covered by the rule. Tokens are case insensitive. Default is any address. Valid tokens include:'' indicates any remote address. If present, this must be the only token included.'Defaultgateway''DHCP''DNS''WINS''Intranet' (supported on Windows versions 1809+)'RmtIntranet' (supported on Windows versions 1809+)'Internet' (supported on Windows versions 1809+)'Ply2Renders' (supported on Windows versions 1809+)'LocalSubnet' indicates any local address on the local subnet.A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask nor a network prefix is specified, the subnet mask defaults to 255.255.255.255.A valid IPv6 address.An IPv4 address range in the format of 'start address - end address' with no spaces included.An IPv6 address range in the format of 'start address - end address' with no spaces included.","title":"RemoteAddressRanges"},"RemotePortRanges":{"type":"array","items":{"type":"string"},"description":"List of remote port ranges. For example, '100-120', '200', '300-320'. If not specified, the default is All.","title":"RemotePortRanges"},"ServiceName":{"type":"string","description":"The name used in cases when a service, not an application, is sending or receiving traffic.","title":"ServiceName"},"TrafficDirection":{"enum":["notConfigured","out","in"],"description":"The traffic direction that the rule is enabled for. If not specified, the default is Out. Possible values are: notConfigured, out, in.","title":"TrafficDirection"}},"required":[]},"description":"Configures the firewall rule settings. This collection can contain a maximum of 150 elements.","title":"FirewallRules"},"LanManagerAuthenticationLevel":{"enum":["lmAndNltm","lmNtlmAndNtlmV2","lmAndNtlmOnly","lmAndNtlmV2","lmNtlmV2AndNotLm","lmNtlmV2AndNotLmOrNtm"],"description":"This security setting determines which challenge/response authentication protocol is used for network logons. Possible values are: lmAndNltm, lmNtlmAndNtlmV2, lmAndNtlmOnly, lmAndNtlmV2, lmNtlmV2AndNotLm, lmNtlmV2AndNotLmOrNtm.","title":"LanManagerAuthenticationLevel"},"LanManagerWorkstationDisableInsecureGuestLogons":{"type":"boolean","description":"If enabled,the SMB client will allow insecure guest logons. If not configured, the SMB client will reject insecure guest logons.","title":"LanManagerWorkstationDisableInsecureGuestLogons"},"LocalSecurityOptionsAdministratorAccountName":{"type":"string","description":"Define a different account name to be associated with the security identifier (SID) for the account 'Administrator'.","title":"LocalSecurityOptionsAdministratorAccountName"},"LocalSecurityOptionsAdministratorElevationPromptBehavior":{"enum":["notConfigured","elevateWithoutPrompting","promptForCredentialsOnTheSecureDesktop","promptForConsentOnTheSecureDesktop","promptForCredentials","promptForConsent","promptForConsentForNonWindowsBinaries"],"description":"Define the behavior of the elevation prompt for admins in Admin Approval Mode. Possible values are: notConfigured, elevateWithoutPrompting, promptForCredentialsOnTheSecureDesktop, promptForConsentOnTheSecureDesktop, promptForCredentials, promptForConsent, promptForConsentForNonWindowsBinaries.","title":"LocalSecurityOptionsAdministratorElevationPromptBehavior"},"LocalSecurityOptionsAllowAnonymousEnumerationOfSAMAccountsAndShares":{"type":"boolean","description":"This security setting determines whether to allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares.","title":"LocalSecurityOptionsAllowAnonymousEnumerationOfSAMAccountsAndShares"},"LocalSecurityOptionsAllowPKU2UAuthenticationRequests":{"type":"boolean","description":"Block PKU2U authentication requests to this device to use online identities.","title":"LocalSecurityOptionsAllowPKU2UAuthenticationRequests"},"LocalSecurityOptionsAllowRemoteCallsToSecurityAccountsManager":{"type":"string","description":"Edit the default Security Descriptor Definition Language string to allow or deny users and groups to make remote calls to the SAM.","title":"LocalSecurityOptionsAllowRemoteCallsToSecurityAccountsManager"},"LocalSecurityOptionsAllowRemoteCallsToSecurityAccountsManagerHelperBool":{"type":"boolean","description":"UI helper boolean for LocalSecurityOptionsAllowRemoteCallsToSecurityAccountsManager entity","title":"LocalSecurityOptionsAllowRemoteCallsToSecurityAccountsManagerHelperBool"},"LocalSecurityOptionsAllowSystemToBeShutDownWithoutHavingToLogOn":{"type":"boolean","description":"This security setting determines whether a computer can be shut down without having to log on to Windows.","title":"LocalSecurityOptionsAllowSystemToBeShutDownWithoutHavingToLogOn"},"LocalSecurityOptionsAllowUIAccessApplicationElevation":{"type":"boolean","description":"Allow UIAccess apps to prompt for elevation without using the secure desktop.","title":"LocalSecurityOptionsAllowUIAccessApplicationElevation"},"LocalSecurityOptionsAllowUIAccessApplicationsForSecureLocations":{"type":"boolean","description":"Allow UIAccess apps to prompt for elevation without using the secure desktop.Default is enabled","title":"LocalSecurityOptionsAllowUIAccessApplicationsForSecureLocations"},"LocalSecurityOptionsAllowUndockWithoutHavingToLogon":{"type":"boolean","description":"Prevent a portable computer from being undocked without having to log in.","title":"LocalSecurityOptionsAllowUndockWithoutHavingToLogon"},"LocalSecurityOptionsBlockMicrosoftAccounts":{"type":"boolean","description":"Prevent users from adding new Microsoft accounts to this computer.","title":"LocalSecurityOptionsBlockMicrosoftAccounts"},"LocalSecurityOptionsBlockRemoteLogonWithBlankPassword":{"type":"boolean","description":"Enable Local accounts that are not password protected to log on from locations other than the physical device.Default is enabled","title":"LocalSecurityOptionsBlockRemoteLogonWithBlankPassword"},"LocalSecurityOptionsBlockRemoteOpticalDriveAccess":{"type":"boolean","description":"Enabling this settings allows only interactively logged on user to access CD-ROM media.","title":"LocalSecurityOptionsBlockRemoteOpticalDriveAccess"},"LocalSecurityOptionsBlockUsersInstallingPrinterDrivers":{"type":"boolean","description":"Restrict installing printer drivers as part of connecting to a shared printer to admins only.","title":"LocalSecurityOptionsBlockUsersInstallingPrinterDrivers"},"LocalSecurityOptionsClearVirtualMemoryPageFile":{"type":"boolean","description":"This security setting determines whether the virtual memory pagefile is cleared when the system is shut down.","title":"LocalSecurityOptionsClearVirtualMemoryPageFile"},"LocalSecurityOptionsClientDigitallySignCommunicationsAlways":{"type":"boolean","description":"This security setting determines whether packet signing is required by the SMB client component.","title":"LocalSecurityOptionsClientDigitallySignCommunicationsAlways"},"LocalSecurityOptionsClientSendUnencryptedPasswordToThirdPartySMBServers":{"type":"boolean","description":"If this security setting is enabled, the Server Message Block (SMB) redirector is allowed to send plaintext passwords to non-Microsoft SMB servers that do not support password encryption during authentication.","title":"LocalSecurityOptionsClientSendUnencryptedPasswordToThirdPartySMBServers"},"LocalSecurityOptionsDetectApplicationInstallationsAndPromptForElevation":{"type":"boolean","description":"App installations requiring elevated privileges will prompt for admin credentials.Default is enabled","title":"LocalSecurityOptionsDetectApplicationInstallationsAndPromptForElevation"},"LocalSecurityOptionsDisableAdministratorAccount":{"type":"boolean","description":"Determines whether the Local Administrator account is enabled or disabled.","title":"LocalSecurityOptionsDisableAdministratorAccount"},"LocalSecurityOptionsDisableClientDigitallySignCommunicationsIfServerAgrees":{"type":"boolean","description":"This security setting determines whether the SMB client attempts to negotiate SMB packet signing.","title":"LocalSecurityOptionsDisableClientDigitallySignCommunicationsIfServerAgrees"},"LocalSecurityOptionsDisableGuestAccount":{"type":"boolean","description":"Determines if the Guest account is enabled or disabled.","title":"LocalSecurityOptionsDisableGuestAccount"},"LocalSecurityOptionsDisableServerDigitallySignCommunicationsAlways":{"type":"boolean","description":"This security setting determines whether packet signing is required by the SMB server component.","title":"LocalSecurityOptionsDisableServerDigitallySignCommunicationsAlways"},"LocalSecurityOptionsDisableServerDigitallySignCommunicationsIfClientAgrees":{"type":"boolean","description":"This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it.","title":"LocalSecurityOptionsDisableServerDigitallySignCommunicationsIfClientAgrees"},"LocalSecurityOptionsDoNotAllowAnonymousEnumerationOfSAMAccounts":{"type":"boolean","description":"This security setting determines what additional permissions will be granted for anonymous connections to the computer.","title":"LocalSecurityOptionsDoNotAllowAnonymousEnumerationOfSAMAccounts"},"LocalSecurityOptionsDoNotRequireCtrlAltDel":{"type":"boolean","description":"Require CTRL+ALT+DEL to be pressed before a user can log on.","title":"LocalSecurityOptionsDoNotRequireCtrlAltDel"},"LocalSecurityOptionsDoNotStoreLANManagerHashValueOnNextPasswordChange":{"type":"boolean","description":"This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. Its not stored by default.","title":"LocalSecurityOptionsDoNotStoreLANManagerHashValueOnNextPasswordChange"},"LocalSecurityOptionsFormatAndEjectOfRemovableMediaAllowedUser":{"enum":["notConfigured","administrators","administratorsAndPowerUsers","administratorsAndInteractiveUsers"],"description":"Define who is allowed to format and eject removable NTFS media. Possible values are: notConfigured, administrators, administratorsAndPowerUsers, administratorsAndInteractiveUsers.","title":"LocalSecurityOptionsFormatAndEjectOfRemovableMediaAllowedUser"},"LocalSecurityOptionsGuestAccountName":{"type":"string","description":"Define a different account name to be associated with the security identifier (SID) for the account 'Guest'.","title":"LocalSecurityOptionsGuestAccountName"},"LocalSecurityOptionsHideLastSignedInUser":{"type":"boolean","description":"Do not display the username of the last person who signed in on this device.","title":"LocalSecurityOptionsHideLastSignedInUser"},"LocalSecurityOptionsHideUsernameAtSignIn":{"type":"boolean","description":"Do not display the username of the person signing in to this device after credentials are entered and before the devices desktop is shown.","title":"LocalSecurityOptionsHideUsernameAtSignIn"},"LocalSecurityOptionsInformationDisplayedOnLockScreen":{"enum":["notConfigured","administrators","administratorsAndPowerUsers","administratorsAndInteractiveUsers"],"description":"Configure the user information that is displayed when the session is locked. If not configured, user display name, domain and username are shown. Possible values are: notConfigured, administrators, administratorsAndPowerUsers, administratorsAndInteractiveUsers.","title":"LocalSecurityOptionsInformationDisplayedOnLockScreen"},"LocalSecurityOptionsInformationShownOnLockScreen":{"enum":["notConfigured","userDisplayNameDomainUser","userDisplayNameOnly","doNotDisplayUser"],"description":"Configure the user information that is displayed when the session is locked. If not configured, user display name, domain and username are shown. Possible values are: notConfigured, userDisplayNameDomainUser, userDisplayNameOnly, doNotDisplayUser.","title":"LocalSecurityOptionsInformationShownOnLockScreen"},"LocalSecurityOptionsLogOnMessageText":{"type":"string","description":"Set message text for users attempting to log in.","title":"LocalSecurityOptionsLogOnMessageText"},"LocalSecurityOptionsLogOnMessageTitle":{"type":"string","description":"Set message title for users attempting to log in.","title":"LocalSecurityOptionsLogOnMessageTitle"},"LocalSecurityOptionsMachineInactivityLimit":{"type":"integer","description":"Define maximum minutes of inactivity on the interactive desktops login screen until the screen saver runs. Valid values 0 to 9999","title":"LocalSecurityOptionsMachineInactivityLimit"},"LocalSecurityOptionsMachineInactivityLimitInMinutes":{"type":"integer","description":"Define maximum minutes of inactivity on the interactive desktops login screen until the screen saver runs. Valid values 0 to 9999","title":"LocalSecurityOptionsMachineInactivityLimitInMinutes"},"LocalSecurityOptionsMinimumSessionSecurityForNtlmSspBasedClients":{"enum":["none","requireNtmlV2SessionSecurity","require128BitEncryption","ntlmV2And128BitEncryption"],"description":"This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. Possible values are: none, requireNtmlV2SessionSecurity, require128BitEncryption, ntlmV2And128BitEncryption.","title":"LocalSecurityOptionsMinimumSessionSecurityForNtlmSspBasedClients"},"LocalSecurityOptionsMinimumSessionSecurityForNtlmSspBasedServers":{"enum":["none","requireNtmlV2SessionSecurity","require128BitEncryption","ntlmV2And128BitEncryption"],"description":"This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. Possible values are: none, requireNtmlV2SessionSecurity, require128BitEncryption, ntlmV2And128BitEncryption.","title":"LocalSecurityOptionsMinimumSessionSecurityForNtlmSspBasedServers"},"LocalSecurityOptionsOnlyElevateSignedExecutables":{"type":"boolean","description":"Enforce PKI certification path validation for a given executable file before it is permitted to run.","title":"LocalSecurityOptionsOnlyElevateSignedExecutables"},"LocalSecurityOptionsRestrictAnonymousAccessToNamedPipesAndShares":{"type":"boolean","description":"By default, this security setting restricts anonymous access to shares and pipes to the settings for named pipes that can be accessed anonymously and Shares that can be accessed anonymously","title":"LocalSecurityOptionsRestrictAnonymousAccessToNamedPipesAndShares"},"LocalSecurityOptionsSmartCardRemovalBehavior":{"enum":["noAction","lockWorkstation","forceLogoff","disconnectRemoteDesktopSession"],"description":"This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. Possible values are: noAction, lockWorkstation, forceLogoff, disconnectRemoteDesktopSession.","title":"LocalSecurityOptionsSmartCardRemovalBehavior"},"LocalSecurityOptionsStandardUserElevationPromptBehavior":{"enum":["notConfigured","automaticallyDenyElevationRequests","promptForCredentialsOnTheSecureDesktop","promptForCredentials"],"description":"Define the behavior of the elevation prompt for standard users. Possible values are: notConfigured, automaticallyDenyElevationRequests, promptForCredentialsOnTheSecureDesktop, promptForCredentials.","title":"LocalSecurityOptionsStandardUserElevationPromptBehavior"},"LocalSecurityOptionsSwitchToSecureDesktopWhenPromptingForElevation":{"type":"boolean","description":"Enable all elevation requests to go to the interactive user's desktop rather than the secure desktop. Prompt behavior policy settings for admins and standard users are used.","title":"LocalSecurityOptionsSwitchToSecureDesktopWhenPromptingForElevation"},"LocalSecurityOptionsUseAdminApprovalMode":{"type":"boolean","description":"Defines whether the built-in admin account uses Admin Approval Mode or runs all apps with full admin privileges.Default is enabled","title":"LocalSecurityOptionsUseAdminApprovalMode"},"LocalSecurityOptionsUseAdminApprovalModeForAdministrators":{"type":"boolean","description":"Define whether Admin Approval Mode and all UAC policy settings are enabled, default is enabled","title":"LocalSecurityOptionsUseAdminApprovalModeForAdministrators"},"LocalSecurityOptionsVirtualizeFileAndRegistryWriteFailuresToPerUserLocations":{"type":"boolean","description":"Virtualize file and registry write failures to per user locations","title":"LocalSecurityOptionsVirtualizeFileAndRegistryWriteFailuresToPerUserLocations"},"SmartScreenBlockOverrideForFiles":{"type":"boolean","description":"Allows IT Admins to control whether users can can ignore SmartScreen warnings and run malicious files.","title":"SmartScreenBlockOverrideForFiles"},"SmartScreenEnableInShell":{"type":"boolean","description":"Allows IT Admins to configure SmartScreen for Windows.","title":"SmartScreenEnableInShell"},"UserRightsAccessCredentialManagerAsTrustedCaller":{"type":"object","description":"This user right is used by Credential Manager during Backup/Restore. Users' saved credentials might be compromised if this privilege is given to other entities. Only states NotConfigured and Allowed are supported","title":"UserRightsAccessCredentialManagerAsTrustedCaller","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsActAsPartOfTheOperatingSystem":{"type":"object","description":"This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Only states NotConfigured and Allowed are supported","title":"UserRightsActAsPartOfTheOperatingSystem","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsAllowAccessFromNetwork":{"type":"object","description":"This user right determines which users and groups are allowed to connect to the computer over the network. State Allowed is supported.","title":"UserRightsAllowAccessFromNetwork","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsBackupData":{"type":"object","description":"This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Only states NotConfigured and Allowed are supported","title":"UserRightsBackupData","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsBlockAccessFromNetwork":{"type":"object","description":"This user right determines which users and groups are block from connecting to the computer over the network. State Block is supported.","title":"UserRightsBlockAccessFromNetwork","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsChangeSystemTime":{"type":"object","description":"This user right determines which users and groups can change the time and date on the internal clock of the computer. Only states NotConfigured and Allowed are supported","title":"UserRightsChangeSystemTime","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsCreateGlobalObjects":{"type":"object","description":"This security setting determines whether users can create global objects that are available to all sessions. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. Only states NotConfigured and Allowed are supported","title":"UserRightsCreateGlobalObjects","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsCreatePageFile":{"type":"object","description":"This user right determines which users and groups can call an internal API to create and change the size of a page file. Only states NotConfigured and Allowed are supported","title":"UserRightsCreatePageFile","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsCreatePermanentSharedObjects":{"type":"object","description":"This user right determines which accounts can be used by processes to create a directory object using the object manager. Only states NotConfigured and Allowed are supported","title":"UserRightsCreatePermanentSharedObjects","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsCreateSymbolicLinks":{"type":"object","description":"This user right determines if the user can create a symbolic link from the computer to which they are logged on. Only states NotConfigured and Allowed are supported","title":"UserRightsCreateSymbolicLinks","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsCreateToken":{"type":"object","description":"This user right determines which users/groups can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal API to create an access token. Only states NotConfigured and Allowed are supported","title":"UserRightsCreateToken","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsDebugPrograms":{"type":"object","description":"This user right determines which users can attach a debugger to any process or to the kernel. Only states NotConfigured and Allowed are supported","title":"UserRightsDebugPrograms","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsDelegation":{"type":"object","description":"This user right determines which users can set the Trusted for Delegation setting on a user or computer object. Only states NotConfigured and Allowed are supported.","title":"UserRightsDelegation","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsDenyLocalLogOn":{"type":"object","description":"This user right determines which users cannot log on to the computer. States NotConfigured, Blocked are supported","title":"UserRightsDenyLocalLogOn","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsGenerateSecurityAudits":{"type":"object","description":"This user right determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access.  Only states NotConfigured and Allowed are supported.","title":"UserRightsGenerateSecurityAudits","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsImpersonateClient":{"type":"object","description":"Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Only states NotConfigured and Allowed are supported.","title":"UserRightsImpersonateClient","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsIncreaseSchedulingPriority":{"type":"object","description":"This user right determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. Only states NotConfigured and Allowed are supported.","title":"UserRightsIncreaseSchedulingPriority","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsLoadUnloadDrivers":{"type":"object","description":"This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. Only states NotConfigured and Allowed are supported.","title":"UserRightsLoadUnloadDrivers","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsLocalLogOn":{"type":"object","description":"This user right determines which users can log on to the computer. States NotConfigured, Allowed are supported","title":"UserRightsLocalLogOn","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsLockMemory":{"type":"object","description":"This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Only states NotConfigured and Allowed are supported.","title":"UserRightsLockMemory","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsManageAuditingAndSecurityLogs":{"type":"object","description":"This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. Only states NotConfigured and Allowed are supported.","title":"UserRightsManageAuditingAndSecurityLogs","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsManageVolumes":{"type":"object","description":"This user right determines which users and groups can run maintenance tasks on a volume, such as remote defragmentation. Only states NotConfigured and Allowed are supported.","title":"UserRightsManageVolumes","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsModifyFirmwareEnvironment":{"type":"object","description":"This user right determines who can modify firmware environment values. Only states NotConfigured and Allowed are supported.","title":"UserRightsModifyFirmwareEnvironment","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsModifyObjectLabels":{"type":"object","description":"This user right determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Only states NotConfigured and Allowed are supported.","title":"UserRightsModifyObjectLabels","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsProfileSingleProcess":{"type":"object","description":"This user right determines which users can use performance monitoring tools to monitor the performance of system processes. Only states NotConfigured and Allowed are supported.","title":"UserRightsProfileSingleProcess","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsRemoteDesktopServicesLogOn":{"type":"object","description":"This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client. Only states NotConfigured and Blocked are supported","title":"UserRightsRemoteDesktopServicesLogOn","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsRemoteShutdown":{"type":"object","description":"This user right determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service. Only states NotConfigured and Allowed are supported.","title":"UserRightsRemoteShutdown","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsRestoreData":{"type":"object","description":"This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Only states NotConfigured and Allowed are supported.","title":"UserRightsRestoreData","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"UserRightsTakeOwnership":{"type":"object","description":"This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. Only states NotConfigured and Allowed are supported.","title":"UserRightsTakeOwnership","properties":{"LocalUsersOrGroups":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Endpoint Protection Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup","properties":{"Description":{"type":"string","description":"Admins description of this local user or group.","title":"Description"},"Name":{"type":"string","description":"The name of this local user or group.","title":"Name"},"SecurityIdentifier":{"type":"string","description":"The security identifier of this local user or group (e.g. S-1-5-32-544).","title":"SecurityIdentifier"}},"required":[]},"description":"Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.","title":"LocalUsersOrGroups"},"State":{"enum":["notConfigured","blocked","allowed"],"description":"Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.","title":"State"}},"required":[]},"WindowsDefenderTamperProtection":{"enum":["notConfigured","enable","disable"],"description":"Configure windows defender TamperProtection settings. Possible values are: notConfigured, enable, disable.","title":"WindowsDefenderTamperProtection"},"XboxServicesAccessoryManagementServiceStartupMode":{"enum":["manual","automatic","disabled"],"description":"This setting determines whether the Accessory management service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.","title":"XboxServicesAccessoryManagementServiceStartupMode"},"XboxServicesEnableXboxGameSaveTask":{"type":"boolean","description":"This setting determines whether xbox game save is enabled (1) or disabled (0).","title":"XboxServicesEnableXboxGameSaveTask"},"XboxServicesLiveAuthManagerServiceStartupMode":{"enum":["manual","automatic","disabled"],"description":"This setting determines whether Live Auth Manager service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.","title":"XboxServicesLiveAuthManagerServiceStartupMode"},"XboxServicesLiveGameSaveServiceStartupMode":{"enum":["manual","automatic","disabled"],"description":"This setting determines whether Live Game save service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.","title":"XboxServicesLiveGameSaveServiceStartupMode"},"XboxServicesLiveNetworkingServiceStartupMode":{"enum":["manual","automatic","disabled"],"description":"This setting determines whether Networking service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.","title":"XboxServicesLiveNetworkingServiceStartupMode"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"SupportsScopeTags":{"type":"boolean","description":"Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.","title":"SupportsScopeTags"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationfirmwareinterfacepolicywindows10":{"type":"object","description":"Intune Device Configuration Firmware Interface Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationfirmwareinterfacepolicywindows10","properties":{"Bluetooth":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable Bluetooth. Possible values are: notConfigured, enabled, disabled.","title":"Bluetooth"},"BootFromBuiltInNetworkAdapters":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to boot from built-in network adapters. Possible values are: notConfigured, enabled, disabled.","title":"BootFromBuiltInNetworkAdapters"},"BootFromExternalMedia":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to boot from external media. Possible values are: notConfigured, enabled, disabled.","title":"BootFromExternalMedia"},"Cameras":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether built-in cameras are enabled. Possible values are: notConfigured, enabled, disabled.","title":"Cameras"},"ChangeUefiSettingsPermission":{"enum":["notConfiguredOnly","none"],"description":"Defines the permission level granted to users to change UEFI settings. Possible values are: notConfiguredOnly, none.","title":"ChangeUefiSettingsPermission"},"FrontCamera":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable Front Camera. Possible values are: notConfigured, enabled, disabled.","title":"FrontCamera"},"InfraredCamera":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable Infrared camera. Possible values are: notConfigured, enabled, disabled.","title":"InfraredCamera"},"Microphone":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable Microphone. Possible values are: notConfigured, enabled, disabled.","title":"Microphone"},"MicrophonesAndSpeakers":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether built-in microphones or speakers are enabled. Possible values are: notConfigured, enabled, disabled.","title":"MicrophonesAndSpeakers"},"NearFieldCommunication":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable Near Field Communication. Possible values are: notConfigured, enabled, disabled.","title":"NearFieldCommunication"},"Radios":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether built-in radios e.g. WIFI, NFC, Bluetooth, are enabled. Possible values are: notConfigured, enabled, disabled.","title":"Radios"},"RearCamera":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable rear camera. Possible values are: notConfigured, enabled, disabled.","title":"RearCamera"},"SdCard":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable SD Card Port. Possible values are: notConfigured, enabled, disabled.","title":"SdCard"},"SimultaneousMultiThreading":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable Simultaneous MultiThreading. Possible values are: notConfigured, enabled, disabled.","title":"SimultaneousMultiThreading"},"UsbTypeAPort":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable USB Type A Port. Possible values are: notConfigured, enabled, disabled.","title":"UsbTypeAPort"},"VirtualizationOfCpuAndIO":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether CPU and IO virtualization is enabled. Possible values are: notConfigured, enabled, disabled.","title":"VirtualizationOfCpuAndIO"},"WakeOnLAN":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable Wake on LAN. Possible values are: notConfigured, enabled, disabled.","title":"WakeOnLAN"},"WakeOnPower":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable Wake On Power. Possible values are: notConfigured, enabled, disabled.","title":"WakeOnPower"},"WiFi":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable WiFi. Possible values are: notConfigured, enabled, disabled.","title":"WiFi"},"WindowsPlatformBinaryTable":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable Windows Platform Binary Table. Possible values are: notConfigured, enabled, disabled.","title":"WindowsPlatformBinaryTable"},"WirelessWideAreaNetwork":{"enum":["notConfigured","enabled","disabled"],"description":"Defines whether a user is allowed to enable Wireless Wide Area Network. Possible values are: notConfigured, enabled, disabled.","title":"WirelessWideAreaNetwork"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"SupportsScopeTags":{"type":"boolean","description":"Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.","title":"SupportsScopeTags"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationhealthmonitoringconfigurationpolicywindows10":{"type":"object","description":"Intune Device Configuration Health Monitoring Configuration Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationhealthmonitoringconfigurationpolicywindows10","properties":{"AllowDeviceHealthMonitoring":{"enum":["notConfigured","enabled","disabled"],"description":"Enables device health monitoring on the device. Possible values are: notConfigured, enabled, disabled.","title":"AllowDeviceHealthMonitoring"},"ConfigDeviceHealthMonitoringCustomScope":{"type":"string","description":"Specifies custom set of events collected from the device where health monitoring is enabled","title":"ConfigDeviceHealthMonitoringCustomScope"},"ConfigDeviceHealthMonitoringScope":{"type":"array","items":{"enum":["undefined","healthMonitoring","bootPerformance","windowsUpdates","privilegeManagement"]},"description":"Specifies set of events collected from the device where health monitoring is enabled. Possible values are: undefined, healthMonitoring, bootPerformance, windowsUpdates, privilegeManagement.","title":"ConfigDeviceHealthMonitoringScope"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"SupportsScopeTags":{"type":"boolean","description":"Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.","title":"SupportsScopeTags"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationidentityprotectionpolicywindows10":{"type":"object","description":"Intune Device Configuration Identity Protection Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationidentityprotectionpolicywindows10","properties":{"EnhancedAntiSpoofingForFacialFeaturesEnabled":{"type":"boolean","description":"Boolean value used to enable enhanced anti-spoofing for facial feature recognition on Windows Hello face authentication.","title":"EnhancedAntiSpoofingForFacialFeaturesEnabled"},"PinExpirationInDays":{"type":"integer","description":"Integer value specifies the period (in days) that a PIN can be used before the system requires the user to change it. Valid values are 0 to 730 inclusive. Valid values 0 to 730","title":"PinExpirationInDays"},"PinLowercaseCharactersUsage":{"enum":["blocked","required","allowed","notConfigured"],"description":"This value configures the use of lowercase characters in the Windows Hello for Business PIN. Possible values are: blocked, required, allowed, notConfigured.","title":"PinLowercaseCharactersUsage"},"PinMaximumLength":{"type":"integer","description":"Integer value that sets the maximum number of characters allowed for the work PIN. Valid values are 4 to 127 inclusive and greater than or equal to the value set for the minimum PIN. Valid values 4 to 127","title":"PinMaximumLength"},"PinMinimumLength":{"type":"integer","description":"Integer value that sets the minimum number of characters required for the Windows Hello for Business PIN. Valid values are 4 to 127 inclusive and less than or equal to the value set for the maximum PIN. Valid values 4 to 127","title":"PinMinimumLength"},"PinPreviousBlockCount":{"type":"integer","description":"Controls the ability to prevent users from using past PINs. This must be set between 0 and 50, inclusive, and the current PIN of the user is included in that count. If set to 0, previous PINs are not stored. PIN history is not preserved through a PIN reset. Valid values 0 to 50","title":"PinPreviousBlockCount"},"PinRecoveryEnabled":{"type":"boolean","description":"Boolean value that enables a user to change their PIN by using the Windows Hello for Business PIN recovery service.","title":"PinRecoveryEnabled"},"PinSpecialCharactersUsage":{"enum":["blocked","required","allowed","notConfigured"],"description":"Controls the ability to use special characters in the Windows Hello for Business PIN. Possible values are: blocked, required, allowed, notConfigured.","title":"PinSpecialCharactersUsage"},"PinUppercaseCharactersUsage":{"enum":["blocked","required","allowed","notConfigured"],"description":"This value configures the use of uppercase characters in the Windows Hello for Business PIN. Possible values are: blocked, required, allowed, notConfigured.","title":"PinUppercaseCharactersUsage"},"SecurityDeviceRequired":{"type":"boolean","description":"Controls whether to require a Trusted Platform Module (TPM) for provisioning Windows Hello for Business. A TPM provides an additional security benefit in that data stored on it cannot be used on other devices. If set to False, all devices can provision Windows Hello for Business even if there is not a usable TPM.","title":"SecurityDeviceRequired"},"UnlockWithBiometricsEnabled":{"type":"boolean","description":"Controls the use of biometric gestures, such as face and fingerprint, as an alternative to the Windows Hello for Business PIN.  If set to False, biometric gestures are not allowed. Users must still configure a PIN as a backup in case of failures.","title":"UnlockWithBiometricsEnabled"},"UseCertificatesForOnPremisesAuthEnabled":{"type":"boolean","description":"Boolean value that enables Windows Hello for Business to use certificates to authenticate on-premise resources.","title":"UseCertificatesForOnPremisesAuthEnabled"},"UseSecurityKeyForSignin":{"type":"boolean","description":"Boolean value used to enable the Windows Hello security key as a logon credential.","title":"UseSecurityKeyForSignin"},"WindowsHelloForBusinessBlocked":{"type":"boolean","description":"Boolean value that blocks Windows Hello for Business as a method for signing into Windows.","title":"WindowsHelloForBusinessBlocked"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"SupportsScopeTags":{"type":"boolean","description":"Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.","title":"SupportsScopeTags"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationimportedpfxcertificatepolicywindows10":{"type":"object","description":"Intune Device Configuration Imported Pfx Certificate Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationimportedpfxcertificatepolicywindows10","properties":{"IntendedPurpose":{"enum":["unassigned","smimeEncryption","smimeSigning","vpn","wifi"],"description":"Intended Purpose of the Certificate Profile - which could be Unassigned, SmimeEncryption, SmimeSigning etc. Possible values are: unassigned, smimeEncryption, smimeSigning, vpn, wifi.","title":"IntendedPurpose"},"CertificateValidityPeriodScale":{"enum":["days","months","years"],"description":"Scale for the Certificate Validity Period. Possible values are: days, months, years.","title":"CertificateValidityPeriodScale"},"CertificateValidityPeriodValue":{"type":"integer","description":"Value for the Certificate Validity Period","title":"CertificateValidityPeriodValue"},"KeyStorageProvider":{"enum":["useTpmKspOtherwiseUseSoftwareKsp","useTpmKspOtherwiseFail","usePassportForWorkKspOtherwiseFail","useSoftwareKsp"],"description":"Key Storage Provider (KSP). Possible values are: useTpmKspOtherwiseUseSoftwareKsp, useTpmKspOtherwiseFail, usePassportForWorkKspOtherwiseFail, useSoftwareKsp.","title":"KeyStorageProvider"},"RenewalThresholdPercentage":{"type":"integer","description":"Certificate renewal threshold percentage. Valid values 1 to 99","title":"RenewalThresholdPercentage"},"SubjectAlternativeNameType":{"enum":["none","emailAddress","userPrincipalName","customAzureADAttribute","domainNameService","universalResourceIdentifier"],"description":"Certificate Subject Alternative Name Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.","title":"SubjectAlternativeNameType"},"SubjectNameFormat":{"enum":["commonName","commonNameIncludingEmail","commonNameAsEmail","custom","commonNameAsIMEI","commonNameAsSerialNumber","commonNameAsAadDeviceId","commonNameAsIntuneDeviceId","commonNameAsDurableDeviceId"],"description":"Certificate Subject Name Format. Possible values are: commonName, commonNameIncludingEmail, commonNameAsEmail, custom, commonNameAsIMEI, commonNameAsSerialNumber, commonNameAsAadDeviceId, commonNameAsIntuneDeviceId, commonNameAsDurableDeviceId.","title":"SubjectNameFormat"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationkioskpolicywindows10":{"type":"object","description":"Intune Device Configuration Kiosk Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationkioskpolicywindows10","properties":{"EdgeKioskEnablePublicBrowsing":{"type":"boolean","description":"Enable public browsing kiosk mode for the Microsoft Edge browser. The Default is false.","title":"EdgeKioskEnablePublicBrowsing"},"KioskBrowserBlockedUrlExceptions":{"type":"array","items":{"type":"string"},"description":"Specify URLs that the kiosk browser is allowed to navigate to","title":"KioskBrowserBlockedUrlExceptions"},"KioskBrowserBlockedURLs":{"type":"array","items":{"type":"string"},"description":"Specify URLs that the kiosk browsers should not navigate to","title":"KioskBrowserBlockedURLs"},"KioskBrowserDefaultUrl":{"type":"string","description":"Specify the default URL the browser should navigate to on launch.","title":"KioskBrowserDefaultUrl"},"KioskBrowserEnableEndSessionButton":{"type":"boolean","description":"Enable the kiosk browser's end session button. By default, the end session button is disabled.","title":"KioskBrowserEnableEndSessionButton"},"KioskBrowserEnableHomeButton":{"type":"boolean","description":"Enable the kiosk browser's home button. By default, the home button is disabled.","title":"KioskBrowserEnableHomeButton"},"KioskBrowserEnableNavigationButtons":{"type":"boolean","description":"Enable the kiosk browser's navigation buttons(forward/back). By default, the navigation buttons are disabled.","title":"KioskBrowserEnableNavigationButtons"},"KioskBrowserRestartOnIdleTimeInMinutes":{"type":"integer","description":"Specify the number of minutes the session is idle until the kiosk browser restarts in a fresh state.  Valid values are 1-1440. Valid values 1 to 1440","title":"KioskBrowserRestartOnIdleTimeInMinutes"},"KioskProfiles":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Kiosk Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphWindowsKioskProfile","properties":{"AppConfiguration":{"type":"object","description":"The App configuration that will be used for this kiosk configuration.","title":"AppConfiguration","properties":{"AllowAccessToDownloadsFolder":{"type":"boolean","description":"This setting allows access to Downloads folder in file explorer.","title":"AllowAccessToDownloadsFolder"},"Apps":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Kiosk Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphWindowsKioskAppBase","properties":{"AppType":{"enum":["unknown","store","desktop","aumId"],"description":"The app type. Possible values are: unknown, store, desktop, aumId.","title":"AppType"},"AutoLaunch":{"type":"boolean","description":"Allow the app to be auto-launched in multi-app kiosk mode","title":"AutoLaunch"},"Name":{"type":"string","description":"Represents the friendly name of an app","title":"Name"},"StartLayoutTileSize":{"enum":["hidden","small","medium","wide","large"],"description":"The app tile size for the start layout. Possible values are: hidden, small, medium, wide, large.","title":"StartLayoutTileSize"},"DesktopApplicationId":{"type":"string","description":"Define the DesktopApplicationID of the app","title":"DesktopApplicationId"},"DesktopApplicationLinkPath":{"type":"string","description":"Define the DesktopApplicationLinkPath of the app","title":"DesktopApplicationLinkPath"},"Path":{"type":"string","description":"Define the path of a desktop app","title":"Path"},"AppId":{"type":"string","description":"This references an Intune App that will be target to the same assignments as Kiosk configuration","title":"AppId"},"AppUserModelId":{"type":"string","description":"This is the only Application User Model ID (AUMID) that will be available to launch use while in Kiosk Mode","title":"AppUserModelId"},"ContainedAppId":{"type":"string","description":"This references an contained App from an Intune App","title":"ContainedAppId"},"ClassicAppPath":{"type":"string","description":"This is the classicapppath to be used by v4 Win32 app while in Kiosk Mode","title":"ClassicAppPath"},"EdgeKiosk":{"type":"string","description":"Edge kiosk (url) for Edge kiosk mode","title":"EdgeKiosk"},"EdgeKioskIdleTimeoutMinutes":{"type":"integer","description":"Edge kiosk idle timeout in minutes for Edge kiosk mode. Valid values 0 to 1440","title":"EdgeKioskIdleTimeoutMinutes"},"EdgeKioskType":{"enum":["publicBrowsing","fullScreen"],"description":"Edge kiosk type for Edge kiosk mode. Possible values are: publicBrowsing, fullScreen.","title":"EdgeKioskType"},"EdgeNoFirstRun":{"type":"boolean","description":"Edge first run flag for Edge kiosk mode","title":"EdgeNoFirstRun"},"odataType":{"enum":["#microsoft.graph.windowsKioskDesktopApp","#microsoft.graph.windowsKioskUWPApp","#microsoft.graph.windowsKioskWin32App"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"description":"These are the only Windows Store Apps that will be available to launch from the Start menu. This collection can contain a maximum of 128 elements.","title":"Apps"},"DisallowDesktopApps":{"type":"boolean","description":"This setting indicates that desktop apps are allowed. Default to true.","title":"DisallowDesktopApps"},"ShowTaskBar":{"type":"boolean","description":"This setting allows the admin to specify whether the Task Bar is shown or not.","title":"ShowTaskBar"},"StartMenuLayoutXml":{"type":"string","description":"Allows admins to override the default Start layout and prevents the user from changing it.The layout is modified by specifying an XML file based on a layout modification schema. XML needs to be in Binary format.","title":"StartMenuLayoutXml"},"UwpApp":{"type":"object","description":"This is the only Application User Model ID (AUMID) that will be available to launch use while in Kiosk Mode","title":"UwpApp","properties":{"AppId":{"type":"string","description":"This references an Intune App that will be target to the same assignments as Kiosk configuration","title":"AppId"},"AppUserModelId":{"type":"string","description":"This is the only Application User Model ID (AUMID) that will be available to launch use while in Kiosk Mode","title":"AppUserModelId"},"ContainedAppId":{"type":"string","description":"This references an contained App from an Intune App","title":"ContainedAppId"},"AppType":{"enum":["unknown","store","desktop","aumId"],"description":"The app type. Possible values are: unknown, store, desktop, aumId.","title":"AppType"},"AutoLaunch":{"type":"boolean","description":"Allow the app to be auto-launched in multi-app kiosk mode","title":"AutoLaunch"},"Name":{"type":"string","description":"Represents the friendly name of an app","title":"Name"},"StartLayoutTileSize":{"enum":["hidden","small","medium","wide","large"],"description":"The app tile size for the start layout. Possible values are: hidden, small, medium, wide, large.","title":"StartLayoutTileSize"},"DesktopApplicationId":{"type":"string","description":"Define the DesktopApplicationID of the app","title":"DesktopApplicationId"},"DesktopApplicationLinkPath":{"type":"string","description":"Define the DesktopApplicationLinkPath of the app","title":"DesktopApplicationLinkPath"},"Path":{"type":"string","description":"Define the path of a desktop app","title":"Path"},"ClassicAppPath":{"type":"string","description":"This is the classicapppath to be used by v4 Win32 app while in Kiosk Mode","title":"ClassicAppPath"},"EdgeKiosk":{"type":"string","description":"Edge kiosk (url) for Edge kiosk mode","title":"EdgeKiosk"},"EdgeKioskIdleTimeoutMinutes":{"type":"integer","description":"Edge kiosk idle timeout in minutes for Edge kiosk mode. Valid values 0 to 1440","title":"EdgeKioskIdleTimeoutMinutes"},"EdgeKioskType":{"enum":["publicBrowsing","fullScreen"],"description":"Edge kiosk type for Edge kiosk mode. Possible values are: publicBrowsing, fullScreen.","title":"EdgeKioskType"},"EdgeNoFirstRun":{"type":"boolean","description":"Edge first run flag for Edge kiosk mode","title":"EdgeNoFirstRun"},"odataType":{"enum":["#microsoft.graph.windowsKioskDesktopApp","#microsoft.graph.windowsKioskUWPApp","#microsoft.graph.windowsKioskWin32App"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"Win32App":{"type":"object","description":"This is the win32 app that will be available to launch use while in Kiosk Mode","title":"Win32App","properties":{"ClassicAppPath":{"type":"string","description":"This is the classicapppath to be used by v4 Win32 app while in Kiosk Mode","title":"ClassicAppPath"},"EdgeKiosk":{"type":"string","description":"Edge kiosk (url) for Edge kiosk mode","title":"EdgeKiosk"},"EdgeKioskIdleTimeoutMinutes":{"type":"integer","description":"Edge kiosk idle timeout in minutes for Edge kiosk mode. Valid values 0 to 1440","title":"EdgeKioskIdleTimeoutMinutes"},"EdgeKioskType":{"enum":["publicBrowsing","fullScreen"],"description":"Edge kiosk type for Edge kiosk mode. Possible values are: publicBrowsing, fullScreen.","title":"EdgeKioskType"},"EdgeNoFirstRun":{"type":"boolean","description":"Edge first run flag for Edge kiosk mode","title":"EdgeNoFirstRun"},"AppType":{"enum":["unknown","store","desktop","aumId"],"description":"The app type. Possible values are: unknown, store, desktop, aumId.","title":"AppType"},"AutoLaunch":{"type":"boolean","description":"Allow the app to be auto-launched in multi-app kiosk mode","title":"AutoLaunch"},"Name":{"type":"string","description":"Represents the friendly name of an app","title":"Name"},"StartLayoutTileSize":{"enum":["hidden","small","medium","wide","large"],"description":"The app tile size for the start layout. Possible values are: hidden, small, medium, wide, large.","title":"StartLayoutTileSize"},"DesktopApplicationId":{"type":"string","description":"Define the DesktopApplicationID of the app","title":"DesktopApplicationId"},"DesktopApplicationLinkPath":{"type":"string","description":"Define the DesktopApplicationLinkPath of the app","title":"DesktopApplicationLinkPath"},"Path":{"type":"string","description":"Define the path of a desktop app","title":"Path"},"AppId":{"type":"string","description":"This references an Intune App that will be target to the same assignments as Kiosk configuration","title":"AppId"},"AppUserModelId":{"type":"string","description":"This is the only Application User Model ID (AUMID) that will be available to launch use while in Kiosk Mode","title":"AppUserModelId"},"ContainedAppId":{"type":"string","description":"This references an contained App from an Intune App","title":"ContainedAppId"},"odataType":{"enum":["#microsoft.graph.windowsKioskDesktopApp","#microsoft.graph.windowsKioskUWPApp","#microsoft.graph.windowsKioskWin32App"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"odataType":{"enum":["#microsoft.graph.windowsKioskMultipleApps","#microsoft.graph.windowsKioskSingleUWPApp","#microsoft.graph.windowsKioskSingleWin32App"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"ProfileId":{"type":"string","description":"Key of the entity.","title":"ProfileId"},"ProfileName":{"type":"string","description":"This is a friendly nameused to identify a group of applications, the layout of these apps on the start menu and the users to whom this kiosk configuration is assigned.","title":"ProfileName"},"UserAccountsConfiguration":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Kiosk Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphWindowsKioskUser","properties":{"GroupName":{"type":"string","description":"The name of the AD group that will be locked to this kiosk configuration","title":"GroupName"},"DisplayName":{"type":"string","description":"The display name of the AzureAD group that will be locked to this kiosk configuration","title":"DisplayName"},"GroupId":{"type":"string","description":"The ID of the AzureAD group that will be locked to this kiosk configuration","title":"GroupId"},"UserId":{"type":"string","description":"The ID of the AzureAD user that will be locked to this kiosk configuration","title":"UserId"},"UserPrincipalName":{"type":"string","description":"The user accounts that will be locked to this kiosk configuration","title":"UserPrincipalName"},"UserName":{"type":"string","description":"The local user that will be locked to this kiosk configuration","title":"UserName"},"odataType":{"enum":["#microsoft.graph.windowsKioskActiveDirectoryGroup","#microsoft.graph.windowsKioskAutologon","#microsoft.graph.windowsKioskAzureADGroup","#microsoft.graph.windowsKioskAzureADUser","#microsoft.graph.windowsKioskLocalGroup","#microsoft.graph.windowsKioskLocalUser","#microsoft.graph.windowsKioskVisitor"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"description":"The user accounts that will be locked to this kiosk configuration. This collection can contain a maximum of 100 elements.","title":"UserAccountsConfiguration"}},"required":[]},"description":"This policy setting allows to define a list of Kiosk profiles for a Kiosk configuration. This collection can contain a maximum of 3 elements.","title":"KioskProfiles"},"WindowsKioskForceUpdateSchedule":{"type":"object","description":"force update schedule for Kiosk devices.","title":"WindowsKioskForceUpdateSchedule","properties":{"DayofMonth":{"type":"integer","description":"Day of month. Valid values 1 to 31","title":"DayofMonth"},"DayofWeek":{"enum":["sunday","monday","tuesday","wednesday","thursday","friday","saturday"],"description":"Day of week. Possible values are: sunday, monday, tuesday, wednesday, thursday, friday, saturday.","title":"DayofWeek"},"Recurrence":{"enum":["none","daily","weekly","monthly"],"description":"Recurrence schedule. Possible values are: none, daily, weekly, monthly.","title":"Recurrence"},"RunImmediatelyIfAfterStartDateTime":{"type":"boolean","description":"If true, runs the task immediately if StartDateTime is in the past, else, runs at the next recurrence.","title":"RunImmediatelyIfAfterStartDateTime"},"StartDateTime":{"type":"string","description":"The start time for the force restart.","title":"StartDateTime"}},"required":[]},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationnetworkboundarypolicywindows10":{"type":"object","description":"Intune Device Configuration Network Boundary Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationnetworkboundarypolicywindows10","properties":{"WindowsNetworkIsolationPolicy":{"type":"object","description":"Windows Network Isolation Policy","title":"WindowsNetworkIsolationPolicy","properties":{"EnterpriseCloudResources":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Network Boundary Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphProxiedDomain1","properties":{"IpAddressOrFQDN":{"type":"string","description":"The IP address or FQDN","title":"IpAddressOrFQDN"},"Proxy":{"type":"string","description":"Proxy IP or FQDN","title":"Proxy"}},"required":[]},"description":"Contains a list of enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the EnterpriseInternalProxyServers policy. This collection can contain a maximum of 500 elements.","title":"EnterpriseCloudResources"},"EnterpriseInternalProxyServers":{"type":"array","items":{"type":"string"},"description":"This is the comma-separated list of internal proxy servers. For example, '157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59'. These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the EnterpriseCloudResources policy to force traffic to the matched cloud resources through these proxies.","title":"EnterpriseInternalProxyServers"},"EnterpriseIPRanges":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Network Boundary Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphIpRange1","properties":{"CidrAddress":{"type":"string","description":"IPv4 address in CIDR notation. Not nullable.","title":"CidrAddress"},"LowerAddress":{"type":"string","description":"Lower address.","title":"LowerAddress"},"UpperAddress":{"type":"string","description":"Upper address.","title":"UpperAddress"},"odataType":{"enum":["#microsoft.graph.iPv4CidrRange","#microsoft.graph.iPv6CidrRange","#microsoft.graph.iPv4Range","#microsoft.graph.iPv6Range"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"description":"Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This collection can contain a maximum of 500 elements.","title":"EnterpriseIPRanges"},"EnterpriseIPRangesAreAuthoritative":{"type":"boolean","description":"Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. Default is false.","title":"EnterpriseIPRangesAreAuthoritative"},"EnterpriseNetworkDomainNames":{"type":"array","items":{"type":"string"},"description":"This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected. These locations will be considered a safe destination for enterprise data to be shared to.","title":"EnterpriseNetworkDomainNames"},"EnterpriseProxyServers":{"type":"array","items":{"type":"string"},"description":"This is a list of proxy servers. Any server not on this list is considered non-enterprise.","title":"EnterpriseProxyServers"},"EnterpriseProxyServersAreAuthoritative":{"type":"boolean","description":"Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. Default is false","title":"EnterpriseProxyServersAreAuthoritative"},"NeutralDomainResources":{"type":"array","items":{"type":"string"},"description":"List of domain names that can used for work or personal resource.","title":"NeutralDomainResources"}},"required":[]},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"SupportsScopeTags":{"type":"boolean","description":"Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.","title":"SupportsScopeTags"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationpkcscertificatepolicywindows10":{"type":"object","description":"Intune Device Configuration Pkcs Certificate Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationpkcscertificatepolicywindows10","properties":{"CertificateStore":{"enum":["user","machine"],"description":"Target store certificate. Possible values are: user, machine.","title":"CertificateStore"},"CertificateTemplateName":{"type":"string","description":"PKCS Certificate Template Name","title":"CertificateTemplateName"},"CertificationAuthority":{"type":"string","description":"PKCS Certification Authority","title":"CertificationAuthority"},"CertificationAuthorityName":{"type":"string","description":"PKCS Certification Authority Name","title":"CertificationAuthorityName"},"CustomSubjectAlternativeNames":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Pkcs Certificate Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphCustomSubjectAlternativeName","properties":{"Name":{"type":"string","description":"Custom SAN Name","title":"Name"},"SanType":{"enum":["none","emailAddress","userPrincipalName","customAzureADAttribute","domainNameService","universalResourceIdentifier"],"description":"Custom SAN Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.","title":"SanType"}},"required":[]},"description":"Custom Subject Alternative Name Settings. This collection can contain a maximum of 500 elements.","title":"CustomSubjectAlternativeNames"},"ExtendedKeyUsages":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Pkcs Certificate Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphExtendedKeyUsage","properties":{"Name":{"type":"string","description":"Extended Key Usage Name","title":"Name"},"ObjectIdentifier":{"type":"string","description":"Extended Key Usage Object Identifier","title":"ObjectIdentifier"}},"required":[]},"description":"Extended Key Usage (EKU) settings. This collection can contain a maximum of 500 elements.","title":"ExtendedKeyUsages"},"SubjectAlternativeNameFormatString":{"type":"string","description":"Custom String that defines the AAD Attribute.","title":"SubjectAlternativeNameFormatString"},"SubjectNameFormatString":{"type":"string","description":"Custom format to use with SubjectNameFormat = Custom. Example: CN=EmailAddress}},E=EmailAddress}},OU=Enterprise Users,O=Contoso Corporation,L=Redmond,ST=WA,C=US","title":"SubjectNameFormatString"},"CertificateValidityPeriodScale":{"enum":["days","months","years"],"description":"Scale for the Certificate Validity Period. Possible values are: days, months, years.","title":"CertificateValidityPeriodScale"},"CertificateValidityPeriodValue":{"type":"integer","description":"Value for the Certificate Validity Period","title":"CertificateValidityPeriodValue"},"KeyStorageProvider":{"enum":["useTpmKspOtherwiseUseSoftwareKsp","useTpmKspOtherwiseFail","usePassportForWorkKspOtherwiseFail","useSoftwareKsp"],"description":"Key Storage Provider (KSP). Possible values are: useTpmKspOtherwiseUseSoftwareKsp, useTpmKspOtherwiseFail, usePassportForWorkKspOtherwiseFail, useSoftwareKsp.","title":"KeyStorageProvider"},"RenewalThresholdPercentage":{"type":"integer","description":"Certificate renewal threshold percentage. Valid values 1 to 99","title":"RenewalThresholdPercentage"},"SubjectAlternativeNameType":{"enum":["none","emailAddress","userPrincipalName","customAzureADAttribute","domainNameService","universalResourceIdentifier"],"description":"Certificate Subject Alternative Name Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.","title":"SubjectAlternativeNameType"},"SubjectNameFormat":{"enum":["commonName","commonNameIncludingEmail","commonNameAsEmail","custom","commonNameAsIMEI","commonNameAsSerialNumber","commonNameAsAadDeviceId","commonNameAsIntuneDeviceId","commonNameAsDurableDeviceId"],"description":"Certificate Subject Name Format. Possible values are: commonName, commonNameIncludingEmail, commonNameAsEmail, custom, commonNameAsIMEI, commonNameAsSerialNumber, commonNameAsAadDeviceId, commonNameAsIntuneDeviceId, commonNameAsDurableDeviceId.","title":"SubjectNameFormat"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationpolicyandroiddeviceadministrator":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for microsoft.intune.deviceconfigurationpolicyandroiddeviceadministrator","properties":{"Id":{"type":"string","description":"Id of the Intune policy.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the Intune policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune policy.","title":"Description"},"AppsBlockClipboardSharing":{"type":"boolean","description":"Block clipboard sharing between apps (Samsung KNOX Standard 4.0+).","title":"AppsBlockClipboardSharing"},"AppsBlockCopyPaste":{"type":"boolean","description":"Block copy and paste functionality.","title":"AppsBlockCopyPaste"},"AppsBlockYouTube":{"type":"boolean","description":"Block YouTube (Samsung KNOX Standard 4.0+).","title":"AppsBlockYouTube"},"AppsHideList":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"Specify the apps that will be hidden on the device. Users cannot discover or run these apps.","title":"AppsHideList"},"AppsInstallAllowList":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"Specify the apps that users can install. Users will not be able to install apps that are not on the list.","title":"AppsInstallAllowList"},"AppsLaunchBlockList":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"Specify the apps that users cannot run on their device.","title":"AppsLaunchBlockList"},"BluetoothBlocked":{"type":"boolean","description":"Block Bluetooth (Samsung KNOX Standard 4.0+).","title":"BluetoothBlocked"},"CameraBlocked":{"type":"boolean","description":"Block use of camera","title":"CameraBlocked"},"CellularBlockDataRoaming":{"type":"boolean","description":"Block data roaming over the cellular network (Samsung KNOX Standard 4.0+).","title":"CellularBlockDataRoaming"},"CellularBlockMessaging":{"type":"boolean","description":"Block SMS/MMS messaging functionality (Samsung KNOX Standard 4.0+).","title":"CellularBlockMessaging"},"CellularBlockVoiceRoaming":{"type":"boolean","description":"Block voice roaming over the cellular network (Samsung KNOX Standard 4.0+).","title":"CellularBlockVoiceRoaming"},"CellularBlockWiFiTethering":{"type":"boolean","description":"Block Wi-Fi tethering (Samsung KNOX Standard 4.0+).","title":"CellularBlockWiFiTethering"},"CompliantAppListType":{"enum":["none","appsInListCompliant","appsNotInListCompliant"],"description":"Device compliance can be viewed in the Restricted Apps Compliance report.","title":"CompliantAppListType"},"CompliantAppsList":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"Enter the Google Play Store URL of the app you want. For example, to specify the Microsoft Remote Desktop app for Android, enter https://play.google.com/store/apps/details?id=com.microsoft.rdc.android. To find the URL of an app, use a search engine to locate the store page. For example, to find the Remote Desktop app, you could search Microsoft Remote Desktop Play Store.","title":"CompliantAppsList"},"DateAndTimeBlockChanges":{"type":"boolean","description":"Block user from changing date and time on device (Samsung KNOX).","title":"DateAndTimeBlockChanges"},"DeviceSharingAllowed":{"type":"boolean","description":"Allow multiple users to log into the Company Portal using their AAD credentials (Samsung KNOX Standard 4.0+).","title":"DeviceSharingAllowed"},"DiagnosticDataBlockSubmission":{"type":"boolean","description":"Block submitting diagnostic data from device.","title":"DiagnosticDataBlockSubmission"},"FactoryResetBlocked":{"type":"boolean","description":"Block factory reset on device.","title":"FactoryResetBlocked"},"GoogleAccountBlockAutoSync":{"type":"boolean","description":"Block Google account auto sync functionality on device.","title":"GoogleAccountBlockAutoSync"},"GooglePlayStoreBlocked":{"type":"boolean","description":"Block Google Play store (Samsung KNOX Standard 4.0+).","title":"GooglePlayStoreBlocked"},"KioskModeApps":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"Kiosk mode apps","title":"KioskModeApps"},"KioskModeBlockSleepButton":{"type":"boolean","description":"Kiosk mode block sleep button","title":"KioskModeBlockSleepButton"},"KioskModeBlockVolumeButtons":{"type":"boolean","description":"Kiosk mode block volume buttons","title":"KioskModeBlockVolumeButtons"},"LocationServicesBlocked":{"type":"boolean","description":"Location services blocked","title":"LocationServicesBlocked"},"NfcBlocked":{"type":"boolean","description":"Block Near Field Communication (NFC) technology (Samsung KNOX Standard 4.0+).","title":"NfcBlocked"},"PasswordBlockFingerprintUnlock":{"type":"boolean","description":"Block using fingerprint to unlock device.","title":"PasswordBlockFingerprintUnlock"},"PasswordBlockTrustAgents":{"type":"boolean","description":"Block Smart Lock or other trust agents from adjusting lock screen settings (Samsung KNOX Standard 5.0+).","title":"PasswordBlockTrustAgents"},"PasswordExpirationDays":{"type":"integer","description":"Number of days until device password must be changed. (1-365)","title":"PasswordExpirationDays"},"PasswordMinimumLength":{"type":"integer","description":"Minimum number of digits or characters in password. (4-16)","title":"PasswordMinimumLength"},"PasswordMinutesOfInactivityBeforeScreenTimeout":{"type":"integer","description":"Maximum minutes of inactivity until screen locks. Ignored by device if new time is longer than what's currently set on device. If set to Immediately, devices will use the minimum possible value per device.","title":"PasswordMinutesOfInactivityBeforeScreenTimeout"},"PasswordPreviousPasswordBlockCount":{"type":"integer","description":"Number of new passwords that must be used until an old one can be reused.","title":"PasswordPreviousPasswordBlockCount"},"PasswordRequired":{"type":"boolean","description":"Require password to access device.","title":"PasswordRequired"},"PasswordRequiredType":{"enum":["deviceDefault","alphabetic","alphanumeric","alphanumericWithSymbols","lowSecurityBiometric","numeric","numericComplex","any"],"description":"Specify the type of password required.","title":"PasswordRequiredType"},"PasswordSignInFailureCountBeforeFactoryReset":{"type":"integer","description":"Number of consecutive times an incorrect password can be entered before device is wiped of all data.","title":"PasswordSignInFailureCountBeforeFactoryReset"},"PowerOffBlocked":{"type":"boolean","description":"Block user from powering off device. If this setting is disabled the setting 'Number of sign-in failures before wiping device' does not function.","title":"PowerOffBlocked"},"RequiredPasswordComplexity":{"enum":["none","low","medium","high"],"description":"Define the password complexity.","title":"RequiredPasswordComplexity"},"ScreenCaptureBlocked":{"type":"boolean","description":"Block capturing contents of screen as an image.","title":"ScreenCaptureBlocked"},"SecurityRequireVerifyApps":{"type":"boolean","description":"Security require verify apps","title":"SecurityRequireVerifyApps"},"StorageBlockGoogleBackup":{"type":"boolean","description":"Block sync with Google backup.","title":"StorageBlockGoogleBackup"},"StorageBlockRemovableStorage":{"type":"boolean","description":"Block removable storage usage (Samsung KNOX Standard 4.0+).","title":"StorageBlockRemovableStorage"},"StorageRequireDeviceEncryption":{"type":"boolean","description":"Require encryption on device. Not all devices support encryption.","title":"StorageRequireDeviceEncryption"},"StorageRequireRemovableStorageEncryption":{"type":"boolean","description":"Storage cards must be encrypted. Not all devices support storage card encryption. For more information, see the device and mobile operating system documentation.","title":"StorageRequireRemovableStorageEncryption"},"VoiceAssistantBlocked":{"type":"boolean","description":"Block voice assistant (Samsung KNOX Standard 4.0+).","title":"VoiceAssistantBlocked"},"VoiceDialingBlocked":{"type":"boolean","description":"Block voice dialing (Samsung KNOX Standard 4.0+).","title":"VoiceDialingBlocked"},"WebBrowserBlockAutofill":{"type":"boolean","description":"Block autofill.","title":"WebBrowserBlockAutofill"},"WebBrowserBlocked":{"type":"boolean","description":"Block web browser on device.","title":"WebBrowserBlocked"},"WebBrowserBlockJavaScript":{"type":"boolean","description":"Block JavaScript in the browser.","title":"WebBrowserBlockJavaScript"},"WebBrowserBlockPopups":{"type":"boolean","description":"Block pop-ups in web browser.","title":"WebBrowserBlockPopups"},"WebBrowserCookieSettings":{"enum":["browserDefault","blockAlways","allowCurrentWebSite","allowFromWebsitesVisited","allowAlways"],"description":"Allow or block browser cookies","title":"WebBrowserCookieSettings"},"WiFiBlocked":{"type":"boolean","description":"Block Wi-Fi (Samsung KNOX Standard 4.0+).","title":"WiFiBlocked"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationpolicyandroiddeviceowner":{"type":"object","description":"This resource configures an Intune Device Configuration Policy Android Device Owner.","title":"Schema for microsoft.intune.deviceconfigurationpolicyandroiddeviceowner","properties":{"Id":{"type":"string","description":"The Id of the policy.","title":"Id"},"DisplayName":{"type":"string","description":"The display name of the policy.","title":"DisplayName"},"Description":{"type":"string","description":"The description of the policy.","title":"Description"},"AccountsBlockModification":{"type":"boolean","description":"Block modification of accounts. Only supported on Dedicated devices.","title":"AccountsBlockModification"},"AppsAllowInstallFromUnknownSources":{"type":"boolean","description":"When allowed, users can enable the 'unknown sources' setting to install apps from sources other than the Google Play Store.","title":"AppsAllowInstallFromUnknownSources"},"AppsAutoUpdatePolicy":{"enum":["notConfigured","userChoice","never","wiFiOnly","always"],"description":"Devices check for app updates daily. The default behavior is to let device users decide. They'll be able to set their preferences in the managed Google Play app.","title":"AppsAutoUpdatePolicy"},"AppsDefaultPermissionPolicy":{"enum":["deviceDefault","prompt","autoGrant","autoDeny"],"description":"Define the default permission policy for requests for runtime permissions.","title":"AppsDefaultPermissionPolicy"},"AppsRecommendSkippingFirstUseHints":{"type":"boolean","description":"Enable a suggestion to apps that they skip their user tutorials and any introductory hints when they first start up, if applicable.","title":"AppsRecommendSkippingFirstUseHints"},"AzureAdSharedDeviceDataClearApps":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"A list of managed apps that will have their data cleared during a global sign-out in AAD shared device mode. This collection can contain a maximum of 500 elements.","title":"AzureAdSharedDeviceDataClearApps"},"BluetoothBlockConfiguration":{"type":"boolean","description":"Block configuring Bluetooth.","title":"BluetoothBlockConfiguration"},"BluetoothBlockContactSharing":{"type":"boolean","description":"Block access to work contacts from another device such as a car system when an Android device is paired via Bluetooth.","title":"BluetoothBlockContactSharing"},"CameraBlocked":{"type":"boolean","description":"Block all cameras on the device","title":"CameraBlocked"},"CellularBlockWiFiTethering":{"type":"boolean","description":"Block tethering and access to portable hotspots.","title":"CellularBlockWiFiTethering"},"CertificateCredentialConfigurationDisabled":{"type":"boolean","description":"Blocks users from making any changes to credentials associated with certificates associated with certificates assigned to them.","title":"CertificateCredentialConfigurationDisabled"},"CrossProfilePoliciesAllowCopyPaste":{"type":"boolean","description":"Indicates whether or not text copied from one profile (personal or work) can be pasted in the other.","title":"CrossProfilePoliciesAllowCopyPaste"},"CrossProfilePoliciesAllowDataSharing":{"enum":["notConfigured","crossProfileDataSharingBlocked","dataSharingFromWorkToPersonalBlocked","crossProfileDataSharingAllowed","unkownFutureValue"],"description":"Indicates whether data from one profile (personal or work) can be shared with apps in the other profile.","title":"CrossProfilePoliciesAllowDataSharing"},"CrossProfilePoliciesShowWorkContactsInPersonalProfile":{"type":"boolean","description":"Indicates whether or not contacts stored in work profile are shown in personal profile contact searches/incoming calls.","title":"CrossProfilePoliciesShowWorkContactsInPersonalProfile"},"DataRoamingBlocked":{"type":"boolean","description":"Block data roaming.","title":"DataRoamingBlocked"},"DateTimeConfigurationBlocked":{"type":"boolean","description":"Block user from manually setting the date and time.","title":"DateTimeConfigurationBlocked"},"DetailedHelpText":{"type":"object","description":"Represents the customized detailed help text provided to users when they attempt to modify managed settings on their device.","title":"DetailedHelpText","properties":{"defaultMessage":{"type":"string","description":"The default message displayed if the user's locale doesn't match with any of the localized messages.","title":"defaultMessage"},"localizedMessages":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Device Configuration Policy Android Device Owner.","title":"Schema for MSFT_MicrosoftGraphkeyvaluepair","properties":{"Name":{"type":"string","description":"Name of the message localizedMessages.","title":"Name"},"Value":{"type":"string","description":"Value of the message localizedMessages.","title":"Value"}},"required":[]},"description":"The list of <locale, message> pairs. This collection can contain a maximum of 500 elements.","title":"localizedMessages"}},"required":[]},"DeviceOwnerLockScreenMessage":{"type":"object","description":"Represents the customized lock screen message provided to users when they attempt to modify managed settings on their device.","title":"DeviceOwnerLockScreenMessage","properties":{"defaultMessage":{"type":"string","description":"The default message displayed if the user's locale doesn't match with any of the localized messages.","title":"defaultMessage"},"localizedMessages":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Device Configuration Policy Android Device Owner.","title":"Schema for MSFT_MicrosoftGraphkeyvaluepair","properties":{"Name":{"type":"string","description":"Name of the message localizedMessages.","title":"Name"},"Value":{"type":"string","description":"Value of the message localizedMessages.","title":"Value"}},"required":[]},"description":"The list of <locale, message> pairs. This collection can contain a maximum of 500 elements.","title":"localizedMessages"}},"required":[]},"EnrollmentProfile":{"enum":["notConfigured","dedicatedDevice","fullyManaged"],"description":"Represents the enrollment profile type.","title":"EnrollmentProfile"},"FactoryResetBlocked":{"type":"boolean","description":"Block factory resetting from settings.","title":"FactoryResetBlocked"},"FactoryResetDeviceAdministratorEmails":{"type":"array","items":{"type":"string"},"description":"Email addresses of device admins for factory reset protection. When a device is factory reset, it will require that one of these admins log in with their Google account to unlock the device. If none are specified, factory reset protection is not enabled.","title":"FactoryResetDeviceAdministratorEmails"},"GlobalProxy":{"type":"object","description":"Proxy is set up directly with host, port and excluded hosts.","title":"GlobalProxy","properties":{"odataType":{"enum":["#microsoft.graph.androidDeviceOwnerGlobalProxyAutoConfig","#microsoft.graph.androidDeviceOwnerGlobalProxyDirect"],"description":"The type of the global proxy.","title":"odataType"},"proxyAutoConfigURL":{"type":"string","description":"The proxy auto-config URL.","title":"proxyAutoConfigURL"},"excludedHosts":{"type":"array","items":{"type":"string"},"description":"The excluded hosts.","title":"excludedHosts"},"host":{"type":"string","description":"The host name.","title":"host"},"port":{"type":"integer","description":"The port.","title":"port"}},"required":[]},"GoogleAccountsBlocked":{"type":"boolean","description":"Blocking prevents users from adding their personal Google account to their device.","title":"GoogleAccountsBlocked"},"KioskCustomizationDeviceSettingsBlocked":{"type":"boolean","description":"Indicates whether a user can access the device's Settings app while in Kiosk Mode.","title":"KioskCustomizationDeviceSettingsBlocked"},"KioskCustomizationPowerButtonActionsBlocked":{"type":"boolean","description":"Whether the power menu is shown when a user long presses the Power button of a device in Kiosk Mode.","title":"KioskCustomizationPowerButtonActionsBlocked"},"KioskCustomizationStatusBar":{"enum":["notConfigured","notificationsAndSystemInfoEnabled","systemInfoOnly"],"description":"Indicates whether system info and notifications are disabled in Kiosk Mode","title":"KioskCustomizationStatusBar"},"KioskCustomizationSystemErrorWarnings":{"type":"boolean","description":"Indicates whether system error dialogs for crashed or unresponsive apps are shown in Kiosk Mode.","title":"KioskCustomizationSystemErrorWarnings"},"KioskCustomizationSystemNavigation":{"enum":["notConfigured","navigationEnabled","homeButtonOnly"],"description":"Indicates which navigation features are enabled in Kiosk Mode.","title":"KioskCustomizationSystemNavigation"},"KioskModeAppOrderEnabled":{"type":"boolean","description":"Whether or not to enable app ordering in Kiosk Mode.","title":"KioskModeAppOrderEnabled"},"KioskModeAppPositions":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Device Configuration Policy Android Device Owner.","title":"Schema for MSFT_MicrosoftGraphandroiddeviceownerkioskmodeapppositionitem","properties":{"item":{"type":"object","description":"Item to be arranged.","title":"item","properties":{"odataType":{"enum":["#microsoft.graph.androidDeviceOwnerKioskModeApp","#microsoft.graph.androidDeviceOwnerKioskModeWeblink","#microsoft.graph.androidDeviceOwnerKioskModeManagedFolder"],"description":"Type of the item.","title":"odataType"},"folderIdentifier":{"type":"string","description":"The folder identifier.","title":"folderIdentifier"},"folderName":{"type":"string","description":"The folder name.","title":"folderName"},"items":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Device Configuration Policy Android Device Owner.","title":"Schema for MSFT_MicrosoftGraphandroiddeviceownerkioskmodefolderitem","properties":{"odataType":{"enum":["#microsoft.graph.androidDeviceOwnerKioskModeApp","#microsoft.graph.androidDeviceOwnerKioskModeWeblink"],"description":"The type of the item.","title":"odataType"},"className":{"type":"string","description":"The class name of the item.","title":"className"},"package":{"type":"string","description":"The package of the item.","title":"package"},"label":{"type":"string","description":"The label of the item.","title":"label"},"link":{"type":"string","description":"The link of the item.","title":"link"}},"required":[]},"description":"Item to be arranged.","title":"items"},"className":{"type":"string","description":"The class name of the item.","title":"className"},"package":{"type":"string","description":"The package of the item.","title":"package"},"label":{"type":"string","description":"The label of the item.","title":"label"},"link":{"type":"string","description":"The link of the item.","title":"link"}},"required":[]},"position":{"type":"integer","description":"Position of the item on the grid. Valid values 0 to 9999999.","title":"position"}},"required":[]},"description":"The ordering of items on Kiosk Mode Managed Home Screen. This collection can contain a maximum of 500 elements.","title":"KioskModeAppPositions"},"KioskModeApps":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"A list of managed apps that will be shown when the device is in Kiosk Mode. This collection can contain a maximum of 500 elements.","title":"KioskModeApps"},"KioskModeAppsInFolderOrderedByName":{"type":"boolean","description":"Whether or not to alphabetize applications within a folder in Kiosk Mode.","title":"KioskModeAppsInFolderOrderedByName"},"KioskModeBluetoothConfigurationEnabled":{"type":"boolean","description":"Enable end-users to configure and pair devices over Bluetooth.","title":"KioskModeBluetoothConfigurationEnabled"},"KioskModeDebugMenuEasyAccessEnabled":{"type":"boolean","description":"Whether or not to allow a user to easy access to the debug menu in Kiosk Mode","title":"KioskModeDebugMenuEasyAccessEnabled"},"KioskModeExitCode":{"type":"string","description":"The 4-6 digit PIN will be the code an IT administrator enters on a multi-app dedicated device to pause kiosk mode.","title":"KioskModeExitCode"},"KioskModeFlashlightConfigurationEnabled":{"type":"boolean","description":"Whether or not to allow a user to use the flashlight in Kiosk Mode.","title":"KioskModeFlashlightConfigurationEnabled"},"KioskModeFolderIcon":{"enum":["notConfigured","darkSquare","darkCircle","lightSquare","lightCircle"],"description":"Folder icon configuration for managed home screen in Kiosk Mode.","title":"KioskModeFolderIcon"},"KioskModeGridHeight":{"type":"integer","description":"Number of rows for Managed Home Screen grid with app ordering enabled in Kiosk Mode. Valid values 1 to 9999999.","title":"KioskModeGridHeight"},"KioskModeGridWidth":{"type":"integer","description":"Number of columns for Managed Home Screen grid with app ordering enabled in Kiosk Mode. Valid values 1 to 9999999.","title":"KioskModeGridWidth"},"KioskModeIconSize":{"enum":["notConfigured","smallest","small","regular","large","largest"],"description":"Icon size configuration for managed home screen in Kiosk Mode.","title":"KioskModeIconSize"},"KioskModeLockHomeScreen":{"type":"boolean","description":"Whether or not to lock home screen to the end user in Kiosk Mode.","title":"KioskModeLockHomeScreen"},"KioskModeManagedFolders":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Device Configuration Policy Android Device Owner.","title":"Schema for MSFT_MicrosoftGraphandroiddeviceownerkioskmodemanagedfolder","properties":{"folderIdentifier":{"type":"string","description":"The folder identifier.","title":"folderIdentifier"},"folderName":{"type":"string","description":"The folder name.","title":"folderName"},"items":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Device Configuration Policy Android Device Owner.","title":"Schema for MSFT_MicrosoftGraphandroiddeviceownerkioskmodefolderitem","properties":{"odataType":{"enum":["#microsoft.graph.androidDeviceOwnerKioskModeApp","#microsoft.graph.androidDeviceOwnerKioskModeWeblink"],"description":"The type of the item.","title":"odataType"},"className":{"type":"string","description":"The class name of the item.","title":"className"},"package":{"type":"string","description":"The package of the item.","title":"package"},"label":{"type":"string","description":"The label of the item.","title":"label"},"link":{"type":"string","description":"The link of the item.","title":"link"}},"required":[]},"description":"Item to be arranged.","title":"items"}},"required":[]},"description":"A list of managed folders for a device in Kiosk Mode. This collection can contain a maximum of 500 elements.","title":"KioskModeManagedFolders"},"KioskModeManagedHomeScreenAutoSignout":{"type":"boolean","description":"Whether or not to automatically sign-out of MHS and Shared device mode applications after inactive for Managed Home Screen.","title":"KioskModeManagedHomeScreenAutoSignout"},"KioskModeManagedHomeScreenInactiveSignOutDelayInSeconds":{"type":"integer","description":"Number of seconds to give user notice before automatically signing them out for Managed Home Screen. Valid values 0 to 9999999.","title":"KioskModeManagedHomeScreenInactiveSignOutDelayInSeconds"},"KioskModeManagedHomeScreenInactiveSignOutNoticeInSeconds":{"type":"integer","description":"Number of seconds device is inactive before automatically signing user out for Managed Home Screen. Valid values 0 to 9999999.","title":"KioskModeManagedHomeScreenInactiveSignOutNoticeInSeconds"},"KioskModeManagedHomeScreenPinComplexity":{"enum":["notConfigured","simple","complex"],"description":"Complexity of PIN for sign-in session for Managed Home Screen.","title":"KioskModeManagedHomeScreenPinComplexity"},"KioskModeManagedHomeScreenPinRequired":{"type":"boolean","description":"Whether or not require user to set a PIN for sign-in session for Managed Home Screen.","title":"KioskModeManagedHomeScreenPinRequired"},"KioskModeManagedHomeScreenPinRequiredToResume":{"type":"boolean","description":"Whether or not required user to enter session PIN if screensaver has appeared for Managed Home Screen.","title":"KioskModeManagedHomeScreenPinRequiredToResume"},"KioskModeManagedHomeScreenSignInBackground":{"type":"string","description":"Custom URL background for sign-in screen for Managed Home Screen.","title":"KioskModeManagedHomeScreenSignInBackground"},"KioskModeManagedHomeScreenSignInBrandingLogo":{"type":"string","description":"Custom URL branding logo for sign-in screen and session pin page for Managed Home Screen.","title":"KioskModeManagedHomeScreenSignInBrandingLogo"},"KioskModeManagedHomeScreenSignInEnabled":{"type":"boolean","description":"Whether or not show sign-in screen for Managed Home Screen.","title":"KioskModeManagedHomeScreenSignInEnabled"},"KioskModeManagedSettingsEntryDisabled":{"type":"boolean","description":"Whether or not to use single app kiosk mode or multi-app kiosk mode.","title":"KioskModeManagedSettingsEntryDisabled"},"KioskModeMediaVolumeConfigurationEnabled":{"type":"boolean","description":"Whether or not to allow a user to change the media volume in Kiosk Mode.","title":"KioskModeMediaVolumeConfigurationEnabled"},"KioskModeScreenOrientation":{"enum":["notConfigured","portrait","landscape","autoRotate"],"description":"Screen orientation configuration for managed home screen in Kiosk Mode.","title":"KioskModeScreenOrientation"},"KioskModeScreenSaverConfigurationEnabled":{"type":"boolean","description":"Start screen saver when the device screen times out or locks.","title":"KioskModeScreenSaverConfigurationEnabled"},"KioskModeScreenSaverDetectMediaDisabled":{"type":"boolean","description":"Whether or not the device screen should show the screen saver if audio/video is playing in Kiosk Mode.","title":"KioskModeScreenSaverDetectMediaDisabled"},"KioskModeScreenSaverDisplayTimeInSeconds":{"type":"integer","description":"The number of seconds that the device will display the screen saver for in Kiosk Mode. Valid values 0 to 9999999","title":"KioskModeScreenSaverDisplayTimeInSeconds"},"KioskModeScreenSaverImageUrl":{"type":"string","description":"URL for an image that will be the device's screen saver in Kiosk Mode.","title":"KioskModeScreenSaverImageUrl"},"KioskModeScreenSaverStartDelayInSeconds":{"type":"integer","description":"The number of seconds the device needs to be inactive for before the screen saver is shown in Kiosk Mode. Valid values 1 to 9999999","title":"KioskModeScreenSaverStartDelayInSeconds"},"KioskModeShowAppNotificationBadge":{"type":"boolean","description":"Whether or not to display application notification badges in Kiosk Mode.","title":"KioskModeShowAppNotificationBadge"},"KioskModeShowDeviceInfo":{"type":"boolean","description":"Whether or not to allow a user to access basic device information.","title":"KioskModeShowDeviceInfo"},"KioskModeUseManagedHomeScreenApp":{"enum":["notConfigured","singleAppMode","multiAppMode"],"description":"Whether or not to use single app kiosk mode or multi-app kiosk mode.","title":"KioskModeUseManagedHomeScreenApp"},"KioskModeVirtualHomeButtonEnabled":{"type":"boolean","description":"Enable IT administrators to temporarily leave multi-app kiosk mode to make changes on the device.","title":"KioskModeVirtualHomeButtonEnabled"},"KioskModeVirtualHomeButtonType":{"enum":["notConfigured","swipeUp","floating"],"description":"Enable a soft-key button that returns users to the Managed Home Screen. Choose between a persistent, floating button or a button activated by a swipe-up gesture.","title":"KioskModeVirtualHomeButtonType"},"KioskModeWallpaperUrl":{"type":"string","description":"Customize the appearance of the screen background for assigned groups.","title":"KioskModeWallpaperUrl"},"KioskModeWifiAllowedSsids":{"type":"array","items":{"type":"string"},"description":"The restricted set of WIFI SSIDs available for the user to configure in Kiosk Mode. This collection can contain a maximum of 500 elements.","title":"KioskModeWifiAllowedSsids"},"KioskModeWiFiConfigurationEnabled":{"type":"boolean","description":"Enable end-users to connect to different Wi-Fi networks.","title":"KioskModeWiFiConfigurationEnabled"},"MicrophoneForceMute":{"type":"boolean","description":"Block unmuting the microphone and adjusting the microphone volume.","title":"MicrophoneForceMute"},"MicrosoftLauncherConfigurationEnabled":{"type":"boolean","description":"Indicates whether or not to you want configure Microsoft Launcher.","title":"MicrosoftLauncherConfigurationEnabled"},"MicrosoftLauncherCustomWallpaperAllowUserModification":{"type":"boolean","description":"Indicates whether or not the user can modify the wallpaper to personalize their device.","title":"MicrosoftLauncherCustomWallpaperAllowUserModification"},"MicrosoftLauncherCustomWallpaperEnabled":{"type":"boolean","description":"Indicates whether or not to configure the wallpaper on the targeted devices.","title":"MicrosoftLauncherCustomWallpaperEnabled"},"MicrosoftLauncherCustomWallpaperImageUrl":{"type":"string","description":"Indicates the URL for the image file to use as the wallpaper on the targeted devices.","title":"MicrosoftLauncherCustomWallpaperImageUrl"},"MicrosoftLauncherDockPresenceAllowUserModification":{"type":"boolean","description":"Indicates whether or not the user can modify the device dock configuration on the device.","title":"MicrosoftLauncherDockPresenceAllowUserModification"},"MicrosoftLauncherDockPresenceConfiguration":{"enum":["notConfigured","show","hide","disabled"],"description":"Indicates whether or not you want to configure the device dock. ","title":"MicrosoftLauncherDockPresenceConfiguration"},"MicrosoftLauncherFeedAllowUserModification":{"type":"boolean","description":"Indicates whether or not the user can modify the launcher feed on the device.","title":"MicrosoftLauncherFeedAllowUserModification"},"MicrosoftLauncherFeedEnabled":{"type":"boolean","description":"Indicates whether or not the user can modify the launcher feed on the device.","title":"MicrosoftLauncherFeedEnabled"},"MicrosoftLauncherSearchBarPlacementConfiguration":{"enum":["notConfigured","top","bottom","hide"],"description":"Indicates whether or not you want to configure the device dock.","title":"MicrosoftLauncherSearchBarPlacementConfiguration"},"NetworkEscapeHatchAllowed":{"type":"boolean","description":"Whether the network escape hatch is enabled. If a network connection can't be made at boot time, the escape hatch prompts the user to temporarily connect to a network in order to refresh the device policy. After applying policy, the temporary network will be forgotten and the device will continue booting. This prevents being unable to connect to a network if there is no suitable network in the last policy and the device boots into an app in lock task mode, or the user is otherwise unable to reach device settings.","title":"NetworkEscapeHatchAllowed"},"NfcBlockOutgoingBeam":{"type":"boolean","description":"Block usage of NFC to beam data from apps.","title":"NfcBlockOutgoingBeam"},"PasswordBlockKeyguard":{"type":"boolean","description":"Disable lock screen","title":"PasswordBlockKeyguard"},"PasswordBlockKeyguardFeatures":{"type":"array","items":{"enum":["notConfigured","camera","notifications","unredactedNotifications","trustAgents","fingerprint","remoteInput","allFeatures","face","iris","biometrics"]},"description":"These features are accessible to users when the device is locked. Users will not be able to see or access disabled features.","title":"PasswordBlockKeyguardFeatures"},"PasswordExpirationDays":{"type":"integer","description":"Number of days until device password must be changed. (1-365)","title":"PasswordExpirationDays"},"PasswordMinimumLength":{"type":"integer","description":"Indicates the minimum length of the password required on the device. Valid values 4 to 16","title":"PasswordMinimumLength"},"PasswordMinimumLetterCharacters":{"type":"integer","description":"Indicates the minimum number of letter characters required for device password. Valid values 1 to 16","title":"PasswordMinimumLetterCharacters"},"PasswordMinimumLowerCaseCharacters":{"type":"integer","description":"Indicates the minimum number of lower case characters required for device password. Valid values 1 to 16","title":"PasswordMinimumLowerCaseCharacters"},"PasswordMinimumNonLetterCharacters":{"type":"integer","description":"Indicates the minimum number of non-letter characters required for device password. Valid values 1 to 16","title":"PasswordMinimumNonLetterCharacters"},"PasswordMinimumNumericCharacters":{"type":"integer","description":"Indicates the minimum number of numeric characters required for device password. Valid values 1 to 16","title":"PasswordMinimumNumericCharacters"},"PasswordMinimumSymbolCharacters":{"type":"integer","description":"Indicates the minimum number of symbol characters required for device password. Valid values 1 to 16","title":"PasswordMinimumSymbolCharacters"},"PasswordMinimumUpperCaseCharacters":{"type":"integer","description":"Indicates the minimum number of upper case letter characters required for device password. Valid values 1 to 16","title":"PasswordMinimumUpperCaseCharacters"},"PasswordMinutesOfInactivityBeforeScreenTimeout":{"type":"integer","description":"Maximum time after which the device will lock. Can disable screen lock as well so that it never times out.","title":"PasswordMinutesOfInactivityBeforeScreenTimeout"},"PasswordPreviousPasswordCountToBlock":{"type":"integer","description":"Enter the number of unique passwords required before a user can reuse an old one. (1-24)","title":"PasswordPreviousPasswordCountToBlock"},"PasswordRequiredType":{"enum":["deviceDefault","required","numeric","numericComplex","alphabetic","alphanumeric","alphanumericWithSymbols","lowSecurityBiometric","customPassword"],"description":"Set the password's complexity requirements. Additional password requirements will become available based on your selection.","title":"PasswordRequiredType"},"PasswordRequireUnlock":{"enum":["deviceDefault","daily","unkownFutureValue"],"description":"Indicates the timeout period after which a device must be unlocked using a form of strong authentication.","title":"PasswordRequireUnlock"},"PasswordSignInFailureCountBeforeFactoryReset":{"type":"integer","description":"Number of consecutive times an incorrect password can be entered before device is wiped of all data. (4-11)","title":"PasswordSignInFailureCountBeforeFactoryReset"},"PersonalProfileAppsAllowInstallFromUnknownSources":{"type":"boolean","description":"Indicates whether the user can install apps from unknown sources on the personal profile.","title":"PersonalProfileAppsAllowInstallFromUnknownSources"},"PersonalProfileCameraBlocked":{"type":"boolean","description":"Indicates whether to disable the use of the camera on the personal profile.","title":"PersonalProfileCameraBlocked"},"PersonalProfilePersonalApplications":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"Policy applied to applications in the personal profile. This collection can contain a maximum of 500 elements.","title":"PersonalProfilePersonalApplications"},"PersonalProfilePlayStoreMode":{"enum":["notConfigured","blockedApps","allowedApps"],"description":"Used together with PersonalProfilePersonalApplications to control how apps in the personal profile are allowed or blocked","title":"PersonalProfilePlayStoreMode"},"PersonalProfileScreenCaptureBlocked":{"type":"boolean","description":"Indicates whether to disable the capability to take screenshots on the personal profile.","title":"PersonalProfileScreenCaptureBlocked"},"PlayStoreMode":{"enum":["notConfigured","allowList","blockList"],"description":"Users get access to all apps, except the ones you've required uninstall in Client Apps. If you choose 'Not configured' for this setting, users can only access the apps you've listed as available or required in Client Apps.","title":"PlayStoreMode"},"ScreenCaptureBlocked":{"type":"boolean","description":"Block screen capture","title":"ScreenCaptureBlocked"},"SecurityCommonCriteriaModeEnabled":{"type":"boolean","description":"Represents the security common criteria mode enabled provided to users when they attempt to modify managed settings on their device.","title":"SecurityCommonCriteriaModeEnabled"},"SecurityDeveloperSettingsEnabled":{"type":"boolean","description":"Indicates whether or not the user is allowed to access developer settings like developer options and safe boot on the device.","title":"SecurityDeveloperSettingsEnabled"},"SecurityRequireVerifyApps":{"type":"boolean","description":"Enable Google Play Protect to scan apps before and after they're installed. If it detects a threat, it might warn the user to remove the app from the device. Required by default.","title":"SecurityRequireVerifyApps"},"ShortHelpText":{"type":"object","description":"Represents the customized short help text provided to users when they attempt to modify managed settings on their device.","title":"ShortHelpText","properties":{"defaultMessage":{"type":"string","description":"The default message displayed if the user's locale doesn't match with any of the localized messages.","title":"defaultMessage"},"localizedMessages":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Device Configuration Policy Android Device Owner.","title":"Schema for MSFT_MicrosoftGraphkeyvaluepair","properties":{"Name":{"type":"string","description":"Name of the message localizedMessages.","title":"Name"},"Value":{"type":"string","description":"Value of the message localizedMessages.","title":"Value"}},"required":[]},"description":"The list of <locale, message> pairs. This collection can contain a maximum of 500 elements.","title":"localizedMessages"}},"required":[]},"StatusBarBlocked":{"type":"boolean","description":"Block access to the status bar, including notifications and quick settings.","title":"StatusBarBlocked"},"StayOnModes":{"type":"array","items":{"enum":["notConfigured","ac","usb","wireless"]},"description":"The battery plugged in modes for which the device stays on. When using this setting, it is recommended to clear the Time to lock screen setting so that the device doesn't lock itself while it stays on.","title":"StayOnModes"},"StorageAllowUsb":{"type":"boolean","description":"Allow USB storage.","title":"StorageAllowUsb"},"StorageBlockExternalMedia":{"type":"boolean","description":"Block mounting of external media.","title":"StorageBlockExternalMedia"},"StorageBlockUsbFileTransfer":{"type":"boolean","description":"Block transfer of files over USB.","title":"StorageBlockUsbFileTransfer"},"SystemUpdateFreezePeriods":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Device Configuration Policy Android Device Owner.","title":"Schema for MSFT_MicrosoftGraphandroiddeviceownersystemupdatefreezeperiod","properties":{"endDay":{"type":"integer","description":"The day of the end date of the freeze period. Valid values 1 to 31.","title":"endDay"},"endMonth":{"type":"integer","description":"The month of the end date of the freeze period. Valid values 1 to 12.","title":"endMonth"},"startDay":{"type":"integer","description":"The day of the start date of the freeze period. Valid values 1 to 31.","title":"startDay"},"startMonth":{"type":"integer","description":"The month of the start date of the freeze period. Valid values 1 to 12.","title":"startMonth"}},"required":[]},"description":"Indicates the annually repeating time periods during which system updates are postponed. This collection can contain a maximum of 500 elements.","title":"SystemUpdateFreezePeriods"},"SystemUpdateInstallType":{"enum":["deviceDefault","postpone","windowed","automatic"],"description":"When over-the-air updates are available for this device, they will be installed based on this policy.?","title":"SystemUpdateInstallType"},"SystemUpdateWindowEndMinutesAfterMidnight":{"type":"integer","description":"End of the maintenance window in the device's time zone.?","title":"SystemUpdateWindowEndMinutesAfterMidnight"},"SystemUpdateWindowStartMinutesAfterMidnight":{"type":"integer","description":"Beginning of the maintenance window in the device's time zone.?","title":"SystemUpdateWindowStartMinutesAfterMidnight"},"SystemWindowsBlocked":{"type":"boolean","description":"Disable window notifications such as toasts, incoming calls, outgoing calls, system alerts, and system errors.?","title":"SystemWindowsBlocked"},"UsersBlockAdd":{"type":"boolean","description":"Blocks users from adding and signing in to personal accounts while on the device.","title":"UsersBlockAdd"},"UsersBlockRemove":{"type":"boolean","description":"Block removal of users.","title":"UsersBlockRemove"},"VolumeBlockAdjustment":{"type":"boolean","description":"Block changes to volume.","title":"VolumeBlockAdjustment"},"VpnAlwaysOnLockdownMode":{"type":"boolean","description":"Enabling this forces all network traffic through the VPN tunnel. If a connection to the VPN can't be established, no network traffic will be allowed.","title":"VpnAlwaysOnLockdownMode"},"VpnAlwaysOnPackageIdentifier":{"type":"string","description":"Android app package name for app that will handle an always-on VPN connection.","title":"VpnAlwaysOnPackageIdentifier"},"WifiBlockEditConfigurations":{"type":"boolean","description":"Block user creation or editing of any Wi-Fi configurations.","title":"WifiBlockEditConfigurations"},"WifiBlockEditPolicyDefinedConfigurations":{"type":"boolean","description":"Block changes to Wi-Fi configurations created by the device owner. Users can create their own Wi-Fi configurations.","title":"WifiBlockEditPolicyDefinedConfigurations"},"WorkProfilePasswordExpirationDays":{"type":"integer","description":"Indicates the number of days that a work profile password can be set before it expires and a new password will be required. Valid values 1 to 365","title":"WorkProfilePasswordExpirationDays"},"WorkProfilePasswordMinimumLength":{"type":"integer","description":"Indicates the minimum length of the work profile password. Valid values 4 to 16","title":"WorkProfilePasswordMinimumLength"},"WorkProfilePasswordMinimumLetterCharacters":{"type":"integer","description":"Indicates the minimum number of numeric characters required for the work profile password. Valid values 1 to 16","title":"WorkProfilePasswordMinimumLetterCharacters"},"WorkProfilePasswordMinimumLowerCaseCharacters":{"type":"integer","description":"Indicates the minimum number of non-letter characters required for the work profile password. Valid values 1 to 16","title":"WorkProfilePasswordMinimumLowerCaseCharacters"},"WorkProfilePasswordMinimumNonLetterCharacters":{"type":"integer","description":"Indicates the minimum number of letter characters required for the work profile password. Valid values 1 to 16","title":"WorkProfilePasswordMinimumNonLetterCharacters"},"WorkProfilePasswordMinimumNumericCharacters":{"type":"integer","description":"Indicates the minimum number of lower-case characters required for the work profile password. Valid values 1 to 16","title":"WorkProfilePasswordMinimumNumericCharacters"},"WorkProfilePasswordMinimumSymbolCharacters":{"type":"integer","description":"Indicates the minimum number of upper-case letter characters required for the work profile password. Valid values 1 to 16","title":"WorkProfilePasswordMinimumSymbolCharacters"},"WorkProfilePasswordMinimumUpperCaseCharacters":{"type":"integer","description":"Indicates the minimum number of symbol characters required for the work profile password. Valid values 1 to 16","title":"WorkProfilePasswordMinimumUpperCaseCharacters"},"WorkProfilePasswordPreviousPasswordCountToBlock":{"type":"integer","description":"Indicates the length of the work profile password history, where the user will not be able to enter a new password that is the same as any password in the history. Valid values 0 to 24","title":"WorkProfilePasswordPreviousPasswordCountToBlock"},"WorkProfilePasswordRequiredType":{"enum":["deviceDefault","required","numeric","numericComplex","alphabetic","alphanumeric","alphanumericWithSymbols","lowSecurityBiometric","customPassword"],"description":"Indicates the minimum password quality required on the work profile password.","title":"WorkProfilePasswordRequiredType"},"WorkProfilePasswordRequireUnlock":{"enum":["deviceDefault","daily","unkownFutureValue"],"description":"Indicates the timeout period after which a work profile must be unlocked using a form of strong authentication.","title":"WorkProfilePasswordRequireUnlock"},"WorkProfilePasswordSignInFailureCountBeforeFactoryReset":{"type":"integer","description":"Indicates the number of times a user can enter an incorrect work profile password before the device is wiped. Valid values 4 to 11","title":"WorkProfilePasswordSignInFailureCountBeforeFactoryReset"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationpolicyandroidopensourceproject":{"type":"object","description":"This resource configures an Intune device configuration profile for an Android Open Source Project Device.","title":"Schema for microsoft.intune.deviceconfigurationpolicyandroidopensourceproject","properties":{"Id":{"type":"string","description":"Id of the Intune policy.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the Intune policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune policy.","title":"Description"},"AppsBlockInstallFromUnknownSources":{"type":"boolean","description":"Prevent applications from unknown sources.","title":"AppsBlockInstallFromUnknownSources"},"BluetoothBlockConfiguration":{"type":"boolean","description":"Prevent bluetooth configuration.","title":"BluetoothBlockConfiguration"},"BluetoothBlocked":{"type":"boolean","description":"Prevents using Bluetooth on devices.","title":"BluetoothBlocked"},"CameraBlocked":{"type":"boolean","description":"Prevents access to the device camera.","title":"CameraBlocked"},"FactoryResetBlocked":{"type":"boolean","description":"Prevent factory reset.","title":"FactoryResetBlocked"},"PasswordMinimumLength":{"type":"integer","description":"Minimum number of characters required for the password.","title":"PasswordMinimumLength"},"PasswordMinutesOfInactivityBeforeScreenTimeout":{"type":"integer","description":"Maximum minutes of inactivity until screen locks.","title":"PasswordMinutesOfInactivityBeforeScreenTimeout"},"PasswordRequiredType":{"enum":["deviceDefault","required","numeric","numericComplex","alphabetic","alphanumeric","alphanumericWithSymbols","lowSecurityBiometric","customPassword"],"description":"Set password complexity.","title":"PasswordRequiredType"},"PasswordSignInFailureCountBeforeFactoryReset":{"type":"integer","description":"Number of sign-in failures before wiping device.","title":"PasswordSignInFailureCountBeforeFactoryReset"},"ScreenCaptureBlocked":{"type":"boolean","description":"Prevent screen capture.","title":"ScreenCaptureBlocked"},"SecurityAllowDebuggingFeatures":{"type":"boolean","description":"Enable debugging features.","title":"SecurityAllowDebuggingFeatures"},"StorageBlockExternalMedia":{"type":"boolean","description":"Prevent external media.","title":"StorageBlockExternalMedia"},"StorageBlockUsbFileTransfer":{"type":"boolean","description":"Prevent USB file transfer.","title":"StorageBlockUsbFileTransfer"},"WifiBlockEditConfigurations":{"type":"boolean","description":"Prevent Wifi configuration edit.","title":"WifiBlockEditConfigurations"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationpolicyandroidworkprofile":{"type":"object","description":"This resource configures an Intune device configuration profile for an Android WorkProfile Device.","title":"Schema for microsoft.intune.deviceconfigurationpolicyandroidworkprofile","properties":{"DisplayName":{"type":"string","description":"Display name of the device general configuration policy for Android WorkProfile.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the device general configuration policy for Android WorkProfile","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the Intune Policy.","title":"Assignments"},"PasswordBlockFaceUnlock":{"type":"boolean","description":"Indicates whether or not to block face unlock.","title":"PasswordBlockFaceUnlock"},"PasswordBlockFingerprintUnlock":{"type":"boolean","description":"Indicates whether or not to block fingerprint unlock","title":"PasswordBlockFingerprintUnlock"},"PasswordBlockIrisUnlock":{"type":"boolean","description":"Indicates whether or not to block iris unlock.","title":"PasswordBlockIrisUnlock"},"passwordBlockTrustAgents":{"type":"boolean","description":"Indicates whether or not to block Smart Lock and other trust agents.","title":"passwordBlockTrustAgents"},"PasswordExpirationDays":{"type":"integer","description":"Number of days before the password expires","title":"PasswordExpirationDays"},"PasswordMinimumLength":{"type":"integer","description":"Minimum length of passwords","title":"PasswordMinimumLength"},"PasswordMinutesOfInactivityBeforeScreenTimeout":{"type":"integer","description":"Minutes of inactivity before the screen times out","title":"PasswordMinutesOfInactivityBeforeScreenTimeout"},"PasswordPreviousPasswordBlockCount":{"type":"integer","description":"Number of previous passwords to block","title":"PasswordPreviousPasswordBlockCount"},"PasswordSignInFailureCountBeforeFactoryReset":{"type":"integer","description":"Number of sign in failures allowed before factory reset","title":"PasswordSignInFailureCountBeforeFactoryReset"},"PasswordRequiredType":{"enum":["deviceDefault","lowSecurityBiometric","required","atLeastNumeric","numericComplex","atLeastAlphabetic","atLeastAlphanumeric","alphanumericWithSymbols"],"description":"Type of password that is required","title":"PasswordRequiredType"},"RequiredPasswordComplexity":{"enum":["none","low","medium","high"],"description":"Indicates the required device password complexity on Android. One of: NONE, LOW, MEDIUM, HIGH.","title":"RequiredPasswordComplexity"},"WorkProfileAllowAppInstallsFromUnknownSources":{"type":"boolean","description":"Indicates whether to allow installation of apps from unknown sources.","title":"WorkProfileAllowAppInstallsFromUnknownSources"},"WorkProfileDataSharingType":{"enum":["deviceDefault","preventAny","allowPersonalToWork","noRestrictions"],"description":"Type of data sharing that is allowed","title":"WorkProfileDataSharingType"},"WorkProfileBlockNotificationsWhileDeviceLocked":{"type":"boolean","description":"Indicates whether or not to block notifications while device locked","title":"WorkProfileBlockNotificationsWhileDeviceLocked"},"WorkProfileBlockAddingAccounts":{"type":"boolean","description":"Block users from adding/removing accounts in work profile","title":"WorkProfileBlockAddingAccounts"},"WorkProfileBluetoothEnableContactSharing":{"type":"boolean","description":"Allow bluetooth devices to access enterprise contacts","title":"WorkProfileBluetoothEnableContactSharing"},"WorkProfileBlockScreenCapture":{"type":"boolean","description":"Block screen capture in work profile","title":"WorkProfileBlockScreenCapture"},"WorkProfileBlockCrossProfileCallerId":{"type":"boolean","description":"Block display work profile caller ID in personal profile","title":"WorkProfileBlockCrossProfileCallerId"},"WorkProfileBlockCamera":{"type":"boolean","description":"Block work profile camera","title":"WorkProfileBlockCamera"},"WorkProfileBlockCrossProfileContactsSearch":{"type":"boolean","description":"Block work profile contacts availability in personal profile","title":"WorkProfileBlockCrossProfileContactsSearch"},"WorkProfileBlockCrossProfileCopyPaste":{"type":"boolean","description":"Boolean that indicates if the setting disallow cross profile copy paste is enabled","title":"WorkProfileBlockCrossProfileCopyPaste"},"WorkProfileDefaultAppPermissionPolicy":{"enum":["deviceDefault","prompt","autoGrant","autoDeny"],"description":"Type of password that is required","title":"WorkProfileDefaultAppPermissionPolicy"},"WorkProfilePasswordBlockFaceUnlock":{"type":"boolean","description":"Indicates whether or not to block face unlock in work profile.","title":"WorkProfilePasswordBlockFaceUnlock"},"WorkProfilePasswordBlockFingerprintUnlock":{"type":"boolean","description":"Indicates whether or not to block fingerprint unlock in work profile","title":"WorkProfilePasswordBlockFingerprintUnlock"},"WorkProfilePasswordBlockIrisUnlock":{"type":"boolean","description":"Indicates whether or not to block iris unlock in work profile.","title":"WorkProfilePasswordBlockIrisUnlock"},"WorkProfilePasswordBlockTrustAgents":{"type":"boolean","description":"Indicates whether or not to block Smart Lock and other trust agents for work profile","title":"WorkProfilePasswordBlockTrustAgents"},"WorkProfilePasswordExpirationDays":{"type":"integer","description":"Number of days before the work profile password expires","title":"WorkProfilePasswordExpirationDays"},"WorkProfilePasswordMinimumLength":{"type":"integer","description":"Minimum length of work profile password","title":"WorkProfilePasswordMinimumLength"},"WorkProfilePasswordMinNumericCharacters":{"type":"integer","description":"Minimum count of numeric characters required in work profile password","title":"WorkProfilePasswordMinNumericCharacters"},"WorkProfilePasswordMinNonLetterCharacters":{"type":"integer","description":"Minimum count of non-letter characters required in work profile password","title":"WorkProfilePasswordMinNonLetterCharacters"},"WorkProfilePasswordMinLetterCharacters":{"type":"integer","description":"Minimum count of letter characters required in work profile password","title":"WorkProfilePasswordMinLetterCharacters"},"WorkProfilePasswordMinLowerCaseCharacters":{"type":"integer","description":"Minimum count of lower-case characters required in work profile password","title":"WorkProfilePasswordMinLowerCaseCharacters"},"WorkProfilePasswordMinUpperCaseCharacters":{"type":"integer","description":"Minimum count of upper-case characters required in work profile password","title":"WorkProfilePasswordMinUpperCaseCharacters"},"WorkProfilePasswordMinSymbolCharacters":{"type":"integer","description":"Minimum count of symbols required in work profile password","title":"WorkProfilePasswordMinSymbolCharacters"},"WorkProfilePasswordMinutesOfInactivityBeforeScreenTimeout":{"type":"integer","description":"Minutes of inactivity before the screen times out","title":"WorkProfilePasswordMinutesOfInactivityBeforeScreenTimeout"},"WorkProfilePasswordPreviousPasswordBlockCount":{"type":"integer","description":"Number of previous work profile passwords to block","title":"WorkProfilePasswordPreviousPasswordBlockCount"},"WorkProfilePasswordSignInFailureCountBeforeFactoryReset":{"type":"integer","description":"Number of sign in failures allowed before work profile is removed and all corporate data deleted","title":"WorkProfilePasswordSignInFailureCountBeforeFactoryReset"},"WorkProfilePasswordRequiredType":{"enum":["deviceDefault","lowSecurityBiometric","required","atLeastNumeric","numericComplex","atLeastAlphabetic","atLeastAlphanumeric","alphanumericWithSymbols"],"description":"Type of work profile password that is required","title":"WorkProfilePasswordRequiredType"},"WorkProfileRequiredPasswordComplexity":{"enum":["none","low","medium","high"],"description":"Indicates the required device password complexity on Android. One of: NONE, LOW, MEDIUM, HIGH in work profile.","title":"WorkProfileRequiredPasswordComplexity"},"WorkProfileRequirePassword":{"type":"boolean","description":"Password is required or not for work profile","title":"WorkProfileRequirePassword"},"SecurityRequireVerifyApps":{"type":"boolean","description":"Require the Android Verify apps feature is turned on","title":"SecurityRequireVerifyApps"},"VpnAlwaysOnPackageIdentifier":{"type":"string","description":"Package identifier for always-on VPN.","title":"VpnAlwaysOnPackageIdentifier"},"VpnEnableAlwaysOnLockdownMode":{"type":"boolean","description":"Enable lockdown mode for always-on VPN.","title":"VpnEnableAlwaysOnLockdownMode"},"WorkProfileAllowWidgets":{"type":"boolean","description":"Allow widgets from work profile apps.","title":"WorkProfileAllowWidgets"},"WorkProfileBlockPersonalAppInstallsFromUnknownSources":{"type":"boolean","description":"Prevent app installations from unknown sources in the personal profile.","title":"WorkProfileBlockPersonalAppInstallsFromUnknownSources"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the site collection exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationpolicyios":{"type":"object","description":"This resource configures an Intune Device Configuration Policy for iOS.","title":"Schema for microsoft.intune.deviceconfigurationpolicyios","properties":{"Id":{"type":"string","description":"Id of the Intune policy.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the Intune policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune policy.","title":"Description"},"AccountBlockModification":{"type":"boolean","description":"Indicates whether or not to allow account modification when the device is in supervised mode.","title":"AccountBlockModification"},"ActivationLockAllowWhenSupervised":{"type":"boolean","description":"Activation Lock makes it harder for a lost or stolen device to be reactivated.","title":"ActivationLockAllowWhenSupervised"},"AirDropBlocked":{"type":"boolean","description":"Indicates whether or not to allow AirDrop when the device is in supervised mode.","title":"AirDropBlocked"},"AirDropForceUnmanagedDropTarget":{"type":"boolean","description":"Force AirDrop to be considered an unmanaged drop target.","title":"AirDropForceUnmanagedDropTarget"},"AirPlayForcePairingPasswordForOutgoingRequests":{"type":"boolean","description":"Force requiring a pairing password for outgoing AirPlay requests.","title":"AirPlayForcePairingPasswordForOutgoingRequests"},"AirPrintBlockCredentialsStorage":{"type":"boolean","description":"Blocks keychain storage of username and password for outgoing AirPrint request.","title":"AirPrintBlockCredentialsStorage"},"AirPrintBlocked":{"type":"boolean","description":"Blocks AirPrint request.","title":"AirPrintBlocked"},"AirPrintBlockiBeaconDiscovery":{"type":"boolean","description":"Blocking prevents malicious AirPrint Bluetooth beacons phishing for network traffic.","title":"AirPrintBlockiBeaconDiscovery"},"AirPrintForceTrustedTLS":{"type":"boolean","description":"Forces trusted certificates for TLS printing communication","title":"AirPrintForceTrustedTLS"},"AppClipsBlocked":{"type":"boolean","description":"Block app clips.","title":"AppClipsBlocked"},"AppleNewsBlocked":{"type":"boolean","description":"Block Apple News","title":"AppleNewsBlocked"},"ApplePersonalizedAdsBlocked":{"type":"boolean","description":"Block Apple PersonalizedAdsBlocked","title":"ApplePersonalizedAdsBlocked"},"AppleWatchBlockPairing":{"type":"boolean","description":"Indicates whether or not to allow Apple Watch pairing when the device is in supervised mode (iOS 9.0 and later).","title":"AppleWatchBlockPairing"},"AppleWatchForceWristDetection":{"type":"boolean","description":"Force paired Apple watch to use wrist detection.","title":"AppleWatchForceWristDetection"},"AppRemovalBlocked":{"type":"boolean","description":"Block app removal.","title":"AppRemovalBlocked"},"AppsSingleAppModeList":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"Apps you add to this list and assign to a device can lock the device to run only that app once launched, or lock the device while a certain action is running (for example, taking a test). Once the action is complete, or you remove the restriction, the device returns to its normal state.","title":"AppsSingleAppModeList"},"AppStoreBlockAutomaticDownloads":{"type":"boolean","description":"Blocks automatic downloading of apps purchased on other devices. Does not affect updates to existing apps.","title":"AppStoreBlockAutomaticDownloads"},"AppStoreBlocked":{"type":"boolean","description":"For supervised devices as of iOS 13.0.","title":"AppStoreBlocked"},"AppStoreBlockInAppPurchases":{"type":"boolean","description":"Block AppStore in-app purchases.","title":"AppStoreBlockInAppPurchases"},"AppStoreBlockUIAppInstallation":{"type":"boolean","description":"Block App Store from Home Screen. Users may continue to use iTunes or Apple Configurator to install or update apps.","title":"AppStoreBlockUIAppInstallation"},"AppStoreRequirePassword":{"type":"boolean","description":"Users must enter Apple ID password for each in-app and iTunes purchase.","title":"AppStoreRequirePassword"},"AppsVisibilityList":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"Enter the iTunes App Store URL of the app you want. For example, to specify the Microsoft Work Folders app for iOS, enter https://itunes.apple.com/us/app/work-folders/id950878067?mt=8. To find the URL of an app, use a search engine to locate the store page. For example, to find the Work Folders app, you could search Microsoft Work Folders ITunes.","title":"AppsVisibilityList"},"AppsVisibilityListType":{"enum":["none","appsInListCompliant","appsNotInListCompliant"],"description":"Set whether the list is a list of apps to hide or a list of apps to make visible.","title":"AppsVisibilityListType"},"AutoFillForceAuthentication":{"type":"boolean","description":"Require Touch ID or Face ID before passwords or credit card information can be auto filled in Safari and Apps. Available with iOS 12.0 and later.","title":"AutoFillForceAuthentication"},"AutoUnlockBlocked":{"type":"boolean","description":"Block auto unlock.","title":"AutoUnlockBlocked"},"BlockSystemAppRemoval":{"type":"boolean","description":"Blocking disables the ability to remove system apps from the device.","title":"BlockSystemAppRemoval"},"BluetoothBlockModification":{"type":"boolean","description":"Block modification of Bluetooth settings. To use this setting, the device must be in supervised mode (iOS 10.0+).","title":"BluetoothBlockModification"},"CameraBlocked":{"type":"boolean","description":"Indicates whether or not to block the user from accessing the camera of the device. Requires a supervised device for iOS 13 and later.","title":"CameraBlocked"},"CellularBlockDataRoaming":{"type":"boolean","description":"Block data roaming over the cellular network. This won't show in the device's management profile, but a block will be enforced for data roaming every time the device checks in (typically every 8 hours).","title":"CellularBlockDataRoaming"},"CellularBlockGlobalBackgroundFetchWhileRoaming":{"type":"boolean","description":"Block global background fetch while roaming over the cellular network.","title":"CellularBlockGlobalBackgroundFetchWhileRoaming"},"CellularBlockPerAppDataModification":{"type":"boolean","description":"Block changes to app cellular data usage settings.","title":"CellularBlockPerAppDataModification"},"CellularBlockPersonalHotspot":{"type":"boolean","description":"This value is available only with certain carriers. This won't show in the device's management profile, but a block will be enforced for personal hotspot every time the device checks in (typically every 8 hours). Block modification of personal hotspot in addition to this setting to ensure personal hotspot will always be blocked.","title":"CellularBlockPersonalHotspot"},"CellularBlockPersonalHotspotModification":{"type":"boolean","description":"For devices running iOS 12.2 and later. Users can't turn Personal Hotspot on or off. If you block this setting and block Personal Hotspot, Personal Hotspot will be turned off.","title":"CellularBlockPersonalHotspotModification"},"CellularBlockPlanModification":{"type":"boolean","description":"Indicates whether or not to allow users to change the settings of the cellular plan on a supervised device.","title":"CellularBlockPlanModification"},"CellularBlockVoiceRoaming":{"type":"boolean","description":"Block voice roaming over the cellular network.","title":"CellularBlockVoiceRoaming"},"CertificatesBlockUntrustedTlsCertificates":{"type":"boolean","description":"Block untrusted Transport Layer Security (TLS) certificates.","title":"CertificatesBlockUntrustedTlsCertificates"},"ClassroomAppBlockRemoteScreenObservation":{"type":"boolean","description":"Block remote screen observation by Classroom app. To use this setting, the device must be in supervised mode (iOS 9.3+).","title":"ClassroomAppBlockRemoteScreenObservation"},"ClassroomAppForceUnpromptedScreenObservation":{"type":"boolean","description":"Student devices enrolled in a class via the Classroom app will automatically give permission to that course's teacher to silently observe the student's screen.","title":"ClassroomAppForceUnpromptedScreenObservation"},"ClassroomForceAutomaticallyJoinClasses":{"type":"boolean","description":"Students can join a class without prompting the teacher.","title":"ClassroomForceAutomaticallyJoinClasses"},"ClassroomForceRequestPermissionToLeaveClasses":{"type":"boolean","description":"Requires a student enrolled in an unmanaged course via Classroom to request permission from the teacher when attempting to leave the course. Only available in iOS 11.3+","title":"ClassroomForceRequestPermissionToLeaveClasses"},"ClassroomForceUnpromptedAppAndDeviceLock":{"type":"boolean","description":"Teachers can lock an app open or lock the device without first prompting the user.","title":"ClassroomForceUnpromptedAppAndDeviceLock"},"CompliantAppListType":{"enum":["none","appsInListCompliant","appsNotInListCompliant"],"description":"Device compliance can be viewed in the Restricted Apps Compliance report.","title":"CompliantAppListType"},"CompliantAppsList":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"Enter the iTunes App Store URL of the app you want. For example, to specify the Microsoft Work Folders app for iOS, enter https://itunes.apple.com/us/app/work-folders/id950878067?mt=8. To find the URL of an app, use a search engine to locate the store page. For example, to find the Work Folders app, you could search Microsoft Work Folders ITunes.","title":"CompliantAppsList"},"ConfigurationProfileBlockChanges":{"type":"boolean","description":"Indicates whether or not to block the user from installing configuration profiles and certificates interactively when the device is in supervised mode.","title":"ConfigurationProfileBlockChanges"},"ContactsAllowManagedToUnmanagedWrite":{"type":"boolean","description":"Users can sync and add their managed contacts (including business and corporate ones) to an unmanaged app, such as the device's built-in contacts app.","title":"ContactsAllowManagedToUnmanagedWrite"},"ContactsAllowUnmanagedToManagedRead":{"type":"boolean","description":"An unmanaged app, such as the device's built-in contacts app, can access contact info in a managed app, such as Outlook.","title":"ContactsAllowUnmanagedToManagedRead"},"ContinuousPathKeyboardBlocked":{"type":"boolean","description":"QuickPath enables continuous input on the device keyboard. Available for iOS/iPadOS 13.0 and later.","title":"ContinuousPathKeyboardBlocked"},"DateAndTimeForceSetAutomatically":{"type":"boolean","description":"Forces device to Set Date & Time Automatically. The device's time zone will only be updated when the device has cellular connections or wifi with location services enabled.","title":"DateAndTimeForceSetAutomatically"},"DefinitionLookupBlocked":{"type":"boolean","description":"Indicates whether or not to block definition lookup when the device is in supervised mode (iOS 8.1.3 and later ).","title":"DefinitionLookupBlocked"},"DeviceBlockEnableRestrictions":{"type":"boolean","description":"On iOS 12.0 and later, this blocks users from setting their own Screen Time settings, which includes device restrictions. On iOS 11.4.1 and earlier, this blocks the user from enabling restrictions in the device settings. The blocking effect is the same on any supervised iOS device.","title":"DeviceBlockEnableRestrictions"},"DeviceBlockEraseContentAndSettings":{"type":"boolean","description":"Block the use of the erase all content and settings option on the device.","title":"DeviceBlockEraseContentAndSettings"},"DeviceBlockNameModification":{"type":"boolean","description":"Indicates whether or not to allow device name modification when the device is in supervised mode (iOS 9.0 and later).","title":"DeviceBlockNameModification"},"DiagnosticDataBlockSubmission":{"type":"boolean","description":"Block the device from sending diagnostic and usage telemetry data.","title":"DiagnosticDataBlockSubmission"},"DiagnosticDataBlockSubmissionModification":{"type":"boolean","description":"Block the modification of the diagnostic submission and app analytics settings in the Diagnostics and Usage pane in Settings. To use this setting, the device must be in supervised mode (iOS 9.3.2+).","title":"DiagnosticDataBlockSubmissionModification"},"DocumentsBlockManagedDocumentsInUnmanagedApps":{"type":"boolean","description":"Indicates whether or not to block the user from viewing managed documents in unmanaged apps.","title":"DocumentsBlockManagedDocumentsInUnmanagedApps"},"DocumentsBlockUnmanagedDocumentsInManagedApps":{"type":"boolean","description":"Indicates whether or not to block the user from viewing unmanaged documents in managed apps.","title":"DocumentsBlockUnmanagedDocumentsInManagedApps"},"EmailInDomainSuffixes":{"type":"array","items":{"type":"string"},"description":"Emails that the user sends or receives which don't match the domains you specify here will be marked as untrusted.","title":"EmailInDomainSuffixes"},"EnterpriseAppBlockTrust":{"type":"boolean","description":"Removes the Trust Enterprise Developer button in Settings->General->Profiles & Device Management.","title":"EnterpriseAppBlockTrust"},"EnterpriseAppBlockTrustModification":{"type":"boolean","description":"Block the changing of enterprise app trust settings.","title":"EnterpriseAppBlockTrustModification"},"EnterpriseBookBlockBackup":{"type":"boolean","description":"Indicates whether or not to backup enterprise book.","title":"EnterpriseBookBlockBackup"},"EnterpriseBookBlockMetadataSync":{"type":"boolean","description":"Indicates whether or not to sync enterprise book metadata.","title":"EnterpriseBookBlockMetadataSync"},"EsimBlockModification":{"type":"boolean","description":"Indicates whether or not to allow the addition or removal of cellular plans on the eSIM of a supervised device.","title":"EsimBlockModification"},"FaceTimeBlocked":{"type":"boolean","description":"Indicates whether or not to block the user from using FaceTime. Requires a supervised device for iOS 13 and later.","title":"FaceTimeBlocked"},"FilesNetworkDriveAccessBlocked":{"type":"boolean","description":"Using the Server Message Block (SMB) protocol, devices can access files or other resources on a network server. Available for devices running iOS and iPadOS, versions 13.0 and later.","title":"FilesNetworkDriveAccessBlocked"},"FilesUsbDriveAccessBlocked":{"type":"boolean","description":"Devices with access can connect to and open files on a USB drive. Available for devices running iOS and iPadOS, versions 13.0 and later.","title":"FilesUsbDriveAccessBlocked"},"FindMyDeviceInFindMyAppBlocked":{"type":"boolean","description":"A Find My app feature. Available for iOS/iPadOS 13.0 and later.","title":"FindMyDeviceInFindMyAppBlocked"},"FindMyFriendsBlocked":{"type":"boolean","description":"Block changes to the Find My Friends app settings.","title":"FindMyFriendsBlocked"},"FindMyFriendsInFindMyAppBlocked":{"type":"boolean","description":"A Find My app feature. Used to locate family and friends from an Apple device or iCloud.com. Available for iOS/iPadOS 13.0 and later.","title":"FindMyFriendsInFindMyAppBlocked"},"GameCenterBlocked":{"type":"boolean","description":"Indicates whether or not to block the user from using Game Center when the device is in supervised mode.","title":"GameCenterBlocked"},"GamingBlockGameCenterFriends":{"type":"boolean","description":"Block adding Game Center friends. For supervised devices as of iOS 13.0.","title":"GamingBlockGameCenterFriends"},"GamingBlockMultiplayer":{"type":"boolean","description":"For supervised devices as of iOS 13.0.","title":"GamingBlockMultiplayer"},"HostPairingBlocked":{"type":"boolean","description":"Host pairing allows you to control which devices the device can pair with.","title":"HostPairingBlocked"},"IBooksStoreBlocked":{"type":"boolean","description":"Indicates whether or not to block the user from using the iBooks Store when the device is in supervised mode.","title":"IBooksStoreBlocked"},"IBooksStoreBlockErotica":{"type":"boolean","description":"User will not be able to download media from the iBook store that has been tagged as erotica.","title":"IBooksStoreBlockErotica"},"ICloudBlockActivityContinuation":{"type":"boolean","description":"Handoff lets users start work on one iOS device, and continue it on another MacOS or iOS device.","title":"ICloudBlockActivityContinuation"},"ICloudBlockBackup":{"type":"boolean","description":"Block backing up device to iCloud.","title":"ICloudBlockBackup"},"ICloudBlockDocumentSync":{"type":"boolean","description":"Blocks iCloud from syncing documents and data.","title":"ICloudBlockDocumentSync"},"ICloudBlockManagedAppsSync":{"type":"boolean","description":"Block managed apps from syncing to cloud.","title":"ICloudBlockManagedAppsSync"},"ICloudBlockPhotoLibrary":{"type":"boolean","description":"Any photos not fully downloaded from iCloud Photo Library to device will be removed from local storage.","title":"ICloudBlockPhotoLibrary"},"ICloudBlockPhotoStreamSync":{"type":"boolean","description":"Block photo stream syncing to iCloud.","title":"ICloudBlockPhotoStreamSync"},"ICloudBlockSharedPhotoStream":{"type":"boolean","description":"Block shared photo streaming. Blocking can cause data loss.","title":"ICloudBlockSharedPhotoStream"},"ICloudPrivateRelayBlocked":{"type":"boolean","description":"Block iCloud private relay.","title":"ICloudPrivateRelayBlocked"},"ICloudRequireEncryptedBackup":{"type":"boolean","description":"Require encryption on device backup.","title":"ICloudRequireEncryptedBackup"},"ITunesBlocked":{"type":"boolean","description":"Block iTunes.","title":"ITunesBlocked"},"ITunesBlockExplicitContent":{"type":"boolean","description":"Block explicit iTunes music, podcast, and news content from iTunes. For supervised devices as of 13.0.","title":"ITunesBlockExplicitContent"},"ITunesBlockMusicService":{"type":"boolean","description":"Block Music service. If true, Music app reverts to classic mode and Music service is disabled.","title":"ITunesBlockMusicService"},"ITunesBlockRadio":{"type":"boolean","description":"Indicates whether or not to block the user from using iTunes Radio when the device is in supervised mode (iOS 9.3 and later).","title":"ITunesBlockRadio"},"KeyboardBlockAutoCorrect":{"type":"boolean","description":"Indicates whether or not to block keyboard auto-correction when the device is in supervised mode (iOS 8.1.3 and later).","title":"KeyboardBlockAutoCorrect"},"KeyboardBlockDictation":{"type":"boolean","description":"Indicates whether or not to block the user from using dictation input when the device is in supervised mode.","title":"KeyboardBlockDictation"},"KeyboardBlockPredictive":{"type":"boolean","description":"Indicates whether or not to block predictive keyboards when device is in supervised mode (iOS 8.1.3 and later).","title":"KeyboardBlockPredictive"},"KeyboardBlockShortcuts":{"type":"boolean","description":"Indicates whether or not to block keyboard shortcuts when the device is in supervised mode (iOS 9.0 and later).","title":"KeyboardBlockShortcuts"},"KeyboardBlockSpellCheck":{"type":"boolean","description":"Indicates whether or not to block keyboard spell-checking when the device is in supervised mode (iOS 8.1.3 and later).","title":"KeyboardBlockSpellCheck"},"KeychainBlockCloudSync":{"type":"boolean","description":"Disables syncing credentials stored in the Keychain to iCloud.","title":"KeychainBlockCloudSync"},"KioskModeAllowAssistiveSpeak":{"type":"boolean","description":"Indicates whether or not to allow assistive speak while in kiosk mode.","title":"KioskModeAllowAssistiveSpeak"},"KioskModeAllowAssistiveTouchSettings":{"type":"boolean","description":"Users can turn AssistiveTouch on or off.","title":"KioskModeAllowAssistiveTouchSettings"},"KioskModeAllowAutoLock":{"type":"boolean","description":"Kiosk mode allow auto lock","title":"KioskModeAllowAutoLock"},"KioskModeAllowColorInversionSettings":{"type":"boolean","description":"Users can turn invert colors on or off.","title":"KioskModeAllowColorInversionSettings"},"KioskModeAllowRingerSwitch":{"type":"boolean","description":"Kiosk mode allow ringer switch","title":"KioskModeAllowRingerSwitch"},"KioskModeAllowScreenRotation":{"type":"boolean","description":"Kiosk mode allow screen rotation","title":"KioskModeAllowScreenRotation"},"KioskModeAllowSleepButton":{"type":"boolean","description":"Kiosk mode allow sleep button","title":"KioskModeAllowSleepButton"},"KioskModeAllowTouchscreen":{"type":"boolean","description":"Kiosk mode allow touchscreen","title":"KioskModeAllowTouchscreen"},"KioskModeAllowVoiceControlModification":{"type":"boolean","description":"Indicates whether or not to allow the user to toggle voice control in kiosk mode.","title":"KioskModeAllowVoiceControlModification"},"KioskModeAllowVoiceOverSettings":{"type":"boolean","description":"Users can turn VoiceOver on or off.","title":"KioskModeAllowVoiceOverSettings"},"KioskModeAllowVolumeButtons":{"type":"boolean","description":"Kiosk mode allow volume buttons","title":"KioskModeAllowVolumeButtons"},"KioskModeAllowZoomSettings":{"type":"boolean","description":"Users can turn zoom on or off.","title":"KioskModeAllowZoomSettings"},"KioskModeAppStoreUrl":{"type":"string","description":"URL of app for kiosk mode, e.g. https://itunes.apple.com/us/app/work-folders/id950878067?mt=8","title":"KioskModeAppStoreUrl"},"KioskModeAppType":{"enum":["notConfigured","appStoreApp","managedApp","builtInApp"],"description":"Indicates type of app in kiosk mode.","title":"KioskModeAppType"},"KioskModeBlockAutoLock":{"type":"boolean","description":"Indicates whether or not to block the auto-lock while in Kiosk Mode.","title":"KioskModeBlockAutoLock"},"KioskModeBlockRingerSwitch":{"type":"boolean","description":"Indicates whether or not to block the ringer switch while in Kiosk Mode.","title":"KioskModeBlockRingerSwitch"},"KioskModeBlockScreenRotation":{"type":"boolean","description":"Indicates whether or not to block the screen rotation while in Kiosk Mode.","title":"KioskModeBlockScreenRotation"},"KioskModeBlockSleepButton":{"type":"boolean","description":"Indicates whether or not to block the sleep button while in Kiosk Mode.","title":"KioskModeBlockSleepButton"},"KioskModeBlockTouchscreen":{"type":"boolean","description":"Indicates whether or not to block the touchscreen while in Kiosk Mode.","title":"KioskModeBlockTouchscreen"},"KioskModeBlockVolumeButtons":{"type":"boolean","description":"Indicates whether or not to block the volume buttons while in Kiosk Mode.","title":"KioskModeBlockVolumeButtons"},"KioskModeBuiltInAppId":{"type":"string","description":"To see a list of bundle IDs for common built-in iOS apps, see the Intune documentation.","title":"KioskModeBuiltInAppId"},"KioskModeEnableVoiceControl":{"type":"boolean","description":"Indicates whether or not to enable the voice control while in Kiosk Mode.","title":"KioskModeEnableVoiceControl"},"KioskModeManagedAppId":{"type":"string","description":"Add managed Intune apps from the Software Node.","title":"KioskModeManagedAppId"},"KioskModeRequireAssistiveTouch":{"type":"boolean","description":"Indicates whether or not to enforce assistive touch while in Kiosk Mode.","title":"KioskModeRequireAssistiveTouch"},"KioskModeRequireColorInversion":{"type":"boolean","description":"Indicates whether or not to enforce color inversion while in Kiosk Mode.","title":"KioskModeRequireColorInversion"},"KioskModeRequireMonoAudio":{"type":"boolean","description":"Indicates whether or not to enforce mono audio while in Kiosk Mode.","title":"KioskModeRequireMonoAudio"},"KioskModeRequireVoiceOver":{"type":"boolean","description":"Indicates whether or not to enforce voice control while in Kiosk Mode.","title":"KioskModeRequireVoiceOver"},"KioskModeRequireZoom":{"type":"boolean","description":"Indicates whether or not to enforce zoom while in Kiosk Mode.","title":"KioskModeRequireZoom"},"LockScreenBlockControlCenter":{"type":"boolean","description":"Indicates whether or not to block the user from using control center on the lock screen.","title":"LockScreenBlockControlCenter"},"LockScreenBlockNotificationView":{"type":"boolean","description":"Indicates whether or not to block the user from using the notification view on the lock screen.","title":"LockScreenBlockNotificationView"},"LockScreenBlockPassbook":{"type":"boolean","description":"Indicates whether or not to block the user from using passbook when the device is locked.","title":"LockScreenBlockPassbook"},"LockScreenBlockTodayView":{"type":"boolean","description":"Indicates whether or not to block the user from using the Today View on the lock screen.","title":"LockScreenBlockTodayView"},"ManagedPasteboardRequired":{"type":"boolean","description":"Indicates whether or not to enforce managed pasteboard.","title":"ManagedPasteboardRequired"},"MediaContentRatingApps":{"enum":["allAllowed","allBlocked","agesAbove4","agesAbove9","agesAbove12","agesAbove17"],"description":"Media content rating settings for apps.","title":"MediaContentRatingApps"},"MediaContentRatingAustralia":{"type":"object","description":"Media content rating settings for Australia","title":"MediaContentRatingAustralia","properties":{"movieRating":{"enum":["allAllowed","allBlocked","general","parentalGuidance","mature","agesAbove15","agesAbove18"],"description":"Movies rating selected for Australia","title":"movieRating"},"tvRating":{"enum":["allAllowed","allBlocked","preschoolers","children","general","parentalGuidance","mature","agesAbove15","agesAbove15AdultViolence"],"description":"TV rating selected for Australia","title":"tvRating"}},"required":[]},"MediaContentRatingCanada":{"type":"object","description":"Media content rating settings for Canada","title":"MediaContentRatingCanada","properties":{"movieRating":{"enum":["allAllowed","allBlocked","general","parentalGuidance","agesAbove14","agesAbove18","restricted"],"description":"Movies rating selected for Canada","title":"movieRating"},"tvRating":{"enum":["allAllowed","allBlocked","children","childrenAbove8","general","parentalGuidance","agesAbove14","agesAbove18"],"description":"TV rating selected for Canada","title":"tvRating"}},"required":[]},"MediaContentRatingFrance":{"type":"object","description":"Media content rating settings for France","title":"MediaContentRatingFrance","properties":{"movieRating":{"enum":["allAllowed","allBlocked","agesAbove10","agesAbove12","agesAbove16","agesAbove18"],"description":"Movies rating selected for France","title":"movieRating"},"tvRating":{"enum":["allAllowed","allBlocked","agesAbove10","agesAbove12","agesAbove16","agesAbove18"],"description":"TV rating selected for France","title":"tvRating"}},"required":[]},"MediaContentRatingGermany":{"type":"object","description":"Media content rating settings for Germany","title":"MediaContentRatingGermany","properties":{"movieRating":{"enum":["allAllowed","allBlocked","general","agesAbove6","agesAbove12","agesAbove16","adults"],"description":"Movies rating selected for Germany","title":"movieRating"},"tvRating":{"enum":["allAllowed","allBlocked","general","agesAbove6","agesAbove12","agesAbove16","adults"],"description":"TV rating selected for Germany","title":"tvRating"}},"required":[]},"MediaContentRatingIreland":{"type":"object","description":"Media content rating settings for Ireland","title":"MediaContentRatingIreland","properties":{"movieRating":{"enum":["allAllowed","allBlocked","general","parentalGuidance","agesAbove12","agesAbove15","agesAbove16","adults"],"description":"Movies rating selected for Ireland","title":"movieRating"},"tvRating":{"enum":["allAllowed","allBlocked","general","children","youngAdults","parentalSupervision","mature"],"description":"TV rating selected for Ireland","title":"tvRating"}},"required":[]},"MediaContentRatingJapan":{"type":"object","description":"Media content rating settings for Japan","title":"MediaContentRatingJapan","properties":{"movieRating":{"enum":["allAllowed","allBlocked","general","parentalGuidance","agesAbove15","agesAbove18"],"description":"Movies rating selected for Japan","title":"movieRating"},"tvRating":{"enum":["allAllowed","allBlocked","explicitAllowed"],"description":"TV rating selected for Japan","title":"tvRating"}},"required":[]},"MediaContentRatingNewZealand":{"type":"object","description":"Media content rating settings for New Zealand","title":"MediaContentRatingNewZealand","properties":{"movieRating":{"enum":["allAllowed","allBlocked","general","parentalGuidance","mature","agesAbove13","agesAbove15","agesAbove16","agesAbove18","restricted","agesAbove16Restricted"],"description":"Movies rating selected for New Zealand","title":"movieRating"},"tvRating":{"enum":["allAllowed","allBlocked","general","parentalGuidance","adults"],"description":"TV rating selected for New Zealand","title":"tvRating"}},"required":[]},"MediaContentRatingUnitedKingdom":{"type":"object","description":"Media content rating settings for United Kingdom","title":"MediaContentRatingUnitedKingdom","properties":{"movieRating":{"enum":["allAllowed","allBlocked","general","universalChildren","parentalGuidance","agesAbove12Video","agesAbove12Cinema","agesAbove15","adults"],"description":"Movies rating selected for UK","title":"movieRating"},"tvRating":{"enum":["allAllowed","allBlocked","caution"],"description":"TV rating selected for UK","title":"tvRating"}},"required":[]},"MediaContentRatingUnitedStates":{"type":"object","description":"Media content rating settings for United States","title":"MediaContentRatingUnitedStates","properties":{"movieRating":{"enum":["allAllowed","allBlocked","general","parentalGuidance","parentalGuidance13","restricted","adults"],"description":"Movies rating selected for USA","title":"movieRating"},"tvRating":{"enum":["allAllowed","allBlocked","childrenAll","childrenAbove7","general","parentalGuidance","childrenAbove14","adults"],"description":"TV rating selected for USA","title":"tvRating"}},"required":[]},"MessagesBlocked":{"type":"boolean","description":"Indicates whether or not to block the user from using the Messages app on the supervised device.","title":"MessagesBlocked"},"NetworkUsageRules":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Device Configuration Policy for iOS.","title":"Schema for MSFT_MicrosoftGraphiosnetworkusagerule","properties":{"cellularDataBlocked":{"type":"boolean","description":"If set to true, corresponding managed apps will not be allowed to use cellular data at any time.","title":"cellularDataBlocked"},"cellularDataBlockWhenRoaming":{"type":"boolean","description":"If set to true, corresponding managed apps will not be allowed to use cellular data when roaming.","title":"cellularDataBlockWhenRoaming"},"managedApps":{"type":"array","items":{"type":"object","description":"This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.","title":"Schema for MSFT_MicrosoftGraphapplistitem","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"odatatype of the item.","title":"odataType"},"appId":{"type":"string","description":"Kiosk mode managed app id","title":"appId"},"appStoreUrl":{"type":"string","description":"Define the app store URL.","title":"appStoreUrl"},"name":{"type":"string","description":"Define the name of the app.","title":"name"},"publisher":{"type":"string","description":"Define the publisher of the app.","title":"publisher"}},"required":[]},"description":"Information about the managed apps that this rule is going to apply to.","title":"managedApps"}},"required":[]},"description":"If you don't add any managed apps, the configured settings will apply to all managed apps by default. If you add specific managed apps, the configured settings will apply to only those apps.","title":"NetworkUsageRules"},"NfcBlocked":{"type":"boolean","description":"Indicates whether or not to block the user from using nfc on the supervised device.","title":"NfcBlocked"},"NotificationsBlockSettingsModification":{"type":"boolean","description":"Indicates whether or not to allow notifications settings modification (iOS 9.3 and later).","title":"NotificationsBlockSettingsModification"},"OnDeviceOnlyDictationForced":{"type":"boolean","description":"Indicates whether or not to enforce on device only dictation.","title":"OnDeviceOnlyDictationForced"},"OnDeviceOnlyTranslationForced":{"type":"boolean","description":"Indicates whether or not to enforce on device only translation.","title":"OnDeviceOnlyTranslationForced"},"PasscodeBlockFingerprintModification":{"type":"boolean","description":"Block users from adding, changing, or removing fingerprints and faces. Face ID is available in iOS 11.0 and later.","title":"PasscodeBlockFingerprintModification"},"PasscodeBlockFingerprintUnlock":{"type":"boolean","description":"Face ID is available on iOS 11.0 and later.","title":"PasscodeBlockFingerprintUnlock"},"PasscodeBlockModification":{"type":"boolean","description":"Block passcode from being added, changed or removed. Changes to passcode restrictions will be ignored on supervised devices after blocking passcode modification.","title":"PasscodeBlockModification"},"PasscodeBlockSimple":{"type":"boolean","description":"Block simple password sequences, such as 1234 or 1111.","title":"PasscodeBlockSimple"},"PasscodeExpirationDays":{"type":"integer","description":"Number of days until device password must be changed. (1-65535)","title":"PasscodeExpirationDays"},"PasscodeMinimumCharacterSetCount":{"type":"integer","description":"Minimum number (0-4) of non-alphanumeric characters, such as #, %, !, etc., required in the password. The default value is 0.","title":"PasscodeMinimumCharacterSetCount"},"PasscodeMinimumLength":{"type":"integer","description":"Minimum number of digits or characters in password. (4-14)","title":"PasscodeMinimumLength"},"PasscodeMinutesOfInactivityBeforeLock":{"type":"integer","description":"Set to 0 to require a password immediately. There is no maximum number of minutes, and this number overrides the number currently set on the device. (This compliance check is supported for devices with OS versions iOS 8.0 and above)","title":"PasscodeMinutesOfInactivityBeforeLock"},"PasscodeMinutesOfInactivityBeforeScreenTimeout":{"type":"integer","description":"Set to 0 to use the device's minimum possible value. This number (0-60) overrides the number currently set on the device. If set to Immediately, devices will use the minimum possible value per device.","title":"PasscodeMinutesOfInactivityBeforeScreenTimeout"},"PasscodePreviousPasscodeBlockCount":{"type":"integer","description":"Number of new passwords that must be used until an old one can be reused. (1-24)","title":"PasscodePreviousPasscodeBlockCount"},"PasscodeRequired":{"type":"boolean","description":"In addition to requiring a password on all devices, this setting enforces a non-simple, 6-digit password requirement (regardless of other password settings you configure) on devices that are enrolled with Apple user enrollment.","title":"PasscodeRequired"},"PasscodeRequiredType":{"enum":["deviceDefault","alphanumeric","numeric"],"description":"Type of passcode that is required.","title":"PasscodeRequiredType"},"PasscodeSignInFailureCountBeforeWipe":{"type":"integer","description":"Number of consecutive times an incorrect password can be entered before device is wiped of all data. (2-11)","title":"PasscodeSignInFailureCountBeforeWipe"},"PasswordBlockAirDropSharing":{"type":"boolean","description":"Indicates whether or not to block AirDrop password sharing","title":"PasswordBlockAirDropSharing"},"PasswordBlockAutoFill":{"type":"boolean","description":"Indicates whether or not to block password autofill.","title":"PasswordBlockAutoFill"},"PasswordBlockProximityRequests":{"type":"boolean","description":"Indicates whether or not to block password proximity requests.","title":"PasswordBlockProximityRequests"},"PkiBlockOTAUpdates":{"type":"boolean","description":"Allows your users to receive software updates without connecting their devices to a computer","title":"PkiBlockOTAUpdates"},"PodcastsBlocked":{"type":"boolean","description":"Indicates whether or not to block podcasts.","title":"PodcastsBlocked"},"PrivacyForceLimitAdTracking":{"type":"boolean","description":"Disables device advertising identifier","title":"PrivacyForceLimitAdTracking"},"ProximityBlockSetupToNewDevice":{"type":"boolean","description":"Block user's from using their Apple devices to set up and configure other Apple devices.","title":"ProximityBlockSetupToNewDevice"},"SafariBlockAutofill":{"type":"boolean","description":"Indicates whether or not to block Safari autofill.","title":"SafariBlockAutofill"},"SafariBlocked":{"type":"boolean","description":"Indicates whether or not to block Safari. For supervised devices as of iOS 13.0.","title":"SafariBlocked"},"SafariBlockJavaScript":{"type":"boolean","description":"Indicates whether or not to block javascript in Safari.","title":"SafariBlockJavaScript"},"SafariBlockPopups":{"type":"boolean","description":"Indicates whether or not to block popups on Safari.","title":"SafariBlockPopups"},"SafariCookieSettings":{"enum":["browserDefault","blockAlways","allowCurrentWebSite","allowFromWebsitesVisited","allowAlways"],"description":"Cookie settings for Safari.","title":"SafariCookieSettings"},"SafariManagedDomains":{"type":"array","items":{"type":"string"},"description":"Documents downloaded from the URLs you specify here will be considered managed (Safari only).","title":"SafariManagedDomains"},"SafariPasswordAutoFillDomains":{"type":"array","items":{"type":"string"},"description":"Users can save passwords in Safari only from URLs matching the patterns you specify here. To use this setting, the device must be in supervised mode and not configured for multiple users. (iOS 9.3+)","title":"SafariPasswordAutoFillDomains"},"SafariRequireFraudWarning":{"type":"boolean","description":"Indicates whether or not to require fraud warning in Safari.","title":"SafariRequireFraudWarning"},"ScreenCaptureBlocked":{"type":"boolean","description":"Indicates whether or not to block the user from taking Screenshots","title":"ScreenCaptureBlocked"},"SharedDeviceBlockTemporarySessions":{"type":"boolean","description":"Indicates whether or not to block temporary sessions on shared devices.","title":"SharedDeviceBlockTemporarySessions"},"SiriBlocked":{"type":"boolean","description":"Indicates whether or not to block Siri.","title":"SiriBlocked"},"SiriBlockedWhenLocked":{"type":"boolean","description":"Indicates whether or not to block Siri when locked.","title":"SiriBlockedWhenLocked"},"SiriBlockUserGeneratedContent":{"type":"boolean","description":"Block Siri from querying user-generated content from the internet.","title":"SiriBlockUserGeneratedContent"},"SiriRequireProfanityFilter":{"type":"boolean","description":"Prevents Siri from dictating, or speaking profane language.","title":"SiriRequireProfanityFilter"},"SoftwareUpdatesEnforcedDelayInDays":{"type":"integer","description":"Delay the user's software update for this many days. The maximum is 90 days. (1-90)","title":"SoftwareUpdatesEnforcedDelayInDays"},"SoftwareUpdatesForceDelayed":{"type":"boolean","description":"Delay user visibility of Software Updates. This does not impact any scheduled updates. It represents days before software updates are visible to end users after release.","title":"SoftwareUpdatesForceDelayed"},"SpotlightBlockInternetResults":{"type":"boolean","description":"Blocks Spotlight from returning any results from an Internet search.","title":"SpotlightBlockInternetResults"},"UnpairedExternalBootToRecoveryAllowed":{"type":"boolean","description":"Allow users to boot devices into recovery mode with unpaired devices. Available for devices running iOS and iPadOS versions 14.5 and later.","title":"UnpairedExternalBootToRecoveryAllowed"},"UsbRestrictedModeBlocked":{"type":"boolean","description":"Blocks USB Restricted mode. USB Restricted mode blocks USB accessories from exchanging data with a device that has been locked over an hour.","title":"UsbRestrictedModeBlocked"},"VoiceDialingBlocked":{"type":"boolean","description":"Indicates whether or not to block voice dialing.","title":"VoiceDialingBlocked"},"VpnBlockCreation":{"type":"boolean","description":"Blocks the creation of VPN configurations","title":"VpnBlockCreation"},"WallpaperBlockModification":{"type":"boolean","description":"Block wallpaper from being changed.","title":"WallpaperBlockModification"},"WiFiConnectOnlyToConfiguredNetworks":{"type":"boolean","description":"Force the device to use only Wi-Fi networks set up through configuration profiles.","title":"WiFiConnectOnlyToConfiguredNetworks"},"WiFiConnectToAllowedNetworksOnlyForced":{"type":"boolean","description":"Require devices to use Wi-Fi networks set up via configuration profiles. Available for devices running iOS and iPadOS versions 14.5 and later.","title":"WiFiConnectToAllowedNetworksOnlyForced"},"WifiPowerOnForced":{"type":"boolean","description":"Wi-Fi can't be turned off in the Settings app or in the Control Center, even when the device is in airplane mode. Available for iOS/iPadOS 13.0 and later.","title":"WifiPowerOnForced"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationpolicymacos":{"type":"object","description":"This resource configures an Intune device configuration profile for an MacOS Device.","title":"Schema for microsoft.intune.deviceconfigurationpolicymacos","properties":{"Id":{"type":"string","description":"Id of the Intune policy.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the Intune policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune policy.","title":"Description"},"AddingGameCenterFriendsBlocked":{"type":"boolean","description":"Configures users from adding friends to Game Center. Available for devices running macOS versions 10.13 and later.","title":"AddingGameCenterFriendsBlocked"},"AirDropBlocked":{"type":"boolean","description":"Configures whether or not to allow AirDrop.","title":"AirDropBlocked"},"AppleWatchBlockAutoUnlock":{"type":"boolean","description":"Blocks users from unlocking their Mac with Apple Watch.","title":"AppleWatchBlockAutoUnlock"},"CameraBlocked":{"type":"boolean","description":"Blocks users from taking photographs and videos.","title":"CameraBlocked"},"ClassroomAppBlockRemoteScreenObservation":{"type":"boolean","description":"Blocks AirPlay, screen sharing to other devices, and a Classroom app feature used by teachers to view their students' screens. This setting isn't available if you've blocked screenshots.","title":"ClassroomAppBlockRemoteScreenObservation"},"ClassroomAppForceUnpromptedScreenObservation":{"type":"boolean","description":"Unprompted observation means that teachers can view screens without warning students first. This setting isn't available if you've blocked screenshots.","title":"ClassroomAppForceUnpromptedScreenObservation"},"ClassroomForceAutomaticallyJoinClasses":{"type":"boolean","description":"Students can join a class without prompting the teacher.","title":"ClassroomForceAutomaticallyJoinClasses"},"ClassroomForceRequestPermissionToLeaveClasses":{"type":"boolean","description":"Students enrolled in an unmanaged Classroom course must get teacher consent to leave the course.","title":"ClassroomForceRequestPermissionToLeaveClasses"},"ClassroomForceUnpromptedAppAndDeviceLock":{"type":"boolean","description":"Teachers can lock a student's device or app without the student's approval.","title":"ClassroomForceUnpromptedAppAndDeviceLock"},"CompliantAppListType":{"enum":["none","appsInListCompliant","appsNotInListCompliant"],"description":"Device compliance can be viewed in the Restricted Apps Compliance report.","title":"CompliantAppListType"},"CompliantAppsList":{"type":"array","items":{"type":"object","description":"This resource configures an Intune device configuration profile for an MacOS Device.","title":"Schema for MSFT_MicrosoftGraphapplistitemMacOS","properties":{"odataType":{"enum":["#microsoft.graph.appleAppListItem"],"description":"Specify the odataType","title":"odataType"},"appId":{"type":"string","description":"The application or bundle identifier of the application","title":"appId"},"appStoreUrl":{"type":"string","description":"The Store URL of the application","title":"appStoreUrl"},"name":{"type":"string","description":"The application name","title":"name"},"publisher":{"type":"string","description":"The publisher of the application","title":"publisher"}},"required":[]},"description":"List of apps in the compliance (either allow list or block list, controlled by CompliantAppListType).","title":"CompliantAppsList"},"ContentCachingBlocked":{"type":"boolean","description":"Configures whether or not to allow content caching.","title":"ContentCachingBlocked"},"DefinitionLookupBlocked":{"type":"boolean","description":"Block look up, a feature that looks up the definition of a highlighted word.","title":"DefinitionLookupBlocked"},"EmailInDomainSuffixes":{"type":"array","items":{"type":"string"},"description":"Emails that the user sends or receives which don't match the domains you specify here will be marked as untrusted. ","title":"EmailInDomainSuffixes"},"EraseContentAndSettingsBlocked":{"type":"boolean","description":"Configures the reset option on supervised devices. Available for devices running macOS versions 12.0 and later.","title":"EraseContentAndSettingsBlocked"},"GameCenterBlocked":{"type":"boolean","description":"Configured if the Game Center icon is removed from the Home screen. Available for devices running macOS versions 10.13 and later.","title":"GameCenterBlocked"},"ICloudBlockActivityContinuation":{"type":"boolean","description":"Handoff lets users start work on one MacOS device, and continue it on another MacOS or iOS device. Available for macOS 10.15 and later.","title":"ICloudBlockActivityContinuation"},"ICloudBlockAddressBook":{"type":"boolean","description":"Blocks iCloud from syncing contacts.","title":"ICloudBlockAddressBook"},"ICloudBlockBookmarks":{"type":"boolean","description":"Blocks iCloud from syncing bookmarks.","title":"ICloudBlockBookmarks"},"ICloudBlockCalendar":{"type":"boolean","description":"Blocks iCloud from syncing calendars.","title":"ICloudBlockCalendar"},"ICloudBlockDocumentSync":{"type":"boolean","description":"Blocks iCloud from syncing documents and data.","title":"ICloudBlockDocumentSync"},"ICloudBlockMail":{"type":"boolean","description":"Blocks iCloud from syncing mail.","title":"ICloudBlockMail"},"ICloudBlockNotes":{"type":"boolean","description":"Blocks iCloud from syncing notes.","title":"ICloudBlockNotes"},"ICloudBlockPhotoLibrary":{"type":"boolean","description":"Any photos not fully downloaded from iCloud Photo Library to device will be removed from local storage.","title":"ICloudBlockPhotoLibrary"},"ICloudBlockReminders":{"type":"boolean","description":"Blocks iCloud from syncing reminders.","title":"ICloudBlockReminders"},"ICloudDesktopAndDocumentsBlocked":{"type":"boolean","description":"Configures if the synchronization of cloud desktop and documents is blocked. Available for devices running macOS 10.12.4 and later.","title":"ICloudDesktopAndDocumentsBlocked"},"ICloudPrivateRelayBlocked":{"type":"boolean","description":"Configures if iCloud private relay is blocked or not. Available for devices running macOS 12 and later.","title":"ICloudPrivateRelayBlocked"},"ITunesBlockFileSharing":{"type":"boolean","description":"Blocks files from being transferred using iTunes.","title":"ITunesBlockFileSharing"},"ITunesBlockMusicService":{"type":"boolean","description":"Configures  whether or not to block files from being transferred using iTunes.","title":"ITunesBlockMusicService"},"KeyboardBlockDictation":{"type":"boolean","description":"Block dictation, which is a feature that converts the user's voice to text.","title":"KeyboardBlockDictation"},"KeychainBlockCloudSync":{"type":"boolean","description":"Disables syncing credentials stored in the Keychain to iCloud","title":"KeychainBlockCloudSync"},"MultiplayerGamingBlocked":{"type":"boolean","description":"Configures whether multiplayer gaming when using Game Center is blocked. Available for devices running macOS versions 10.13 and later.","title":"MultiplayerGamingBlocked"},"PasswordBlockAirDropSharing":{"type":"boolean","description":"Configures whether or not to block sharing passwords with the AirDrop passwords feature.","title":"PasswordBlockAirDropSharing"},"PasswordBlockAutoFill":{"type":"boolean","description":"Configures whether or not to block the AutoFill Passwords feature.","title":"PasswordBlockAutoFill"},"PasswordBlockFingerprintUnlock":{"type":"boolean","description":"Requires user to set a non-biometric passcode or password to unlock the device.","title":"PasswordBlockFingerprintUnlock"},"PasswordBlockModification":{"type":"boolean","description":"Blocks user from changing the set passcode.","title":"PasswordBlockModification"},"PasswordBlockProximityRequests":{"type":"boolean","description":"Configures whether or not to block requesting passwords from nearby devices.","title":"PasswordBlockProximityRequests"},"PasswordBlockSimple":{"type":"boolean","description":"Block simple password sequences, such as 1234 or 1111.","title":"PasswordBlockSimple"},"PasswordExpirationDays":{"type":"integer","description":"Number of days until device password must be changed. (1-65535)","title":"PasswordExpirationDays"},"PasswordMaximumAttemptCount":{"type":"integer","description":"Configures the number of allowed failed attempts to enter the passcode at the device's lock screen. Valid values 2 to 11","title":"PasswordMaximumAttemptCount"},"PasswordMinimumCharacterSetCount":{"type":"integer","description":"Minimum number (0-4) of non-alphanumeric characters, such as #, %, !, etc., required in the password. The default value is 0.","title":"PasswordMinimumCharacterSetCount"},"PasswordMinimumLength":{"type":"integer","description":"Minimum number of digits or characters in password (4-16).","title":"PasswordMinimumLength"},"PasswordMinutesOfInactivityBeforeLock":{"type":"integer","description":"Set to 0 to require a password immediately. There is no maximum number of minutes, and this number overrides the number currently set on the device.","title":"PasswordMinutesOfInactivityBeforeLock"},"PasswordMinutesOfInactivityBeforeScreenTimeout":{"type":"integer","description":"Set to 0 to use the device's minimum possible value. This number (0-60 minutes) overrides the number currently set on the device.","title":"PasswordMinutesOfInactivityBeforeScreenTimeout"},"PasswordMinutesUntilFailedLoginReset":{"type":"integer","description":"Configures the number of minutes before the login is reset after the maximum number of unsuccessful login attempts is reached.","title":"PasswordMinutesUntilFailedLoginReset"},"PasswordPreviousPasswordBlockCount":{"type":"integer","description":"Number of new passwords that must be used until an old one can be reused. (1-24)","title":"PasswordPreviousPasswordBlockCount"},"PasswordRequired":{"type":"boolean","description":"Specify the type of password required.","title":"PasswordRequired"},"PasswordRequiredType":{"enum":["deviceDefault","alphanumeric","numeric"],"description":"Specify the type of password required.","title":"PasswordRequiredType"},"PrivacyAccessControls":{"type":"array","items":{"type":"object","description":"This resource configures an Intune device configuration profile for an MacOS Device.","title":"Schema for MSFT_MicrosoftGraphmacosprivacyaccesscontrolitem","properties":{"accessibility":{"enum":["notConfigured","enabled","disabled"],"description":"Allow the app or process to control the Mac via the Accessibility subsystem.","title":"accessibility"},"addressBook":{"enum":["notConfigured","enabled","disabled"],"description":"Allow or block access to contact information managed by Contacts.","title":"addressBook"},"appleEventsAllowedReceivers":{"type":"array","items":{"type":"object","description":"This resource configures an Intune device configuration profile for an MacOS Device.","title":"Schema for MSFT_MicrosoftGraphmacosappleeventreceiver","properties":{"allowed":{"type":"boolean","description":"Allow or block this app from receiving Apple events.","title":"allowed"},"codeRequirement":{"type":"string","description":"Code requirement for the app or binary that receives the Apple Event.","title":"codeRequirement"},"identifier":{"type":"string","description":"Bundle ID of the app or file path of the process or executable that receives the Apple Event.","title":"identifier"},"identifierType":{"enum":["bundleID","path"],"description":"Use bundle ID for an app or path for a process or executable that receives the Apple Event.","title":"identifierType"}},"required":[]},"description":"Allow or deny the app or process to send a restricted Apple event to another app or process. You will need to know the identifier, identifier type, and code requirement of the receiving app or process.","title":"appleEventsAllowedReceivers"},"blockCamera":{"type":"boolean","description":"Block access to camera app.","title":"blockCamera"},"blockListenEvent":{"type":"boolean","description":"Block the app or process from listening to events from input devices such as mouse, keyboard, and trackpad.Requires macOS 10.15 or later.","title":"blockListenEvent"},"blockMicrophone":{"type":"boolean","description":"Block access to microphone.","title":"blockMicrophone"},"blockScreenCapture":{"type":"boolean","description":"Block app from capturing contents of system display. Requires macOS 10.15 or later.","title":"blockScreenCapture"},"calendar":{"enum":["notConfigured","enabled","disabled"],"description":"Allow or block access to event information managed by Calendar.","title":"calendar"},"codeRequirement":{"type":"string","description":"Enter the code requirement, which can be obtained with the command 'codesign -display -r -' in the Terminal app. Include everything after '=>'.","title":"codeRequirement"},"displayName":{"type":"string","description":"The display name of the app, process, or executable.","title":"displayName"},"fileProviderPresence":{"enum":["notConfigured","enabled","disabled"],"description":"Allow the app or process to access files managed by another app's file provider extension. Requires macOS 10.15 or later.","title":"fileProviderPresence"},"identifier":{"type":"string","description":"The bundle ID or path of the app, process, or executable.","title":"identifier"},"identifierType":{"enum":["bundleID","path"],"description":"A bundle ID is used to identify an app. A path is used to identify a process or executable.","title":"identifierType"},"mediaLibrary":{"enum":["notConfigured","enabled","disabled"],"description":"Allow or block access to music and the media library.","title":"mediaLibrary"},"photos":{"enum":["notConfigured","enabled","disabled"],"description":"Allow or block access to images managed by Photos.","title":"photos"},"postEvent":{"enum":["notConfigured","enabled","disabled"],"description":"Control access to CoreGraphics APIs, which are used to send CGEvents to the system event stream.","title":"postEvent"},"reminders":{"enum":["notConfigured","enabled","disabled"],"description":"Allow or block access to information managed by Reminders.","title":"reminders"},"speechRecognition":{"enum":["notConfigured","enabled","disabled"],"description":"Allow or block access to system speech recognition facility.","title":"speechRecognition"},"staticCodeValidation":{"type":"boolean","description":"Statically validates the code requirement. Use this setting if the process invalidates its dynamic code signature.","title":"staticCodeValidation"},"systemPolicyAllFiles":{"enum":["notConfigured","enabled","disabled"],"description":"Control access to all protected files on a device. Files might be in locations such as emails, messages, apps, and administrative settings. Apply this setting with caution.","title":"systemPolicyAllFiles"},"systemPolicyDesktopFolder":{"enum":["notConfigured","enabled","disabled"],"description":"Allow or block access to Desktop folder.","title":"systemPolicyDesktopFolder"},"systemPolicyDocumentsFolder":{"enum":["notConfigured","enabled","disabled"],"description":"Allow or block access to Documents folder.","title":"systemPolicyDocumentsFolder"},"systemPolicyDownloadsFolder":{"enum":["notConfigured","enabled","disabled"],"description":"Allow or block access to Downloads folder.","title":"systemPolicyDownloadsFolder"},"systemPolicyNetworkVolumes":{"enum":["notConfigured","enabled","disabled"],"description":"Allow or block access to network volumes. Requires macOS 10.15 or later.","title":"systemPolicyNetworkVolumes"},"systemPolicyRemovableVolumes":{"enum":["notConfigured","enabled","disabled"],"description":"Control access to removable volumes on the device, such as an external hard drive. Requires macOS 10.15 or later.","title":"systemPolicyRemovableVolumes"},"systemPolicySystemAdminFiles":{"enum":["notConfigured","enabled","disabled"],"description":"Allow app or process to access files used in system administration.","title":"systemPolicySystemAdminFiles"}},"required":[]},"description":"Configure an app's access to specific data, folders, and apps on a device. These settings apply to devices running macOS Mojave 10.14 and later.","title":"PrivacyAccessControls"},"SafariBlockAutofill":{"type":"boolean","description":"Blocks Safari from remembering what users enter in web forms.","title":"SafariBlockAutofill"},"ScreenCaptureBlocked":{"type":"boolean","description":"Configures whether or not to block the user from taking Screenshots.","title":"ScreenCaptureBlocked"},"SoftwareUpdateMajorOSDeferredInstallDelayInDays":{"type":"integer","description":"Specify the number of days (1-90) to delay visibility of major OS software updates. Available for devices running macOS versions 11.3 and later. Valid values 0 to 90","title":"SoftwareUpdateMajorOSDeferredInstallDelayInDays"},"SoftwareUpdateMinorOSDeferredInstallDelayInDays":{"type":"integer","description":"Specify the number of days (1-90) to delay visibility of minor OS software updates. Available for devices running macOS versions 11.3 and later. Valid values 0 to 90","title":"SoftwareUpdateMinorOSDeferredInstallDelayInDays"},"SoftwareUpdateNonOSDeferredInstallDelayInDays":{"type":"integer","description":"Specify the number of days (1-90) to delay visibility of non-OS software updates. Available for devices running macOS versions 11.3 and later. Valid values 0 to 90","title":"SoftwareUpdateNonOSDeferredInstallDelayInDays"},"SoftwareUpdatesEnforcedDelayInDays":{"type":"integer","description":"Delay the user's software update for this many days. The maximum is 90 days. (1-90)","title":"SoftwareUpdatesEnforcedDelayInDays"},"SpotlightBlockInternetResults":{"type":"boolean","description":"Blocks Spotlight from returning any results from an Internet search","title":"SpotlightBlockInternetResults"},"TouchIdTimeoutInHours":{"type":"integer","description":"Configures the maximum hours after which the user must enter their password to unlock the device instead of using Touch ID. Available for devices running macOS 12 and later. Valid values 0 to 2147483647","title":"TouchIdTimeoutInHours"},"UpdateDelayPolicy":{"type":"array","items":{"enum":["none","delayOSUpdateVisibility","delayAppUpdateVisibility","unknownFutureValue","delayMajorOsUpdateVisibility"]},"description":"Configures whether to delay OS and/or app updates for macOS.","title":"UpdateDelayPolicy"},"WallpaperModificationBlocked":{"type":"boolean","description":"Configures whether the wallpaper can be changed. Available for devices running macOS versions 10.13 and later.","title":"WallpaperModificationBlocked"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationpolicywindows10":{"type":"object","description":"Intune Device Configuration Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationpolicywindows10","properties":{"AccountsBlockAddingNonMicrosoftAccountEmail":{"type":"boolean","description":"Indicates whether or not to Block the user from adding email accounts to the device that are not associated with a Microsoft account.","title":"AccountsBlockAddingNonMicrosoftAccountEmail"},"ActivateAppsWithVoice":{"enum":["notConfigured","enabled","disabled"],"description":"Specifies if Windows apps can be activated by voice. Possible values are: notConfigured, enabled, disabled.","title":"ActivateAppsWithVoice"},"AntiTheftModeBlocked":{"type":"boolean","description":"Indicates whether or not to block the user from selecting an AntiTheft mode preference (Windows 10 Mobile only).","title":"AntiTheftModeBlocked"},"AppManagementMSIAllowUserControlOverInstall":{"type":"boolean","description":"This policy setting permits users to change installation options that typically are available only to system administrators.","title":"AppManagementMSIAllowUserControlOverInstall"},"AppManagementMSIAlwaysInstallWithElevatedPrivileges":{"type":"boolean","description":"This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system.","title":"AppManagementMSIAlwaysInstallWithElevatedPrivileges"},"AppManagementPackageFamilyNamesToLaunchAfterLogOn":{"type":"array","items":{"type":"string"},"description":"List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are to be launched after logon.","title":"AppManagementPackageFamilyNamesToLaunchAfterLogOn"},"AppsAllowTrustedAppsSideloading":{"enum":["notConfigured","blocked","allowed"],"description":"Indicates whether apps from AppX packages signed with a trusted certificate can be side loaded. Possible values are: notConfigured, blocked, allowed.","title":"AppsAllowTrustedAppsSideloading"},"AppsBlockWindowsStoreOriginatedApps":{"type":"boolean","description":"Indicates whether or not to disable the launch of all apps from Windows Store that came pre-installed or were downloaded.","title":"AppsBlockWindowsStoreOriginatedApps"},"AuthenticationAllowSecondaryDevice":{"type":"boolean","description":"Allows secondary authentication devices to work with Windows.","title":"AuthenticationAllowSecondaryDevice"},"AuthenticationPreferredAzureADTenantDomainName":{"type":"string","description":"Specifies the preferred domain among available domains in the Azure AD tenant.","title":"AuthenticationPreferredAzureADTenantDomainName"},"AuthenticationWebSignIn":{"enum":["notConfigured","enabled","disabled"],"description":"Indicates whether or not Web Credential Provider will be enabled. Possible values are: notConfigured, enabled, disabled.","title":"AuthenticationWebSignIn"},"BluetoothAllowedServices":{"type":"array","items":{"type":"string"},"description":"Specify a list of allowed Bluetooth services and profiles in hex formatted strings.","title":"BluetoothAllowedServices"},"BluetoothBlockAdvertising":{"type":"boolean","description":"Whether or not to Block the user from using bluetooth advertising.","title":"BluetoothBlockAdvertising"},"BluetoothBlockDiscoverableMode":{"type":"boolean","description":"Whether or not to Block the user from using bluetooth discoverable mode.","title":"BluetoothBlockDiscoverableMode"},"BluetoothBlocked":{"type":"boolean","description":"Whether or not to Block the user from using bluetooth.","title":"BluetoothBlocked"},"BluetoothBlockPrePairing":{"type":"boolean","description":"Whether or not to block specific bundled Bluetooth peripherals to automatically pair with the host device.","title":"BluetoothBlockPrePairing"},"BluetoothBlockPromptedProximalConnections":{"type":"boolean","description":"Whether or not to block the users from using Swift Pair and other proximity based scenarios.","title":"BluetoothBlockPromptedProximalConnections"},"CameraBlocked":{"type":"boolean","description":"Whether or not to Block the user from accessing the camera of the device.","title":"CameraBlocked"},"CellularBlockDataWhenRoaming":{"type":"boolean","description":"Whether or not to Block the user from using data over cellular while roaming.","title":"CellularBlockDataWhenRoaming"},"CellularBlockVpn":{"type":"boolean","description":"Whether or not to Block the user from using VPN over cellular.","title":"CellularBlockVpn"},"CellularBlockVpnWhenRoaming":{"type":"boolean","description":"Whether or not to Block the user from using VPN when roaming over cellular.","title":"CellularBlockVpnWhenRoaming"},"CellularData":{"enum":["blocked","required","allowed","notConfigured"],"description":"Whether or not to allow the cellular data channel on the device. If not configured, the cellular data channel is allowed and the user can turn it off. Possible values are: blocked, required, allowed, notConfigured.","title":"CellularData"},"CertificatesBlockManualRootCertificateInstallation":{"type":"boolean","description":"Whether or not to Block the user from doing manual root certificate installation.","title":"CertificatesBlockManualRootCertificateInstallation"},"ConfigureTimeZone":{"type":"string","description":"Specifies the time zone to be applied to the device. This is the standard Windows name for the target time zone.","title":"ConfigureTimeZone"},"ConnectedDevicesServiceBlocked":{"type":"boolean","description":"Whether or not to block Connected Devices Service which enables discovery and connection to other devices, remote messaging, remote app sessions and other cross-device experiences.","title":"ConnectedDevicesServiceBlocked"},"CopyPasteBlocked":{"type":"boolean","description":"Whether or not to Block the user from using copy paste.","title":"CopyPasteBlocked"},"CortanaBlocked":{"type":"boolean","description":"Whether or not to Block the user from using Cortana.","title":"CortanaBlocked"},"CryptographyAllowFipsAlgorithmPolicy":{"type":"boolean","description":"Specify whether to allow or disallow the Federal Information Processing Standard (FIPS) policy.","title":"CryptographyAllowFipsAlgorithmPolicy"},"DataProtectionBlockDirectMemoryAccess":{"type":"boolean","description":"This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows.","title":"DataProtectionBlockDirectMemoryAccess"},"DefenderBlockEndUserAccess":{"type":"boolean","description":"Whether or not to block end user access to Defender.","title":"DefenderBlockEndUserAccess"},"DefenderBlockOnAccessProtection":{"type":"boolean","description":"Allows or disallows Windows Defender On Access Protection functionality.","title":"DefenderBlockOnAccessProtection"},"DefenderCloudBlockLevel":{"enum":["notConfigured","high","highPlus","zeroTolerance"],"description":"Specifies the level of cloud-delivered protection. Possible values are: notConfigured, high, highPlus, zeroTolerance.","title":"DefenderCloudBlockLevel"},"DefenderCloudExtendedTimeout":{"type":"integer","description":"Timeout extension for file scanning by the cloud. Valid values 0 to 50","title":"DefenderCloudExtendedTimeout"},"DefenderCloudExtendedTimeoutInSeconds":{"type":"integer","description":"Timeout extension for file scanning by the cloud. Valid values 0 to 50","title":"DefenderCloudExtendedTimeoutInSeconds"},"DefenderDaysBeforeDeletingQuarantinedMalware":{"type":"integer","description":"Number of days before deleting quarantined malware. Valid values 0 to 90","title":"DefenderDaysBeforeDeletingQuarantinedMalware"},"DefenderDetectedMalwareActions":{"type":"object","description":"Gets or sets Defenders actions to take on detected Malware per threat level.","title":"DefenderDetectedMalwareActions","properties":{"HighSeverity":{"enum":["deviceDefault","clean","quarantine","remove","allow","userDefined","block"],"description":"Indicates a Defender action to take for high severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.","title":"HighSeverity"},"LowSeverity":{"enum":["deviceDefault","clean","quarantine","remove","allow","userDefined","block"],"description":"Indicates a Defender action to take for low severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.","title":"LowSeverity"},"ModerateSeverity":{"enum":["deviceDefault","clean","quarantine","remove","allow","userDefined","block"],"description":"Indicates a Defender action to take for moderate severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.","title":"ModerateSeverity"},"SevereSeverity":{"enum":["deviceDefault","clean","quarantine","remove","allow","userDefined","block"],"description":"Indicates a Defender action to take for severe severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.","title":"SevereSeverity"}},"required":[]},"DefenderDisableCatchupFullScan":{"type":"boolean","description":"When blocked, catch-up scans for scheduled full scans will be turned off.","title":"DefenderDisableCatchupFullScan"},"DefenderDisableCatchupQuickScan":{"type":"boolean","description":"When blocked, catch-up scans for scheduled quick scans will be turned off.","title":"DefenderDisableCatchupQuickScan"},"DefenderFileExtensionsToExclude":{"type":"array","items":{"type":"string"},"description":"File extensions to exclude from scans and real time protection.","title":"DefenderFileExtensionsToExclude"},"DefenderFilesAndFoldersToExclude":{"type":"array","items":{"type":"string"},"description":"Files and folder to exclude from scans and real time protection.","title":"DefenderFilesAndFoldersToExclude"},"DefenderMonitorFileActivity":{"enum":["userDefined","disable","monitorAllFiles","monitorIncomingFilesOnly","monitorOutgoingFilesOnly"],"description":"Value for monitoring file activity. Possible values are: userDefined, disable, monitorAllFiles, monitorIncomingFilesOnly, monitorOutgoingFilesOnly.","title":"DefenderMonitorFileActivity"},"DefenderPotentiallyUnwantedAppAction":{"enum":["deviceDefault","block","audit"],"description":"Gets or sets Defenders action to take on Potentially Unwanted Application (PUA), which includes software with behaviors of ad-injection, software bundling, persistent solicitation for payment or subscription, etc. Defender alerts user when PUA is being downloaded or attempts to install itself. Added in Windows 10 for desktop. Possible values are: deviceDefault, block, audit.","title":"DefenderPotentiallyUnwantedAppAction"},"DefenderPotentiallyUnwantedAppActionSetting":{"enum":["userDefined","enable","auditMode","warn","notConfigured"],"description":"Gets or sets Defenders action to take on Potentially Unwanted Application (PUA), which includes software with behaviors of ad-injection, software bundling, persistent solicitation for payment or subscription, etc. Defender alerts user when PUA is being downloaded or attempts to install itself. Added in Windows 10 for desktop. Possible values are: userDefined, enable, auditMode, warn, notConfigured.","title":"DefenderPotentiallyUnwantedAppActionSetting"},"DefenderProcessesToExclude":{"type":"array","items":{"type":"string"},"description":"Processes to exclude from scans and real time protection.","title":"DefenderProcessesToExclude"},"DefenderPromptForSampleSubmission":{"enum":["userDefined","alwaysPrompt","promptBeforeSendingPersonalData","neverSendData","sendAllDataWithoutPrompting"],"description":"The configuration for how to prompt user for sample submission. Possible values are: userDefined, alwaysPrompt, promptBeforeSendingPersonalData, neverSendData, sendAllDataWithoutPrompting.","title":"DefenderPromptForSampleSubmission"},"DefenderRequireBehaviorMonitoring":{"type":"boolean","description":"Indicates whether or not to require behavior monitoring.","title":"DefenderRequireBehaviorMonitoring"},"DefenderRequireCloudProtection":{"type":"boolean","description":"Indicates whether or not to require cloud protection.","title":"DefenderRequireCloudProtection"},"DefenderRequireNetworkInspectionSystem":{"type":"boolean","description":"Indicates whether or not to require network inspection system.","title":"DefenderRequireNetworkInspectionSystem"},"DefenderRequireRealTimeMonitoring":{"type":"boolean","description":"Indicates whether or not to require real time monitoring.","title":"DefenderRequireRealTimeMonitoring"},"DefenderScanArchiveFiles":{"type":"boolean","description":"Indicates whether or not to scan archive files.","title":"DefenderScanArchiveFiles"},"DefenderScanDownloads":{"type":"boolean","description":"Indicates whether or not to scan downloads.","title":"DefenderScanDownloads"},"DefenderScanIncomingMail":{"type":"boolean","description":"Indicates whether or not to scan incoming mail messages.","title":"DefenderScanIncomingMail"},"DefenderScanMappedNetworkDrivesDuringFullScan":{"type":"boolean","description":"Indicates whether or not to scan mapped network drives during full scan.","title":"DefenderScanMappedNetworkDrivesDuringFullScan"},"DefenderScanMaxCpu":{"type":"integer","description":"Max CPU usage percentage during scan. Valid values 0 to 100","title":"DefenderScanMaxCpu"},"DefenderScanNetworkFiles":{"type":"boolean","description":"Indicates whether or not to scan files opened from a network folder.","title":"DefenderScanNetworkFiles"},"DefenderScanRemovableDrivesDuringFullScan":{"type":"boolean","description":"Indicates whether or not to scan removable drives during full scan.","title":"DefenderScanRemovableDrivesDuringFullScan"},"DefenderScanScriptsLoadedInInternetExplorer":{"type":"boolean","description":"Indicates whether or not to scan scripts loaded in Internet Explorer browser.","title":"DefenderScanScriptsLoadedInInternetExplorer"},"DefenderScanType":{"enum":["userDefined","disabled","quick","full"],"description":"The defender system scan type. Possible values are: userDefined, disabled, quick, full.","title":"DefenderScanType"},"DefenderScheduledQuickScanTime":{"type":"string","description":"The time to perform a daily quick scan.","title":"DefenderScheduledQuickScanTime"},"DefenderScheduledScanTime":{"type":"string","description":"The defender time for the system scan.","title":"DefenderScheduledScanTime"},"DefenderScheduleScanEnableLowCpuPriority":{"type":"boolean","description":"When enabled, low CPU priority will be used during scheduled scans.","title":"DefenderScheduleScanEnableLowCpuPriority"},"DefenderSignatureUpdateIntervalInHours":{"type":"integer","description":"The signature update interval in hours. Specify 0 not to check. Valid values 0 to 24","title":"DefenderSignatureUpdateIntervalInHours"},"DefenderSubmitSamplesConsentType":{"enum":["sendSafeSamplesAutomatically","alwaysPrompt","neverSend","sendAllSamplesAutomatically"],"description":"Checks for the user consent level in Windows Defender to send data. Possible values are: sendSafeSamplesAutomatically, alwaysPrompt, neverSend, sendAllSamplesAutomatically.","title":"DefenderSubmitSamplesConsentType"},"DefenderSystemScanSchedule":{"enum":["userDefined","everyday","sunday","monday","tuesday","wednesday","thursday","friday","saturday","noScheduledScan"],"description":"Defender day of the week for the system scan. Possible values are: userDefined, everyday, sunday, monday, tuesday, wednesday, thursday, friday, saturday, noScheduledScan.","title":"DefenderSystemScanSchedule"},"DeveloperUnlockSetting":{"enum":["notConfigured","blocked","allowed"],"description":"Indicates whether or not to allow developer unlock. Possible values are: notConfigured, blocked, allowed.","title":"DeveloperUnlockSetting"},"DeviceManagementBlockFactoryResetOnMobile":{"type":"boolean","description":"Indicates whether or not to Block the user from resetting their phone.","title":"DeviceManagementBlockFactoryResetOnMobile"},"DeviceManagementBlockManualUnenroll":{"type":"boolean","description":"Indicates whether or not to Block the user from doing manual un-enrollment from device management.","title":"DeviceManagementBlockManualUnenroll"},"DiagnosticsDataSubmissionMode":{"enum":["userDefined","none","basic","enhanced","full"],"description":"Gets or sets a value allowing the device to send diagnostic and usage telemetry data, such as Watson. Possible values are: userDefined, none, basic, enhanced, full.","title":"DiagnosticsDataSubmissionMode"},"DisplayAppListWithGdiDPIScalingTurnedOff":{"type":"array","items":{"type":"string"},"description":"List of legacy applications that have GDI DPI Scaling turned off.","title":"DisplayAppListWithGdiDPIScalingTurnedOff"},"DisplayAppListWithGdiDPIScalingTurnedOn":{"type":"array","items":{"type":"string"},"description":"List of legacy applications that have GDI DPI Scaling turned on.","title":"DisplayAppListWithGdiDPIScalingTurnedOn"},"EdgeAllowStartPagesModification":{"type":"boolean","description":"Allow users to change Start pages on Edge. Use the EdgeHomepageUrls to specify the Start pages that the user would see by default when they open Edge.","title":"EdgeAllowStartPagesModification"},"EdgeBlockAccessToAboutFlags":{"type":"boolean","description":"Indicates whether or not to prevent access to about flags on Edge browser.","title":"EdgeBlockAccessToAboutFlags"},"EdgeBlockAddressBarDropdown":{"type":"boolean","description":"Block the address bar dropdown functionality in Microsoft Edge. Disable this settings to minimize network connections from Microsoft Edge to Microsoft services.","title":"EdgeBlockAddressBarDropdown"},"EdgeBlockAutofill":{"type":"boolean","description":"Indicates whether or not to block auto fill.","title":"EdgeBlockAutofill"},"EdgeBlockCompatibilityList":{"type":"boolean","description":"Block Microsoft compatibility list in Microsoft Edge. This list from Microsoft helps Edge properly display sites with known compatibility issues.","title":"EdgeBlockCompatibilityList"},"EdgeBlockDeveloperTools":{"type":"boolean","description":"Indicates whether or not to block developer tools in the Edge browser.","title":"EdgeBlockDeveloperTools"},"EdgeBlocked":{"type":"boolean","description":"Indicates whether or not to Block the user from using the Edge browser.","title":"EdgeBlocked"},"EdgeBlockEditFavorites":{"type":"boolean","description":"Indicates whether or not to Block the user from making changes to Favorites.","title":"EdgeBlockEditFavorites"},"EdgeBlockExtensions":{"type":"boolean","description":"Indicates whether or not to block extensions in the Edge browser.","title":"EdgeBlockExtensions"},"EdgeBlockFullScreenMode":{"type":"boolean","description":"Allow or prevent Edge from entering the full screen mode.","title":"EdgeBlockFullScreenMode"},"EdgeBlockInPrivateBrowsing":{"type":"boolean","description":"Indicates whether or not to block InPrivate browsing on corporate networks, in the Edge browser.","title":"EdgeBlockInPrivateBrowsing"},"EdgeBlockJavaScript":{"type":"boolean","description":"Indicates whether or not to Block the user from using JavaScript.","title":"EdgeBlockJavaScript"},"EdgeBlockLiveTileDataCollection":{"type":"boolean","description":"Block the collection of information by Microsoft for live tile creation when users pin a site to Start from Microsoft Edge.","title":"EdgeBlockLiveTileDataCollection"},"EdgeBlockPasswordManager":{"type":"boolean","description":"Indicates whether or not to Block password manager.","title":"EdgeBlockPasswordManager"},"EdgeBlockPopups":{"type":"boolean","description":"Indicates whether or not to block popups.","title":"EdgeBlockPopups"},"EdgeBlockPrelaunch":{"type":"boolean","description":"Decide whether Microsoft Edge is prelaunched at Windows startup.","title":"EdgeBlockPrelaunch"},"EdgeBlockPrinting":{"type":"boolean","description":"Configure Edge to allow or block printing.","title":"EdgeBlockPrinting"},"EdgeBlockSavingHistory":{"type":"boolean","description":"Configure Edge to allow browsing history to be saved or to never save browsing history.","title":"EdgeBlockSavingHistory"},"EdgeBlockSearchEngineCustomization":{"type":"boolean","description":"Indicates whether or not to block the user from adding new search engine or changing the default search engine.","title":"EdgeBlockSearchEngineCustomization"},"EdgeBlockSearchSuggestions":{"type":"boolean","description":"Indicates whether or not to block the user from using the search suggestions in the address bar.","title":"EdgeBlockSearchSuggestions"},"EdgeBlockSendingDoNotTrackHeader":{"type":"boolean","description":"Indicates whether or not to Block the user from sending the do not track header.","title":"EdgeBlockSendingDoNotTrackHeader"},"EdgeBlockSendingIntranetTrafficToInternetExplorer":{"type":"boolean","description":"Indicates whether or not to switch the intranet traffic from Edge to Internet Explorer. Note: the name of this property is misleading the property is obsolete, use EdgeSendIntranetTrafficToInternetExplorer instead.","title":"EdgeBlockSendingIntranetTrafficToInternetExplorer"},"EdgeBlockSideloadingExtensions":{"type":"boolean","description":"Indicates whether the user can sideload extensions.","title":"EdgeBlockSideloadingExtensions"},"EdgeBlockTabPreloading":{"type":"boolean","description":"Configure whether Edge preloads the new tab page at Windows startup.","title":"EdgeBlockTabPreloading"},"EdgeBlockWebContentOnNewTabPage":{"type":"boolean","description":"Configure to load a blank page in Edge instead of the default New tab page and prevent users from changing it.","title":"EdgeBlockWebContentOnNewTabPage"},"EdgeClearBrowsingDataOnExit":{"type":"boolean","description":"Clear browsing data on exiting Microsoft Edge.","title":"EdgeClearBrowsingDataOnExit"},"EdgeCookiePolicy":{"enum":["userDefined","allow","blockThirdParty","blockAll"],"description":"Indicates which cookies to block in the Edge browser. Possible values are: userDefined, allow, blockThirdParty, blockAll.","title":"EdgeCookiePolicy"},"EdgeDisableFirstRunPage":{"type":"boolean","description":"Block the Microsoft web page that opens on the first use of Microsoft Edge. This policy allows enterprises, like those enrolled in zero emissions configurations, to block this page.","title":"EdgeDisableFirstRunPage"},"EdgeEnterpriseModeSiteListLocation":{"type":"string","description":"Indicates the enterprise mode site list location. Could be a local file, local network or http location.","title":"EdgeEnterpriseModeSiteListLocation"},"EdgeFavoritesBarVisibility":{"enum":["notConfigured","hide","show"],"description":"Get or set a value that specifies whether to set the favorites bar to always be visible or hidden on any page. Possible values are: notConfigured, hide, show.","title":"EdgeFavoritesBarVisibility"},"EdgeFavoritesListLocation":{"type":"string","description":"The location of the favorites list to provision. Could be a local file, local network or http location.","title":"EdgeFavoritesListLocation"},"EdgeFirstRunUrl":{"type":"string","description":"The first run URL for when Edge browser is opened for the first time.","title":"EdgeFirstRunUrl"},"EdgeHomeButtonConfiguration":{"type":"object","description":"Causes the Home button to either hide, load the default Start page, load a New tab page, or a custom URL","title":"EdgeHomeButtonConfiguration","properties":{"HomeButtonCustomURL":{"type":"string","description":"The specific URL to load.","title":"HomeButtonCustomURL"},"odataType":{"enum":["#microsoft.graph.edgeHomeButtonHidden","#microsoft.graph.edgeHomeButtonLoadsStartPage","#microsoft.graph.edgeHomeButtonOpensCustomURL","#microsoft.graph.edgeHomeButtonOpensNewTab"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"EdgeHomeButtonConfigurationEnabled":{"type":"boolean","description":"Enable the Home button configuration.","title":"EdgeHomeButtonConfigurationEnabled"},"EdgeHomepageUrls":{"type":"array","items":{"type":"string"},"description":"The list of URLs for homepages shodwn on MDM-enrolled devices on Edge browser.","title":"EdgeHomepageUrls"},"EdgeKioskModeRestriction":{"enum":["notConfigured","digitalSignage","normalMode","publicBrowsingSingleApp","publicBrowsingMultiApp"],"description":"Controls how the Microsoft Edge settings are restricted based on the configure kiosk mode. Possible values are: notConfigured, digitalSignage, normalMode, publicBrowsingSingleApp, publicBrowsingMultiApp.","title":"EdgeKioskModeRestriction"},"EdgeKioskResetAfterIdleTimeInMinutes":{"type":"integer","description":"Specifies the time in minutes from the last user activity before Microsoft Edge kiosk resets.  Valid values are 0-1440. The default is 5. 0 indicates no reset. Valid values 0 to 1440","title":"EdgeKioskResetAfterIdleTimeInMinutes"},"EdgeNewTabPageURL":{"type":"string","description":"Specify the page opened when new tabs are created.","title":"EdgeNewTabPageURL"},"EdgeOpensWith":{"enum":["notConfigured","startPage","newTabPage","previousPages","specificPages"],"description":"Specify what kind of pages are open at start. Possible values are: notConfigured, startPage, newTabPage, previousPages, specificPages.","title":"EdgeOpensWith"},"EdgePreventCertificateErrorOverride":{"type":"boolean","description":"Allow or prevent users from overriding certificate errors.","title":"EdgePreventCertificateErrorOverride"},"EdgeRequiredExtensionPackageFamilyNames":{"type":"array","items":{"type":"string"},"description":"Specify the list of package family names of browser extensions that are required and cannot be turned off by the user.","title":"EdgeRequiredExtensionPackageFamilyNames"},"EdgeRequireSmartScreen":{"type":"boolean","description":"Indicates whether or not to Require the user to use the smart screen filter.","title":"EdgeRequireSmartScreen"},"EdgeSearchEngine":{"type":"object","description":"Allows IT admins to set a default search engine for MDM-Controlled devices. Users can override this and change their default search engine provided the AllowSearchEngineCustomization policy is not set.","title":"EdgeSearchEngine","properties":{"EdgeSearchEngineType":{"enum":["default","bing"],"description":"Allows IT admins to set a predefined default search engine for MDM-Controlled devices. Possible values are: default, bing.","title":"EdgeSearchEngineType"},"EdgeSearchEngineOpenSearchXmlUrl":{"type":"string","description":"Points to a https link containing the OpenSearch xml file that contains, at minimum, the short name and the URL to the search Engine.","title":"EdgeSearchEngineOpenSearchXmlUrl"},"odataType":{"enum":["#microsoft.graph.edgeSearchEngine","#microsoft.graph.edgeSearchEngineCustom"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"EdgeSendIntranetTrafficToInternetExplorer":{"type":"boolean","description":"Indicates whether or not to switch the intranet traffic from Edge to Internet Explorer.","title":"EdgeSendIntranetTrafficToInternetExplorer"},"EdgeShowMessageWhenOpeningInternetExplorerSites":{"enum":["notConfigured","disabled","enabled","keepGoing"],"description":"Controls the message displayed by Edge before switching to Internet Explorer. Possible values are: notConfigured, disabled, enabled, keepGoing.","title":"EdgeShowMessageWhenOpeningInternetExplorerSites"},"EdgeSyncFavoritesWithInternetExplorer":{"type":"boolean","description":"Enable favorites sync between Internet Explorer and Microsoft Edge. Additions, deletions, modifications and order changes to favorites are shared between browsers.","title":"EdgeSyncFavoritesWithInternetExplorer"},"EdgeTelemetryForMicrosoft365Analytics":{"enum":["notConfigured","intranet","internet","intranetAndInternet"],"description":"Specifies what type of telemetry data (none, intranet, internet, both) is sent to Microsoft 365 Analytics. Possible values are: notConfigured, intranet, internet, intranetAndInternet.","title":"EdgeTelemetryForMicrosoft365Analytics"},"EnableAutomaticRedeployment":{"type":"boolean","description":"Allow users with administrative rights to delete all user data and settings using CTRL + Win + R at the device lock screen so that the device can be automatically re-configured and re-enrolled into management.","title":"EnableAutomaticRedeployment"},"EnergySaverOnBatteryThresholdPercentage":{"type":"integer","description":"This setting allows you to specify battery charge level at which Energy Saver is turned on. While on battery, Energy Saver is automatically turned on at (and below) the specified battery charge level. Valid input range (0-100). Valid values 0 to 100","title":"EnergySaverOnBatteryThresholdPercentage"},"EnergySaverPluggedInThresholdPercentage":{"type":"integer","description":"This setting allows you to specify battery charge level at which Energy Saver is turned on. While plugged in, Energy Saver is automatically turned on at (and below) the specified battery charge level. Valid input range (0-100). Valid values 0 to 100","title":"EnergySaverPluggedInThresholdPercentage"},"EnterpriseCloudPrintDiscoveryEndPoint":{"type":"string","description":"Endpoint for discovering cloud printers.","title":"EnterpriseCloudPrintDiscoveryEndPoint"},"EnterpriseCloudPrintDiscoveryMaxLimit":{"type":"integer","description":"Maximum number of printers that should be queried from a discovery endpoint. This is a mobile only setting. Valid values 1 to 65535","title":"EnterpriseCloudPrintDiscoveryMaxLimit"},"EnterpriseCloudPrintMopriaDiscoveryResourceIdentifier":{"type":"string","description":"OAuth resource URI for printer discovery service as configured in Azure portal.","title":"EnterpriseCloudPrintMopriaDiscoveryResourceIdentifier"},"EnterpriseCloudPrintOAuthAuthority":{"type":"string","description":"Authentication endpoint for acquiring OAuth tokens.","title":"EnterpriseCloudPrintOAuthAuthority"},"EnterpriseCloudPrintOAuthClientIdentifier":{"type":"string","description":"GUID of a client application authorized to retrieve OAuth tokens from the OAuth Authority.","title":"EnterpriseCloudPrintOAuthClientIdentifier"},"EnterpriseCloudPrintResourceIdentifier":{"type":"string","description":"OAuth resource URI for print service as configured in the Azure portal.","title":"EnterpriseCloudPrintResourceIdentifier"},"ExperienceBlockDeviceDiscovery":{"type":"boolean","description":"Indicates whether or not to enable device discovery UX.","title":"ExperienceBlockDeviceDiscovery"},"ExperienceBlockErrorDialogWhenNoSIM":{"type":"boolean","description":"Indicates whether or not to allow the error dialog from displaying if no SIM card is detected.","title":"ExperienceBlockErrorDialogWhenNoSIM"},"ExperienceBlockTaskSwitcher":{"type":"boolean","description":"Indicates whether or not to enable task switching on the device.","title":"ExperienceBlockTaskSwitcher"},"ExperienceDoNotSyncBrowserSettings":{"enum":["notConfigured","blockedWithUserOverride","blocked"],"description":"Allow or prevent the syncing of Microsoft Edge Browser settings. Option for IT admins to prevent syncing across devices, but allow user override. Possible values are: notConfigured, blockedWithUserOverride, blocked.","title":"ExperienceDoNotSyncBrowserSettings"},"FindMyFiles":{"enum":["notConfigured","enabled","disabled"],"description":"Controls if the user can configure search to Find My Files mode, which searches files in secondary hard drives and also outside of the user profile. Find My Files does not allow users to search files or locations to which they do not have access. Possible values are: notConfigured, enabled, disabled.","title":"FindMyFiles"},"GameDvrBlocked":{"type":"boolean","description":"Indicates whether or not to block DVR and broadcasting.","title":"GameDvrBlocked"},"InkWorkspaceAccess":{"enum":["notConfigured","enabled","disabled"],"description":"Controls the user access to the ink workspace, from the desktop and from above the lock screen. Possible values are: notConfigured, enabled, disabled.","title":"InkWorkspaceAccess"},"InkWorkspaceAccessState":{"enum":["notConfigured","blocked","allowed"],"description":"Controls the user access to the ink workspace, from the desktop and from above the lock screen. Possible values are: notConfigured, blocked, allowed.","title":"InkWorkspaceAccessState"},"InkWorkspaceBlockSuggestedApps":{"type":"boolean","description":"Specify whether to show recommended app suggestions in the ink workspace.","title":"InkWorkspaceBlockSuggestedApps"},"InternetSharingBlocked":{"type":"boolean","description":"Indicates whether or not to Block the user from using internet sharing.","title":"InternetSharingBlocked"},"LocationServicesBlocked":{"type":"boolean","description":"Indicates whether or not to Block the user from location services.","title":"LocationServicesBlocked"},"LockScreenActivateAppsWithVoice":{"enum":["notConfigured","enabled","disabled"],"description":"This policy setting specifies whether Windows apps can be activated by voice while the system is locked. Possible values are: notConfigured, enabled, disabled.","title":"LockScreenActivateAppsWithVoice"},"LockScreenAllowTimeoutConfiguration":{"type":"boolean","description":"Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices. If this policy is set to Allow, the value set by lockScreenTimeoutInSeconds is ignored.","title":"LockScreenAllowTimeoutConfiguration"},"LockScreenBlockActionCenterNotifications":{"type":"boolean","description":"Indicates whether or not to block action center notifications over lock screen.","title":"LockScreenBlockActionCenterNotifications"},"LockScreenBlockCortana":{"type":"boolean","description":"Indicates whether or not the user can interact with Cortana using speech while the system is locked.","title":"LockScreenBlockCortana"},"LockScreenBlockToastNotifications":{"type":"boolean","description":"Indicates whether to allow toast notifications above the device lock screen.","title":"LockScreenBlockToastNotifications"},"LockScreenTimeoutInSeconds":{"type":"integer","description":"Set the duration (in seconds) from the screen locking to the screen turning off for Windows 10 Mobile devices. Supported values are 11-1800. Valid values 11 to 1800","title":"LockScreenTimeoutInSeconds"},"LogonBlockFastUserSwitching":{"type":"boolean","description":"Disables the ability to quickly switch between users that are logged on simultaneously without logging off.","title":"LogonBlockFastUserSwitching"},"MessagingBlockMMS":{"type":"boolean","description":"Indicates whether or not to block the MMS send/receive functionality on the device.","title":"MessagingBlockMMS"},"MessagingBlockRichCommunicationServices":{"type":"boolean","description":"Indicates whether or not to block the RCS send/receive functionality on the device.","title":"MessagingBlockRichCommunicationServices"},"MessagingBlockSync":{"type":"boolean","description":"Indicates whether or not to block text message back up and restore and Messaging Everywhere.","title":"MessagingBlockSync"},"MicrosoftAccountBlocked":{"type":"boolean","description":"Indicates whether or not to Block a Microsoft account.","title":"MicrosoftAccountBlocked"},"MicrosoftAccountBlockSettingsSync":{"type":"boolean","description":"Indicates whether or not to Block Microsoft account settings sync.","title":"MicrosoftAccountBlockSettingsSync"},"MicrosoftAccountSignInAssistantSettings":{"enum":["notConfigured","disabled"],"description":"Controls the Microsoft Account Sign-In Assistant (wlidsvc) NT service. Possible values are: notConfigured, disabled.","title":"MicrosoftAccountSignInAssistantSettings"},"NetworkProxyApplySettingsDeviceWide":{"type":"boolean","description":"If set, proxy settings will be applied to all processes and accounts in the device. Otherwise, it will be applied to the user account that's enrolled into MDM.","title":"NetworkProxyApplySettingsDeviceWide"},"NetworkProxyAutomaticConfigurationUrl":{"type":"string","description":"Address to the proxy auto-config (PAC) script you want to use.","title":"NetworkProxyAutomaticConfigurationUrl"},"NetworkProxyDisableAutoDetect":{"type":"boolean","description":"Disable automatic detection of settings. If enabled, the system will try to find the path to a proxy auto-config (PAC) script.","title":"NetworkProxyDisableAutoDetect"},"NetworkProxyServer":{"type":"object","description":"Specifies manual proxy server settings.","title":"NetworkProxyServer","properties":{"Address":{"type":"string","description":"Address to the proxy server. Specify an address in the format ':'","title":"Address"},"Exceptions":{"type":"array","items":{"type":"string"},"description":"Addresses that should not use the proxy server. The system will not use the proxy server for addresses beginning with what is specified in this node.","title":"Exceptions"},"UseForLocalAddresses":{"type":"boolean","description":"Specifies whether the proxy server should be used for local (intranet) addresses.","title":"UseForLocalAddresses"}},"required":[]},"NfcBlocked":{"type":"boolean","description":"Indicates whether or not to Block the user from using near field communication.","title":"NfcBlocked"},"OneDriveDisableFileSync":{"type":"boolean","description":"Gets or sets a value allowing IT admins to prevent apps and features from working with files on OneDrive.","title":"OneDriveDisableFileSync"},"PasswordBlockSimple":{"type":"boolean","description":"Specify whether PINs or passwords such as '1111' or '1234' are allowed. For Windows 10 desktops, it also controls the use of picture passwords.","title":"PasswordBlockSimple"},"PasswordExpirationDays":{"type":"integer","description":"The password expiration in days. Valid values 0 to 730","title":"PasswordExpirationDays"},"PasswordMinimumAgeInDays":{"type":"integer","description":"This security setting determines the period of time (in days) that a password must be used before the user can change it. Valid values 0 to 998","title":"PasswordMinimumAgeInDays"},"PasswordMinimumCharacterSetCount":{"type":"integer","description":"The number of character sets required in the password.","title":"PasswordMinimumCharacterSetCount"},"PasswordMinimumLength":{"type":"integer","description":"The minimum password length. Valid values 4 to 16","title":"PasswordMinimumLength"},"PasswordMinutesOfInactivityBeforeScreenTimeout":{"type":"integer","description":"The minutes of inactivity before the screen times out.","title":"PasswordMinutesOfInactivityBeforeScreenTimeout"},"PasswordPreviousPasswordBlockCount":{"type":"integer","description":"The number of previous passwords to prevent reuse of. Valid values 0 to 50","title":"PasswordPreviousPasswordBlockCount"},"PasswordRequired":{"type":"boolean","description":"Indicates whether or not to require the user to have a password.","title":"PasswordRequired"},"PasswordRequiredType":{"enum":["deviceDefault","alphanumeric","numeric"],"description":"The required password type. Possible values are: deviceDefault, alphanumeric, numeric.","title":"PasswordRequiredType"},"PasswordRequireWhenResumeFromIdleState":{"type":"boolean","description":"Indicates whether or not to require a password upon resuming from an idle state.","title":"PasswordRequireWhenResumeFromIdleState"},"PasswordSignInFailureCountBeforeFactoryReset":{"type":"integer","description":"The number of sign in failures before factory reset. Valid values 0 to 999","title":"PasswordSignInFailureCountBeforeFactoryReset"},"PersonalizationDesktopImageUrl":{"type":"string","description":"A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Desktop Image or a file Url to a local image on the file system that needs to used as the Desktop Image.","title":"PersonalizationDesktopImageUrl"},"PersonalizationLockScreenImageUrl":{"type":"string","description":"A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image.","title":"PersonalizationLockScreenImageUrl"},"PowerButtonActionOnBattery":{"enum":["notConfigured","noAction","sleep","hibernate","shutdown"],"description":"This setting specifies the action that Windows takes when a user presses the Power button while on battery. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.","title":"PowerButtonActionOnBattery"},"PowerButtonActionPluggedIn":{"enum":["notConfigured","noAction","sleep","hibernate","shutdown"],"description":"This setting specifies the action that Windows takes when a user presses the Power button while plugged in. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.","title":"PowerButtonActionPluggedIn"},"PowerHybridSleepOnBattery":{"enum":["notConfigured","enabled","disabled"],"description":"This setting allows you to turn off hybrid sleep while on battery. If you set this setting to disable, a hiberfile is not generated when the system transitions to sleep (Stand By). If you set this setting to enable or do not configure this policy setting, users control this setting. Possible values are: notConfigured, enabled, disabled.","title":"PowerHybridSleepOnBattery"},"PowerHybridSleepPluggedIn":{"enum":["notConfigured","enabled","disabled"],"description":"This setting allows you to turn off hybrid sleep while plugged in. If you set this setting to disable, a hiberfile is not generated when the system transitions to sleep (Stand By). If you set this setting to enable or do not configure this policy setting, users control this setting. Possible values are: notConfigured, enabled, disabled.","title":"PowerHybridSleepPluggedIn"},"PowerLidCloseActionOnBattery":{"enum":["notConfigured","noAction","sleep","hibernate","shutdown"],"description":"This setting specifies the action that Windows takes when a user closes the lid on a mobile PC while on battery. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.","title":"PowerLidCloseActionOnBattery"},"PowerLidCloseActionPluggedIn":{"enum":["notConfigured","noAction","sleep","hibernate","shutdown"],"description":"This setting specifies the action that Windows takes when a user closes the lid on a mobile PC while plugged in. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.","title":"PowerLidCloseActionPluggedIn"},"PowerSleepButtonActionOnBattery":{"enum":["notConfigured","noAction","sleep","hibernate","shutdown"],"description":"This setting specifies the action that Windows takes when a user presses the Sleep button while on battery. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.","title":"PowerSleepButtonActionOnBattery"},"PowerSleepButtonActionPluggedIn":{"enum":["notConfigured","noAction","sleep","hibernate","shutdown"],"description":"This setting specifies the action that Windows takes when a user presses the Sleep button while plugged in. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.","title":"PowerSleepButtonActionPluggedIn"},"PrinterBlockAddition":{"type":"boolean","description":"Prevent user installation of additional printers from printers settings.","title":"PrinterBlockAddition"},"PrinterDefaultName":{"type":"string","description":"Name (network host name) of an installed printer.","title":"PrinterDefaultName"},"PrinterNames":{"type":"array","items":{"type":"string"},"description":"Automatically provision printers based on their names (network host names).","title":"PrinterNames"},"PrivacyAdvertisingId":{"enum":["notConfigured","blocked","allowed"],"description":"Enables or disables the use of advertising ID. Added in Windows 10, version 1607. Possible values are: notConfigured, blocked, allowed.","title":"PrivacyAdvertisingId"},"PrivacyAutoAcceptPairingAndConsentPrompts":{"type":"boolean","description":"Indicates whether or not to allow the automatic acceptance of the pairing and privacy user consent dialog when launching apps.","title":"PrivacyAutoAcceptPairingAndConsentPrompts"},"PrivacyBlockActivityFeed":{"type":"boolean","description":"Blocks the usage of cloud based speech services for Cortana, Dictation, or Store applications.","title":"PrivacyBlockActivityFeed"},"PrivacyBlockInputPersonalization":{"type":"boolean","description":"Indicates whether or not to block the usage of cloud based speech services for Cortana, Dictation, or Store applications.","title":"PrivacyBlockInputPersonalization"},"PrivacyBlockPublishUserActivities":{"type":"boolean","description":"Blocks the shared experiences/discovery of recently used resources in task switcher etc.","title":"PrivacyBlockPublishUserActivities"},"PrivacyDisableLaunchExperience":{"type":"boolean","description":"This policy prevents the privacy experience from launching during user logon for new and upgraded users.","title":"PrivacyDisableLaunchExperience"},"ResetProtectionModeBlocked":{"type":"boolean","description":"Indicates whether or not to Block the user from reset protection mode.","title":"ResetProtectionModeBlocked"},"SafeSearchFilter":{"enum":["userDefined","strict","moderate"],"description":"Specifies what filter level of safe search is required. Possible values are: userDefined, strict, moderate.","title":"SafeSearchFilter"},"ScreenCaptureBlocked":{"type":"boolean","description":"Indicates whether or not to Block the user from taking Screenshots.","title":"ScreenCaptureBlocked"},"SearchBlockDiacritics":{"type":"boolean","description":"Specifies if search can use diacritics.","title":"SearchBlockDiacritics"},"SearchBlockWebResults":{"type":"boolean","description":"Indicates whether or not to block the web search.","title":"SearchBlockWebResults"},"SearchDisableAutoLanguageDetection":{"type":"boolean","description":"Specifies whether to use automatic language detection when indexing content and properties.","title":"SearchDisableAutoLanguageDetection"},"SearchDisableIndexerBackoff":{"type":"boolean","description":"Indicates whether or not to disable the search indexer backoff feature.","title":"SearchDisableIndexerBackoff"},"SearchDisableIndexingEncryptedItems":{"type":"boolean","description":"Indicates whether or not to block indexing of WIP-protected items to prevent them from appearing in search results for Cortana or Explorer.","title":"SearchDisableIndexingEncryptedItems"},"SearchDisableIndexingRemovableDrive":{"type":"boolean","description":"Indicates whether or not to allow users to add locations on removable drives to libraries and to be indexed.","title":"SearchDisableIndexingRemovableDrive"},"SearchDisableLocation":{"type":"boolean","description":"Specifies if search can use location information.","title":"SearchDisableLocation"},"SearchDisableUseLocation":{"type":"boolean","description":"Specifies if search can use location information.","title":"SearchDisableUseLocation"},"SearchEnableAutomaticIndexSizeManangement":{"type":"boolean","description":"Specifies minimum amount of hard drive space on the same drive as the index location before indexing stops.","title":"SearchEnableAutomaticIndexSizeManangement"},"SearchEnableRemoteQueries":{"type":"boolean","description":"Indicates whether or not to block remote queries of this computers index.","title":"SearchEnableRemoteQueries"},"SecurityBlockAzureADJoinedDevicesAutoEncryption":{"type":"boolean","description":"Specify whether to allow automatic device encryption during OOBE when the device is Azure AD joined (desktop only).","title":"SecurityBlockAzureADJoinedDevicesAutoEncryption"},"SettingsBlockAccountsPage":{"type":"boolean","description":"Indicates whether or not to block access to Accounts in Settings app.","title":"SettingsBlockAccountsPage"},"SettingsBlockAddProvisioningPackage":{"type":"boolean","description":"Indicates whether or not to block the user from installing provisioning packages.","title":"SettingsBlockAddProvisioningPackage"},"SettingsBlockAppsPage":{"type":"boolean","description":"Indicates whether or not to block access to Apps in Settings app.","title":"SettingsBlockAppsPage"},"SettingsBlockChangeLanguage":{"type":"boolean","description":"Indicates whether or not to block the user from changing the language settings.","title":"SettingsBlockChangeLanguage"},"SettingsBlockChangePowerSleep":{"type":"boolean","description":"Indicates whether or not to block the user from changing power and sleep settings.","title":"SettingsBlockChangePowerSleep"},"SettingsBlockChangeRegion":{"type":"boolean","description":"Indicates whether or not to block the user from changing the region settings.","title":"SettingsBlockChangeRegion"},"SettingsBlockChangeSystemTime":{"type":"boolean","description":"Indicates whether or not to block the user from changing date and time settings.","title":"SettingsBlockChangeSystemTime"},"SettingsBlockDevicesPage":{"type":"boolean","description":"Indicates whether or not to block access to Devices in Settings app.","title":"SettingsBlockDevicesPage"},"SettingsBlockEaseOfAccessPage":{"type":"boolean","description":"Indicates whether or not to block access to Ease of Access in Settings app.","title":"SettingsBlockEaseOfAccessPage"},"SettingsBlockEditDeviceName":{"type":"boolean","description":"Indicates whether or not to block the user from editing the device name.","title":"SettingsBlockEditDeviceName"},"SettingsBlockGamingPage":{"type":"boolean","description":"Indicates whether or not to block access to Gaming in Settings app.","title":"SettingsBlockGamingPage"},"SettingsBlockNetworkInternetPage":{"type":"boolean","description":"Indicates whether or not to block access to Network & Internet in Settings app.","title":"SettingsBlockNetworkInternetPage"},"SettingsBlockPersonalizationPage":{"type":"boolean","description":"Indicates whether or not to block access to Personalization in Settings app.","title":"SettingsBlockPersonalizationPage"},"SettingsBlockPrivacyPage":{"type":"boolean","description":"Indicates whether or not to block access to Privacy in Settings app.","title":"SettingsBlockPrivacyPage"},"SettingsBlockRemoveProvisioningPackage":{"type":"boolean","description":"Indicates whether or not to block the runtime configuration agent from removing provisioning packages.","title":"SettingsBlockRemoveProvisioningPackage"},"SettingsBlockSettingsApp":{"type":"boolean","description":"Indicates whether or not to block access to Settings app.","title":"SettingsBlockSettingsApp"},"SettingsBlockSystemPage":{"type":"boolean","description":"Indicates whether or not to block access to System in Settings app.","title":"SettingsBlockSystemPage"},"SettingsBlockTimeLanguagePage":{"type":"boolean","description":"Indicates whether or not to block access to Time & Language in Settings app.","title":"SettingsBlockTimeLanguagePage"},"SettingsBlockUpdateSecurityPage":{"type":"boolean","description":"Indicates whether or not to block access to Update & Security in Settings app.","title":"SettingsBlockUpdateSecurityPage"},"SharedUserAppDataAllowed":{"type":"boolean","description":"Indicates whether or not to block multiple users of the same app to share data.","title":"SharedUserAppDataAllowed"},"SmartScreenAppInstallControl":{"enum":["notConfigured","anywhere","storeOnly","recommendations","preferStore"],"description":"Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store. Possible values are: notConfigured, anywhere, storeOnly, recommendations, preferStore.","title":"SmartScreenAppInstallControl"},"SmartScreenBlockPromptOverride":{"type":"boolean","description":"Indicates whether or not users can override SmartScreen Filter warnings about potentially malicious websites.","title":"SmartScreenBlockPromptOverride"},"SmartScreenBlockPromptOverrideForFiles":{"type":"boolean","description":"Indicates whether or not users can override the SmartScreen Filter warnings about downloading unverified files","title":"SmartScreenBlockPromptOverrideForFiles"},"SmartScreenEnableAppInstallControl":{"type":"boolean","description":"This property will be deprecated in July 2019 and will be replaced by property SmartScreenAppInstallControl. Allows IT Admins to control whether users are allowed to install apps from places other than the Store.","title":"SmartScreenEnableAppInstallControl"},"StartBlockUnpinningAppsFromTaskbar":{"type":"boolean","description":"Indicates whether or not to block the user from unpinning apps from taskbar.","title":"StartBlockUnpinningAppsFromTaskbar"},"StartMenuAppListVisibility":{"enum":["userDefined","collapse","remove","disableSettingsApp"],"description":"Setting the value of this collapses the app list, removes the app list entirely, or disables the corresponding toggle in the Settings app. Possible values are: userDefined, collapse, remove, disableSettingsApp.","title":"StartMenuAppListVisibility"},"StartMenuHideChangeAccountSettings":{"type":"boolean","description":"Enabling this policy hides the change account setting from appearing in the user tile in the start menu.","title":"StartMenuHideChangeAccountSettings"},"StartMenuHideFrequentlyUsedApps":{"type":"boolean","description":"Enabling this policy hides the most used apps from appearing on the start menu and disables the corresponding toggle in the Settings app.","title":"StartMenuHideFrequentlyUsedApps"},"StartMenuHideHibernate":{"type":"boolean","description":"Enabling this policy hides hibernate from appearing in the power button in the start menu.","title":"StartMenuHideHibernate"},"StartMenuHideLock":{"type":"boolean","description":"Enabling this policy hides lock from appearing in the user tile in the start menu.","title":"StartMenuHideLock"},"StartMenuHidePowerButton":{"type":"boolean","description":"Enabling this policy hides the power button from appearing in the start menu.","title":"StartMenuHidePowerButton"},"StartMenuHideRecentJumpLists":{"type":"boolean","description":"Enabling this policy hides recent jump lists from appearing on the start menu/taskbar and disables the corresponding toggle in the Settings app.","title":"StartMenuHideRecentJumpLists"},"StartMenuHideRecentlyAddedApps":{"type":"boolean","description":"Enabling this policy hides recently added apps from appearing on the start menu and disables the corresponding toggle in the Settings app.","title":"StartMenuHideRecentlyAddedApps"},"StartMenuHideRestartOptions":{"type":"boolean","description":"Enabling this policy hides 'Restart/Update and Restart' from appearing in the power button in the start menu.","title":"StartMenuHideRestartOptions"},"StartMenuHideShutDown":{"type":"boolean","description":"Enabling this policy hides shut down/update and shut down from appearing in the power button in the start menu.","title":"StartMenuHideShutDown"},"StartMenuHideSignOut":{"type":"boolean","description":"Enabling this policy hides sign out from appearing in the user tile in the start menu.","title":"StartMenuHideSignOut"},"StartMenuHideSleep":{"type":"boolean","description":"Enabling this policy hides sleep from appearing in the power button in the start menu.","title":"StartMenuHideSleep"},"StartMenuHideSwitchAccount":{"type":"boolean","description":"Enabling this policy hides switch account from appearing in the user tile in the start menu.","title":"StartMenuHideSwitchAccount"},"StartMenuHideUserTile":{"type":"boolean","description":"Enabling this policy hides the user tile from appearing in the start menu.","title":"StartMenuHideUserTile"},"StartMenuLayoutEdgeAssetsXml":{"type":"string","description":"This policy setting allows you to import Edge assets to be used with startMenuLayoutXml policy. Start layout can contain secondary tile from Edge app which looks for Edge local asset file. Edge local asset would not exist and cause Edge secondary tile to appear empty in this case. This policy only gets applied when startMenuLayoutXml policy is modified. The value should be a UTF-8 Base64 encoded byte array.","title":"StartMenuLayoutEdgeAssetsXml"},"StartMenuLayoutXml":{"type":"string","description":"Allows admins to override the default Start menu layout and prevents the user from changing it. The layout is modified by specifying an XML file based on a layout modification schema. XML needs to be in a UTF8 encoded byte array format.","title":"StartMenuLayoutXml"},"StartMenuMode":{"enum":["userDefined","fullScreen","nonFullScreen"],"description":"Allows admins to decide how the Start menu is displayed. Possible values are: userDefined, fullScreen, nonFullScreen.","title":"StartMenuMode"},"StartMenuPinnedFolderDocuments":{"enum":["notConfigured","hide","show"],"description":"Enforces the visibility (Show/Hide) of the Documents folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.","title":"StartMenuPinnedFolderDocuments"},"StartMenuPinnedFolderDownloads":{"enum":["notConfigured","hide","show"],"description":"Enforces the visibility (Show/Hide) of the Downloads folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.","title":"StartMenuPinnedFolderDownloads"},"StartMenuPinnedFolderFileExplorer":{"enum":["notConfigured","hide","show"],"description":"Enforces the visibility (Show/Hide) of the FileExplorer shortcut on the Start menu. Possible values are: notConfigured, hide, show.","title":"StartMenuPinnedFolderFileExplorer"},"StartMenuPinnedFolderHomeGroup":{"enum":["notConfigured","hide","show"],"description":"Enforces the visibility (Show/Hide) of the HomeGroup folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.","title":"StartMenuPinnedFolderHomeGroup"},"StartMenuPinnedFolderMusic":{"enum":["notConfigured","hide","show"],"description":"Enforces the visibility (Show/Hide) of the Music folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.","title":"StartMenuPinnedFolderMusic"},"StartMenuPinnedFolderNetwork":{"enum":["notConfigured","hide","show"],"description":"Enforces the visibility (Show/Hide) of the Network folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.","title":"StartMenuPinnedFolderNetwork"},"StartMenuPinnedFolderPersonalFolder":{"enum":["notConfigured","hide","show"],"description":"Enforces the visibility (Show/Hide) of the PersonalFolder shortcut on the Start menu. Possible values are: notConfigured, hide, show.","title":"StartMenuPinnedFolderPersonalFolder"},"StartMenuPinnedFolderPictures":{"enum":["notConfigured","hide","show"],"description":"Enforces the visibility (Show/Hide) of the Pictures folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.","title":"StartMenuPinnedFolderPictures"},"StartMenuPinnedFolderSettings":{"enum":["notConfigured","hide","show"],"description":"Enforces the visibility (Show/Hide) of the Settings folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.","title":"StartMenuPinnedFolderSettings"},"StartMenuPinnedFolderVideos":{"enum":["notConfigured","hide","show"],"description":"Enforces the visibility (Show/Hide) of the Videos folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.","title":"StartMenuPinnedFolderVideos"},"StorageBlockRemovableStorage":{"type":"boolean","description":"Indicates whether or not to Block the user from using removable storage.","title":"StorageBlockRemovableStorage"},"StorageRequireMobileDeviceEncryption":{"type":"boolean","description":"Indicating whether or not to require encryption on a mobile device.","title":"StorageRequireMobileDeviceEncryption"},"StorageRestrictAppDataToSystemVolume":{"type":"boolean","description":"Indicates whether application data is restricted to the system drive.","title":"StorageRestrictAppDataToSystemVolume"},"StorageRestrictAppInstallToSystemVolume":{"type":"boolean","description":"Indicates whether the installation of applications is restricted to the system drive.","title":"StorageRestrictAppInstallToSystemVolume"},"SystemTelemetryProxyServer":{"type":"string","description":"Gets or sets the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests.","title":"SystemTelemetryProxyServer"},"TaskManagerBlockEndTask":{"type":"boolean","description":"Specify whether non-administrators can use Task Manager to end tasks.","title":"TaskManagerBlockEndTask"},"TenantLockdownRequireNetworkDuringOutOfBoxExperience":{"type":"boolean","description":"Whether the device is required to connect to the network.","title":"TenantLockdownRequireNetworkDuringOutOfBoxExperience"},"UninstallBuiltInApps":{"type":"boolean","description":"Indicates whether or not to uninstall a fixed list of built-in Windows apps.","title":"UninstallBuiltInApps"},"UsbBlocked":{"type":"boolean","description":"Indicates whether or not to Block the user from USB connection.","title":"UsbBlocked"},"VoiceRecordingBlocked":{"type":"boolean","description":"Indicates whether or not to Block the user from voice recording.","title":"VoiceRecordingBlocked"},"WebRtcBlockLocalhostIpAddress":{"type":"boolean","description":"Indicates whether or not user's localhost IP address is displayed while making phone calls using the WebRTC","title":"WebRtcBlockLocalhostIpAddress"},"WiFiBlockAutomaticConnectHotspots":{"type":"boolean","description":"Indicating whether or not to block automatically connecting to Wi-Fi hotspots. Has no impact if Wi-Fi is blocked.","title":"WiFiBlockAutomaticConnectHotspots"},"WiFiBlocked":{"type":"boolean","description":"Indicates whether or not to Block the user from using Wi-Fi.","title":"WiFiBlocked"},"WiFiBlockManualConfiguration":{"type":"boolean","description":"Indicates whether or not to Block the user from using Wi-Fi manual configuration.","title":"WiFiBlockManualConfiguration"},"WiFiScanInterval":{"type":"integer","description":"Specify how often devices scan for Wi-Fi networks. Supported values are 1-500, where 100 = default, and 500 = low frequency. Valid values 1 to 500","title":"WiFiScanInterval"},"Windows10AppsForceUpdateSchedule":{"type":"object","description":"Windows 10 force update schedule for Apps.","title":"Windows10AppsForceUpdateSchedule","properties":{"Recurrence":{"enum":["none","daily","weekly","monthly"],"description":"Recurrence schedule. Possible values are: none, daily, weekly, monthly.","title":"Recurrence"},"RunImmediatelyIfAfterStartDateTime":{"type":"boolean","description":"If true, runs the task immediately if StartDateTime is in the past, else, runs at the next recurrence.","title":"RunImmediatelyIfAfterStartDateTime"},"StartDateTime":{"type":"string","description":"The start time for the force restart.","title":"StartDateTime"}},"required":[]},"WindowsSpotlightBlockConsumerSpecificFeatures":{"type":"boolean","description":"Allows IT admins to block experiences that are typically for consumers only, such as Start suggestions, Membership notifications, Post-OOBE app install and redirect tiles.","title":"WindowsSpotlightBlockConsumerSpecificFeatures"},"WindowsSpotlightBlocked":{"type":"boolean","description":"Allows IT admins to turn off all Windows Spotlight features","title":"WindowsSpotlightBlocked"},"WindowsSpotlightBlockOnActionCenter":{"type":"boolean","description":"Block suggestions from Microsoft that show after each OS clean install, upgrade or in an on-going basis to introduce users to what is new or changed","title":"WindowsSpotlightBlockOnActionCenter"},"WindowsSpotlightBlockTailoredExperiences":{"type":"boolean","description":"Block personalized content in Windows spotlight based on users device usage.","title":"WindowsSpotlightBlockTailoredExperiences"},"WindowsSpotlightBlockThirdPartyNotifications":{"type":"boolean","description":"Block third party content delivered via Windows Spotlight","title":"WindowsSpotlightBlockThirdPartyNotifications"},"WindowsSpotlightBlockWelcomeExperience":{"type":"boolean","description":"Block Windows Spotlight Windows welcome experience","title":"WindowsSpotlightBlockWelcomeExperience"},"WindowsSpotlightBlockWindowsTips":{"type":"boolean","description":"Allows IT admins to turn off the popup of Windows Tips.","title":"WindowsSpotlightBlockWindowsTips"},"WindowsSpotlightConfigureOnLockScreen":{"enum":["notConfigured","disabled","enabled"],"description":"Specifies the type of Spotlight. Possible values are: notConfigured, disabled, enabled.","title":"WindowsSpotlightConfigureOnLockScreen"},"WindowsStoreBlockAutoUpdate":{"type":"boolean","description":"Indicates whether or not to block automatic update of apps from Windows Store.","title":"WindowsStoreBlockAutoUpdate"},"WindowsStoreBlocked":{"type":"boolean","description":"Indicates whether or not to Block the user from using the Windows store.","title":"WindowsStoreBlocked"},"WindowsStoreEnablePrivateStoreOnly":{"type":"boolean","description":"Indicates whether or not to enable Private Store Only.","title":"WindowsStoreEnablePrivateStoreOnly"},"WirelessDisplayBlockProjectionToThisDevice":{"type":"boolean","description":"Indicates whether or not to allow other devices from discovering this PC for projection.","title":"WirelessDisplayBlockProjectionToThisDevice"},"WirelessDisplayBlockUserInputFromReceiver":{"type":"boolean","description":"Indicates whether or not to allow user input from wireless display receiver.","title":"WirelessDisplayBlockUserInputFromReceiver"},"WirelessDisplayRequirePinForPairing":{"type":"boolean","description":"Indicates whether or not to require a PIN for new devices to initiate pairing.","title":"WirelessDisplayRequirePinForPairing"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"SupportsScopeTags":{"type":"boolean","description":"Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.","title":"SupportsScopeTags"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationscepcertificatepolicywindows10":{"type":"object","description":"Intune Device Configuration Scep Certificate Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationscepcertificatepolicywindows10","properties":{"CertificateStore":{"enum":["user","machine"],"description":"Target store certificate. Possible values are: user, machine.","title":"CertificateStore"},"HashAlgorithm":{"enum":["sha1","sha2"],"description":"SCEP Hash Algorithm. Possible values are: sha1, sha2.","title":"HashAlgorithm"},"KeySize":{"enum":["size1024","size2048","size4096"],"description":"SCEP Key Size. Possible values are: size1024, size2048, size4096.","title":"KeySize"},"KeyUsage":{"type":"array","items":{"enum":["keyEncipherment","digitalSignature"]},"description":"SCEP Key Usage. Possible values are: keyEncipherment, digitalSignature.","title":"KeyUsage"},"ScepServerUrls":{"type":"array","items":{"type":"string"},"description":"SCEP Server Url(s).","title":"ScepServerUrls"},"SubjectAlternativeNameFormatString":{"type":"string","description":"Custom String that defines the AAD Attribute.","title":"SubjectAlternativeNameFormatString"},"SubjectNameFormatString":{"type":"string","description":"Custom format to use with SubjectNameFormat = Custom. Example: CN={{UserName}},E={{EmailAddress}},OU=Enterprise Users,O=Contoso Corporation,L=Redmond,ST=WA,C=US","title":"SubjectNameFormatString"},"CustomSubjectAlternativeNames":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Pkcs Certificate Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphCustomSubjectAlternativeName","properties":{"Name":{"type":"string","description":"Custom SAN Name","title":"Name"},"SanType":{"enum":["none","emailAddress","userPrincipalName","customAzureADAttribute","domainNameService","universalResourceIdentifier"],"description":"Custom SAN Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.","title":"SanType"}},"required":[]},"description":"Custom Subject Alternative Name Settings. This collection can contain a maximum of 500 elements.","title":"CustomSubjectAlternativeNames"},"ExtendedKeyUsages":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Pkcs Certificate Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphExtendedKeyUsage","properties":{"Name":{"type":"string","description":"Extended Key Usage Name","title":"Name"},"ObjectIdentifier":{"type":"string","description":"Extended Key Usage Object Identifier","title":"ObjectIdentifier"}},"required":[]},"description":"Extended Key Usage (EKU) settings. This collection can contain a maximum of 500 elements.","title":"ExtendedKeyUsages"},"CertificateValidityPeriodScale":{"enum":["days","months","years"],"description":"Scale for the Certificate Validity Period. Possible values are: days, months, years.","title":"CertificateValidityPeriodScale"},"CertificateValidityPeriodValue":{"type":"integer","description":"Value for the Certificate Validity Period","title":"CertificateValidityPeriodValue"},"KeyStorageProvider":{"enum":["useTpmKspOtherwiseUseSoftwareKsp","useTpmKspOtherwiseFail","usePassportForWorkKspOtherwiseFail","useSoftwareKsp"],"description":"Key Storage Provider (KSP). Possible values are: useTpmKspOtherwiseUseSoftwareKsp, useTpmKspOtherwiseFail, usePassportForWorkKspOtherwiseFail, useSoftwareKsp.","title":"KeyStorageProvider"},"RenewalThresholdPercentage":{"type":"integer","description":"Certificate renewal threshold percentage. Valid values 1 to 99","title":"RenewalThresholdPercentage"},"SubjectAlternativeNameType":{"enum":["none","emailAddress","userPrincipalName","customAzureADAttribute","domainNameService","universalResourceIdentifier"],"description":"Certificate Subject Alternative Name Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.","title":"SubjectAlternativeNameType"},"SubjectNameFormat":{"enum":["commonName","commonNameIncludingEmail","commonNameAsEmail","custom","commonNameAsIMEI","commonNameAsSerialNumber","commonNameAsAadDeviceId","commonNameAsIntuneDeviceId","commonNameAsDurableDeviceId"],"description":"Certificate Subject Name Format. Possible values are: commonName, commonNameIncludingEmail, commonNameAsEmail, custom, commonNameAsIMEI, commonNameAsSerialNumber, commonNameAsAadDeviceId, commonNameAsIntuneDeviceId, commonNameAsDurableDeviceId.","title":"SubjectNameFormat"},"RootCertificateDisplayName":{"type":"string","description":"Trusted Root Certificate DisplayName","title":"RootCertificateDisplayName"},"RootCertificateId":{"type":"string","description":"Trusted Root Certificate Id","title":"RootCertificateId"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationsecureassessmentpolicywindows10":{"type":"object","description":"Intune Device Configuration Secure Assessment Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationsecureassessmentpolicywindows10","properties":{"AllowPrinting":{"type":"boolean","description":"Indicates whether or not to allow the app from printing during the test.","title":"AllowPrinting"},"AllowScreenCapture":{"type":"boolean","description":"Indicates whether or not to allow screen capture capability during a test.","title":"AllowScreenCapture"},"AllowTextSuggestion":{"type":"boolean","description":"Indicates whether or not to allow text suggestions during the test.","title":"AllowTextSuggestion"},"AssessmentAppUserModelId":{"type":"string","description":"Specifies the application user model ID of the assessment app launched when a user signs in to a secure assessment with a local guest account. Important notice: this property must be set with localGuestAccountName in order to make the local guest account sign-in experience work properly for secure assessments.","title":"AssessmentAppUserModelId"},"ConfigurationAccount":{"type":"string","description":"The account used to configure the Windows device for taking the test. The user can be a domain account (domain/user), an AAD account (usernametenant.com) or a local account (username).","title":"ConfigurationAccount"},"ConfigurationAccountType":{"enum":["azureADAccount","domainAccount","localAccount","localGuestAccount"],"description":"The account type used to by ConfigurationAccount. Possible values are: azureADAccount, domainAccount, localAccount, localGuestAccount.","title":"ConfigurationAccountType"},"LaunchUri":{"type":"string","description":"Url link to an assessment that's automatically loaded when the secure assessment browser is launched. It has to be a valid Url (https://msdn.microsoft.com/).","title":"LaunchUri"},"LocalGuestAccountName":{"type":"string","description":"Specifies the display text for the local guest account shown on the sign-in screen. Typically is the name of an assessment. When the user clicks the local guest account on the sign-in screen, an assessment app is launched with a specified assessment URL. Secure assessments can only be configured with local guest account sign-in on devices running Windows 10, version 1903 or later. Important notice: this property must be set with assessmentAppUserModelID in order to make the local guest account sign-in experience work properly for secure assessments.","title":"LocalGuestAccountName"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationsharedmultidevicepolicywindows10":{"type":"object","description":"Intune Device Configuration Shared Multi Device Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationsharedmultidevicepolicywindows10","properties":{"AccountManagerPolicy":{"type":"object","description":"Specifies how accounts are managed on a shared PC. Only applies when disableAccountManager is false.","title":"AccountManagerPolicy","properties":{"AccountDeletionPolicy":{"enum":["immediate","diskSpaceThreshold","diskSpaceThresholdOrInactiveThreshold"],"description":"Configures when accounts are deleted. Possible values are: immediate, diskSpaceThreshold, diskSpaceThresholdOrInactiveThreshold.","title":"AccountDeletionPolicy"},"CacheAccountsAboveDiskFreePercentage":{"type":"integer","description":"Sets the percentage of available disk space a PC should have before it stops deleting cached shared PC accounts. Only applies when AccountDeletionPolicy is DiskSpaceThreshold or DiskSpaceThresholdOrInactiveThreshold. Valid values 0 to 100","title":"CacheAccountsAboveDiskFreePercentage"},"InactiveThresholdDays":{"type":"integer","description":"Specifies when the accounts will start being deleted when they have not been logged on during the specified period, given as number of days. Only applies when AccountDeletionPolicy is DiskSpaceThreshold or DiskSpaceThresholdOrInactiveThreshold.","title":"InactiveThresholdDays"},"RemoveAccountsBelowDiskFreePercentage":{"type":"integer","description":"Sets the percentage of disk space remaining on a PC before cached accounts will be deleted to free disk space. Accounts that have been inactive the longest will be deleted first. Only applies when AccountDeletionPolicy is DiskSpaceThresholdOrInactiveThreshold. Valid values 0 to 100","title":"RemoveAccountsBelowDiskFreePercentage"}},"required":[]},"AllowedAccounts":{"type":"array","items":{"enum":["notConfigured","guest","domain"]},"description":"Indicates which type of accounts are allowed to use on a shared PC. Possible values are: notConfigured, guest, domain.","title":"AllowedAccounts"},"AllowLocalStorage":{"type":"boolean","description":"Specifies whether local storage is allowed on a shared PC.","title":"AllowLocalStorage"},"DisableAccountManager":{"type":"boolean","description":"Disables the account manager for shared PC mode.","title":"DisableAccountManager"},"DisableEduPolicies":{"type":"boolean","description":"Specifies whether the default shared PC education environment policies should be disabled. For Windows 10 RS2 and later, this policy will be applied without setting Enabled to true.","title":"DisableEduPolicies"},"DisablePowerPolicies":{"type":"boolean","description":"Specifies whether the default shared PC power policies should be disabled.","title":"DisablePowerPolicies"},"DisableSignInOnResume":{"type":"boolean","description":"Disables the requirement to sign in whenever the device wakes up from sleep mode.","title":"DisableSignInOnResume"},"Enabled":{"type":"boolean","description":"Enables shared PC mode and applies the shared pc policies.","title":"Enabled"},"FastFirstSignIn":{"enum":["notConfigured","enabled","disabled"],"description":"Specifies whether to auto connect new non-admin Azure AD accounts to pre-configured candidate local accounts. Possible values are: notConfigured, enabled, disabled.","title":"FastFirstSignIn"},"IdleTimeBeforeSleepInSeconds":{"type":"integer","description":"Specifies the time in seconds that a device must sit idle before the PC goes to sleep. Setting this value to 0 prevents the sleep timeout from occurring.","title":"IdleTimeBeforeSleepInSeconds"},"KioskAppDisplayName":{"type":"string","description":"Specifies the display text for the account shown on the sign-in screen which launches the app specified by SetKioskAppUserModelId. Only applies when KioskAppUserModelId is set.","title":"KioskAppDisplayName"},"KioskAppUserModelId":{"type":"string","description":"Specifies the application user model ID of the app to use with assigned access.","title":"KioskAppUserModelId"},"LocalStorage":{"enum":["notConfigured","enabled","disabled"],"description":"Specifies whether local storage is allowed on a shared PC. Possible values are: notConfigured, enabled, disabled.","title":"LocalStorage"},"MaintenanceStartTime":{"type":"string","description":"Specifies the daily start time of maintenance hour.","title":"MaintenanceStartTime"},"SetAccountManager":{"enum":["notConfigured","enabled","disabled"],"description":"Disables the account manager for shared PC mode. Possible values are: notConfigured, enabled, disabled.","title":"SetAccountManager"},"SetEduPolicies":{"enum":["notConfigured","enabled","disabled"],"description":"Specifies whether the default shared PC education environment policies should be enabled/disabled/not configured. For Windows 10 RS2 and later, this policy will be applied without setting Enabled to true. Possible values are: notConfigured, enabled, disabled.","title":"SetEduPolicies"},"SetPowerPolicies":{"enum":["notConfigured","enabled","disabled"],"description":"Specifies whether the default shared PC power policies should be enabled/disabled. Possible values are: notConfigured, enabled, disabled.","title":"SetPowerPolicies"},"SignInOnResume":{"enum":["notConfigured","enabled","disabled"],"description":"Specifies the requirement to sign in whenever the device wakes up from sleep mode. Possible values are: notConfigured, enabled, disabled.","title":"SignInOnResume"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationtrustedcertificatepolicywindows10":{"type":"object","description":"Intune Device Configuration Trusted Certificate Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationtrustedcertificatepolicywindows10","properties":{"CertFileName":{"type":"string","description":"File name to display in UI.","title":"CertFileName"},"DestinationStore":{"enum":["computerCertStoreRoot","computerCertStoreIntermediate","userCertStoreIntermediate"],"description":"Destination store location for the Trusted Root Certificate. Possible values are: computerCertStoreRoot, computerCertStoreIntermediate, userCertStoreIntermediate.","title":"DestinationStore"},"TrustedRootCertificate":{"type":"string","description":"Trusted Root Certificate","title":"TrustedRootCertificate"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationvpnpolicywindows10":{"type":"object","description":"Intune Device Configuration Vpn Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationvpnpolicywindows10","properties":{"AssociatedApps":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Vpn Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphWindows10AssociatedApps","properties":{"AppType":{"enum":["desktop","universal"],"description":"Application type. Possible values are: desktop, universal.","title":"AppType"},"Identifier":{"type":"string","description":"Identifier.","title":"Identifier"}},"required":[]},"description":"Associated Apps. This collection can contain a maximum of 10000 elements.","title":"AssociatedApps"},"AuthenticationMethod":{"enum":["certificate","usernameAndPassword","customEapXml","derivedCredential"],"description":"Authentication method. Possible values are: certificate, usernameAndPassword, customEapXml, derivedCredential.","title":"AuthenticationMethod"},"ConnectionType":{"enum":["pulseSecure","f5EdgeClient","dellSonicWallMobileConnect","checkPointCapsuleVpn","automatic","ikEv2","l2tp","pptp","citrix","paloAltoGlobalProtect","ciscoAnyConnect","unknownFutureValue","microsoftTunnel"],"description":"Connection type. Possible values are: pulseSecure, f5EdgeClient, dellSonicWallMobileConnect, checkPointCapsuleVpn, automatic, ikEv2, l2tp, pptp, citrix, paloAltoGlobalProtect, ciscoAnyConnect, unknownFutureValue, microsoftTunnel.","title":"ConnectionType"},"CryptographySuite":{"type":"object","description":"Cryptography Suite security settings for IKEv2 VPN in Windows10 and above","title":"CryptographySuite","properties":{"AuthenticationTransformConstants":{"enum":["md5_96","sha1_96","sha_256_128","aes128Gcm","aes192Gcm","aes256Gcm"],"description":"Authentication Transform Constants. Possible values are: md5_96, sha1_96, sha_256_128, aes128Gcm, aes192Gcm, aes256Gcm.","title":"AuthenticationTransformConstants"},"CipherTransformConstants":{"enum":["aes256","des","tripleDes","aes128","aes128Gcm","aes256Gcm","aes192","aes192Gcm","chaCha20Poly1305"],"description":"Cipher Transform Constants. Possible values are: aes256, des, tripleDes, aes128, aes128Gcm, aes256Gcm, aes192, aes192Gcm, chaCha20Poly1305.","title":"CipherTransformConstants"},"DhGroup":{"enum":["group1","group2","group14","ecp256","ecp384","group24"],"description":"Diffie Hellman Group. Possible values are: group1, group2, group14, ecp256, ecp384, group24.","title":"DhGroup"},"EncryptionMethod":{"enum":["aes256","des","tripleDes","aes128","aes128Gcm","aes256Gcm","aes192","aes192Gcm","chaCha20Poly1305"],"description":"Encryption Method. Possible values are: aes256, des, tripleDes, aes128, aes128Gcm, aes256Gcm, aes192, aes192Gcm, chaCha20Poly1305.","title":"EncryptionMethod"},"IntegrityCheckMethod":{"enum":["sha2_256","sha1_96","sha1_160","sha2_384","sha2_512","md5"],"description":"Integrity Check Method. Possible values are: sha2_256, sha1_96, sha1_160, sha2_384, sha2_512, md5.","title":"IntegrityCheckMethod"},"PfsGroup":{"enum":["pfs1","pfs2","pfs2048","ecp256","ecp384","pfsMM","pfs24"],"description":"Perfect Forward Secrecy Group. Possible values are: pfs1, pfs2, pfs2048, ecp256, ecp384, pfsMM, pfs24.","title":"PfsGroup"}},"required":[]},"DnsRules":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Vpn Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphVpnDnsRule","properties":{"AutoTrigger":{"type":"boolean","description":"Automatically connect to the VPN when the device connects to this domain: Default False.","title":"AutoTrigger"},"Name":{"type":"string","description":"Name.","title":"Name"},"Persistent":{"type":"boolean","description":"Keep this rule active even when the VPN is not connected: Default False","title":"Persistent"},"ProxyServerUri":{"type":"string","description":"Proxy Server Uri.","title":"ProxyServerUri"},"Servers":{"type":"array","items":{"type":"string"},"description":"Servers.","title":"Servers"}},"required":[]},"description":"DNS rules. This collection can contain a maximum of 1000 elements.","title":"DnsRules"},"DnsSuffixes":{"type":"array","items":{"type":"string"},"description":"Specify DNS suffixes to add to the DNS search list to properly route short names.","title":"DnsSuffixes"},"EapXml":{"type":"string","description":"Extensible Authentication Protocol (EAP) XML. (UTF8 encoded byte array)","title":"EapXml"},"EnableAlwaysOn":{"type":"boolean","description":"Enable Always On mode.","title":"EnableAlwaysOn"},"EnableConditionalAccess":{"type":"boolean","description":"Enable conditional access.","title":"EnableConditionalAccess"},"EnableDeviceTunnel":{"type":"boolean","description":"Enable device tunnel.","title":"EnableDeviceTunnel"},"EnableDnsRegistration":{"type":"boolean","description":"Enable IP address registration with internal DNS.","title":"EnableDnsRegistration"},"EnableSingleSignOnWithAlternateCertificate":{"type":"boolean","description":"Enable single sign-on (SSO) with alternate certificate.","title":"EnableSingleSignOnWithAlternateCertificate"},"EnableSplitTunneling":{"type":"boolean","description":"Enable split tunneling.","title":"EnableSplitTunneling"},"MicrosoftTunnelSiteId":{"type":"string","description":"ID of the Microsoft Tunnel site associated with the VPN profile.","title":"MicrosoftTunnelSiteId"},"OnlyAssociatedAppsCanUseConnection":{"type":"boolean","description":"Only associated Apps can use connection (per-app VPN).","title":"OnlyAssociatedAppsCanUseConnection"},"ProfileTarget":{"enum":["user","device","autoPilotDevice"],"description":"Profile target type. Possible values are: user, device, autoPilotDevice.","title":"ProfileTarget"},"ProxyServer":{"type":"object","description":"Proxy Server.","title":"ProxyServer","properties":{"BypassProxyServerForLocalAddress":{"type":"boolean","description":"Bypass proxy server for local address.","title":"BypassProxyServerForLocalAddress"},"Address":{"type":"string","description":"Address.","title":"Address"},"AutomaticConfigurationScriptUrl":{"type":"string","description":"Proxy's automatic configuration script url.","title":"AutomaticConfigurationScriptUrl"},"Port":{"type":"integer","description":"Port. Valid values 0 to 65535","title":"Port"},"AutomaticallyDetectProxySettings":{"type":"boolean","description":"Automatically detect proxy settings.","title":"AutomaticallyDetectProxySettings"},"odataType":{"enum":["#microsoft.graph.windows10VpnProxyServer","#microsoft.graph.windows81VpnProxyServer"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"RememberUserCredentials":{"type":"boolean","description":"Remember user credentials.","title":"RememberUserCredentials"},"Routes":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Vpn Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphVpnRoute","properties":{"DestinationPrefix":{"type":"string","description":"Destination prefix (IPv4/v6 address).","title":"DestinationPrefix"},"PrefixSize":{"type":"integer","description":"Prefix size. (1-32). Valid values 1 to 32","title":"PrefixSize"}},"required":[]},"description":"Routes (optional for third-party providers). This collection can contain a maximum of 1000 elements.","title":"Routes"},"SingleSignOnEku":{"type":"object","description":"Single sign-on Extended Key Usage (EKU).","title":"SingleSignOnEku","properties":{"Name":{"type":"string","description":"Extended Key Usage Name","title":"Name"},"ObjectIdentifier":{"type":"string","description":"Extended Key Usage Object Identifier","title":"ObjectIdentifier"}},"required":[]},"SingleSignOnIssuerHash":{"type":"string","description":"Single sign-on issuer hash.","title":"SingleSignOnIssuerHash"},"TrafficRules":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Vpn Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphVpnTrafficRule","properties":{"AppId":{"type":"string","description":"App identifier, if this traffic rule is triggered by an app.","title":"AppId"},"AppType":{"enum":["none","desktop","universal"],"description":"App type, if this traffic rule is triggered by an app. Possible values are: none, desktop, universal.","title":"AppType"},"Claims":{"type":"string","description":"Claims associated with this traffic rule.","title":"Claims"},"LocalAddressRanges":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Vpn Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphIPv4Range","properties":{"LowerAddress":{"type":"string","description":"Lower address.","title":"LowerAddress"},"UpperAddress":{"type":"string","description":"Upper address.","title":"UpperAddress"},"CidrAddress":{"type":"string","description":"IPv4 address in CIDR notation. Not nullable.","title":"CidrAddress"},"odataType":{"enum":["#microsoft.graph.iPv4CidrRange","#microsoft.graph.iPv6CidrRange","#microsoft.graph.iPv4Range","#microsoft.graph.iPv6Range"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"description":"Local address range. This collection can contain a maximum of 500 elements.","title":"LocalAddressRanges"},"LocalPortRanges":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Vpn Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphNumberRange","properties":{"LowerNumber":{"type":"integer","description":"Lower number.","title":"LowerNumber"},"UpperNumber":{"type":"integer","description":"Upper number.","title":"UpperNumber"}},"required":[]},"description":"Local port range can be set only when protocol is either TCP or UDP (6 or 17). This collection can contain a maximum of 500 elements.","title":"LocalPortRanges"},"Name":{"type":"string","description":"Name.","title":"Name"},"Protocols":{"type":"integer","description":"Protocols (0-255). Valid values 0 to 255","title":"Protocols"},"RemoteAddressRanges":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Vpn Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphIPv4Range","properties":{"LowerAddress":{"type":"string","description":"Lower address.","title":"LowerAddress"},"UpperAddress":{"type":"string","description":"Upper address.","title":"UpperAddress"},"CidrAddress":{"type":"string","description":"IPv4 address in CIDR notation. Not nullable.","title":"CidrAddress"},"odataType":{"enum":["#microsoft.graph.iPv4CidrRange","#microsoft.graph.iPv6CidrRange","#microsoft.graph.iPv4Range","#microsoft.graph.iPv6Range"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"description":"Remote address range. This collection can contain a maximum of 500 elements.","title":"RemoteAddressRanges"},"RemotePortRanges":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Vpn Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphNumberRange","properties":{"LowerNumber":{"type":"integer","description":"Lower number.","title":"LowerNumber"},"UpperNumber":{"type":"integer","description":"Upper number.","title":"UpperNumber"}},"required":[]},"description":"Remote port range can be set only when protocol is either TCP or UDP (6 or 17). This collection can contain a maximum of 500 elements.","title":"RemotePortRanges"},"RoutingPolicyType":{"enum":["none","splitTunnel","forceTunnel"],"description":"When app triggered, indicates whether to enable split tunneling along this route. Possible values are: none, splitTunnel, forceTunnel.","title":"RoutingPolicyType"},"VpnTrafficDirection":{"enum":["outbound","inbound","unknownFutureValue"],"description":"Specify whether the rule applies to inbound traffic or outbound traffic. Possible values are: outbound, inbound, unknownFutureValue.","title":"VpnTrafficDirection"}},"required":[]},"description":"Traffic rules. This collection can contain a maximum of 1000 elements.","title":"TrafficRules"},"TrustedNetworkDomains":{"type":"array","items":{"type":"string"},"description":"Trusted Network Domains","title":"TrustedNetworkDomains"},"WindowsInformationProtectionDomain":{"type":"string","description":"Windows Information Protection (WIP) domain to associate with this connection.","title":"WindowsInformationProtectionDomain"},"ConnectionName":{"type":"string","description":"Connection name displayed to the user.","title":"ConnectionName"},"CustomXml":{"type":"string","description":"Custom XML commands that configures the VPN connection. (UTF8 encoded byte array)","title":"CustomXml"},"ServerCollection":{"type":"array","items":{"type":"object","description":"Intune Device Configuration Vpn Policy for Windows10","title":"Schema for MSFT_MicrosoftGraphVpnServer","properties":{"Address":{"type":"string","description":"Address (IP address, FQDN or URL)","title":"Address"},"Description":{"type":"string","description":"Description.","title":"Description"},"IsDefaultServer":{"type":"boolean","description":"Default server.","title":"IsDefaultServer"}},"required":[]},"description":"List of VPN Servers on the network. Make sure end users can access these network locations. This collection can contain a maximum of 500 elements.","title":"ServerCollection"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationwindowsteampolicywindows10":{"type":"object","description":"Intune Device Configuration Windows Team Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationwindowsteampolicywindows10","properties":{"AzureOperationalInsightsBlockTelemetry":{"type":"boolean","description":"Indicates whether or not to Block Azure Operational Insights.","title":"AzureOperationalInsightsBlockTelemetry"},"AzureOperationalInsightsWorkspaceId":{"type":"string","description":"The Azure Operational Insights workspace id.","title":"AzureOperationalInsightsWorkspaceId"},"AzureOperationalInsightsWorkspaceKey":{"type":"string","description":"The Azure Operational Insights Workspace key.","title":"AzureOperationalInsightsWorkspaceKey"},"ConnectAppBlockAutoLaunch":{"type":"boolean","description":"Specifies whether to automatically launch the Connect app whenever a projection is initiated.","title":"ConnectAppBlockAutoLaunch"},"MaintenanceWindowBlocked":{"type":"boolean","description":"Indicates whether or not to Block setting a maintenance window for device updates.","title":"MaintenanceWindowBlocked"},"MaintenanceWindowDurationInHours":{"type":"integer","description":"Maintenance window duration for device updates. Valid values 0 to 5","title":"MaintenanceWindowDurationInHours"},"MaintenanceWindowStartTime":{"type":"string","description":"Maintenance window start time for device updates.","title":"MaintenanceWindowStartTime"},"MiracastBlocked":{"type":"boolean","description":"Indicates whether or not to Block wireless projection.","title":"MiracastBlocked"},"MiracastChannel":{"enum":["userDefined","one","two","three","four","five","six","seven","eight","nine","ten","eleven","thirtySix","forty","fortyFour","fortyEight","oneHundredFortyNine","oneHundredFiftyThree","oneHundredFiftySeven","oneHundredSixtyOne","oneHundredSixtyFive"],"description":"The channel. Possible values are: userDefined, one, two, three, four, five, six, seven, eight, nine, ten, eleven, thirtySix, forty, fortyFour, fortyEight, oneHundredFortyNine, oneHundredFiftyThree, oneHundredFiftySeven, oneHundredSixtyOne, oneHundredSixtyFive.","title":"MiracastChannel"},"MiracastRequirePin":{"type":"boolean","description":"Indicates whether or not to require a pin for wireless projection.","title":"MiracastRequirePin"},"SettingsBlockMyMeetingsAndFiles":{"type":"boolean","description":"Specifies whether to disable the 'My meetings and files' feature in the Start menu, which shows the signed-in user's meetings and files from Office 365.","title":"SettingsBlockMyMeetingsAndFiles"},"SettingsBlockSessionResume":{"type":"boolean","description":"Specifies whether to allow the ability to resume a session when the session times out.","title":"SettingsBlockSessionResume"},"SettingsBlockSigninSuggestions":{"type":"boolean","description":"Specifies whether to disable auto-populating of the sign-in dialog with invitees from scheduled meetings.","title":"SettingsBlockSigninSuggestions"},"SettingsDefaultVolume":{"type":"integer","description":"Specifies the default volume value for a new session. Permitted values are 0-100. The default is 45. Valid values 0 to 100","title":"SettingsDefaultVolume"},"SettingsScreenTimeoutInMinutes":{"type":"integer","description":"Specifies the number of minutes until the Hub screen turns off.","title":"SettingsScreenTimeoutInMinutes"},"SettingsSessionTimeoutInMinutes":{"type":"integer","description":"Specifies the number of minutes until the session times out.","title":"SettingsSessionTimeoutInMinutes"},"SettingsSleepTimeoutInMinutes":{"type":"integer","description":"Specifies the number of minutes until the Hub enters sleep mode.","title":"SettingsSleepTimeoutInMinutes"},"WelcomeScreenBackgroundImageUrl":{"type":"string","description":"The welcome screen background image URL. The URL must use the HTTPS protocol and return a PNG image.","title":"WelcomeScreenBackgroundImageUrl"},"WelcomeScreenBlockAutomaticWakeUp":{"type":"boolean","description":"Indicates whether or not to Block the welcome screen from waking up automatically when someone enters the room.","title":"WelcomeScreenBlockAutomaticWakeUp"},"WelcomeScreenMeetingInformation":{"enum":["userDefined","showOrganizerAndTimeOnly","showOrganizerAndTimeAndSubject"],"description":"The welcome screen meeting information shown. Possible values are: userDefined, showOrganizerAndTimeOnly, showOrganizerAndTimeAndSubject.","title":"WelcomeScreenMeetingInformation"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"SupportsScopeTags":{"type":"boolean","description":"Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.","title":"SupportsScopeTags"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceconfigurationwirednetworkpolicywindows10":{"type":"object","description":"Intune Device Configuration Wired Network Policy for Windows10","title":"Schema for microsoft.intune.deviceconfigurationwirednetworkpolicywindows10","properties":{"AuthenticationBlockPeriodInMinutes":{"type":"integer","description":"Specify the duration for which automatic authentication attempts will be blocked from occurring after a failed authentication attempt.","title":"AuthenticationBlockPeriodInMinutes"},"AuthenticationMethod":{"enum":["certificate","usernameAndPassword","derivedCredential","unknownFutureValue"],"description":"Specify the authentication method. Possible values are: certificate, usernameAndPassword, derivedCredential. Possible values are: certificate, usernameAndPassword, derivedCredential, unknownFutureValue.","title":"AuthenticationMethod"},"AuthenticationPeriodInSeconds":{"type":"integer","description":"Specify the number of seconds for the client to wait after an authentication attempt before failing. Valid range 1-3600.","title":"AuthenticationPeriodInSeconds"},"AuthenticationRetryDelayPeriodInSeconds":{"type":"integer","description":"Specify the number of seconds between a failed authentication and the next authentication attempt. Valid range 1-3600.","title":"AuthenticationRetryDelayPeriodInSeconds"},"AuthenticationType":{"enum":["none","user","machine","machineOrUser","guest","unknownFutureValue"],"description":"Specify whether to authenticate the user, the device, either, or to use guest authentication (none). If you're using certificate authentication, make sure the certificate type matches the authentication type. Possible values are: none, user, machine, machineOrUser, guest. Possible values are: none, user, machine, machineOrUser, guest, unknownFutureValue.","title":"AuthenticationType"},"CacheCredentials":{"type":"boolean","description":"When TRUE, caches user credentials on the device so that users don't need to keep entering them each time they connect. When FALSE, do not cache credentials. Default value is FALSE.","title":"CacheCredentials"},"DisableUserPromptForServerValidation":{"type":"boolean","description":"When TRUE, prevents the user from being prompted to authorize new servers for trusted certification authorities when EAP type is selected as PEAP. When FALSE, does not prevent the user from being prompted. Default value is FALSE.","title":"DisableUserPromptForServerValidation"},"EapolStartPeriodInSeconds":{"type":"integer","description":"Specify the number of seconds to wait before sending an EAPOL (Extensible Authentication Protocol over LAN) Start message. Valid range 1-3600.","title":"EapolStartPeriodInSeconds"},"EapType":{"enum":["eapTls","leap","eapSim","eapTtls","peap","eapFast","teap"],"description":"Extensible Authentication Protocol (EAP). Indicates the type of EAP protocol set on the Wi-Fi endpoint (router). Possible values are: eapTls, leap, eapSim, eapTtls, peap, eapFast, teap. Possible values are: eapTls, leap, eapSim, eapTtls, peap, eapFast, teap.","title":"EapType"},"Enforce8021X":{"type":"boolean","description":"When TRUE, the automatic configuration service for wired networks requires the use of 802.1X for port authentication. When FALSE, 802.1X is not required. Default value is FALSE.","title":"Enforce8021X"},"ForceFIPSCompliance":{"type":"boolean","description":"When TRUE, forces FIPS compliance. When FALSE, does not enable FIPS compliance. Default value is FALSE.","title":"ForceFIPSCompliance"},"InnerAuthenticationProtocolForEAPTTLS":{"enum":["unencryptedPassword","challengeHandshakeAuthenticationProtocol","microsoftChap","microsoftChapVersionTwo"],"description":"Specify inner authentication protocol for EAP TTLS. Possible values are: unencryptedPassword, challengeHandshakeAuthenticationProtocol, microsoftChap, microsoftChapVersionTwo. Possible values are: unencryptedPassword, challengeHandshakeAuthenticationProtocol, microsoftChap, microsoftChapVersionTwo.","title":"InnerAuthenticationProtocolForEAPTTLS"},"MaximumAuthenticationFailures":{"type":"integer","description":"Specify the maximum authentication failures allowed for a set of credentials. Valid range 1-100.","title":"MaximumAuthenticationFailures"},"MaximumEAPOLStartMessages":{"type":"integer","description":"Specify the maximum number of EAPOL (Extensible Authentication Protocol over LAN) Start messages to be sent before returning failure. Valid range 1-100.","title":"MaximumEAPOLStartMessages"},"OuterIdentityPrivacyTemporaryValue":{"type":"string","description":"Specify the string to replace usernames for privacy when using EAP TTLS or PEAP.","title":"OuterIdentityPrivacyTemporaryValue"},"PerformServerValidation":{"type":"boolean","description":"When TRUE, enables verification of server's identity by validating the certificate when EAP type is selected as PEAP. When FALSE, the certificate is not validated. Default value is TRUE.","title":"PerformServerValidation"},"RequireCryptographicBinding":{"type":"boolean","description":"When TRUE, enables cryptographic binding when EAP type is selected as PEAP. When FALSE, does not enable cryptogrpahic binding. Default value is TRUE.","title":"RequireCryptographicBinding"},"SecondaryAuthenticationMethod":{"enum":["certificate","usernameAndPassword","derivedCredential","unknownFutureValue"],"description":"Specify the secondary authentication method. Possible values are: certificate, usernameAndPassword, derivedCredential. Possible values are: certificate, usernameAndPassword, derivedCredential, unknownFutureValue.","title":"SecondaryAuthenticationMethod"},"TrustedServerCertificateNames":{"type":"array","items":{"type":"string"},"description":"Specify trusted server certificate names.","title":"TrustedServerCertificateNames"},"RootCertificatesForServerValidationIds":{"type":"array","items":{"type":"string"},"description":"Specify root certificates for server validation. This collection can contain a maximum of 500 elements.","title":"RootCertificatesForServerValidationIds"},"RootCertificatesForServerValidationDisplayNames":{"type":"array","items":{"type":"string"},"description":"Specify root certificate display names for server validation. This collection can contain a maximum of 500 elements.","title":"RootCertificatesForServerValidationDisplayNames"},"IdentityCertificateForClientAuthenticationId":{"type":"string","description":"Specify identity certificate for client authentication.","title":"IdentityCertificateForClientAuthenticationId"},"IdentityCertificateForClientAuthenticationDisplayName":{"type":"string","description":"Specify identity certificate display name for client authentication.","title":"IdentityCertificateForClientAuthenticationDisplayName"},"SecondaryIdentityCertificateForClientAuthenticationId":{"type":"string","description":"Specify root certificate for client validation","title":"SecondaryIdentityCertificateForClientAuthenticationId"},"SecondaryIdentityCertificateForClientAuthenticationDisplayName":{"type":"string","description":"Specify root certificate display name for client validation","title":"SecondaryIdentityCertificateForClientAuthenticationDisplayName"},"RootCertificateForClientValidationId":{"type":"string","description":"Specify root certificate for client validation.","title":"RootCertificateForClientValidationId"},"RootCertificateForClientValidationDisplayName":{"type":"string","description":"Specify root certificate display name for client validation.","title":"RootCertificateForClientValidationDisplayName"},"SecondaryRootCertificateForClientValidationId":{"type":"string","description":"Specify secondary root certificate for client validation.","title":"SecondaryRootCertificateForClientValidationId"},"SecondaryRootCertificateForClientValidationDisplayName":{"type":"string","description":"Specify secondary root certificate display name for client validation.","title":"SecondaryRootCertificateForClientValidationDisplayName"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceenrollmentlimitrestriction":{"type":"object","description":"This resource configures the Intune device enrollment limit restrictions.","title":"Schema for microsoft.intune.deviceenrollmentlimitrestriction","properties":{"DisplayName":{"type":"string","description":"Display name of the device enrollment limit restriction.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the device enrollment limit restriction.","title":"Description"},"Limit":{"type":"integer","description":"Specifies the maximum number of devices a user can enroll","title":"Limit"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the restriction exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.deviceenrollmentplatformrestriction":{"type":"object","description":"This resource configures the Intune device platform enrollment restrictions.\r\n\r\n**Be aware**: To deploy a Android platform restriction policy, two individual configurations must exist:\r\n\r\n* The first one contains the key for `AndroidRestriction`\r\n* The second one contains the key for `AndroidForWorkRestriction`","title":"Schema for microsoft.intune.deviceenrollmentplatformrestriction","properties":{"Identity":{"type":"string","description":"Identity of the device enrollment platform restriction.","title":"Identity"},"DisplayName":{"type":"string","description":"Display name of the device enrollment platform restriction.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the device enrollment platform restriction.","title":"Description"},"AndroidForWorkRestriction":{"type":"object","description":"Android for work restrictions based on platform, platform operating system version, and device ownership.","title":"AndroidForWorkRestriction","properties":{"PlatformBlocked":{"type":"boolean","description":"Block the platform from enrolling.","title":"PlatformBlocked"},"PersonalDeviceEnrollmentBlocked":{"type":"boolean","description":"Block personally owned devices from enrolling.","title":"PersonalDeviceEnrollmentBlocked"},"OsMinimumVersion":{"type":"string","description":"Min OS version supported.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"Max OS version supported.","title":"OsMaximumVersion"},"BlockedManufacturers":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Manufacturers.","title":"BlockedManufacturers"},"BlockedSkus":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Skus.","title":"BlockedSkus"}},"required":[]},"AndroidRestriction":{"type":"object","description":"Android restrictions based on platform, platform operating system version, and device ownership.","title":"AndroidRestriction","properties":{"PlatformBlocked":{"type":"boolean","description":"Block the platform from enrolling.","title":"PlatformBlocked"},"PersonalDeviceEnrollmentBlocked":{"type":"boolean","description":"Block personally owned devices from enrolling.","title":"PersonalDeviceEnrollmentBlocked"},"OsMinimumVersion":{"type":"string","description":"Min OS version supported.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"Max OS version supported.","title":"OsMaximumVersion"},"BlockedManufacturers":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Manufacturers.","title":"BlockedManufacturers"},"BlockedSkus":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Skus.","title":"BlockedSkus"}},"required":[]},"IosRestriction":{"type":"object","description":"Ios restrictions based on platform, platform operating system version, and device ownership.","title":"IosRestriction","properties":{"PlatformBlocked":{"type":"boolean","description":"Block the platform from enrolling.","title":"PlatformBlocked"},"PersonalDeviceEnrollmentBlocked":{"type":"boolean","description":"Block personally owned devices from enrolling.","title":"PersonalDeviceEnrollmentBlocked"},"OsMinimumVersion":{"type":"string","description":"Min OS version supported.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"Max OS version supported.","title":"OsMaximumVersion"},"BlockedManufacturers":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Manufacturers.","title":"BlockedManufacturers"},"BlockedSkus":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Skus.","title":"BlockedSkus"}},"required":[]},"MacOSRestriction":{"type":"object","description":"Mac restrictions based on platform, platform operating system version, and device ownership.","title":"MacOSRestriction","properties":{"PlatformBlocked":{"type":"boolean","description":"Block the platform from enrolling.","title":"PlatformBlocked"},"PersonalDeviceEnrollmentBlocked":{"type":"boolean","description":"Block personally owned devices from enrolling.","title":"PersonalDeviceEnrollmentBlocked"},"OsMinimumVersion":{"type":"string","description":"Min OS version supported.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"Max OS version supported.","title":"OsMaximumVersion"},"BlockedManufacturers":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Manufacturers.","title":"BlockedManufacturers"},"BlockedSkus":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Skus.","title":"BlockedSkus"}},"required":[]},"MacRestriction":{"type":"object","description":"Mac restrictions based on platform, platform operating system version, and device ownership.","title":"MacRestriction","properties":{"PlatformBlocked":{"type":"boolean","description":"Block the platform from enrolling.","title":"PlatformBlocked"},"PersonalDeviceEnrollmentBlocked":{"type":"boolean","description":"Block personally owned devices from enrolling.","title":"PersonalDeviceEnrollmentBlocked"},"OsMinimumVersion":{"type":"string","description":"Min OS version supported.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"Max OS version supported.","title":"OsMaximumVersion"},"BlockedManufacturers":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Manufacturers.","title":"BlockedManufacturers"},"BlockedSkus":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Skus.","title":"BlockedSkus"}},"required":[]},"WindowsHomeSkuRestriction":{"type":"object","description":"Windows Home Sku restrictions based on platform, platform operating system version, and device ownership.","title":"WindowsHomeSkuRestriction","properties":{"PlatformBlocked":{"type":"boolean","description":"Block the platform from enrolling.","title":"PlatformBlocked"},"PersonalDeviceEnrollmentBlocked":{"type":"boolean","description":"Block personally owned devices from enrolling.","title":"PersonalDeviceEnrollmentBlocked"},"OsMinimumVersion":{"type":"string","description":"Min OS version supported.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"Max OS version supported.","title":"OsMaximumVersion"},"BlockedManufacturers":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Manufacturers.","title":"BlockedManufacturers"},"BlockedSkus":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Skus.","title":"BlockedSkus"}},"required":[]},"WindowsMobileRestriction":{"type":"object","description":"Windows mobile restrictions based on platform, platform operating system version, and device ownership.","title":"WindowsMobileRestriction","properties":{"PlatformBlocked":{"type":"boolean","description":"Block the platform from enrolling.","title":"PlatformBlocked"},"PersonalDeviceEnrollmentBlocked":{"type":"boolean","description":"Block personally owned devices from enrolling.","title":"PersonalDeviceEnrollmentBlocked"},"OsMinimumVersion":{"type":"string","description":"Min OS version supported.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"Max OS version supported.","title":"OsMaximumVersion"},"BlockedManufacturers":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Manufacturers.","title":"BlockedManufacturers"},"BlockedSkus":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Skus.","title":"BlockedSkus"}},"required":[]},"WindowsRestriction":{"type":"object","description":"Windows restrictions based on platform, platform operating system version, and device ownership.","title":"WindowsRestriction","properties":{"PlatformBlocked":{"type":"boolean","description":"Block the platform from enrolling.","title":"PlatformBlocked"},"PersonalDeviceEnrollmentBlocked":{"type":"boolean","description":"Block personally owned devices from enrolling.","title":"PersonalDeviceEnrollmentBlocked"},"OsMinimumVersion":{"type":"string","description":"Min OS version supported.","title":"OsMinimumVersion"},"OsMaximumVersion":{"type":"string","description":"Max OS version supported.","title":"OsMaximumVersion"},"BlockedManufacturers":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Manufacturers.","title":"BlockedManufacturers"},"BlockedSkus":{"type":"array","items":{"type":"string"},"description":"Collection of blocked Skus.","title":"BlockedSkus"}},"required":[]},"DeviceEnrollmentConfigurationType":{"enum":["platformRestrictions","singlePlatformRestriction"],"description":"Support for Enrollment Configuration Type","title":"DeviceEnrollmentConfigurationType"},"Priority":{"type":"integer","description":"Priority is used when a user exists in multiple groups that are assigned enrollment configuration. Users are subject only to the configuration with the lowest priority value.","title":"Priority"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["Identity","DisplayName"]},"microsoft.intune.deviceenrollmentstatuspagewindows10":{"type":"object","description":"Intune Device Enrollment Status Page Configuration for Windows10","title":"Schema for microsoft.intune.deviceenrollmentstatuspagewindows10","properties":{"DisplayName":{"type":"string","description":"The display name of the device enrollment configuration","title":"DisplayName"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Description":{"type":"string","description":"The description of the device enrollment configuration","title":"Description"},"AllowDeviceResetOnInstallFailure":{"type":"boolean","description":"Allow or block device reset on installation failure","title":"AllowDeviceResetOnInstallFailure"},"AllowDeviceUseOnInstallFailure":{"type":"boolean","description":"Allow the user to continue using the device on installation failure","title":"AllowDeviceUseOnInstallFailure"},"AllowLogCollectionOnInstallFailure":{"type":"boolean","description":"Allow or block log collection on installation failure","title":"AllowLogCollectionOnInstallFailure"},"AllowNonBlockingAppInstallation":{"type":"boolean","description":"Install all required apps as non blocking apps during white glove","title":"AllowNonBlockingAppInstallation"},"BlockDeviceSetupRetryByUser":{"type":"boolean","description":"Allow the user to retry the setup on installation failure","title":"BlockDeviceSetupRetryByUser"},"CustomErrorMessage":{"type":"string","description":"Set custom error message to show upon installation failure","title":"CustomErrorMessage"},"DisableUserStatusTrackingAfterFirstUser":{"type":"boolean","description":"Only show installation progress for first user post enrollment","title":"DisableUserStatusTrackingAfterFirstUser"},"InstallProgressTimeoutInMinutes":{"type":"integer","description":"Set installation progress timeout in minutes","title":"InstallProgressTimeoutInMinutes"},"InstallQualityUpdates":{"type":"boolean","description":"Allows quality updates installation during OOBE","title":"InstallQualityUpdates"},"SelectedMobileAppIds":{"type":"array","items":{"type":"string"},"description":"Ids of selected applications to track the installation status. When this parameter is used, SelectedMobileAppNames is ignored","title":"SelectedMobileAppIds"},"SelectedMobileAppNames":{"type":"array","items":{"type":"string"},"description":"Names of selected applications to track the installation status. This parameter is ignored when SelectedMobileAppIds is also specified","title":"SelectedMobileAppNames"},"ShowInstallationProgress":{"type":"boolean","description":"Show or hide installation progress to user","title":"ShowInstallationProgress"},"TrackInstallProgressForAutopilotOnly":{"type":"boolean","description":"Only show installation progress for Autopilot enrollment scenarios","title":"TrackInstallProgressForAutopilotOnly"},"Priority":{"type":"integer","description":"Priority is used when a user exists in multiple groups that are assigned enrollment configuration. Users are subject only to the configuration with the lowest priority value.","title":"Priority"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.endpointdetectionandresponsepolicywindows10":{"type":"object","description":"This resource configures an Intune Endpoint Detection and Response Policy for Windows 10.","title":"Schema for microsoft.intune.endpointdetectionandresponsepolicywindows10","properties":{"Identity":{"type":"string","description":"Identity of the endpoint detection and response policy for Windows 10.","title":"Identity"},"DisplayName":{"type":"string","description":"Display name of the endpoint detection and response policy for Windows 10.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the endpoint detection and response policy for Windows 10.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the endpoint detection and response policy for Windows 10.","title":"Assignments"},"SampleSharing":{"enum":["0","1"],"description":"Return or set Windows Defender Advanced Threat Protection Sample Sharing configuration parameter: 0 - none, 1 - All","title":"SampleSharing"},"ConfigurationType":{"enum":["AutoFromConnector","Onboard","Offboard"],"description":"Microsoft Defender for Endpoint endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats.","title":"ConfigurationType"},"ConfigurationBlob":{"type":"string","description":"Set Windows Defender Advanced Threat Protection Onboarding blob and initiate onboarding to Windows Defender Advanced Threat Protection","title":"ConfigurationBlob"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.exploitprotectionpolicywindows10settingcatalog":{"type":"object","description":"This resource configures an Intune Endpoint Protection Exploit Protection policy for a Windows 10 Device.\r\nEnables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML.\r\nFor more information Exploit Protection, see\r\n- Enable Exploit Protection on Devices and Import: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-exploit-protection,\r\n- Export, and deploy Exploit Protection configurations: https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml","title":"Schema for microsoft.intune.exploitprotectionpolicywindows10settingcatalog","properties":{"Identity":{"type":"string","description":"Identity of the endpoint protection policy.","title":"Identity"},"DisplayName":{"type":"string","description":"Display name of the endpoint protection policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the endpoint protection.","title":"Description"},"ExploitProtectionSettings":{"type":"string","description":"Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML.","title":"ExploitProtectionSettings"},"DisallowExploitProtectionOverride":{"enum":["0","1"],"description":"Prevent users from making changes to the exploit protection settings area in the Windows Defender Security Center.values 0:disable, 1:enable","title":"DisallowExploitProtectionOverride"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the endpoint protection.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.policysets":{"type":"object","description":"Intune Policy Sets","title":"Schema for microsoft.intune.policysets","properties":{"Description":{"type":"string","description":"Description of the PolicySet.","title":"Description"},"DisplayName":{"type":"string","description":"DisplayName of the PolicySet.","title":"DisplayName"},"GuidedDeploymentTags":{"type":"array","items":{"type":"string"},"description":"Tags of the guided deployment","title":"GuidedDeploymentTags"},"RoleScopeTags":{"type":"array","items":{"type":"string"},"description":"RoleScopeTags of the PolicySet","title":"RoleScopeTags"},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Items":{"type":"array","items":{"type":"object","description":"Intune Policy Sets","title":"Schema for MSFT_DeviceManagementConfigurationPolicyItems","properties":{"dataType":{"type":"string","description":"The type of policy the item represents.","title":"dataType"},"payloadId":{"type":"string","description":"The group Id of the policy the item represents.","title":"payloadId"},"displayName":{"type":"string","description":"The collection display name of the policy the item represents","title":"displayName"},"itemType":{"type":"string","description":"The type of policy the item represents.","title":"itemType"},"guidedDeploymentTags":{"type":"array","items":{"type":"string"},"description":"Tags of the guided deployment","title":"guidedDeploymentTags"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Items"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.roleassignment":{"type":"object","description":"This resource configures an Intune Role Assignment.","title":"Schema for microsoft.intune.roleassignment","properties":{"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Description":{"type":"string","description":"Description of the Role Assignment.","title":"Description"},"DisplayName":{"type":"string","description":"The display or friendly name of the role Assignment.","title":"DisplayName"},"ResourceScopes":{"type":"array","items":{"type":"string"},"description":"List of ids of role scope member security groups. These are IDs from Azure Active Directory. Ignored if ScopeType is not 'ResourceScope'","title":"ResourceScopes"},"ResourceScopesDisplayNames":{"type":"array","items":{"type":"string"},"description":"List of DisplayName of role scope member security groups. These are Displayname from Azure Active Directory. Ignored if ScopeType is not 'ResourceScope'","title":"ResourceScopesDisplayNames"},"ScopeType":{"type":"string","description":"Specifies the type of scope for a Role Assignment. Default type 'ResourceScope' allows assignment of ResourceScopes. Possible values are: resourceScope, allDevices, allLicensedUsers, allDevicesAndLicensedUsers.","title":"ScopeType"},"Members":{"type":"array","items":{"type":"string"},"description":"The list of ids of role member security groups. These are IDs from Azure Active Directory.","title":"Members"},"MembersDisplayNames":{"type":"array","items":{"type":"string"},"description":"The list of Displaynames of role member security groups. These are Displaynamnes from Azure Active Directory.","title":"MembersDisplayNames"},"RoleDefinition":{"type":"string","description":"The Role Definition Id.","title":"RoleDefinition"},"RoleDefinitionDisplayName":{"type":"string","description":"The Role Definition Displayname.","title":"RoleDefinitionDisplayName"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the Role exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.roledefinition":{"type":"object","description":"This resource configures an Intune Role Definition.","title":"Schema for microsoft.intune.roledefinition","properties":{"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Description":{"type":"string","description":"Description of the Role definition.","title":"Description"},"DisplayName":{"type":"string","description":"Display Name of the Role definition.","title":"DisplayName"},"IsBuiltIn":{"type":"boolean","description":"Type of Role. Set to True if it is built-in, or set to False if it is a custom role definition.","title":"IsBuiltIn"},"allowedResourceActions":{"type":"array","items":{"type":"string"},"description":"List of allowed resource actions","title":"allowedResourceActions"},"notAllowedResourceActions":{"type":"array","items":{"type":"string"},"description":"List of not allowed resource actions","title":"notAllowedResourceActions"},"roleScopeTagIds":{"type":"array","items":{"type":"string"},"description":"Id of the Scope Tags to assign","title":"roleScopeTagIds"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the Role exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.settingcatalogasrrulespolicywindows10":{"type":"object","description":"This resource configures a Intune Endpoint Protection Attack Surface Reduction rules policy for a Windows 10 Device.\r\nThis resource returns ASR rules created using settings catalog settings.","title":"Schema for microsoft.intune.settingcatalogasrrulespolicywindows10","properties":{"Identity":{"type":"string","description":"Identity of the endpoint protection attack surface protection rules policy for Windows 10.","title":"Identity"},"DisplayName":{"type":"string","description":"Display name of the endpoint protection attack surface protection rules policy for Windows 10.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the endpoint protection attack surface protection rules policy for Windows 10.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Assignments of the endpoint protection.","title":"Assignments"},"AttackSurfaceReductionOnlyExclusions":{"type":"array","items":{"type":"string"},"description":"Exclude files and paths from attack surface reduction rules","title":"AttackSurfaceReductionOnlyExclusions"},"BlockAbuseOfExploitedVulnerableSignedDrivers":{"enum":["off","block","audit","warn"],"description":"This rule prevents an application from writing a vulnerable signed driver to disk.","title":"BlockAbuseOfExploitedVulnerableSignedDrivers"},"BlockAbuseOfExploitedVulnerableSignedDrivers_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockAbuseOfExploitedVulnerableSignedDrivers_ASROnlyPerRuleExclusions"},"BlockAdobeReaderFromCreatingChildProcesses":{"enum":["off","block","audit","warn"],"description":"This rule prevents attacks by blocking Adobe Reader from creating processes.","title":"BlockAdobeReaderFromCreatingChildProcesses"},"BlockAdobeReaderFromCreatingChildProcesses_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockAdobeReaderFromCreatingChildProcesses_ASROnlyPerRuleExclusions"},"BlockAllOfficeApplicationsFromCreatingChildProcesses":{"enum":["off","block","audit","warn"],"description":"This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access.","title":"BlockAllOfficeApplicationsFromCreatingChildProcesses"},"BlockAllOfficeApplicationsFromCreatingChildProcesses_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions (off: Off, block: Block, audit: Audit, warn: Warn)","title":"BlockAllOfficeApplicationsFromCreatingChildProcesses_ASROnlyPerRuleExclusions"},"BlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem":{"enum":["off","block","audit","warn"],"description":"This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS).","title":"BlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem"},"BlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem_ASROnlyPerRuleExclusions"},"BlockExecutableContentFromEmailClientAndWebmail":{"enum":["off","block","audit","warn"],"description":"This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers.","title":"BlockExecutableContentFromEmailClientAndWebmail"},"BlockExecutableContentFromEmailClientAndWebmail_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockExecutableContentFromEmailClientAndWebmail_ASROnlyPerRuleExclusions"},"BlockExecutableFilesRunningUnlessTheyMeetPrevalenceAgeTrustedListCriterion":{"enum":["off","block","audit","warn"],"description":"This rule blocks executable files that don't meet a prevalence, age, or trusted list criteria, such as .exe, .dll, or .scr, from launching.","title":"BlockExecutableFilesRunningUnlessTheyMeetPrevalenceAgeTrustedListCriterion"},"BlockExecutableFilesRunningUnlessTheyMeetPrevalenceAgeTrustedListCriterion_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockExecutableFilesRunningUnlessTheyMeetPrevalenceAgeTrustedListCriterion_ASROnlyPerRuleExclusions"},"BlockExecutionOfPotentiallyObfuscatedScripts":{"enum":["off","block","audit","warn"],"description":"This rule detects suspicious properties within an obfuscated script.","title":"BlockExecutionOfPotentiallyObfuscatedScripts"},"BlockExecutionOfPotentiallyObfuscatedScripts_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockExecutionOfPotentiallyObfuscatedScripts_ASROnlyPerRuleExclusions"},"BlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent":{"enum":["off","block","audit","warn"],"description":"This rule prevents scripts from launching potentially malicious downloaded content.","title":"BlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent"},"BlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent_ASROnlyPerRuleExclusions"},"BlockOfficeApplicationsFromCreatingExecutableContent":{"enum":["off","block","audit","warn"],"description":"This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.","title":"BlockOfficeApplicationsFromCreatingExecutableContent"},"BlockOfficeApplicationsFromCreatingExecutableContent_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockOfficeApplicationsFromCreatingExecutableContent_ASROnlyPerRuleExclusions"},"BlockOfficeApplicationsFromInjectingCodeIntoOtherProcesses":{"enum":["off","block","audit","warn"],"description":"This rule blocks code injection attempts from Office apps into other processes.","title":"BlockOfficeApplicationsFromInjectingCodeIntoOtherProcesses"},"BlockOfficeApplicationsFromInjectingCodeIntoOtherProcesses_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockOfficeApplicationsFromInjectingCodeIntoOtherProcesses_ASROnlyPerRuleExclusions"},"BlockOfficeCommunicationAppFromCreatingChildProcesses":{"enum":["off","block","audit","warn"],"description":"This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.","title":"BlockOfficeCommunicationAppFromCreatingChildProcesses"},"BlockOfficeCommunicationAppFromCreatingChildProcesses_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockOfficeCommunicationAppFromCreatingChildProcesses_ASROnlyPerRuleExclusions"},"BlockPersistenceThroughWMIEventSubscription":{"enum":["off","block","audit","warn"],"description":"This rule prevents malware from abusing WMI to attain persistence on a device.","title":"BlockPersistenceThroughWMIEventSubscription"},"BlockProcessCreationsFromPSExecAndWMICommands":{"enum":["off","block","audit","warn"],"description":"This rule blocks processes created through PsExec and WMI from running.","title":"BlockProcessCreationsFromPSExecAndWMICommands"},"BlockProcessCreationsFromPSExecAndWMICommands_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockProcessCreationsFromPSExecAndWMICommands_ASROnlyPerRuleExclusions"},"BlockRebootingMachineInSafeMode":{"enum":["off","block","audit","warn"],"description":"This rule prevents the execution of commands to restart machines in Safe Mode.","title":"BlockRebootingMachineInSafeMode"},"BlockRebootingMachineInSafeMode_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockRebootingMachineInSafeMode_ASROnlyPerRuleExclusions"},"BlockUntrustedUnsignedProcessesThatRunFromUSB":{"enum":["off","block","audit","warn"],"description":"With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards.","title":"BlockUntrustedUnsignedProcessesThatRunFromUSB"},"BlockUntrustedUnsignedProcessesThatRunFromUSB_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockUntrustedUnsignedProcessesThatRunFromUSB_ASROnlyPerRuleExclusions"},"BlockUseOfCopiedOrImpersonatedSystemTools":{"enum":["off","block","audit","warn"],"description":"This rule blocks the use of executable files that are identified as copies of Windows system tools. These files are either duplicates or impostors of the original system tools.","title":"BlockUseOfCopiedOrImpersonatedSystemTools"},"BlockUseOfCopiedOrImpersonatedSystemTools_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockUseOfCopiedOrImpersonatedSystemTools_ASROnlyPerRuleExclusions"},"BlockWebShellCreationForServers":{"enum":["off","block","audit","warn"],"description":"This rule blocks webshell creation for servers.","title":"BlockWebShellCreationForServers"},"BlockWebshellCreationForServers_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockWebshellCreationForServers_ASROnlyPerRuleExclusions"},"BlockWin32APICallsFromOfficeMacros":{"enum":["off","block","audit","warn"],"description":"This rule prevents VBA macros from calling Win32 APIs.","title":"BlockWin32APICallsFromOfficeMacros"},"BlockWin32APICallsFromOfficeMacros_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"BlockWin32APICallsFromOfficeMacros_ASROnlyPerRuleExclusions"},"UseAdvancedProtectionAgainstRansomware":{"enum":["off","block","audit","warn"],"description":"This rule provides an extra layer of protection against ransomware.","title":"UseAdvancedProtectionAgainstRansomware"},"UseAdvancedProtectionAgainstRansomware_ASROnlyPerRuleExclusions":{"type":"array","items":{"type":"string"},"description":"ASR Only Per Rule Exclusions","title":"UseAdvancedProtectionAgainstRansomware_ASROnlyPerRuleExclusions"},"ControlledFolderAccessProtectedFolders":{"type":"array","items":{"type":"string"},"description":"List of additional folders that need to be protected","title":"ControlledFolderAccessProtectedFolders"},"ControlledFolderAccessAllowedApplications":{"type":"array","items":{"type":"string"},"description":"List of apps that have access to protected folders.","title":"ControlledFolderAccessAllowedApplications"},"EnableControlledFolderAccess":{"enum":["0","1","2"],"description":"This rule enables Controlled folder access which protects your data by checking apps against a list of known, trusted apps.values 0:disable, 1:enable, 2:audit","title":"EnableControlledFolderAccess"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.wificonfigurationpolicyandroiddeviceadministrator":{"type":"object","description":"This resource configures an Intune Wifi Configuration Policy Android Device Administrator Device.","title":"Schema for microsoft.intune.wificonfigurationpolicyandroiddeviceadministrator","properties":{"Id":{"type":"string","description":"Id of the Intune Policy.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the Intune Policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune Policy.","title":"Description"},"ConnectAutomatically":{"type":"boolean","description":"Connect automatically.","title":"ConnectAutomatically"},"ConnectWhenNetworkNameIsHidden":{"type":"boolean","description":"Connect when network name is hidden.","title":"ConnectWhenNetworkNameIsHidden"},"NetworkName":{"type":"string","description":"Network name.","title":"NetworkName"},"Ssid":{"type":"string","description":"SSID.","title":"Ssid"},"WiFiSecurityType":{"enum":["open","wpaEnterprise","wpa2Enterprise"],"description":"Wi-Fi security type.","title":"WiFiSecurityType"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.wificonfigurationpolicyandroidenterprisedeviceowner":{"type":"object","description":"This resource configures an Intune Wifi Configuration Policy Android Enterprise Device Owner Device.","title":"Schema for microsoft.intune.wificonfigurationpolicyandroidenterprisedeviceowner","properties":{"Id":{"type":"string","description":"Id of the Intune policy","title":"Id"},"DisplayName":{"type":"string","description":"Disaply name of the Intune policy","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune policy","title":"Description"},"ConnectAutomatically":{"type":"boolean","description":"If the network is in range, automatically connect.","title":"ConnectAutomatically"},"ConnectWhenNetworkNameIsHidden":{"type":"boolean","description":"Don't show this Wi-Fi network on an end-user's device in the list of available networks. The SSID will not be broadcasted.","title":"ConnectWhenNetworkNameIsHidden"},"NetworkName":{"type":"string","description":"Network name.","title":"NetworkName"},"PreSharedKey":{"type":"string","description":"Pre shared key.","title":"PreSharedKey"},"PreSharedKeyIsSet":{"type":"boolean","description":"Pre shared key is set.","title":"PreSharedKeyIsSet"},"ProxyAutomaticConfigurationUrl":{"type":"string","description":"URL of the automatic proxy.","title":"ProxyAutomaticConfigurationUrl"},"ProxyExclusionList":{"type":"string","description":"Exclusion list of the proxy.","title":"ProxyExclusionList"},"ProxyManualAddress":{"type":"string","description":"Address of the proxy.","title":"ProxyManualAddress"},"ProxyManualPort":{"type":"integer","description":"Port of the proxy.","title":"ProxyManualPort"},"ProxySettings":{"enum":["none","manual","automatic"],"description":"Proxy setting type.","title":"ProxySettings"},"Ssid":{"type":"string","description":"Service Set Identifier. The name of the Wi-Fi connection.","title":"Ssid"},"WiFiSecurityType":{"enum":["open","wep","wpaPersonal","wpaEnterprise"],"description":"Type of Wi-Fi profile.","title":"WiFiSecurityType"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.wificonfigurationpolicyandroidenterpriseworkprofile":{"type":"object","description":"This resource configures an Intune Wifi Configuration Policy Android Enterprise Work Profile Device.","title":"Schema for microsoft.intune.wificonfigurationpolicyandroidenterpriseworkprofile","properties":{"Id":{"type":"string","description":"Id of the Intune policy.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the Intune policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune policy.","title":"Description"},"ConnectAutomatically":{"type":"boolean","description":"Connect automatically.","title":"ConnectAutomatically"},"ConnectWhenNetworkNameIsHidden":{"type":"boolean","description":"Connect when network name is hidden.","title":"ConnectWhenNetworkNameIsHidden"},"NetworkName":{"type":"string","description":"Network name.","title":"NetworkName"},"Ssid":{"type":"string","description":"SSID.","title":"Ssid"},"WiFiSecurityType":{"enum":["open","wpaEnterprise","wpa2Enterprise"],"description":"Wi-Fi security.","title":"WiFiSecurityType"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.wificonfigurationpolicyandroidforwork":{"type":"object","description":"This resource configures an Intune Wifi Configuration Policy Android For Work Device.","title":"Schema for microsoft.intune.wificonfigurationpolicyandroidforwork","properties":{"Id":{"type":"string","description":"Id of the Intune policy.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the Intune policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune policy.","title":"Description"},"ConnectAutomatically":{"type":"boolean","description":"Connect automatically","title":"ConnectAutomatically"},"ConnectWhenNetworkNameIsHidden":{"type":"boolean","description":"Connect when network name is hidden","title":"ConnectWhenNetworkNameIsHidden"},"NetworkName":{"type":"string","description":"Network name","title":"NetworkName"},"Ssid":{"type":"string","description":"SSID","title":"Ssid"},"WiFiSecurityType":{"enum":["open","wpaEnterprise","wpa2Enterprise"],"description":"Wi-Fi security","title":"WiFiSecurityType"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.wificonfigurationpolicyandroidopensourceproject":{"type":"object","description":"This resource configures an Intune Wifi Configuration Policy Android Open Source Project Device.","title":"Schema for microsoft.intune.wificonfigurationpolicyandroidopensourceproject","properties":{"Id":{"type":"string","description":"Id of the Intune policy.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the Intune policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune policy.","title":"Description"},"ConnectAutomatically":{"type":"boolean","description":"Connect automatically to the network.","title":"ConnectAutomatically"},"ConnectWhenNetworkNameIsHidden":{"type":"boolean","description":"Define if the network should be connected if hidden.","title":"ConnectWhenNetworkNameIsHidden"},"NetworkName":{"type":"string","description":"Define the network name.","title":"NetworkName"},"PreSharedKey":{"type":"string","description":"Define the pre-shared key.","title":"PreSharedKey"},"PreSharedKeyIsSet":{"type":"boolean","description":"Define if the pre-shared key is set.","title":"PreSharedKeyIsSet"},"Ssid":{"type":"string","description":"Define the SSID.","title":"Ssid"},"WiFiSecurityType":{"enum":["open","wep","wpaPersonal","wpaEnterprise"],"description":"Define the Wifi security type.","title":"WiFiSecurityType"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.wificonfigurationpolicyios":{"type":"object","description":"This resource configures an Intune Wifi Configuration Policy for iOS Device.","title":"Schema for microsoft.intune.wificonfigurationpolicyios","properties":{"Id":{"type":"string","description":"Id of the Intune policy.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the Intune policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune policy.","title":"Description"},"ConnectAutomatically":{"type":"boolean","description":"Connect automatically","title":"ConnectAutomatically"},"ConnectWhenNetworkNameIsHidden":{"type":"boolean","description":"Connect when network name is hidden","title":"ConnectWhenNetworkNameIsHidden"},"DisableMacAddressRandomization":{"type":"boolean","description":"Disable the MAC address randomization.","title":"DisableMacAddressRandomization"},"NetworkName":{"type":"string","description":"Network name","title":"NetworkName"},"PreSharedKey":{"type":"string","description":"Pre shared key","title":"PreSharedKey"},"ProxyAutomaticConfigurationUrl":{"type":"string","description":"Proxy automatic configuration url","title":"ProxyAutomaticConfigurationUrl"},"ProxyManualAddress":{"type":"string","description":"Proxy manual address","title":"ProxyManualAddress"},"ProxyManualPort":{"type":"integer","description":"Proxy manual port","title":"ProxyManualPort"},"ProxySettings":{"enum":["none","manual","automatic"],"description":"Proxy settings","title":"ProxySettings"},"Ssid":{"type":"string","description":"SSID","title":"Ssid"},"WiFiSecurityType":{"enum":["open","wpaPersonal","wpaEnterprise","wep","wpa2Personal","wpa2Enterprise"],"description":"Wi-Fi security","title":"WiFiSecurityType"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.wificonfigurationpolicymacos":{"type":"object","description":"This resource configures an Intune Wifi Configuration Policy for MacOS Device.","title":"Schema for microsoft.intune.wificonfigurationpolicymacos","properties":{"Id":{"type":"string","description":"Id of the Intune policy.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the Intune policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune policy.","title":"Description"},"ConnectAutomatically":{"type":"boolean","description":"Connect automatically","title":"ConnectAutomatically"},"ConnectWhenNetworkNameIsHidden":{"type":"boolean","description":"Connect when network name is hidden","title":"ConnectWhenNetworkNameIsHidden"},"NetworkName":{"type":"string","description":"Network name","title":"NetworkName"},"PreSharedKey":{"type":"string","description":"Pre shared key","title":"PreSharedKey"},"ProxyAutomaticConfigurationUrl":{"type":"string","description":"Proxy automatic configuration url","title":"ProxyAutomaticConfigurationUrl"},"ProxyManualAddress":{"type":"string","description":"Proxy manual address","title":"ProxyManualAddress"},"ProxyManualPort":{"type":"integer","description":"Proxy manual port","title":"ProxyManualPort"},"ProxySettings":{"enum":["none","manual","automatic"],"description":"Proxy settings","title":"ProxySettings"},"Ssid":{"type":"string","description":"SSID","title":"Ssid"},"WiFiSecurityType":{"enum":["open","wpaPersonal","wpaEnterprise","wep","wpa2Personal","wpa2Enterprise"],"description":"Wi-Fi security","title":"WiFiSecurityType"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.wificonfigurationpolicywindows10":{"type":"object","description":"This resource configures an Intune Wifi Configuration Policy for Windows10 Device.","title":"Schema for microsoft.intune.wificonfigurationpolicywindows10","properties":{"Id":{"type":"string","description":"Id of the Intune policy.","title":"Id"},"DisplayName":{"type":"string","description":"Display name of the Intune policy.","title":"DisplayName"},"Description":{"type":"string","description":"Description of the Intune policy.","title":"Description"},"ConnectAutomatically":{"type":"boolean","description":"Connect automatically","title":"ConnectAutomatically"},"ConnectToPreferredNetwork":{"type":"boolean","description":"Connect to preferred network","title":"ConnectToPreferredNetwork"},"ConnectWhenNetworkNameIsHidden":{"type":"boolean","description":"Connect when network name is hidden","title":"ConnectWhenNetworkNameIsHidden"},"ForceFIPSCompliance":{"type":"boolean","description":"Force FIPS compliance","title":"ForceFIPSCompliance"},"MeteredConnectionLimit":{"enum":["unrestricted","fixed","variable"],"description":"Metered connection limit","title":"MeteredConnectionLimit"},"NetworkName":{"type":"string","description":"Network name","title":"NetworkName"},"PreSharedKey":{"type":"string","description":"Pre shared key","title":"PreSharedKey"},"ProxyAutomaticConfigurationUrl":{"type":"string","description":"Proxy automatic configuration url","title":"ProxyAutomaticConfigurationUrl"},"ProxyManualAddress":{"type":"string","description":"Proxy manual address","title":"ProxyManualAddress"},"ProxyManualPort":{"type":"integer","description":"Proxy manual port","title":"ProxyManualPort"},"ProxySetting":{"enum":["none","manual","automatic"],"description":"Proxy setting","title":"ProxySetting"},"Ssid":{"type":"string","description":"SSID","title":"Ssid"},"WifiSecurityType":{"enum":["open","wpaPersonal","wpaEnterprise","wep","wpa2Personal","wpa2Enterprise"],"description":"Wi-Fi security","title":"WifiSecurityType"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.windowsautopilotdeploymentprofileazureadhybridjoined":{"type":"object","description":"Intune Windows Autopilot Deployment Profile Azure AD Hybrid Joined","title":"Schema for microsoft.intune.windowsautopilotdeploymentprofileazureadhybridjoined","properties":{"HybridAzureADJoinSkipConnectivityCheck":{"type":"boolean","description":"The Autopilot Hybrid Azure AD join flow will continue even if it does not establish domain controller connectivity during OOBE.","title":"HybridAzureADJoinSkipConnectivityCheck"},"Description":{"type":"string","description":"Description of the profile","title":"Description"},"DeviceNameTemplate":{"type":"string","description":"The template used to name the AutoPilot Device. This can be a custom text and can also contain either the serial number of the device, or a randomly generated number. The total length of the text generated by the template can be no more than 15 characters.","title":"DeviceNameTemplate"},"DeviceType":{"enum":["windowsPc","surfaceHub2","holoLens","surfaceHub2S","virtualMachine","unknownFutureValue"],"description":"The AutoPilot device type that this profile is applicable to. Possible values are: windowsPc, surfaceHub2.","title":"DeviceType"},"DisplayName":{"type":"string","description":"Name of the profile","title":"DisplayName"},"EnableWhiteGlove":{"type":"boolean","description":"Enable Autopilot White Glove for the profile.","title":"EnableWhiteGlove"},"EnrollmentStatusScreenSettings":{"type":"object","description":"Enrollment status screen setting","title":"EnrollmentStatusScreenSettings","properties":{"AllowDeviceUseBeforeProfileAndAppInstallComplete":{"type":"boolean","description":"Allow or block user to use device before profile and app installation complete","title":"AllowDeviceUseBeforeProfileAndAppInstallComplete"},"AllowDeviceUseOnInstallFailure":{"type":"boolean","description":"Allow the user to continue using the device on installation failure","title":"AllowDeviceUseOnInstallFailure"},"AllowLogCollectionOnInstallFailure":{"type":"boolean","description":"Allow or block log collection on installation failure","title":"AllowLogCollectionOnInstallFailure"},"BlockDeviceSetupRetryByUser":{"type":"boolean","description":"Allow the user to retry the setup on installation failure","title":"BlockDeviceSetupRetryByUser"},"CustomErrorMessage":{"type":"string","description":"Set custom error message to show upon installation failure","title":"CustomErrorMessage"},"HideInstallationProgress":{"type":"boolean","description":"Show or hide installation progress to user","title":"HideInstallationProgress"},"InstallProgressTimeoutInMinutes":{"type":"integer","description":"Set installation progress timeout in minutes","title":"InstallProgressTimeoutInMinutes"}},"required":[]},"ExtractHardwareHash":{"type":"boolean","description":"HardwareHash Extraction for the profile","title":"ExtractHardwareHash"},"Language":{"type":"string","description":"Language configured on the device","title":"Language"},"ManagementServiceAppId":{"type":"string","description":"AzureAD management app ID used during client device-based enrollment discovery","title":"ManagementServiceAppId"},"OutOfBoxExperienceSettings":{"type":"object","description":"Out of box experience setting","title":"OutOfBoxExperienceSettings","properties":{"DeviceUsageType":{"enum":["singleUser","shared"],"description":"AAD join authentication type. Possible values are: singleUser, shared.","title":"DeviceUsageType"},"HideEscapeLink":{"type":"boolean","description":"If set to true, then the user can't start over with different account, on company sign-in","title":"HideEscapeLink"},"HideEULA":{"type":"boolean","description":"Show or hide EULA to user","title":"HideEULA"},"HidePrivacySettings":{"type":"boolean","description":"Show or hide privacy settings to user","title":"HidePrivacySettings"},"SkipKeyboardSelectionPage":{"type":"boolean","description":"If set, then skip the keyboard selection page if Language and Region are set","title":"SkipKeyboardSelectionPage"},"UserType":{"enum":["administrator","standard"],"description":"Type of user. Possible values are: administrator, standard.","title":"UserType"}},"required":[]},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.windowsautopilotdeploymentprofileazureadjoined":{"type":"object","description":"Intune Windows Autopilot Deployment Profile Azure AD Joined","title":"Schema for microsoft.intune.windowsautopilotdeploymentprofileazureadjoined","properties":{"Description":{"type":"string","description":"Description of the profile","title":"Description"},"DeviceNameTemplate":{"type":"string","description":"The template used to name the AutoPilot Device. This can be a custom text and can also contain either the serial number of the device, or a randomly generated number. The total length of the text generated by the template can be no more than 15 characters.","title":"DeviceNameTemplate"},"DeviceType":{"enum":["windowsPc","surfaceHub2","holoLens","surfaceHub2S","virtualMachine","unknownFutureValue"],"description":"The AutoPilot device type that this profile is applicable to. Possible values are: windowsPc, surfaceHub2.","title":"DeviceType"},"DisplayName":{"type":"string","description":"Name of the profile","title":"DisplayName"},"EnableWhiteGlove":{"type":"boolean","description":"Enable Autopilot White Glove for the profile.","title":"EnableWhiteGlove"},"EnrollmentStatusScreenSettings":{"type":"object","description":"Enrollment status screen setting","title":"EnrollmentStatusScreenSettings","properties":{"AllowDeviceUseBeforeProfileAndAppInstallComplete":{"type":"boolean","description":"Allow or block user to use device before profile and app installation complete","title":"AllowDeviceUseBeforeProfileAndAppInstallComplete"},"AllowDeviceUseOnInstallFailure":{"type":"boolean","description":"Allow the user to continue using the device on installation failure","title":"AllowDeviceUseOnInstallFailure"},"AllowLogCollectionOnInstallFailure":{"type":"boolean","description":"Allow or block log collection on installation failure","title":"AllowLogCollectionOnInstallFailure"},"BlockDeviceSetupRetryByUser":{"type":"boolean","description":"Allow the user to retry the setup on installation failure","title":"BlockDeviceSetupRetryByUser"},"CustomErrorMessage":{"type":"string","description":"Set custom error message to show upon installation failure","title":"CustomErrorMessage"},"HideInstallationProgress":{"type":"boolean","description":"Show or hide installation progress to user","title":"HideInstallationProgress"},"InstallProgressTimeoutInMinutes":{"type":"integer","description":"Set installation progress timeout in minutes","title":"InstallProgressTimeoutInMinutes"}},"required":[]},"ExtractHardwareHash":{"type":"boolean","description":"HardwareHash Extraction for the profile","title":"ExtractHardwareHash"},"Language":{"type":"string","description":"Language configured on the device","title":"Language"},"ManagementServiceAppId":{"type":"string","description":"AzureAD management app ID used during client device-based enrollment discovery","title":"ManagementServiceAppId"},"OutOfBoxExperienceSettings":{"type":"object","description":"Out of box experience setting","title":"OutOfBoxExperienceSettings","properties":{"DeviceUsageType":{"enum":["singleUser","shared"],"description":"AAD join authentication type. Possible values are: singleUser, shared.","title":"DeviceUsageType"},"HideEscapeLink":{"type":"boolean","description":"If set to true, then the user can't start over with different account, on company sign-in","title":"HideEscapeLink"},"HideEULA":{"type":"boolean","description":"Show or hide EULA to user","title":"HideEULA"},"HidePrivacySettings":{"type":"boolean","description":"Show or hide privacy settings to user","title":"HidePrivacySettings"},"SkipKeyboardSelectionPage":{"type":"boolean","description":"If set, then skip the keyboard selection page if Language and Region are set","title":"SkipKeyboardSelectionPage"},"UserType":{"enum":["administrator","standard"],"description":"Type of user. Possible values are: administrator, standard.","title":"UserType"}},"required":[]},"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.windowsinformationprotectionpolicywindows10mdmenrolled":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for microsoft.intune.windowsinformationprotectionpolicywindows10mdmenrolled","properties":{"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"DisplayName":{"type":"string","description":"Policy display name.","title":"DisplayName"},"AzureRightsManagementServicesAllowed":{"type":"boolean","description":"Specifies whether to allow Azure RMS encryption for WIP","title":"AzureRightsManagementServicesAllowed"},"DataRecoveryCertificate":{"type":"object","description":"Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent(DRA) certificate for encrypting file system(EFS)","title":"DataRecoveryCertificate","properties":{"Certificate":{"type":"string","description":"Data recovery Certificate","title":"Certificate"},"Description":{"type":"string","description":"Data recovery Certificate description","title":"Description"},"ExpirationDateTime":{"type":"string","description":"Data recovery Certificate expiration datetime","title":"ExpirationDateTime"},"SubjectName":{"type":"string","description":"Data recovery Certificate subject name","title":"SubjectName"}},"required":[]},"EnforcementLevel":{"enum":["noProtection","encryptAndAuditOnly","encryptAuditAndPrompt","encryptAuditAndBlock"],"description":"WIP enforcement level.See the Enum definition for supported values. Possible values are: noProtection, encryptAndAuditOnly, encryptAuditAndPrompt, encryptAuditAndBlock.","title":"EnforcementLevel"},"EnterpriseDomain":{"type":"string","description":"Primary enterprise domain","title":"EnterpriseDomain"},"EnterpriseInternalProxyServers":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphWindowsInformationProtectionResourceCollection","properties":{"DisplayName":{"type":"string","description":"Display name","title":"DisplayName"},"Resources":{"type":"array","items":{"type":"string"},"description":"Collection of resources","title":"Resources"}},"required":[]},"description":"This is the comma-separated list of internal proxy servers. For example, '157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59'. These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the EnterpriseProxiedDomains policy to force traffic to the matched domains through these proxies","title":"EnterpriseInternalProxyServers"},"EnterpriseIPRanges":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphWindowsInformationProtectionIPRangeCollection","properties":{"DisplayName":{"type":"string","description":"Display name","title":"DisplayName"},"Ranges":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphIpRange","properties":{"CidrAddress":{"type":"string","description":"IPv4 address in CIDR notation. Not nullable.","title":"CidrAddress"},"LowerAddress":{"type":"string","description":"Lower address.","title":"LowerAddress"},"UpperAddress":{"type":"string","description":"Upper address.","title":"UpperAddress"},"odataType":{"enum":["#microsoft.graph.iPv4CidrRange","#microsoft.graph.iPv6CidrRange","#microsoft.graph.iPv4Range","#microsoft.graph.iPv6Range"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"description":"Collection of ip ranges","title":"Ranges"}},"required":[]},"description":"Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to","title":"EnterpriseIPRanges"},"EnterpriseIPRangesAreAuthoritative":{"type":"boolean","description":"Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. Default is false","title":"EnterpriseIPRangesAreAuthoritative"},"EnterpriseNetworkDomainNames":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphWindowsInformationProtectionResourceCollection","properties":{"DisplayName":{"type":"string","description":"Display name","title":"DisplayName"},"Resources":{"type":"array","items":{"type":"string"},"description":"Collection of resources","title":"Resources"}},"required":[]},"description":"This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to","title":"EnterpriseNetworkDomainNames"},"EnterpriseProtectedDomainNames":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphWindowsInformationProtectionResourceCollection","properties":{"DisplayName":{"type":"string","description":"Display name","title":"DisplayName"},"Resources":{"type":"array","items":{"type":"string"},"description":"Collection of resources","title":"Resources"}},"required":[]},"description":"List of enterprise domains to be protected","title":"EnterpriseProtectedDomainNames"},"EnterpriseProxiedDomains":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphWindowsInformationProtectionProxiedDomainCollection","properties":{"DisplayName":{"type":"string","description":"Display name","title":"DisplayName"},"ProxiedDomains":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphProxiedDomain","properties":{"IpAddressOrFQDN":{"type":"string","description":"The IP address or FQDN","title":"IpAddressOrFQDN"},"Proxy":{"type":"string","description":"Proxy IP or FQDN","title":"Proxy"}},"required":[]},"description":"Collection of proxied domains","title":"ProxiedDomains"}},"required":[]},"description":"Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the EnterpriseInternalProxyServers policy","title":"EnterpriseProxiedDomains"},"EnterpriseProxyServers":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphWindowsInformationProtectionResourceCollection","properties":{"DisplayName":{"type":"string","description":"Display name","title":"DisplayName"},"Resources":{"type":"array","items":{"type":"string"},"description":"Collection of resources","title":"Resources"}},"required":[]},"description":"This is a list of proxy servers. Any server not on this list is considered non-enterprise","title":"EnterpriseProxyServers"},"EnterpriseProxyServersAreAuthoritative":{"type":"boolean","description":"Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. Default is false","title":"EnterpriseProxyServersAreAuthoritative"},"ExemptApps":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphWindowsInformationProtectionApp","properties":{"Denied":{"type":"boolean","description":"If true, app is denied protection or exemption.","title":"Denied"},"Description":{"type":"string","description":"The app's description.","title":"Description"},"DisplayName":{"type":"string","description":"App display name.","title":"DisplayName"},"ProductName":{"type":"string","description":"The product name.","title":"ProductName"},"PublisherName":{"type":"string","description":"The publisher name","title":"PublisherName"},"BinaryName":{"type":"string","description":"The binary name.","title":"BinaryName"},"BinaryVersionHigh":{"type":"string","description":"The high binary version.","title":"BinaryVersionHigh"},"BinaryVersionLow":{"type":"string","description":"The lower binary version.","title":"BinaryVersionLow"},"odataType":{"enum":["#microsoft.graph.windowsInformationProtectionDesktopApp","#microsoft.graph.windowsInformationProtectionStoreApp"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"description":"Exempt applications can also access enterprise data, but the data handled by those applications are not protected. This is because some critical enterprise applications may have compatibility problems with encrypted data.","title":"ExemptApps"},"IconsVisible":{"type":"boolean","description":"Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles in the Start menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the WIP icon in the title bar of a WIP-protected app","title":"IconsVisible"},"IndexingEncryptedStoresOrItemsBlocked":{"type":"boolean","description":"This switch is for the Windows Search Indexer, to allow or disallow indexing of items","title":"IndexingEncryptedStoresOrItemsBlocked"},"NeutralDomainResources":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphWindowsInformationProtectionResourceCollection","properties":{"DisplayName":{"type":"string","description":"Display name","title":"DisplayName"},"Resources":{"type":"array","items":{"type":"string"},"description":"Collection of resources","title":"Resources"}},"required":[]},"description":"List of domain names that can used for work or personal resource","title":"NeutralDomainResources"},"ProtectedApps":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphWindowsInformationProtectionApp","properties":{"Denied":{"type":"boolean","description":"If true, app is denied protection or exemption.","title":"Denied"},"Description":{"type":"string","description":"The app's description.","title":"Description"},"DisplayName":{"type":"string","description":"App display name.","title":"DisplayName"},"ProductName":{"type":"string","description":"The product name.","title":"ProductName"},"PublisherName":{"type":"string","description":"The publisher name","title":"PublisherName"},"BinaryName":{"type":"string","description":"The binary name.","title":"BinaryName"},"BinaryVersionHigh":{"type":"string","description":"The high binary version.","title":"BinaryVersionHigh"},"BinaryVersionLow":{"type":"string","description":"The lower binary version.","title":"BinaryVersionLow"},"odataType":{"enum":["#microsoft.graph.windowsInformationProtectionDesktopApp","#microsoft.graph.windowsInformationProtectionStoreApp"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"description":"Protected applications can access enterprise data and the data handled by those applications are protected with encryption","title":"ProtectedApps"},"ProtectionUnderLockConfigRequired":{"type":"boolean","description":"Specifies whether the protection under lock feature (also known as encrypt under pin) should be configured","title":"ProtectionUnderLockConfigRequired"},"RevokeOnUnenrollDisabled":{"type":"boolean","description":"This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 1 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after unenrollment. If the keys are not revoked, there will be no revoked file cleanup subsequently.","title":"RevokeOnUnenrollDisabled"},"RightsManagementServicesTemplateId":{"type":"string","description":"TemplateID GUID to use for RMS encryption. The RMS template allows the IT admin to configure the details about who has access to RMS-protected file and how long they have access","title":"RightsManagementServicesTemplateId"},"SmbAutoEncryptedFileExtensions":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_MicrosoftGraphWindowsInformationProtectionResourceCollection","properties":{"DisplayName":{"type":"string","description":"Display name","title":"DisplayName"},"Resources":{"type":"array","items":{"type":"string"},"description":"Collection of resources","title":"Resources"}},"required":[]},"description":"Specifies a list of file extensions, so that files with these extensions are encrypted when copying from an SMB share within the corporate boundary","title":"SmbAutoEncryptedFileExtensions"},"Description":{"type":"string","description":"The policy's description.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"Intune Windows Information Protection Policy for Windows10 Mdm Enrolled","title":"Schema for MSFT_IntuneWindowsInformationProtectionPolicyWindows10MdmEnrolledPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.windowsupdateforbusinessfeatureupdateprofilewindows10":{"type":"object","description":"Intune Windows Update For Business Feature Update Profile for Windows10\r\n\r\n## RolloutSettings\r\n\r\nThe RolloutSettings for this resource have the following constraints and notes: \r\n\r\n* When creating a policy:\r\n    * If only a start date is specified, then the start date must be at least today. \r\n        * If the desired state date is before the current date, it will be adjusted to the current date.\r\n    * If a start and end date is specified, the start date must be the current date + 2 days, and  \r\n      the end date must be at least one day after the start date.\r\n        * If the start date is before the current date + 2 days, it will be adjusted to this date.\r\n* When updating a policy:\r\n    * If only a start date is specified, then the start date must either be the date from the current   \r\n      configuration or the current date (or later). \r\n        * If the desired state date is before the current date, it will be adjusted to the current date.\r\n    * If a start and end date is specified, the start date must be the current date + 2 days, and  \r\n      the end date must be at least one day after the start date.\r\n        * If the start date is before the current date + 2 days, it will be adjusted to this date.\r\n* When testing a policy:\r\n    * If the policy is missing and the start and end date are before the current date, it will return true.\r\n    * If the start date is different but before the current start date or time, it will return true.","title":"Schema for microsoft.intune.windowsupdateforbusinessfeatureupdateprofilewindows10","properties":{"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"DisplayName":{"type":"string","description":"The display name of the profile.","title":"DisplayName"},"Description":{"type":"string","description":"The description of the profile which is specified by the user.","title":"Description"},"FeatureUpdateVersion":{"type":"string","description":"The feature update version that will be deployed to the devices targeted by this profile. The version could be any supported version for example 1709, 1803 or 1809 and so on.","title":"FeatureUpdateVersion"},"InstallFeatureUpdatesOptional":{"type":"boolean","description":"If true, the Windows 11 update will become optional","title":"InstallFeatureUpdatesOptional"},"InstallLatestWindows10OnWindows11IneligibleDevice":{"type":"boolean","description":"If true, the latest Microsoft Windows 10 update will be installed on devices ineligible for Microsoft Windows 11. Cannot be changed after creation of the policy.","title":"InstallLatestWindows10OnWindows11IneligibleDevice"},"RolloutSettings":{"type":"object","description":"The windows update rollout settings, including offer start date time, offer end date time, and days between each set of offers. For 'as soon as possible' installation, set this setting to $null or do not configure it.","title":"RolloutSettings","properties":{"OfferEndDateTimeInUTC":{"type":"string","description":"The feature update's ending  of release date and time to be set, update, and displayed for a feature Update profile for example: 2020-06-09T10:00:00Z.","title":"OfferEndDateTimeInUTC"},"OfferIntervalInDays":{"type":"integer","description":"The number of day(s) between each set of offers to be set, updated, and displayed for a feature update profile, for example: if OfferStartDateTimeInUTC is 2020-06-09T10:00:00Z, and OfferIntervalInDays is 1, then the next two sets of offers will be made consecutively on 2020-06-10T10:00:00Z (next day at the same specified time) and 2020-06-11T10:00:00Z (next next day at the same specified time) with 1 day in between each set of offers.","title":"OfferIntervalInDays"},"OfferStartDateTimeInUTC":{"type":"string","description":"The feature update's starting date and time to be set, update, and displayed for a feature Update profile for example: 2020-06-09T10:00:00Z.","title":"OfferStartDateTimeInUTC"}},"required":[]},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.intune.windowsupdateforbusinessringupdateprofilewindows10":{"type":"object","description":"Intune Windows Update For Business Ring Update Profile for Windows 10","title":"Schema for microsoft.intune.windowsupdateforbusinessringupdateprofilewindows10","properties":{"Id":{"type":"string","description":"The unique identifier for an entity. Read-only.","title":"Id"},"DisplayName":{"type":"string","description":"Admin provided name of the device configuration.","title":"DisplayName"},"AllowWindows11Upgrade":{"type":"boolean","description":"When TRUE, allows eligible Windows 10 devices to upgrade to Windows 11. When FALSE, implies the device stays on the existing operating system. Returned by default. Query parameters are not supported.","title":"AllowWindows11Upgrade"},"AutomaticUpdateMode":{"enum":["userDefined","notifyDownload","autoInstallAtMaintenanceTime","autoInstallAndRebootAtMaintenanceTime","autoInstallAndRebootAtScheduledTime","autoInstallAndRebootWithoutEndUserControl","windowsDefault"],"description":"The Automatic Update Mode. Possible values are: UserDefined, NotifyDownload, AutoInstallAtMaintenanceTime, AutoInstallAndRebootAtMaintenanceTime, AutoInstallAndRebootAtScheduledTime, AutoInstallAndRebootWithoutEndUserControl, WindowsDefault. UserDefined is the default value, no intent. Returned by default. Query parameters are not supported. Possible values are: userDefined, notifyDownload, autoInstallAtMaintenanceTime, autoInstallAndRebootAtMaintenanceTime, autoInstallAndRebootAtScheduledTime, autoInstallAndRebootWithoutEndUserControl, windowsDefault.","title":"AutomaticUpdateMode"},"AutoRestartNotificationDismissal":{"enum":["notConfigured","automatic","user","unknownFutureValue"],"description":"Specify the method by which the auto-restart required notification is dismissed. Possible values are: NotConfigured, Automatic, User. Returned by default. Query parameters are not supported. Possible values are: notConfigured, automatic, user, unknownFutureValue.","title":"AutoRestartNotificationDismissal"},"BusinessReadyUpdatesOnly":{"enum":["userDefined","all","businessReadyOnly","windowsInsiderBuildFast","windowsInsiderBuildSlow","windowsInsiderBuildRelease"],"description":"Determines which branch devices will receive their updates from. Possible values are: UserDefined, All, BusinessReadyOnly, WindowsInsiderBuildFast, WindowsInsiderBuildSlow, WindowsInsiderBuildRelease. Returned by default. Query parameters are not supported. Possible values are: userDefined, all, businessReadyOnly, windowsInsiderBuildFast, windowsInsiderBuildSlow, windowsInsiderBuildRelease.","title":"BusinessReadyUpdatesOnly"},"DeadlineForFeatureUpdatesInDays":{"type":"integer","description":"Number of days before feature updates are installed automatically with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.","title":"DeadlineForFeatureUpdatesInDays"},"DeadlineForQualityUpdatesInDays":{"type":"integer","description":"Number of days before quality updates are installed automatically with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.","title":"DeadlineForQualityUpdatesInDays"},"DeadlineGracePeriodInDays":{"type":"integer","description":"Number of days after deadline until restarts occur automatically with valid range from 0 to 7 days. Returned by default. Query parameters are not supported.","title":"DeadlineGracePeriodInDays"},"DeliveryOptimizationMode":{"enum":["userDefined","httpOnly","httpWithPeeringNat","httpWithPeeringPrivateGroup","httpWithInternetPeering","simpleDownload","bypassMode"],"description":"The Delivery Optimization Mode. Possible values are: UserDefined, HttpOnly, HttpWithPeeringNat, HttpWithPeeringPrivateGroup, HttpWithInternetPeering, SimpleDownload, BypassMode. UserDefined allows the user to set. Returned by default. Query parameters are not supported. Possible values are: userDefined, httpOnly, httpWithPeeringNat, httpWithPeeringPrivateGroup, httpWithInternetPeering, simpleDownload, bypassMode.","title":"DeliveryOptimizationMode"},"DriversExcluded":{"type":"boolean","description":"When TRUE, excludes Windows update Drivers. When FALSE, does not exclude Windows update Drivers. Returned by default. Query parameters are not supported.","title":"DriversExcluded"},"EngagedRestartDeadlineInDays":{"type":"integer","description":"Deadline in days before automatically scheduling and executing a pending restart outside of active hours, with valid range from 2 to 30 days. Returned by default. Query parameters are not supported.","title":"EngagedRestartDeadlineInDays"},"EngagedRestartSnoozeScheduleInDays":{"type":"integer","description":"Number of days a user can snooze Engaged Restart reminder notifications with valid range from 1 to 3 days. Returned by default. Query parameters are not supported.","title":"EngagedRestartSnoozeScheduleInDays"},"EngagedRestartTransitionScheduleInDays":{"type":"integer","description":"Number of days before transitioning from Auto Restarts scheduled outside of active hours to Engaged Restart, which requires the user to schedule, with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.","title":"EngagedRestartTransitionScheduleInDays"},"FeatureUpdatesDeferralPeriodInDays":{"type":"integer","description":"Defer Feature Updates by these many days with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.","title":"FeatureUpdatesDeferralPeriodInDays"},"FeatureUpdatesPaused":{"type":"boolean","description":"When TRUE, assigned devices are paused from receiving feature updates for up to 35 days from the time you pause the ring. When FALSE, does not pause Feature Updates. Returned by default. Query parameters are not supported.s","title":"FeatureUpdatesPaused"},"FeatureUpdatesPauseExpiryDateTime":{"type":"string","description":"The Feature Updates Pause Expiry datetime. This value is 35 days from the time admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported.","title":"FeatureUpdatesPauseExpiryDateTime"},"FeatureUpdatesPauseStartDate":{"type":"string","description":"The Feature Updates Pause start date. This value is the time when the admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported. This property is read-only.","title":"FeatureUpdatesPauseStartDate"},"FeatureUpdatesRollbackStartDateTime":{"type":"string","description":"The Feature Updates Rollback Start datetime.This value is the time when the admin rolled back the Feature update for the ring.Returned by default.Query parameters are not supported.","title":"FeatureUpdatesRollbackStartDateTime"},"FeatureUpdatesRollbackWindowInDays":{"type":"integer","description":"The number of days after a Feature Update for which a rollback is valid with valid range from 2 to 60 days. Returned by default. Query parameters are not supported.","title":"FeatureUpdatesRollbackWindowInDays"},"InstallationSchedule":{"type":"object","description":"The Installation Schedule. Possible values are: ActiveHoursStart, ActiveHoursEnd, ScheduledInstallDay, ScheduledInstallTime. Returned by default. Query parameters are not supported.","title":"InstallationSchedule","properties":{"ActiveHoursEnd":{"type":"string","description":"Active Hours End","title":"ActiveHoursEnd"},"ActiveHoursStart":{"type":"string","description":"Active Hours Start","title":"ActiveHoursStart"},"ScheduledInstallDay":{"enum":["userDefined","everyday","sunday","monday","tuesday","wednesday","thursday","friday","saturday","noScheduledScan"],"description":"Scheduled Install Day in week. Possible values are: userDefined, everyday, sunday, monday, tuesday, wednesday, thursday, friday, saturday, noScheduledScan.","title":"ScheduledInstallDay"},"ScheduledInstallTime":{"type":"string","description":"Scheduled Install Time during day","title":"ScheduledInstallTime"},"odataType":{"enum":["#microsoft.graph.windowsUpdateActiveHoursInstall","#microsoft.graph.windowsUpdateScheduledInstall"],"description":"The type of the entity.","title":"odataType"}},"required":[]},"MicrosoftUpdateServiceAllowed":{"type":"boolean","description":"When TRUE, allows Microsoft Update Service. When FALSE, does not allow Microsoft Update Service. Returned by default. Query parameters are not supported.","title":"MicrosoftUpdateServiceAllowed"},"PostponeRebootUntilAfterDeadline":{"type":"boolean","description":"When TRUE the device should wait until deadline for rebooting outside of active hours. When FALSE the device should not wait until deadline for rebooting outside of active hours. Returned by default. Query parameters are not supported.","title":"PostponeRebootUntilAfterDeadline"},"PrereleaseFeatures":{"enum":["userDefined","settingsOnly","settingsAndExperimentations","notAllowed"],"description":"The Pre-Release Features. Possible values are: UserDefined, SettingsOnly, SettingsAndExperimentations, NotAllowed. UserDefined is the default value, no intent. Returned by default. Query parameters are not supported. Possible values are: userDefined, settingsOnly, settingsAndExperimentations, notAllowed.","title":"PrereleaseFeatures"},"QualityUpdatesDeferralPeriodInDays":{"type":"integer","description":"Defer Quality Updates by these many days with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.","title":"QualityUpdatesDeferralPeriodInDays"},"QualityUpdatesPaused":{"type":"boolean","description":"When TRUE, assigned devices are paused from receiving quality updates for up to 35 days from the time you pause the ring. When FALSE, does not pause Quality Updates. Returned by default. Query parameters are not supported.","title":"QualityUpdatesPaused"},"QualityUpdatesPauseExpiryDateTime":{"type":"string","description":"The Quality Updates Pause Expiry datetime. This value is 35 days from the time admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported.","title":"QualityUpdatesPauseExpiryDateTime"},"QualityUpdatesPauseStartDate":{"type":"string","description":"The Quality Updates Pause start date. This value is the time when the admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported. This property is read-only.","title":"QualityUpdatesPauseStartDate"},"QualityUpdatesRollbackStartDateTime":{"type":"string","description":"The Quality Updates Rollback Start datetime. This value is the time when the admin rolled back the Quality update for the ring. Returned by default. Query parameters are not supported.","title":"QualityUpdatesRollbackStartDateTime"},"ScheduleImminentRestartWarningInMinutes":{"type":"integer","description":"Specify the period for auto-restart imminent warning notifications. Supported values: 15, 30 or 60 (minutes). Returned by default. Query parameters are not supported.","title":"ScheduleImminentRestartWarningInMinutes"},"ScheduleRestartWarningInHours":{"type":"integer","description":"Specify the period for auto-restart warning reminder notifications. Supported values: 2, 4, 8, 12 or 24 (hours). Returned by default. Query parameters are not supported.","title":"ScheduleRestartWarningInHours"},"SkipChecksBeforeRestart":{"type":"boolean","description":"When TRUE, skips all checks before restart: Battery level = 40%, User presence, Display Needed, Presentation mode, Full screen mode, phone call state, game mode etc. When FALSE, does not skip all checks before restart. Returned by default. Query parameters are not supported.","title":"SkipChecksBeforeRestart"},"UpdateNotificationLevel":{"enum":["notConfigured","defaultNotifications","restartWarningsOnly","disableAllNotifications","unknownFutureValue"],"description":"Specifies what Windows Update notifications users see. Possible values are: NotConfigured, DefaultNotifications, RestartWarningsOnly, DisableAllNotifications. Returned by default. Query parameters are not supported. Possible values are: notConfigured, defaultNotifications, restartWarningsOnly, disableAllNotifications, unknownFutureValue.","title":"UpdateNotificationLevel"},"UpdateWeeks":{"enum":["userDefined","firstWeek","secondWeek","thirdWeek","fourthWeek","everyWeek","unknownFutureValue"],"description":"Schedule the update installation on the weeks of the month. Possible values are: UserDefined, FirstWeek, SecondWeek, ThirdWeek, FourthWeek, EveryWeek. Returned by default. Query parameters are not supported. Possible values are: userDefined, firstWeek, secondWeek, thirdWeek, fourthWeek, everyWeek, unknownFutureValue.","title":"UpdateWeeks"},"UserPauseAccess":{"enum":["notConfigured","enabled","disabled"],"description":"Specifies whether to enable end user's access to pause software updates. Possible values are: NotConfigured, Enabled, Disabled. Returned by default. Query parameters are not supported. Possible values are: notConfigured, enabled, disabled.","title":"UserPauseAccess"},"UserWindowsUpdateScanAccess":{"enum":["notConfigured","enabled","disabled"],"description":"Specifies whether to disable user's access to scan Windows Update. Possible values are: NotConfigured, Enabled, Disabled. Returned by default. Query parameters are not supported. Possible values are: notConfigured, enabled, disabled.","title":"UserWindowsUpdateScanAccess"},"Description":{"type":"string","description":"Admin provided description of the Device Configuration.","title":"Description"},"Assignments":{"type":"array","items":{"type":"object","description":"This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.\r\nThis policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.","title":"Schema for MSFT_DeviceManagementConfigurationPolicyAssignments","properties":{"dataType":{"enum":["#microsoft.graph.groupAssignmentTarget","#microsoft.graph.allLicensedUsersAssignmentTarget","#microsoft.graph.allDevicesAssignmentTarget","#microsoft.graph.exclusionGroupAssignmentTarget","#microsoft.graph.configurationManagerCollectionAssignmentTarget"],"description":"The type of the target assignment.","title":"dataType"},"deviceAndAppManagementAssignmentFilterType":{"enum":["none","include","exclude"],"description":"The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.","title":"deviceAndAppManagementAssignmentFilterType"},"deviceAndAppManagementAssignmentFilterId":{"type":"string","description":"The Id of the filter for the target assignment.","title":"deviceAndAppManagementAssignmentFilterId"},"groupId":{"type":"string","description":"The group Id that is the target of the assignment.","title":"groupId"},"groupDisplayName":{"type":"string","description":"The group Display Name that is the target of the assignment.","title":"groupDisplayName"},"collectionId":{"type":"string","description":"The collection Id that is the target of the assignment.(ConfigMgr)","title":"collectionId"}},"required":[]},"description":"Represents the assignment to the Intune policy.","title":"Assignments"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the policy exists, absent ensures it is removed.","title":"Ensure"}},"required":["DisplayName"]},"microsoft.securityandcompliance.auditconfigurationpolicy":{"type":"object","description":"This resource configures an Audit ConfigurationPolicy\r\nin Security and Compliance Center.","title":"Schema for microsoft.securityandcompliance.auditconfigurationpolicy","properties":{"Workload":{"enum":["Exchange","SharePoint","OneDriveForBusiness"],"description":"Workload associated with the policy.","title":"Workload"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this policy should exist or not.","title":"Ensure"}},"required":["Workload"]},"microsoft.securityandcompliance.autosensitivitylabelpolicy":{"type":"object","description":"This resource configures a Auto Sensitivity label policy in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.autosensitivitylabelpolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name for the sensitivity label. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this label policy should exist or not.","title":"Ensure"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"ApplySensitivityLabel":{"type":"string","description":"The ApplySensitivityLabel parameter specifies the label to use for the auto label policy.","title":"ApplySensitivityLabel"},"ExchangeSender":{"type":"array","items":{"type":"string"},"description":"The ExchangeSender parameter specifies which senders to include in the policy.","title":"ExchangeSender"},"ExchangeSenderException":{"type":"array","items":{"type":"string"},"description":"The ExchangeSenderException parameter specifies which senders to exclude in the policy.","title":"ExchangeSenderException"},"ExchangeSenderMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExchangeSenderMemberOf parameter specifies the distribution groups, mail-enabled security groups, or dynamic distribution groups to include in the auto-labeling policy.","title":"ExchangeSenderMemberOf"},"ExchangeSenderMemberOfException":{"type":"array","items":{"type":"string"},"description":"he ExchangeSenderMemberOf parameter specifies the distribution groups, mail-enabled security groups, or dynamic distribution groups to exclude from the auto-labeling policy.","title":"ExchangeSenderMemberOfException"},"ExchangeLocation":{"type":"array","items":{"type":"string"},"description":"The ExchangeSender parameter specifies which senders to include in the policy.","title":"ExchangeLocation"},"AddExchangeLocation":{"type":"array","items":{"type":"string"},"description":"This AddExchangeLocation parameter specifies new Exchange locations to be added to the policy without affecting the existing ones.","title":"AddExchangeLocation"},"RemoveExchangeLocation":{"type":"array","items":{"type":"string"},"description":"The RemoveExchangeLocation parameter removes locations on Exchange from the policy.","title":"RemoveExchangeLocation"},"Mode":{"enum":["Enable","Disable","TestWithNotifications","TestWithoutNotifications"],"description":"The Mode parameter specifies the action and notification level of the auto-labeling policy.","title":"Mode"},"OneDriveLocation":{"type":"array","items":{"type":"string"},"description":"The OneDriveLocation parameter specifies the OneDrive for Business sites to include. You identify the site by its URL value, or you can use the value.","title":"OneDriveLocation"},"AddOneDriveLocation":{"type":"array","items":{"type":"string"},"description":"The AddOneDriveLocation parameter specifies the OneDrive for Business sites to add to the list of included sites when you aren't using the value All for the OneDriveLocation parameter.","title":"AddOneDriveLocation"},"RemoveOneDriveLocation":{"type":"array","items":{"type":"string"},"description":"The RemoveOneDriveLocation parameter specifies the OneDrive for Business sites to remove from the list of included sites when you aren't using the value All for the OneDriveLocation parameter.","title":"RemoveOneDriveLocation"},"AddOneDriveLocationException":{"type":"array","items":{"type":"string"},"description":"This parameter specifies the OneDrive for Business sites to exclude when you use the value All for the OneDriveLocation parameter.","title":"AddOneDriveLocationException"},"RemoveOneDriveLocationException":{"type":"array","items":{"type":"string"},"description":"This RemoveOneDriveLocationException parameter specifies the OneDrive for Business sites to remove from the list of excluded sites when you use the value All for the OneDriveLocation parameter.","title":"RemoveOneDriveLocationException"},"OneDriveLocationException":{"type":"array","items":{"type":"string"},"description":"The AddOneDriveLocationException parameter specifies the OneDrive for Business sites to add to the list of excluded sites when you use the value All for the OneDriveLocation parameter.","title":"OneDriveLocationException"},"Priority":{"type":"integer","description":"The Priority parameter specifies the priority of the policy. The highest priority policy will take action over lower priority policies if two policies are applicable for a file.","title":"Priority"},"SharePointLocation":{"type":"array","items":{"type":"string"},"description":"The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.","title":"SharePointLocation"},"SharePointLocationException":{"type":"array","items":{"type":"string"},"description":"This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter.","title":"SharePointLocationException"},"AddSharePointLocationException":{"type":"array","items":{"type":"string"},"description":"The AddSharePointLocation parameter specifies the SharePoint Online sites to add to the list of included sites when you aren't using the value All for the SharePointLocation parameter.","title":"AddSharePointLocationException"},"RemoveSharePointLocationException":{"type":"array","items":{"type":"string"},"description":"The RemoveSharePointLocationException parameter specifies the SharePoint Online sites to remove from the list of excluded sites when you use the value All for the SharePointLocation parameter.","title":"RemoveSharePointLocationException"},"AddSharePointLocation":{"type":"array","items":{"type":"string"},"description":"The AddSharePointLocation parameter specifies the SharePoint Online sites to add to the list of included sites when you aren't using the value All for the SharePointLocation parameter.","title":"AddSharePointLocation"},"RemoveSharePointLocation":{"type":"array","items":{"type":"string"},"description":"The RemoveSharePointLocation parameter specifies the SharePoint Online sites to remove from the list of included sites when you aren't using the value All for the SharePointLocation parameter.","title":"RemoveSharePointLocation"}},"required":["Name"]},"microsoft.securityandcompliance.autosensitivitylabelrule":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for microsoft.securityandcompliance.autosensitivitylabelrule","properties":{"Name":{"type":"string","description":"Name of the Rule.","title":"Name"},"Policy":{"type":"string","description":"Name of the associated Policy.","title":"Policy"},"AccessScope":{"enum":["InOrganization","NotInOrganization","None"],"description":"The AccessScope parameter specifies a condition for the auto-labeling policy rule that's based on the access scope of the content. The rule is applied to content that matches the specified access scope. Valid values are: InOrganization, NotInOrganization, None","title":"AccessScope"},"AnyOfRecipientAddressContainsWords":{"type":"string","description":"The AnyOfRecipientAddressContainsWords parameter specifies a condition for the auto-labeling policy rule that looks for words or phrases in recipient email addresses. You can specify multiple words or phrases separated by commas.","title":"AnyOfRecipientAddressContainsWords"},"AnyOfRecipientAddressMatchesPatterns":{"type":"string","description":"The AnyOfRecipientAddressMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in recipient email addresses by using regular expressions.","title":"AnyOfRecipientAddressMatchesPatterns"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"ContentContainsSensitiveInformation":{"type":"object","description":"The ContentContainsSensitiveInformation parameter specifies a condition for the rule that's based on a sensitive information type match in content. The rule is applied to content that contains the specified sensitive information type.","title":"ContentContainsSensitiveInformation","properties":{"SensitiveInformation":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPSensitiveInformation","properties":{"name":{"type":"string","description":"Name of the Sensitive Information Content","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information Content","title":"id"},"maxconfidence":{"type":"string","description":"Maximum Confidence level value for the Sensitive Information","title":"maxconfidence"},"minconfidence":{"type":"string","description":"Minimum Confidence level value for the Sensitive Information","title":"minconfidence"},"classifiertype":{"type":"string","description":"Type of Classifier value for the Sensitive Information","title":"classifiertype"},"mincount":{"type":"string","description":"Minimum Count value for the Sensitive Information","title":"mincount"},"maxcount":{"type":"string","description":"Maximum Count value for the Sensitive Information","title":"maxcount"}},"required":["name"]},"description":"Sensitive Information Content Types","title":"SensitiveInformation"},"Groups":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPContainsSensitiveInformationGroup","properties":{"SensitiveInformation":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPSensitiveInformation","properties":{"name":{"type":"string","description":"Name of the Sensitive Information Content","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information Content","title":"id"},"maxconfidence":{"type":"string","description":"Maximum Confidence level value for the Sensitive Information","title":"maxconfidence"},"minconfidence":{"type":"string","description":"Minimum Confidence level value for the Sensitive Information","title":"minconfidence"},"classifiertype":{"type":"string","description":"Type of Classifier value for the Sensitive Information","title":"classifiertype"},"mincount":{"type":"string","description":"Minimum Count value for the Sensitive Information","title":"mincount"},"maxcount":{"type":"string","description":"Maximum Count value for the Sensitive Information","title":"maxcount"}},"required":["name"]},"description":"Sensitive Information Content Types","title":"SensitiveInformation"},"Labels":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPLabel","properties":{"name":{"type":"string","description":"Name of the Sensitive Label","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information label","title":"id"},"type":{"type":"string","description":"Type of the Sensitive Information label","title":"type"}},"required":["name"]},"description":"Sensitive Information Labels","title":"Labels"},"Name":{"type":"string","description":"Name of the group","title":"Name"},"Operator":{"enum":["And","Or"],"description":"Operator","title":"Operator"}},"required":["Name","Operator"]},"description":"Groups of sensitive information types.","title":"Groups"},"Operator":{"enum":["And","Or"],"description":"Operator","title":"Operator"}},"required":[]},"ContentExtensionMatchesWords":{"type":"string","description":"The ContentExtensionMatchesWords parameter specifies a condition for the auto-labeling policy rule that looks for words in file name extensions. You can specify multiple words separated by commas.","title":"ContentExtensionMatchesWords"},"Disabled":{"type":"boolean","description":"The Disabled parameter specifies whether the auto-labeling policy rule is enabled or disabled.","title":"Disabled"},"DocumentIsPasswordProtected":{"type":"boolean","description":"The DocumentIsPasswordProtected parameter specifies a condition for the auto-labeling policy rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files. ","title":"DocumentIsPasswordProtected"},"DocumentIsUnsupported":{"type":"boolean","description":"The DocumentIsUnsupported parameter specifies a condition for the auto-labeling policy rule that looks for files that can't be scanned.","title":"DocumentIsUnsupported"},"ExceptIfAccessScope":{"enum":["InOrganization","NotInOrganization","None"],"description":"The ExceptIfAccessScopeAccessScope parameter specifies an exception for the auto-labeling policy rule that's based on the access scope of the content. The rule isn't applied to content that matches the specified access scope. Valid values are: InOrganization, NotInOrganization, None","title":"ExceptIfAccessScope"},"ExceptIfAnyOfRecipientAddressContainsWords":{"type":"string","description":"The ExceptIfAnyOfRecipientAddressContainsWords parameter specifies an exception for the auto-labeling policy rule that looks for words or phrases in recipient email addresses. You can specify multiple words separated by commas.","title":"ExceptIfAnyOfRecipientAddressContainsWords"},"ExceptIfAnyOfRecipientAddressMatchesPatterns":{"type":"string","description":"The ExceptIfAnyOfRecipientAddressMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in recipient email addresses by using regular expressions. ","title":"ExceptIfAnyOfRecipientAddressMatchesPatterns"},"ExceptIfContentContainsSensitiveInformation":{"type":"object","description":"The ExceptIfContentContainsSensitiveInformation parameter specifies an exception for the auto-labeling policy rule that's based on a sensitive information type match in content. The rule isn't applied to content that contains the specified sensitive information type.","title":"ExceptIfContentContainsSensitiveInformation","properties":{"SensitiveInformation":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPSensitiveInformation","properties":{"name":{"type":"string","description":"Name of the Sensitive Information Content","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information Content","title":"id"},"maxconfidence":{"type":"string","description":"Maximum Confidence level value for the Sensitive Information","title":"maxconfidence"},"minconfidence":{"type":"string","description":"Minimum Confidence level value for the Sensitive Information","title":"minconfidence"},"classifiertype":{"type":"string","description":"Type of Classifier value for the Sensitive Information","title":"classifiertype"},"mincount":{"type":"string","description":"Minimum Count value for the Sensitive Information","title":"mincount"},"maxcount":{"type":"string","description":"Maximum Count value for the Sensitive Information","title":"maxcount"}},"required":["name"]},"description":"Sensitive Information Content Types","title":"SensitiveInformation"},"Groups":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPContainsSensitiveInformationGroup","properties":{"SensitiveInformation":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPSensitiveInformation","properties":{"name":{"type":"string","description":"Name of the Sensitive Information Content","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information Content","title":"id"},"maxconfidence":{"type":"string","description":"Maximum Confidence level value for the Sensitive Information","title":"maxconfidence"},"minconfidence":{"type":"string","description":"Minimum Confidence level value for the Sensitive Information","title":"minconfidence"},"classifiertype":{"type":"string","description":"Type of Classifier value for the Sensitive Information","title":"classifiertype"},"mincount":{"type":"string","description":"Minimum Count value for the Sensitive Information","title":"mincount"},"maxcount":{"type":"string","description":"Maximum Count value for the Sensitive Information","title":"maxcount"}},"required":["name"]},"description":"Sensitive Information Content Types","title":"SensitiveInformation"},"Labels":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPLabel","properties":{"name":{"type":"string","description":"Name of the Sensitive Label","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information label","title":"id"},"type":{"type":"string","description":"Type of the Sensitive Information label","title":"type"}},"required":["name"]},"description":"Sensitive Information Labels","title":"Labels"},"Name":{"type":"string","description":"Name of the group","title":"Name"},"Operator":{"enum":["And","Or"],"description":"Operator","title":"Operator"}},"required":["Name","Operator"]},"description":"Groups of sensitive information types.","title":"Groups"},"Operator":{"enum":["And","Or"],"description":"Operator","title":"Operator"}},"required":[]},"ExceptIfContentExtensionMatchesWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfContentExtensionMatchesWords parameter specifies an exception for the auto-labeling policy rule that looks for words in file name extensions. You can specify multiple words separated by commas.","title":"ExceptIfContentExtensionMatchesWords"},"ExceptIfDocumentIsPasswordProtected":{"type":"boolean","description":"The ExceptIfDocumentIsPasswordProtected parameter specifies an exception for the auto-labeling policy rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files. ","title":"ExceptIfDocumentIsPasswordProtected"},"ExceptIfDocumentIsUnsupported":{"type":"boolean","description":"The ExceptIfDocumentIsUnsupported parameter specifies an exception for the auto-labeling policy rule that looks for files that can't be scanned.","title":"ExceptIfDocumentIsUnsupported"},"ExceptIfFrom":{"type":"array","items":{"type":"string"},"description":"The ExceptIfFrom parameter specifies an exception for the auto-labeling policy rule that looks for messages from specific senders. You can use any value that uniquely identifies the sender.","title":"ExceptIfFrom"},"ExceptIfFromAddressContainsWords":{"type":"string","description":"The ExceptIfFromAddressContainsWords parameter specifies an exception for the auto-labeling policy rule that looks for words or phrases in the sender's email address. You can specify multiple words or phrases separated by commas.","title":"ExceptIfFromAddressContainsWords"},"ExceptIfFromAddressMatchesPatterns":{"type":"string","description":"The ExceptIfFromAddressMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in the sender's email address by using regular expressions. ","title":"ExceptIfFromAddressMatchesPatterns"},"ExceptIfFromMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfFromMemberOf parameter specifies an exception for the auto-labeling policy rule that looks for messages sent by group members. You identify the group members by their email addresses. You can enter multiple values separated by commas.","title":"ExceptIfFromMemberOf"},"ExceptIfHeaderMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The HeaderMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in a header field by using regular expressions.","title":"ExceptIfHeaderMatchesPatterns"},"ExceptIfProcessingLimitExceeded":{"type":"boolean","description":"The ExceptIfProcessingLimitExceeded parameter specifies an exception for the auto-labeling policy rule that looks for files where scanning couldn't complete.","title":"ExceptIfProcessingLimitExceeded"},"ExceptIfRecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientDomainIs parameter specifies an exception for the auto-labeling policy rule that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"ExceptIfRecipientDomainIs"},"ExceptIfSenderDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSenderDomainIs parameter specifies an exception for the auto-labeling policy rule that looks for messages from senders with email address in the specified domains. You can specify multiple values separated by commas.","title":"ExceptIfSenderDomainIs"},"ExceptIfSenderIPRanges":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSenderIpRanges parameter specifies an exception for the auto-labeling policy rule that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.","title":"ExceptIfSenderIPRanges"},"ExceptIfSentTo":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentTo parameter specifies an exception for the auto-labeling policy rule that looks for recipients in messages. You can use any value that uniquely identifies the recipient. ","title":"ExceptIfSentTo"},"ExceptIfSentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentToMemberOf parameter specifies an exception for the auto-labeling policy rule that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You identify the groups by email address. You can specify multiple values separated by commas.","title":"ExceptIfSentToMemberOf"},"ExceptIfSubjectMatchesPatterns":{"type":"string","description":"The ExceptIfSubjectMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in the Subject field of messages by using regular expressions.","title":"ExceptIfSubjectMatchesPatterns"},"FromAddressContainsWords":{"type":"string","description":"The FromAddressContainsWords parameter specifies a condition for the auto-labeling policy rule that looks for words or phrases in the sender's email address. You can specify multiple words or phrases separated by commas.","title":"FromAddressContainsWords"},"FromAddressMatchesPatterns":{"type":"string","description":"The FromAddressMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in the sender's email address by using regular expressions.","title":"FromAddressMatchesPatterns"},"HeaderMatchesPatterns":{"type":"object","description":"The HeaderMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in a header field by using regular expressions.","title":"HeaderMatchesPatterns","properties":{"Name":{"type":"string","description":"Name of the header pattern","title":"Name"},"Values":{"type":"array","items":{"type":"string"},"description":"Regular expressions for the pattern","title":"Values"}},"required":["Name","Values"]},"ProcessingLimitExceeded":{"type":"boolean","description":"The ProcessingLimitExceeded parameter specifies a condition for the auto-labeling policy rule that looks for files where scanning couldn't complete. You can use this condition to create rules that work together to identify and process messages where the content couldn't be fully scanned.","title":"ProcessingLimitExceeded"},"RecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The RecipientDomainIs parameter specifies a condition for the auto-labeling policy rule that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.","title":"RecipientDomainIs"},"ReportSeverityLevel":{"enum":["None","Low","Medium","High"],"description":"The ReportSeverityLevel parameter specifies the severity level of the incident report for content detections based on the rule. Valid values are: None, Low, Medium, High","title":"ReportSeverityLevel"},"RuleErrorAction":{"enum":["Ignore","RetryThenBlock",""],"description":"The RuleErrorAction parameter specifies what to do if an error is encountered during the evaluation of the rule. Valid values are: Ignore, RetryThenBlock, *blank*","title":"RuleErrorAction"},"SenderDomainIs":{"type":"array","items":{"type":"string"},"description":"The SenderDomainIs parameter specifies a condition for the auto-labeling policy rule that looks for messages from senders with email address in the specified domains. ","title":"SenderDomainIs"},"SenderIPRanges":{"type":"array","items":{"type":"string"},"description":"The SenderIpRanges parameter specifies a condition for the auto-sensitivity policy rule that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.","title":"SenderIPRanges"},"SentTo":{"type":"array","items":{"type":"string"},"description":"The SentTo parameter specifies a condition for the auto-sensitivity policy rule that looks for recipients in messages. You can use any value that uniquely identifies the recipient.","title":"SentTo"},"SentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The SentToMemberOf parameter specifies a condition for the auto-labeling policy rule that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You identify the groups by email address.","title":"SentToMemberOf"},"SubjectMatchesPatterns":{"type":"string","description":"The SubjectMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in the Subject field of messages by using regular expressions.","title":"SubjectMatchesPatterns"},"Workload":{"enum":["Exchange","SharePoint","OneDriveForBusiness"],"description":"Workload the rule is associated with. Value can be: Exchange, SharePoint, OneDriveForBusiness","title":"Workload"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"}},"required":["Name","Policy","Workload"]},"microsoft.securityandcompliance.caseholdpolicy":{"type":"object","description":"This resource configures a eDiscovery Case Policy\r\nin Security and Compliance Center.","title":"Schema for microsoft.securityandcompliance.caseholdpolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the case hold policy.","title":"Name"},"Case":{"type":"string","description":"The Case parameter specifies the eDiscovery case that you want to associate with the case hold policy.","title":"Case"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"Enabled":{"type":"boolean","description":"The Enabled parameter specifies whether the policy is enabled or disabled.","title":"Enabled"},"ExchangeLocation":{"type":"array","items":{"type":"string"},"description":"The ExchangeLocation parameter specifies the mailboxes to include in the policy.","title":"ExchangeLocation"},"PublicFolderLocation":{"type":"array","items":{"type":"string"},"description":"The PublicFolderLocation parameter specifies that you want to include all public folders in the case hold policy. You use the value All for this parameter.","title":"PublicFolderLocation"},"SharePointLocation":{"type":"array","items":{"type":"string"},"description":"The SharePointLocation parameter specifies the SharePoint Online and OneDrive for Business sites to include. You identify a site by its URL value.","title":"SharePointLocation"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this policy should exist or not.","title":"Ensure"}},"required":["Name","Case"]},"microsoft.securityandcompliance.caseholdrule":{"type":"object","description":"This resource configures an eDiscovery Case Hold Rule\r\nin Security and Compliance.","title":"Schema for microsoft.securityandcompliance.caseholdrule","properties":{"Name":{"type":"string","description":"The Name parameter specifies a unique name for the case hold rule.","title":"Name"},"Policy":{"type":"string","description":"The Policy parameter specifies the case hold policy that contains the rule. You can use any value that uniquely identifies the policy.","title":"Policy"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"ContentMatchQuery":{"type":"string","description":"The ContentMatchQuery parameter specifies a content search filter. Use this parameter to create a query-based hold so only the content that matches the specified search query is placed on hold. This parameter uses a text search string or a query that's formatted by using the Keyword Query Language (KQL).","title":"ContentMatchQuery"},"Disabled":{"type":"boolean","description":"The Disabled parameter specifies whether the case hold rule is enabled or disabled.","title":"Disabled"},"Ensure":{"enum":["Present","Absent"],"description":"Present ensures the rule exists, absent ensures it is removed","title":"Ensure"}},"required":["Name","Policy"]},"microsoft.securityandcompliance.compliancecase":{"type":"object","description":"This resource configures an eDiscovery Case in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.compliancecase","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the compliance case.","title":"Name"},"Description":{"type":"string","description":"The description of the case.","title":"Description"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this case should exist or not.","title":"Ensure"},"Status":{"enum":["Active","Closed"],"description":"Status for the case. Can either be 'Active' or 'Closed'","title":"Status"}},"required":["Name"]},"microsoft.securityandcompliance.compliancesearch":{"type":"object","description":"This resource configures an Compliance Search (eDiscovery) in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.compliancesearch","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the complaiance tag.","title":"Name"},"Case":{"type":"string","description":"Compliance Case (eDiscovery) that this Search is associated with","title":"Case"},"AllowNotFoundExchangeLocationsEnabled":{"type":"boolean","description":"The AllowNotFoundExchangeLocationsEnabled parameter specifies whether to include mailboxes other than regular user mailboxes in the compliance search.","title":"AllowNotFoundExchangeLocationsEnabled"},"ContentMatchQuery":{"type":"string","description":"The ContentMatchQuery parameter specifies a content search filter. This parameter uses a text search string or a query that's formatted by using the Keyword Query Language (KQL).","title":"ContentMatchQuery"},"Description":{"type":"string","description":"The Description parameter specifies an optional description for the compliance search. If the value contains spaces, enclose the value in quotation marks.","title":"Description"},"ExchangeLocation":{"type":"array","items":{"type":"string"},"description":"The ExchangeLocation parameter specifies the mailboxes to include.","title":"ExchangeLocation"},"ExchangeLocationExclusion":{"type":"array","items":{"type":"string"},"description":"This parameter specifies the mailboxes to exclude when you use the value All for the ExchangeLocation parameter.","title":"ExchangeLocationExclusion"},"HoldNames":{"type":"array","items":{"type":"string"},"description":"The HoldNames parameter specifies that the content locations that have been placed on hold in the specified eDiscovery case will be searched. You use the value All for this parameter. You also need to specify the name of an eDiscovery case by using the Case parameter.","title":"HoldNames"},"IncludeUserAppContent":{"type":"boolean","description":"The IncludeUserAppContent parameter specifies that you want to search the cloud-based storage location for users who don't have a regular Office 365 user account in your organization. These types of users include users without an Exchange Online license who use Office applications, Office 365 guest users, and on-premises users whose identity is synchronized with your Office 365 organization.","title":"IncludeUserAppContent"},"Language":{"type":"string","description":"The Language parameter specifies the language for the compliance search. Valid input for this parameter is a supported culture code value from the Microsoft .NET Framework CultureInfo class. For example, da-DK for Danish or ja-JP for Japanese.","title":"Language"},"PublicFolderLocation":{"type":"array","items":{"type":"string"},"description":"The PublicFolderLocation parameter specifies that you want to include all public folders in the search. You use the value All for this parameter.","title":"PublicFolderLocation"},"SharePointLocation":{"type":"array","items":{"type":"string"},"description":"The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.","title":"SharePointLocation"},"SharePointLocationExclusion":{"type":"array","items":{"type":"string"},"description":"This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.","title":"SharePointLocationExclusion"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this search should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.securityandcompliance.compliancesearchaction":{"type":"object","description":"This resource configures a Compliance Search Action in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.compliancesearchaction","properties":{"Action":{"enum":["Export","Preview","Purge","Retention"],"description":"The Action parameter specifies what type of action to define. Accepted values are Export, Retention and Purge.","title":"Action"},"SearchName":{"type":"string","description":"The SearchName parameter specifies the name of the existing content search to associate with the content search action. You can specify multiple content searches separated by commas.","title":"SearchName"},"FileTypeExclusionsForUnindexedItems":{"type":"array","items":{"type":"string"},"description":"The FileTypeExclusionsForUnindexedItems specifies the file types to exclude because they can't be indexed. You can specify multiple values separated by commas.","title":"FileTypeExclusionsForUnindexedItems"},"EnableDedupe":{"type":"boolean","description":"The EnableDedupe parameter eliminates duplication of messages when you export content search results.","title":"EnableDedupe"},"IncludeCredential":{"type":"boolean","description":"The IncludeCredential switch specifies whether to include the credential in the results.","title":"IncludeCredential"},"IncludeSharePointDocumentVersions":{"type":"boolean","description":"The IncludeSharePointDocumentVersions parameter specifies whether to export previous versions of the document when you use the Export switch.","title":"IncludeSharePointDocumentVersions"},"PurgeType":{"enum":["SoftDelete","HardDelete"],"description":"The PurgeType parameter specifies how to remove items when the action is Purge.","title":"PurgeType"},"RetryOnError":{"type":"boolean","description":"The RetryOnError switch specifies whether to retry the action on any items that failed without re-running the entire action all over again.","title":"RetryOnError"},"ActionScope":{"enum":["IndexedItemsOnly","UnindexedItemsOnly","BothIndexedAndUnindexedItems"],"description":"The ActionScope parameter specifies the items to include when the action is Export.","title":"ActionScope"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this action should exist or not.","title":"Ensure"}},"required":["Action","SearchName"]},"microsoft.securityandcompliance.compliancetag":{"type":"object","description":"This resource configures a Compliance Tag in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.compliancetag","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the complaiance tag.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"EventType":{"type":"string","description":"The EventType parameter specifies the retention rule that's associated with the label.","title":"EventType"},"IsRecordLabel":{"type":"boolean","description":"The IsRecordLabel parameter specifies whether the label is a record label.","title":"IsRecordLabel"},"Notes":{"type":"string","description":"The Notes parameter specifies an optional note. If you specify a value that contains spaces, enclose the value in quotation marks, for example: 'This is a user note'","title":"Notes"},"Regulatory":{"type":"boolean","description":"Regulatory description","title":"Regulatory"},"FilePlanProperty":{"type":"object","description":"The FilePlanProperty parameter specifies the file plan properties to include in the label.","title":"FilePlanProperty","properties":{"FilePlanPropertyDepartment":{"type":"string","description":"File plan department. Can get list by running Get-FilePlanPropertyDepartment.","title":"FilePlanPropertyDepartment"},"FilePlanPropertyAuthority":{"type":"string","description":"File plan Authority. Can get list by running Get-FilePlanPropertyAuthority.","title":"FilePlanPropertyAuthority"},"FilePlanPropertyCategory":{"type":"string","description":"File plan category. Can get a list by running Get-FilePlanPropertyCategory.","title":"FilePlanPropertyCategory"},"FilePlanPropertyCitation":{"type":"string","description":"File plan citation. Can get a list by running Get-FilePlanPropertyCitation.","title":"FilePlanPropertyCitation"},"FilePlanPropertyReferenceId":{"type":"string","description":"File plan reference id. Can get a list by running Get-FilePlanPropertyReferenceId.","title":"FilePlanPropertyReferenceId"},"FilePlanPropertySubCategory":{"type":"string","description":"File plan subcategory. Can get a list by running Get-FilePlanPropertySubCategory.","title":"FilePlanPropertySubCategory"}},"required":[]},"ReviewerEmail":{"type":"array","items":{"type":"string"},"description":"The ReviewerEmail parameter specifies the email address of a reviewer for Delete and KeepAndDelete retention actions. You can specify multiple email addresses separated by commas.","title":"ReviewerEmail"},"RetentionDuration":{"type":"string","description":"The RetentionDuration parameter specifies the hold duration for the retention rule. Valid values are: An integer - The hold duration in days, Unlimited - The content is held indefinitely.","title":"RetentionDuration"},"RetentionAction":{"enum":["Delete","Keep","KeepAndDelete"],"description":"The RetentionAction parameter specifies the action for the label. Valid values are: Delete, Keep or KeepAndDelete.","title":"RetentionAction"},"RetentionType":{"enum":["CreationAgeInDays","EventAgeInDays","ModificationAgeInDays","TaggedAgeInDays"],"description":"The RetentionType parameter specifies whether the retention duration is calculated from the content creation date, tagged date, or last modification date. Valid values are: CreationAgeInDays, EventAgeInDays,ModificationAgeInDays, or TaggedAgeInDays.","title":"RetentionType"}},"required":["Name"]},"microsoft.securityandcompliance.deviceconditionalaccesspolicy":{"type":"object","description":"This resource configures a Device Conditional Access Policy in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.deviceconditionalaccesspolicy","properties":{"Name":{"type":"string","description":"The name of the Device Conditional Access Policy.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this policy should exist or not.","title":"Ensure"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"Enabled":{"type":"boolean","description":"The Enabled parameter specifies whether the policy is enabled.","title":"Enabled"}},"required":["Name"]},"microsoft.securityandcompliance.deviceconfigurationpolicy":{"type":"object","description":"This resource configures a Device Configuration Policy in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.deviceconfigurationpolicy","properties":{"Name":{"type":"string","description":"The name of the Device Configuration Policy.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this policy should exist or not.","title":"Ensure"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"Enabled":{"type":"boolean","description":"The Enabled parameter specifies whether the policy is enabled.","title":"Enabled"}},"required":["Name"]},"microsoft.securityandcompliance.dlpcompliancepolicy":{"type":"object","description":"This resource configures a Data Loss Prevention Compliance\r\nPolicy in Security and Compliance Center.","title":"Schema for microsoft.securityandcompliance.dlpcompliancepolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the DLP policy. If the value contains spaces, enclose the value in quotation marks.","title":"Name"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"EndpointDlpLocation":{"type":"array","items":{"type":"string"},"description":"The EndpointDLPLocation parameter specifies the user accounts to include in the DLP policy for Endpoint DLP when they are logged on to an onboarded device. You identify the account by name or email address. You can use the value All to include all user accounts.","title":"EndpointDlpLocation"},"EndpointDlpLocationException":{"type":"array","items":{"type":"string"},"description":"The EndpointDlpLocationException parameter specifies the user accounts to exclude from Endpoint DLP when you use the value All for the EndpointDlpLocation parameter. You identify the account by name or email address.","title":"EndpointDlpLocationException"},"OnPremisesScannerDlpLocation":{"type":"array","items":{"type":"string"},"description":"The OnPremisesScannerDlpLocation parameter specifies the on-premises file shares and SharePoint document libraries and folders to include in the DLP policy. You can use the value All to include all on-premises file shares and SharePoint document libraries and folders.","title":"OnPremisesScannerDlpLocation"},"OnPremisesScannerDlpLocationException":{"type":"array","items":{"type":"string"},"description":"The OnPremisesScannerDlpLocationException parameter specifies the on-premises file shares and SharePoint document libraries and folders to exclude from the DLP policy if you use the value All for the OnPremisesScannerDlpLocation parameter.","title":"OnPremisesScannerDlpLocationException"},"PowerBIDlpLocation":{"type":"array","items":{"type":"string"},"description":"The PowerBIDlpLocation parameter specifies the Power BI workspace IDs to include in the DLP policy. Only workspaces hosted in Premium Gen2 capacities are permitted. You can use the value All to include all supported workspaces.","title":"PowerBIDlpLocation"},"PowerBIDlpLocationException":{"type":"array","items":{"type":"string"},"description":"The PowerBIDlpLocationException parameter specifies the Power BI workspace IDs to exclude from the DLP policy when you use the value All for the PowerBIDlpLocation parameter. Only workspaces hosted in Premium Gen2 capacities are permitted.","title":"PowerBIDlpLocationException"},"ThirdPartyAppDlpLocation":{"type":"array","items":{"type":"string"},"description":"The ThirdPartyAppDlpLocation parameter specifies the non-Microsoft cloud apps to include in the DLP policy. You can use the value All to include all connected apps.","title":"ThirdPartyAppDlpLocation"},"ThirdPartyAppDlpLocationException":{"type":"array","items":{"type":"string"},"description":"The ThirdPartyAppDlpLocationException parameter specifies the non-Microsoft cloud apps to exclude from the DLP policy when you use the value All for the ThirdPartyAppDlpLocation parameter.","title":"ThirdPartyAppDlpLocationException"},"ExchangeLocation":{"type":"array","items":{"type":"string"},"description":"The ExchangeLocation parameter specifies Exchange Online mailboxes to include in the DLP policy. You can only use the value All for this parameter to include all mailboxes.","title":"ExchangeLocation"},"ExchangeSenderMemberOf":{"type":"array","items":{"type":"string"},"description":"Exchange members to include.","title":"ExchangeSenderMemberOf"},"ExchangeSenderMemberOfException":{"type":"array","items":{"type":"string"},"description":"Exchange members to exclude.","title":"ExchangeSenderMemberOfException"},"Mode":{"enum":["Enable","TestWithNotifications","TestWithoutNotifications","Disable","PendingDeletion"],"description":"The Mode parameter specifies the action and notification level of the DLP policy. Valid values are: Enable, TestWithNotifications, TestWithoutNotifications, Disable and PendingDeletion.","title":"Mode"},"OneDriveLocation":{"type":"array","items":{"type":"string"},"description":"The OneDriveLocation parameter specifies the OneDrive for Business sites to include. You identify the site by its URL value, or you can use the value All to include all sites.","title":"OneDriveLocation"},"OneDriveLocationException":{"type":"array","items":{"type":"string"},"description":"This parameter specifies the OneDrive for Business sites to exclude when you use the value All for the OneDriveLocation parameter. You identify the site by its URL value.","title":"OneDriveLocationException"},"Priority":{"type":"integer","description":"Priority for the Policy.","title":"Priority"},"SharePointLocation":{"type":"array","items":{"type":"string"},"description":"The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.","title":"SharePointLocation"},"SharePointLocationException":{"type":"array","items":{"type":"string"},"description":"This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.","title":"SharePointLocationException"},"TeamsLocation":{"type":"array","items":{"type":"string"},"description":"Teams locations to include","title":"TeamsLocation"},"TeamsLocationException":{"type":"array","items":{"type":"string"},"description":"Teams locations to exclude.","title":"TeamsLocationException"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this policy should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.securityandcompliance.dlpcompliancerule":{"type":"object","description":"This resource configures a Data Loss Prevention Compliance\r\nRule in Security and Compliance Center.","title":"Schema for microsoft.securityandcompliance.dlpcompliancerule","properties":{"Name":{"type":"string","description":"Name of the Rule.","title":"Name"},"Policy":{"type":"string","description":"Name of the associated DLP Compliance Policy.","title":"Policy"},"AccessScope":{"enum":["InOrganization","NotInOrganization","None"],"description":"The AccessScope parameter specifies a condition for the DLP rule that's based on the access scope of the content. The rule is applied to content that matches the specified access scope.","title":"AccessScope"},"BlockAccess":{"type":"boolean","description":"The BlockAccess parameter specifies an action for the DLP rule that blocks access to the source item when the conditions of the rule are met. $true: Blocks further access to the source item that matched the rule. The owner, author, and site owner can still access the item. $false: Allows access to the source item that matched the rule. This is the default value.","title":"BlockAccess"},"BlockAccessScope":{"enum":["All","PerUser","None"],"description":"The BlockAccessScope parameter specifies the scope of the block access action.","title":"BlockAccessScope"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks.","title":"Comment"},"AdvancedRule":{"type":"string","description":"The AdvancedRule parameter uses complex rule syntax that supports multiple AND, OR, and NOT operators and nested groups","title":"AdvancedRule"},"ContentContainsSensitiveInformation":{"type":"object","description":"The ContentContainsSensitiveInformation parameter specifies a condition for the rule that's based on a sensitive information type match in content. The rule is applied to content that contains the specified sensitive information type.","title":"ContentContainsSensitiveInformation","properties":{"SensitiveInformation":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPSensitiveInformation","properties":{"name":{"type":"string","description":"Name of the Sensitive Information Content","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information Content","title":"id"},"maxconfidence":{"type":"string","description":"Maximum Confidence level value for the Sensitive Information","title":"maxconfidence"},"minconfidence":{"type":"string","description":"Minimum Confidence level value for the Sensitive Information","title":"minconfidence"},"classifiertype":{"type":"string","description":"Type of Classifier value for the Sensitive Information","title":"classifiertype"},"mincount":{"type":"string","description":"Minimum Count value for the Sensitive Information","title":"mincount"},"maxcount":{"type":"string","description":"Maximum Count value for the Sensitive Information","title":"maxcount"}},"required":["name"]},"description":"Sensitive Information Content Types","title":"SensitiveInformation"},"Groups":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPContainsSensitiveInformationGroup","properties":{"SensitiveInformation":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPSensitiveInformation","properties":{"name":{"type":"string","description":"Name of the Sensitive Information Content","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information Content","title":"id"},"maxconfidence":{"type":"string","description":"Maximum Confidence level value for the Sensitive Information","title":"maxconfidence"},"minconfidence":{"type":"string","description":"Minimum Confidence level value for the Sensitive Information","title":"minconfidence"},"classifiertype":{"type":"string","description":"Type of Classifier value for the Sensitive Information","title":"classifiertype"},"mincount":{"type":"string","description":"Minimum Count value for the Sensitive Information","title":"mincount"},"maxcount":{"type":"string","description":"Maximum Count value for the Sensitive Information","title":"maxcount"}},"required":["name"]},"description":"Sensitive Information Content Types","title":"SensitiveInformation"},"Labels":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPLabel","properties":{"name":{"type":"string","description":"Name of the Sensitive Label","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information label","title":"id"},"type":{"type":"string","description":"Type of the Sensitive Information label","title":"type"}},"required":["name"]},"description":"Sensitive Information Labels","title":"Labels"},"Name":{"type":"string","description":"Name of the group","title":"Name"},"Operator":{"enum":["And","Or"],"description":"Operator","title":"Operator"}},"required":["Name","Operator"]},"description":"Groups of sensitive information types.","title":"Groups"},"Operator":{"enum":["And","Or"],"description":"Operator","title":"Operator"}},"required":[]},"ExceptIfContentContainsSensitiveInformation":{"type":"object","description":"The ExceptIfContentContainsSensitiveInformation parameter specifies an exception for the rule that's based on a sensitive information type match in content. The rule isn't applied to content that contains the specified sensitive information type.","title":"ExceptIfContentContainsSensitiveInformation","properties":{"SensitiveInformation":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPSensitiveInformation","properties":{"name":{"type":"string","description":"Name of the Sensitive Information Content","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information Content","title":"id"},"maxconfidence":{"type":"string","description":"Maximum Confidence level value for the Sensitive Information","title":"maxconfidence"},"minconfidence":{"type":"string","description":"Minimum Confidence level value for the Sensitive Information","title":"minconfidence"},"classifiertype":{"type":"string","description":"Type of Classifier value for the Sensitive Information","title":"classifiertype"},"mincount":{"type":"string","description":"Minimum Count value for the Sensitive Information","title":"mincount"},"maxcount":{"type":"string","description":"Maximum Count value for the Sensitive Information","title":"maxcount"}},"required":["name"]},"description":"Sensitive Information Content Types","title":"SensitiveInformation"},"Groups":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPContainsSensitiveInformationGroup","properties":{"SensitiveInformation":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPSensitiveInformation","properties":{"name":{"type":"string","description":"Name of the Sensitive Information Content","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information Content","title":"id"},"maxconfidence":{"type":"string","description":"Maximum Confidence level value for the Sensitive Information","title":"maxconfidence"},"minconfidence":{"type":"string","description":"Minimum Confidence level value for the Sensitive Information","title":"minconfidence"},"classifiertype":{"type":"string","description":"Type of Classifier value for the Sensitive Information","title":"classifiertype"},"mincount":{"type":"string","description":"Minimum Count value for the Sensitive Information","title":"mincount"},"maxcount":{"type":"string","description":"Maximum Count value for the Sensitive Information","title":"maxcount"}},"required":["name"]},"description":"Sensitive Information Content Types","title":"SensitiveInformation"},"Labels":{"type":"array","items":{"type":"object","description":"This resource configures a Auto Sensitivity Label\r\nRule in Security and Compliance Center.","title":"Schema for MSFT_SCDLPLabel","properties":{"name":{"type":"string","description":"Name of the Sensitive Label","title":"name"},"id":{"type":"string","description":"Id of the Sensitive Information label","title":"id"},"type":{"type":"string","description":"Type of the Sensitive Information label","title":"type"}},"required":["name"]},"description":"Sensitive Information Labels","title":"Labels"},"Name":{"type":"string","description":"Name of the group","title":"Name"},"Operator":{"enum":["And","Or"],"description":"Operator","title":"Operator"}},"required":["Name","Operator"]},"description":"Groups of sensitive information types.","title":"Groups"},"Operator":{"enum":["And","Or"],"description":"Operator","title":"Operator"}},"required":[]},"ContentPropertyContainsWords":{"type":"array","items":{"type":"string"},"description":"The ContentPropertyContainsWords parameter specifies a condition for the DLP rule that's based on a property match in content. The rule is applied to content that contains the specified property.","title":"ContentPropertyContainsWords"},"Disabled":{"type":"boolean","description":"The Disabled parameter specifies whether the DLP rule is disabled.","title":"Disabled"},"GenerateAlert":{"type":"array","items":{"type":"string"},"description":"The GenerateAlert parameter specifies an action for the DLP rule that notifies the specified users when the conditions of the rule are met.","title":"GenerateAlert"},"GenerateIncidentReport":{"type":"array","items":{"type":"string"},"description":"The GenerateIncidentReport parameter specifies an action for the DLP rule that sends an incident report to the specified users when the conditions of the rule are met.","title":"GenerateIncidentReport"},"IncidentReportContent":{"type":"array","items":{"enum":["All","Default","DetectionDetails","Detections","DocumentAuthor","DocumentLastModifier","MatchedItem","OriginalContent","RulesMatched","Service","Severity","Title","RetentionLabel","SensitivityLabel"]},"description":"The IncidentReportContent parameter specifies the content to include in the report when you use the GenerateIncidentReport parameter.","title":"IncidentReportContent"},"NotifyAllowOverride":{"type":"array","items":{"enum":["FalsePositive","WithoutJustification","WithJustification"]},"description":"The NotifyAllowOverride parameter specifies the notification override options when the conditions of the rule are met.","title":"NotifyAllowOverride"},"NotifyEmailCustomText":{"type":"string","description":"The NotifyEmailCustomText parameter specifies the custom text in the email notification message that's sent to recipients when the conditions of the rule are met.","title":"NotifyEmailCustomText"},"NotifyPolicyTipCustomText":{"type":"string","description":"The NotifyPolicyTipCustomText parameter specifies the custom text in the Policy Tip notification message that's shown to recipients when the conditions of the rule are met. The maximum length is 256 characters. HTML tags and tokens (variables) aren't supported.","title":"NotifyPolicyTipCustomText"},"NotifyUser":{"type":"array","items":{"type":"string"},"description":"The NotifyUser parameter specifies an action for the DLP rule that notifies the specified users when the conditions of the rule are met.","title":"NotifyUser"},"ReportSeverityLevel":{"enum":["Low","Medium","High","None"],"description":"The ReportSeverityLevel parameter specifies the severity level of the incident report for content detections based on the rule.","title":"ReportSeverityLevel"},"RuleErrorAction":{"enum":["Ignore","RetryThenBlock"],"description":"The RuleErrorAction parameter specifies what to do if an error is encountered during the evaluation of the rule.","title":"RuleErrorAction"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"},"AnyOfRecipientAddressContainsWords":{"type":"array","items":{"type":"string"},"description":"The AnyOfRecipientAddressContainsWords parameter specifies a condition for the DLP rule that looks for words or phrases in recipient email addresses.","title":"AnyOfRecipientAddressContainsWords"},"AnyOfRecipientAddressMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The AnyOfRecipientAddressMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in recipient email addresses by using regular expressions.","title":"AnyOfRecipientAddressMatchesPatterns"},"RemoveRMSTemplate":{"type":"boolean","description":"The RemoveRMSTemplate parameter specifies an action for the DLP rule that removes Office 365 Message Encryption from messages and their attachments.","title":"RemoveRMSTemplate"},"StopPolicyProcessing":{"type":"boolean","description":"The StopPolicyProcessing parameter specifies an action that stops processing more DLP policy rules.","title":"StopPolicyProcessing"},"DocumentIsUnsupported":{"type":"boolean","description":"The DocumentIsUnsupported parameter specifies a condition for the DLP rule that looks for files that can't be scanned.","title":"DocumentIsUnsupported"},"ExceptIfDocumentIsUnsupported":{"type":"boolean","description":"The ExceptIfDocumentIsUnsupported parameter specifies an exception for the DLP rule that looks for files that can't be scanned.","title":"ExceptIfDocumentIsUnsupported"},"HasSenderOverride":{"type":"boolean","description":"The SenderOverride parameter specifies a condition for the rule that looks for messages where the sender chose to override a DLP policy.","title":"HasSenderOverride"},"ExceptIfHasSenderOverride":{"type":"boolean","description":"The ExceptIfHasSenderOverride parameter specifies an exception for the rule that looks for messages where the sender chose to override a DLP policy.","title":"ExceptIfHasSenderOverride"},"ProcessingLimitExceeded":{"type":"boolean","description":"The ProcessingLimitExceeded parameter specifies a condition for the DLP rule that looks for files where scanning couldn't complete.","title":"ProcessingLimitExceeded"},"ExceptIfProcessingLimitExceeded":{"type":"boolean","description":"The ExceptIfProcessingLimitExceeded parameter specifies an exception for the DLP rule that looks for files where scanning couldn't complete.","title":"ExceptIfProcessingLimitExceeded"},"DocumentIsPasswordProtected":{"type":"boolean","description":"The DocumentIsPasswordProtected parameter specifies a condition for the DLP rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files.","title":"DocumentIsPasswordProtected"},"ExceptIfDocumentIsPasswordProtected":{"type":"boolean","description":"The ExceptIfDocumentIsPasswordProtected parameter specifies an exception for the DLP rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files. ","title":"ExceptIfDocumentIsPasswordProtected"},"MessageTypeMatches":{"type":"array","items":{"type":"string"},"description":"The MessageTypeMatches parameter specifies a condition for the DLP rule that looks for types of SMIME message patterns.","title":"MessageTypeMatches"},"FromScope":{"type":"array","items":{"type":"string"},"description":"The FromScope parameter specifies whether messages from inside or outside the organisation are in scope for the DLP rule.","title":"FromScope"},"ExceptIfFromScope":{"type":"array","items":{"type":"string"},"description":"The ExceptIfFromScope parameter specifies whether messages from inside or outside the organisation are in scope for the DLP rule.","title":"ExceptIfFromScope"},"SubjectContainsWords":{"type":"array","items":{"type":"string"},"description":"The SubjectContainsWords parameter specifies a condition for the DLP rule that looks for words or phrases in the Subject field of messages. You can specify multiple words or phrases separated by commas.","title":"SubjectContainsWords"},"SubjectMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The SubjectMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in the Subject field of messages by using regular expressions.","title":"SubjectMatchesPatterns"},"SubjectOrBodyContainsWords":{"type":"array","items":{"type":"string"},"description":"The SubjectOrBodyContainsWords parameter specifies a condition for the rule that looks for words in the Subject field or body of messages.","title":"SubjectOrBodyContainsWords"},"SubjectOrBodyMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The SubjectOrBodyMatchesPatterns parameter specifies a condition for the rule that looks for text patterns in the Subject field or body of messages.","title":"SubjectOrBodyMatchesPatterns"},"ContentCharacterSetContainsWords":{"type":"array","items":{"type":"string"},"description":"The ContentCharacterSetContainsWords parameter specifies a condition for the rule that looks for character set names in messages. You can specify multiple values separated by commas.","title":"ContentCharacterSetContainsWords"},"DocumentNameMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The DocumentNameMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in the name of message attachments by using regular expressions.","title":"DocumentNameMatchesPatterns"},"DocumentNameMatchesWords":{"type":"array","items":{"type":"string"},"description":"The DocumentNameMatchesWords parameter specifies a condition for the DLP rule that looks for words or phrases in the name of message attachments. ","title":"DocumentNameMatchesWords"},"ExceptIfAnyOfRecipientAddressContainsWords":{"type":"array","items":{"type":"string"},"description":"he ExceptIfAnyOfRecipientAddressContainsWords parameter specifies an exception for the DLP rule that looks for words or phrases in recipient email addresses.","title":"ExceptIfAnyOfRecipientAddressContainsWords"},"ExceptIfAnyOfRecipientAddressMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfAnyOfRecipientAddressMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in recipient email addresses by using regular expressions.","title":"ExceptIfAnyOfRecipientAddressMatchesPatterns"},"ExceptIfContentCharacterSetContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfContentCharacterSetContainsWords parameter specifies an exception for the rule that looks for character set names in messages.","title":"ExceptIfContentCharacterSetContainsWords"},"ExceptIfContentPropertyContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfContentPropertyContainsWords parameter specifies an exception for the DLP rule that's based on a property match in content.","title":"ExceptIfContentPropertyContainsWords"},"ExceptIfDocumentNameMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfDocumentNameMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in the name of message attachments by using regular expressions.","title":"ExceptIfDocumentNameMatchesPatterns"},"ExceptIfDocumentNameMatchesWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfDocumentNameMatchesWords parameter specifies an exception for the DLP rule that looks for words or phrases in the name of message attachments.","title":"ExceptIfDocumentNameMatchesWords"},"ExceptIfFromAddressContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfFromAddressContainsWords parameter specifies an exception for the DLP rule that looks for words or phrases in the sender's email address.","title":"ExceptIfFromAddressContainsWords"},"ExceptIfFromAddressMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfFromAddressMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in the sender's email address by using regular expressions.","title":"ExceptIfFromAddressMatchesPatterns"},"FromAddressContainsWords":{"type":"array","items":{"type":"string"},"description":"The FromAddressContainsWords parameter specifies a condition for the DLP rule that looks for words or phrases in the sender's email address.","title":"FromAddressContainsWords"},"FromAddressMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The FromAddressMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in the sender's email address by using regular expressions. ","title":"FromAddressMatchesPatterns"},"ExceptIfMessageTypeMatches":{"type":"array","items":{"type":"string"},"description":"The ExceptIfMessageTypeMatches parameter specifies an exception for the rule that looks for messages of the specified type.","title":"ExceptIfMessageTypeMatches"},"RecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The RecipientDomainIs parameter specifies a condition for the DLP rule that looks for recipients with email addresses in the specified domains.","title":"RecipientDomainIs"},"ExceptIfRecipientDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfRecipientDomainIs parameter specifies an exception for the DLP rule that looks for recipients with email addresses in the specified domains.","title":"ExceptIfRecipientDomainIs"},"ExceptIfSenderDomainIs":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSenderDomainIs parameter specifies an exception for the DLP rule that looks for messages from senders with email address in the specified domains. ","title":"ExceptIfSenderDomainIs"},"ExceptIfSenderIPRanges":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSenderIpRanges parameter specifies an exception for the DLP rule that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.","title":"ExceptIfSenderIPRanges"},"ExceptIfSentTo":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSentTo parameter specifies an exception for the DLP rule that looks for recipients in messages. You identify the recipients by email address.","title":"ExceptIfSentTo"},"ExceptIfSubjectContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSubjectContainsWords parameter specifies an exception for the DLP rule that looks for words or phrases in the Subject field of messages.","title":"ExceptIfSubjectContainsWords"},"ExceptIfSubjectMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSubjectMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in the Subject field of messages by using regular expressions.","title":"ExceptIfSubjectMatchesPatterns"},"ExceptIfSubjectOrBodyContainsWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSubjectOrBodyContainsWords parameter specifies an exception for the rule that looks for words in the Subject field or body of messages.","title":"ExceptIfSubjectOrBodyContainsWords"},"ExceptIfSubjectOrBodyMatchesPatterns":{"type":"array","items":{"type":"string"},"description":"The ExceptIfSubjectOrBodyMatchesPatterns parameter specifies an exception for the rule that looks for text patterns in the Subject field or body of messages.","title":"ExceptIfSubjectOrBodyMatchesPatterns"},"DocumentContainsWords":{"type":"array","items":{"type":"string"},"description":"The DocumentContainsWords parameter specifies a condition for the DLP rule that looks for words in message attachments. Only supported attachment types are checked.","title":"DocumentContainsWords"},"SentToMemberOf":{"type":"array","items":{"type":"string"},"description":"The SentToMemberOf parameter specifies a condition for the DLP rule that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups.","title":"SentToMemberOf"},"ContentIsNotLabeled":{"type":"boolean","description":"The ContentIsNotLabeled parameter specifies if the content is labeled. A True or False condition.","title":"ContentIsNotLabeled"},"SetHeader":{"type":"array","items":{"type":"string"},"description":"The SetHeader The SetHeader parameter specifies an action for the DLP rule that adds or modifies a header field and value in the message header. You can specify multiple header name and value pairs separated by commas","title":"SetHeader"},"ContentExtensionMatchesWords":{"type":"array","items":{"type":"string"},"description":"The ContentExtensionMatchesWords parameter specifies a condition for the DLP rule that looks for words in file name extensions. You can specify multiple words separated by commas.","title":"ContentExtensionMatchesWords"},"ExceptIfContentExtensionMatchesWords":{"type":"array","items":{"type":"string"},"description":"The ExceptIfContentExtensionMatchesWords parameter specifies an exception for the DLP rule that looks for words in file name extensions. You can specify multiple words separated by commas.","title":"ExceptIfContentExtensionMatchesWords"}},"required":["Name","Policy"]},"microsoft.securityandcompliance.fileplanpropertyauthority":{"type":"object","description":"This resource configures an authority entry for Security and\r\nCompliance File Plans.","title":"Schema for microsoft.securityandcompliance.fileplanpropertyauthority","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the Authority.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this authority should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.securityandcompliance.fileplanpropertycategory":{"type":"object","description":"This resource configures a category entry for Security and\r\nCompliance File Plans.","title":"Schema for microsoft.securityandcompliance.fileplanpropertycategory","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the category.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this category should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.securityandcompliance.fileplanpropertycitation":{"type":"object","description":"This resource configures a citation entry for Security and\r\nCompliance File Plans.","title":"Schema for microsoft.securityandcompliance.fileplanpropertycitation","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the citation.","title":"Name"},"CitationUrl":{"type":"string","description":"URL of the citation.","title":"CitationUrl"},"CitationJurisdiction":{"type":"string","description":"Jurisdiction of the citation.","title":"CitationJurisdiction"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this citation should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.securityandcompliance.fileplanpropertydepartment":{"type":"object","description":"This resource configures a department entry for Security and\r\nCompliance File Plans.","title":"Schema for microsoft.securityandcompliance.fileplanpropertydepartment","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the department.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this department should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.securityandcompliance.fileplanpropertyreferenceid":{"type":"object","description":"This resource configures a reference ID entry for Security and\r\nCompliance File Plans.","title":"Schema for microsoft.securityandcompliance.fileplanpropertyreferenceid","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the reference id.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this reference id should exist or not.","title":"Ensure"}},"required":["Name"]},"microsoft.securityandcompliance.fileplanpropertysubcategory":{"type":"object","description":"This resource configures a sub-category entry for Security and\r\nCompliance File Plans.","title":"Schema for microsoft.securityandcompliance.fileplanpropertysubcategory","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the sub-category.","title":"Name"},"Category":{"type":"string","description":"The Category parameter specifies the name of the parent category associated with the sub-category.","title":"Category"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this category should exist or not.","title":"Ensure"}},"required":["Name","Category"]},"microsoft.securityandcompliance.labelpolicy":{"type":"object","description":"This resource configures a Sensitivity label policy in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.labelpolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name for the sensitivity label. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this label policy should exist or not.","title":"Ensure"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"AdvancedSettings":{"type":"array","items":{"type":"object","description":"This resource configures a Sensitivity label policy in Security and Compliance.","title":"Schema for MSFT_SCLabelSetting","properties":{"Key":{"type":"string","description":"Advanced settings key.","title":"Key"},"Value":{"type":"array","items":{"type":"string"},"description":"Advanced settings value.","title":"Value"}},"required":[]},"description":"The AdvancedSettings parameter enables client-specific features and capabilities on the sensitivity label. The settings that you configure with this parameter only affect apps that are designed for the setting.","title":"AdvancedSettings"},"ExchangeLocation":{"type":"array","items":{"type":"string"},"description":"The ExchangeLocation parameter specifies the mailboxes to include in the policy.","title":"ExchangeLocation"},"ExchangeLocationException":{"type":"array","items":{"type":"string"},"description":"The ExchangeLocationException parameter specifies the mailboxes to exclude when you use the value All for the ExchangeLocation parameter.","title":"ExchangeLocationException"},"ModernGroupLocation":{"type":"array","items":{"type":"string"},"description":"The ModernGroupLocation parameter specifies the Microsoft 365 Groups to include in the policy.","title":"ModernGroupLocation"},"ModernGroupLocationException":{"type":"array","items":{"type":"string"},"description":"The ModernGroupLocationException parameter specifies the Microsoft 365 Groups to exclude when you're using the value All for the ModernGroupLocation parameter.","title":"ModernGroupLocationException"},"Labels":{"type":"array","items":{"type":"string"},"description":"The Labels parameter specifies the sensitivity labels that are associated with the policy. You can use any value that uniquely identifies the label.","title":"Labels"},"AddExchangeLocation":{"type":"array","items":{"type":"string"},"description":"The AddExchangeLocation parameter specifies the mailboxes to add in the existing policy.","title":"AddExchangeLocation"},"AddExchangeLocationException":{"type":"array","items":{"type":"string"},"description":"The AddExchangeLocationException parameter specifies the mailboxes to add to exclusions when you use the value All for the ExchangeLocation parameter.","title":"AddExchangeLocationException"},"AddModernGroupLocation":{"type":"array","items":{"type":"string"},"description":"The AddModernGroupLocation parameter specifies the Microsoft 365 Groups to add to include the policy.","title":"AddModernGroupLocation"},"AddModernGroupLocationException":{"type":"array","items":{"type":"string"},"description":"The AddModernGroupLocationException parameter specifies the Microsoft 365 Groups to add to exclusions when you're using the value All for the ModernGroupLocation parameter.","title":"AddModernGroupLocationException"},"AddLabels":{"type":"array","items":{"type":"string"},"description":"The AddLabels parameter specifies the sensitivity labels to add to the policy. You can use any value that uniquely identifies the label.","title":"AddLabels"},"RemoveExchangeLocation":{"type":"array","items":{"type":"string"},"description":"The RemoveExchangeLocation parameter specifies the mailboxes to remove from the policy.","title":"RemoveExchangeLocation"},"RemoveExchangeLocationException":{"type":"array","items":{"type":"string"},"description":"The RemoveExchangeLocationException parameter specifies the mailboxes to remove when you use the value All for the ExchangeLocation parameter.","title":"RemoveExchangeLocationException"},"RemoveModernGroupLocation":{"type":"array","items":{"type":"string"},"description":"The RemoveModernGroupLocation parameter specifies the Microsoft 365 Groups to remove from the policy.","title":"RemoveModernGroupLocation"},"RemoveModernGroupLocationException":{"type":"array","items":{"type":"string"},"description":"The RemoveModernGroupLocationException parameter specifies the Microsoft 365 Groups to remove from excluded values when you're using the value All for the ModernGroupLocation parameter.","title":"RemoveModernGroupLocationException"},"RemoveLabels":{"type":"array","items":{"type":"string"},"description":"The RemoveLabels parameter specifies the sensitivity labels that are removed from the policy. You can use any value that uniquely identifies the label.","title":"RemoveLabels"}},"required":["Name"]},"microsoft.securityandcompliance.protectionalert":{"type":"object","description":"This resource configures a Protection Alert\r\nin Security and Compliance Center.","title":"Schema for microsoft.securityandcompliance.protectionalert","properties":{"AlertBy":{"type":"array","items":{"type":"string"},"description":"Specifies the scope for aggregated alert policies","title":"AlertBy"},"AlertFor":{"type":"array","items":{"type":"string"},"description":"This parameter is reserved for internal Microsoft use","title":"AlertFor"},"AggregationType":{"enum":["None","SimpleAggregation","AnomalousAggregation","CustomAggregation"],"description":"Specifies how the alert policy triggers alerts for multiple occurrences of monitored activity","title":"AggregationType"},"Category":{"type":"string","description":"Specifies a category for the alert policy","title":"Category"},"Comment":{"type":"string","description":"Specifies an optional comment","title":"Comment"},"Disabled":{"type":"boolean","description":"Enables or disables the alert policy","title":"Disabled"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this alert should exist or not.","title":"Ensure"},"Filter":{"type":"string","description":"The Filter parameter uses OPATH syntax to filter the results by the specified properties and values","title":"Filter"},"Name":{"type":"string","description":"Specifies the unique name for the alert policy","title":"Name"},"NotificationCulture":{"type":"string","description":"Specifies the language or locale that's used for notifications. For example, da-DK for Danish","title":"NotificationCulture"},"NotificationEnabled":{"type":"boolean","description":"NotificationEnabled true or false","title":"NotificationEnabled"},"NotifyUserOnFilterMatch":{"type":"boolean","description":"Specifies whether to trigger an alert for a single event when the alert policy is configured for aggregated activity","title":"NotifyUserOnFilterMatch"},"NotifyUserSuppressionExpiryDate":{"type":"string","description":"Specifies whether to temporarily suspend notifications for the alert policy. Until the specified date-time, no notifications are sent for detected activities.","title":"NotifyUserSuppressionExpiryDate"},"NotifyUserThrottleThreshold":{"type":"integer","description":"Specifies the maximum number of notifications for the alert policy within the time period specified by the NotifyUserThrottleWindow parameter. Once the maximum number of notifications has been reached in the time period, no more notifications are sent for the alert.","title":"NotifyUserThrottleThreshold"},"NotifyUserThrottleWindow":{"type":"integer","description":"Specifies the time interval in minutes that's used by the NotifyUserThrottleThreshold parameter","title":"NotifyUserThrottleWindow"},"NotifyUser":{"type":"array","items":{"type":"string"},"description":"Specifies the SMTP address of the user who receives notification messages for the alert policy. You can specify multiple values separated by commas","title":"NotifyUser"},"Operation":{"type":"array","items":{"type":"string"},"description":"Specifies the activities that are monitored by the alert policy","title":"Operation"},"PrivacyManagementScopedSensitiveInformationTypes":{"type":"array","items":{"type":"string"},"description":"PrivacyManagementScopedSensitiveInformationTypes","title":"PrivacyManagementScopedSensitiveInformationTypes"},"PrivacyManagementScopedSensitiveInformationTypesForCounting":{"type":"array","items":{"type":"string"},"description":"PrivacyManagementScopedSensitiveInformationTypesForCounting","title":"PrivacyManagementScopedSensitiveInformationTypesForCounting"},"PrivacyManagementScopedSensitiveInformationTypesThreshold":{"type":"integer","description":"PrivacyManagementScopedSensitiveInformationTypesThreshold","title":"PrivacyManagementScopedSensitiveInformationTypesThreshold"},"Severity":{"enum":["Low","Medium","High","Informational"],"description":"specifies the severity of the detection","title":"Severity"},"ThreatType":{"enum":["Activity","Malware","Phish","Malicious","MaliciousUrlClick","MailFlow"],"description":"Specifies the type of activities that are monitored by the alert policy","title":"ThreatType"},"Threshold":{"type":"integer","description":"Specifies the number of detections that trigger the alert policy within the time period specified by the TimeWindow parameter. A valid value is an integer that's greater than or equal to 3.","title":"Threshold"},"TimeWindow":{"type":"integer","description":"Specifies the time interval in minutes for number of detections specified by the Threshold parameter. A valid value is an integer that's greater than 60 (one hour).","title":"TimeWindow"},"VolumeThreshold":{"type":"integer","description":"Volume Threshold","title":"VolumeThreshold"}},"required":["Name"]},"microsoft.securityandcompliance.retentioncompliancepolicy":{"type":"object","description":"This resource configures a Retention Compliance Policy in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.retentioncompliancepolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the retention policy.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this policy should exist or not.","title":"Ensure"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"DynamicScopeLocation":{"type":"array","items":{"type":"string"},"description":"Location of the dynamic scope for this policy.","title":"DynamicScopeLocation"},"Enabled":{"type":"boolean","description":"Determines if the policy is enabled or not.","title":"Enabled"},"ExchangeLocation":{"type":"array","items":{"type":"string"},"description":"The ExchangeLocation parameter specifies the mailboxes to include.","title":"ExchangeLocation"},"ExchangeLocationException":{"type":"array","items":{"type":"string"},"description":"This parameter specifies the mailboxes to remove from the list of excluded mailboxes when you use the value All for the ExchangeLocation parameter","title":"ExchangeLocationException"},"ModernGroupLocation":{"type":"array","items":{"type":"string"},"description":"The ModernGroupLocation parameter specifies the Office 365 groups to include in the policy.","title":"ModernGroupLocation"},"ModernGroupLocationException":{"type":"array","items":{"type":"string"},"description":"The ModernGroupLocationException parameter specifies the Office 365 groups to exclude when you're using the value All for the ModernGroupLocation parameter.","title":"ModernGroupLocationException"},"OneDriveLocation":{"type":"array","items":{"type":"string"},"description":"The OneDriveLocation parameter specifies the OneDrive for Business sites to include. You identify the site by its URL value, or you can use the value All to include all sites.","title":"OneDriveLocation"},"OneDriveLocationException":{"type":"array","items":{"type":"string"},"description":"This parameter specifies the OneDrive for Business sites to exclude when you use the value All for the OneDriveLocation parameter. You identify the site by its URL value.","title":"OneDriveLocationException"},"PublicFolderLocation":{"type":"array","items":{"type":"string"},"description":"The PublicFolderLocation parameter specifies that you want to include all public folders in the retention policy. You use the value All for this parameter.","title":"PublicFolderLocation"},"RestrictiveRetention":{"type":"boolean","description":"The RestrictiveRetention parameter specifies whether Preservation Lock is enabled for the policy.","title":"RestrictiveRetention"},"SharePointLocation":{"type":"array","items":{"type":"string"},"description":"The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.","title":"SharePointLocation"},"SharePointLocationException":{"type":"array","items":{"type":"string"},"description":"This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.","title":"SharePointLocationException"},"SkypeLocation":{"type":"array","items":{"type":"string"},"description":"The SkypeLocation parameter specifies the Skype for Business Online users to include in the policy.","title":"SkypeLocation"},"SkypeLocationException":{"type":"array","items":{"type":"string"},"description":"This parameter is reserved for internal Microsoft use.","title":"SkypeLocationException"},"TeamsChannelLocation":{"type":"array","items":{"type":"string"},"description":"The TeamsChannelLocation parameter specifies the Teams Channel to include in the policy.","title":"TeamsChannelLocation"},"TeamsChannelLocationException":{"type":"array","items":{"type":"string"},"description":"This parameter specifies the SharePoint Online sites to exclude when you use the value All for the TeamsChannelLocation parameter. You identify the site by its URL value.","title":"TeamsChannelLocationException"},"TeamsChatLocation":{"type":"array","items":{"type":"string"},"description":"The TeamsChatLocation parameter specifies the Teams Chat to include in the policy.","title":"TeamsChatLocation"},"TeamsChatLocationException":{"type":"array","items":{"type":"string"},"description":"This parameter specifies the SharePoint Online sites to exclude when you use the value All for the TeamsChatLocation parameter. You identify the site by its URL value.","title":"TeamsChatLocationException"}},"required":["Name"]},"microsoft.securityandcompliance.retentioncompliancerule":{"type":"object","description":"This resource configures a Retention Compliance Rule in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.retentioncompliancerule","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the retention rule.","title":"Name"},"Policy":{"type":"string","description":"The Policy parameter specifies the policy to contain the rule.","title":"Policy"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"ExpirationDateOption":{"enum":["CreationAgeInDays","ModificationAgeInDays"],"description":"The ExpirationDateOption parameter specifies whether the expiration date is calculated from the content creation date or last modification date. Valid values are: CreationAgeInDays and ModificationAgeInDays.","title":"ExpirationDateOption"},"ExcludedItemClasses":{"type":"array","items":{"type":"string"},"description":"The ExcludedItemClasses parameter specifies the types of messages to exclude from the rule. You can use this parameter only to exclude items from a hold policy, which excludes the specified item class from being held. Using this parameter won't exclude items from deletion policies. Typically, you use this parameter to exclude voicemail messages, IM conversations, and other Skype for Business Online content from being held by a hold policy.","title":"ExcludedItemClasses"},"ContentMatchQuery":{"type":"string","description":"The ContentMatchQuery parameter specifies a content search filter.","title":"ContentMatchQuery"},"RetentionComplianceAction":{"enum":["Delete","Keep","KeepAndDelete"],"description":"The RetentionComplianceAction parameter specifies the retention action for the rule. Valid values are: Delete, Keep and KeepAndDelete.","title":"RetentionComplianceAction"},"RetentionDuration":{"type":"string","description":"The RetentionDuration parameter specifies the hold duration for the retention rule. Valid values are: An integer - The hold duration in days, Unlimited - The content is held indefinitely.","title":"RetentionDuration"},"RetentionDurationDisplayHint":{"enum":["Days","Months","Years"],"description":"The RetentionDurationDisplayHint parameter specifies the units that are used to display the retention duration in the Security and Compliance Center. Valid values are: Days, Months or Years.","title":"RetentionDurationDisplayHint"}},"required":["Name","Policy"]},"microsoft.securityandcompliance.retentioneventtype":{"type":"object","description":"This resource configures a Retention Event Type in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.retentioneventtype","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name of the retention event type.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"}},"required":["Name"]},"microsoft.securityandcompliance.securityfilter":{"type":"object","description":"This resource configures a Security Filter in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.securityfilter","properties":{"FilterName":{"type":"string","description":"The FilterName parameter specifies the name of the compliance security filter that you want to view. If the value contains spaces, enclose the value in quotation marks (\\\").","title":"FilterName"},"Action":{"enum":["Export","Preview","Purge","Search","All"],"description":"The Action parameter filters the results by the type of search action that a filter is applied to. ","title":"Action"},"Users":{"type":"array","items":{"type":"string"},"description":"The User parameter filters the results by the user who gets a filter applied to their searches. Acceptable values are : The alias or email address of a user, All or The name of a role group","title":"Users"},"Description":{"type":"string","description":"The Description parameter specifies a description for the compliance security filter. The maximum length is 256 characters. If the value contains spaces, enclose the value in quotation marks (\\\").","title":"Description"},"Filters":{"type":"array","items":{"type":"string"},"description":"The Filters parameter specifies the search criteria for the compliance security filter. The filters are applied to the users specified by the Users parameter. You can create three different types of filters: Mailbox filter, Mailbox content filter or Site and site content filter","title":"Filters"},"Region":{"enum":["APC","AUS","CAN","EUR","FRA","GBR","IND","JPN","LAM","NAM",""],"description":"The Region parameter specifies the satellite location for multi-geo tenants to conduct eDiscovery searches in.","title":"Region"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this label policy should exist or not.","title":"Ensure"}},"required":["FilterName"]},"microsoft.securityandcompliance.sensitivitylabel":{"type":"object","description":"This resource configures Sensitivity labels in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.sensitivitylabel","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name for the sensitivity label. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.","title":"Name"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment.","title":"Comment"},"AdvancedSettings":{"type":"array","items":{"type":"object","description":"This resource configures a Sensitivity label policy in Security and Compliance.","title":"Schema for MSFT_SCLabelSetting","properties":{"Key":{"type":"string","description":"Advanced settings key.","title":"Key"},"Value":{"type":"array","items":{"type":"string"},"description":"Advanced settings value.","title":"Value"}},"required":[]},"description":"The AdvancedSettings parameter enables client-specific features and capabilities on the sensitivity label. The settings that you configure with this parameter only affect apps that are designed for the setting.","title":"AdvancedSettings"},"DisplayName":{"type":"string","description":"The DisplayName parameter specifies the display name for the sensitivity label. The display name appears in the Microsoft Office and is used by Outlook users to select the appropriate sensitivity label before they send a message.","title":"DisplayName"},"LocaleSettings":{"type":"array","items":{"type":"object","description":"This resource configures Sensitivity labels in Security and Compliance.","title":"Schema for MSFT_SCLabelLocaleSettings","properties":{"localeKey":{"type":"string","description":"Name of the Local key.","title":"localeKey"},"LabelSettings":{"type":"array","items":{"type":"object","description":"This resource configures a Sensitivity label policy in Security and Compliance.","title":"Schema for MSFT_SCLabelSetting","properties":{"Key":{"type":"string","description":"Advanced settings key.","title":"Key"},"Value":{"type":"array","items":{"type":"string"},"description":"Advanced settings value.","title":"Value"}},"required":[]},"description":"The locale settings display names.","title":"LabelSettings"}},"required":[]},"description":"The LocaleSettings parameter specifies one or more localized label name or label Tooltips in different languages. Regions include all region codes supported in Office Client applications.","title":"LocaleSettings"},"ParentId":{"type":"string","description":"The ParentId parameter specifies the parent label that you want this label to be under (a sublabel). You can use any value that uniquely identifies the parent sensitivity label for example name.","title":"ParentId"},"Priority":{"type":"integer","description":"The Priority parameter specifies a priority value for the sensitivity label that determines the order of label processing. A lower integer value indicates a higher priority.","title":"Priority"},"Tooltip":{"type":"string","description":"The ToolTip parameter specifies the default tooltip and sensitivity label description that's seen by users. It the value contains spaces, enclose the value in quotation marks.","title":"Tooltip"},"ApplyContentMarkingFooterAlignment":{"enum":["Left","Center","Right"],"description":"The ApplyContentMarkingFooterAlignment parameter specifies the footer alignment.","title":"ApplyContentMarkingFooterAlignment"},"ApplyContentMarkingFooterEnabled":{"type":"boolean","description":"The ApplyContentMarkingFooterEnabled parameter specifies whether to enable or disable the sensitivity label.","title":"ApplyContentMarkingFooterEnabled"},"ApplyContentMarkingFooterFontColor":{"type":"string","description":"The ApplyContentMarkingFooterFontColor parameter specifies the color of the footer text. This parameter accepts a hexadecimal color code value in the format #xxxxxx. The default value is #000000.","title":"ApplyContentMarkingFooterFontColor"},"ApplyContentMarkingFooterFontSize":{"type":"integer","description":"The ApplyContentMarkingFooterFontSize parameter specifies the font size (in points) of the footer text.","title":"ApplyContentMarkingFooterFontSize"},"ApplyContentMarkingFooterMargin":{"type":"integer","description":"The ApplyContentMarkingFooterMargin parameter specifies the size (in points) of the footer margin.","title":"ApplyContentMarkingFooterMargin"},"ApplyContentMarkingFooterText":{"type":"string","description":"The ApplyContentMarkingFooterText parameter specifies the footer text. If the value contains spaces, enclose the value in quotation marks.","title":"ApplyContentMarkingFooterText"},"ApplyContentMarkingHeaderAlignment":{"enum":["Left","Center","Right"],"description":"The ApplyContentMarkingHeaderAlignment parameter specifies the header alignment.","title":"ApplyContentMarkingHeaderAlignment"},"ApplyContentMarkingHeaderEnabled":{"type":"boolean","description":"The ApplyContentMarkingHeaderEnabled parameter enables or disables the Apply Content Marking Header action for the label.","title":"ApplyContentMarkingHeaderEnabled"},"ApplyContentMarkingHeaderFontColor":{"type":"string","description":"The ApplyContentMarkingHeaderFontColor parameter specifies the color of the header text. This parameter accepts a hexadecimal color code value in the format #xxxxxx. The default value is #000000.","title":"ApplyContentMarkingHeaderFontColor"},"ApplyContentMarkingHeaderFontSize":{"type":"integer","description":"The ApplyContentMarkingHeaderFontSize parameter specifies the font size (in points) of the header text.","title":"ApplyContentMarkingHeaderFontSize"},"ApplyContentMarkingHeaderMargin":{"type":"integer","description":"The ApplyContentMarkingHeaderMargin parameter specifies the size (in points) of the header margin.","title":"ApplyContentMarkingHeaderMargin"},"ApplyContentMarkingHeaderText":{"type":"string","description":"The ApplyContentMarkingHeaderText parameter specifies the header text. If the value contains spaces, enclose the value in quotation marks.","title":"ApplyContentMarkingHeaderText"},"ApplyWaterMarkingEnabled":{"type":"boolean","description":"The ApplyWaterMarkingEnabled parameter enables or disables the Apply Watermarking Header action for the label.","title":"ApplyWaterMarkingEnabled"},"ApplyWaterMarkingFontColor":{"type":"string","description":"The ApplyWaterMarkingFontColor parameter specifies the color of the watermark text. This parameter accepts a hexadecimal color code value in the format #xxxxxx.","title":"ApplyWaterMarkingFontColor"},"ApplyWaterMarkingFontSize":{"type":"integer","description":"The ApplyWaterMarkingFontSize parameter specifies the font size (in points) of the watermark text.","title":"ApplyWaterMarkingFontSize"},"ApplyWaterMarkingLayout":{"enum":["Horizontal","Diagonal"],"description":"The ApplyWaterMarkingAlignment parameter specifies the watermark alignment.","title":"ApplyWaterMarkingLayout"},"ApplyWaterMarkingText":{"type":"string","description":"The ApplyWaterMarkingText parameter specifies the watermark text. If the value contains spaces, enclose the value in quotation marks.","title":"ApplyWaterMarkingText"},"ContentType":{"type":"array","items":{"enum":["File","Email","Site","UnifiedGroup","PurviewAssets","Teamwork","SchematizedData"]},"description":"The ContentType parameter specifies where the sensitivity label can be applied.","title":"ContentType"},"EncryptionContentExpiredOnDateInDaysOrNever":{"type":"string","description":"The EncryptionContentExpiredOnDateInDaysOrNever parameter specifies when the encrypted content expires. Valid values are integer or never.","title":"EncryptionContentExpiredOnDateInDaysOrNever"},"EncryptionDoNotForward":{"type":"boolean","description":"The EncryptionDoNotForward parameter specifies whether the Do Not Forward template is applied.","title":"EncryptionDoNotForward"},"EncryptionEncryptOnly":{"type":"boolean","description":"The EncryptionEncryptOnly parameter specifies whether the encrypt-only template is applied.","title":"EncryptionEncryptOnly"},"EncryptionEnabled":{"type":"boolean","description":"The EncryptionEnabled parameter specifies whether encryption in enabled.","title":"EncryptionEnabled"},"EncryptionOfflineAccessDays":{"type":"integer","description":"The EncryptionOfflineAccessDays parameter specifies the number of days that offline access is allowed.","title":"EncryptionOfflineAccessDays"},"EncryptionPromptUser":{"type":"boolean","description":"The EncryptionPromptUser parameter specifies whether to set the label with user defined permission in Word, Excel, and PowerPoint.","title":"EncryptionPromptUser"},"EncryptionProtectionType":{"enum":["Template","RemoveProtection","UserDefined"],"description":"The EncryptionProtectionType parameter specifies the protection type for encryption.","title":"EncryptionProtectionType"},"EncryptionRightsDefinitions":{"type":"string","description":"The EncryptionRightsDefinitions parameter specifies the rights users have when accessing protected. This parameter uses the syntax Identity1:Rights1,Rights2;Identity2:Rights3,Rights4. For example, john@contoso.com:VIEW,EDIT;microsoft.com:VIEW.","title":"EncryptionRightsDefinitions"},"EncryptionRightsUrl":{"type":"string","description":"The EncryptionRightsUrl parameter specifies the URL for hold your own key (HYOK) protection.","title":"EncryptionRightsUrl"},"SiteAndGroupProtectionAllowAccessToGuestUsers":{"type":"boolean","description":"The SiteAndGroupProtectionAllowAccessToGuestUsers parameter enables or disables access to guest users.","title":"SiteAndGroupProtectionAllowAccessToGuestUsers"},"SiteAndGroupProtectionAllowEmailFromGuestUsers":{"type":"boolean","description":"The SiteAndGroupProtectionAllowEmailFromGuestUsers parameter enables or disables email from guest users.","title":"SiteAndGroupProtectionAllowEmailFromGuestUsers"},"SiteAndGroupProtectionAllowFullAccess":{"type":"boolean","description":"The SiteAndGroupProtectionAllowFullAccess parameter enables or disables full access.","title":"SiteAndGroupProtectionAllowFullAccess"},"SiteAndGroupProtectionAllowLimitedAccess":{"type":"boolean","description":"The SiteAndGroupProtectionAllowLimitedAccess parameter enables or disables limited access.","title":"SiteAndGroupProtectionAllowLimitedAccess"},"SiteAndGroupProtectionBlockAccess":{"type":"boolean","description":"The SiteAndGroupProtectionBlockAccess parameter blocks access.","title":"SiteAndGroupProtectionBlockAccess"},"SiteAndGroupProtectionEnabled":{"type":"boolean","description":"The SiteAndGroupProtectionEnabled parameter enables or disables the Site and Group Protection action for the labels.","title":"SiteAndGroupProtectionEnabled"},"SiteAndGroupProtectionPrivacy":{"enum":["Public","Private","Unspecified"],"description":"The SiteAndGroupProtectionPrivacy parameter specifies the privacy level for the label.","title":"SiteAndGroupProtectionPrivacy"},"SiteAndGroupExternalSharingControlType":{"enum":["ExternalUserAndGuestSharing","ExternalUserSharingOnly","ExistingExternalUserSharingOnly","Disabled"],"description":"The SiteAndGroupExternalSharingControlType parameter specifies the external user sharing setting for the label.","title":"SiteAndGroupExternalSharingControlType"}},"required":["Name"]},"microsoft.securityandcompliance.supervisoryreviewpolicy":{"type":"object","description":"This resource configures a Supervision Policy in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.supervisoryreviewpolicy","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name for the supervisory review policy. The name can't exceed 64 characters. If the value contains spaces, enclose the value in quotation marks.","title":"Name"},"Comment":{"type":"string","description":"The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks.","title":"Comment"},"Reviewers":{"type":"array","items":{"type":"string"},"description":"The Reviewers parameter specifies the SMTP addresses of the reviewers for the supervisory review policy. You can specify multiple email addresses separated by commas.","title":"Reviewers"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"}},"required":["Name","Reviewers"]},"microsoft.securityandcompliance.supervisoryreviewrule":{"type":"object","description":"This resource configures a Supervision Review Rule in Security and Compliance.","title":"Schema for microsoft.securityandcompliance.supervisoryreviewrule","properties":{"Name":{"type":"string","description":"The Name parameter specifies the unique name for the supervisory review policy. The name can't exceed 64 characters. If the value contains spaces, enclose the value in quotation marks.","title":"Name"},"Policy":{"type":"string","description":"The Policy parameter specifies the supervisory review policy that's assigned to the rule. You can use any value that uniquely identifies the policy.","title":"Policy"},"Condition":{"type":"string","description":"The Condition parameter specifies the conditions and exceptions for the rule.","title":"Condition"},"SamplingRate":{"type":"integer","description":"The SamplingRate parameter specifies the percentage of communications for review. If you want reviewers to review all detected items, use the value 100.","title":"SamplingRate"},"Ensure":{"enum":["Present","Absent"],"description":"Specify if this rule should exist or not.","title":"Ensure"}},"required":["Name","Policy"]}},"additionalProperties":false,"type":"object","title":"configurationMonitor Schema","description":"Schema for entity configurationMonitor","properties":{"id":{"type":"string"},"displayName":{"type":"string"},"description":{"type":"string"},"parameters":{"title":"openComplexDictionaryType Schema","description":"Schema for entity openComplexDictionaryType","type":"object","properties":{},"required":[]},"baseline":{"title":"configurationBaseline Schema","description":"Schema for entity configurationBaseline","type":"object","properties":{"id":{"type":"string"},"displayName":{"type":"string"},"description":{"type":"string"},"parameters":{"type":"array","items":{"title":"baselineParameter Schema","description":"Schema for entity baselineParameter","type":"object","properties":{"displayName":{"type":"string"},"description":{"type":"string"},"parameterType":{"enum":["string","integer","boolean","unknownFutureValue"]}},"required":[]}},"resources":{"type":"array","items":{"type":"object","properties":{"displayName":{"type":"string"},"resourceType":{"enum":["microsoft.exchange.accepteddomain","microsoft.exchange.activesyncdeviceaccessrule","microsoft.exchange.addressbookpolicy","microsoft.exchange.addresslist","microsoft.exchange.antiphishpolicy","microsoft.exchange.antiphishrule","microsoft.exchange.applicationaccesspolicy","microsoft.exchange.atppolicyforo365","microsoft.exchange.authenticationpolicy","microsoft.exchange.authenticationpolicyassignment","microsoft.exchange.availabilityaddressspace","microsoft.exchange.availabilityconfig","microsoft.exchange.calendarprocessing","microsoft.exchange.casmailboxplan","microsoft.exchange.casmailboxsettings","microsoft.exchange.clientaccessrule","microsoft.exchange.dataclassification","microsoft.exchange.dataencryptionpolicy","microsoft.exchange.distributiongroup","microsoft.exchange.dkimsigningconfig","microsoft.exchange.emailaddresspolicy","microsoft.exchange.eopprotectionpolicyrule","microsoft.exchange.externalinoutlook","microsoft.exchange.globaladdresslist","microsoft.exchange.groupsettings","microsoft.exchange.hostedconnectionfilterpolicy","microsoft.exchange.hostedcontentfilterpolicy","microsoft.exchange.hostedcontentfilterrule","microsoft.exchange.hostedoutboundspamfilterpolicy","microsoft.exchange.hostedoutboundspamfilterrule","microsoft.exchange.inboundconnector","microsoft.exchange.intraorganizationconnector","microsoft.exchange.irmconfiguration","microsoft.exchange.journalrule","microsoft.exchange.mailboxautoreplyconfiguration","microsoft.exchange.mailboxcalendarfolder","microsoft.exchange.mailboxpermission","microsoft.exchange.mailboxplan","microsoft.exchange.mailboxsettings","microsoft.exchange.mailcontact","microsoft.exchange.mailtips","microsoft.exchange.malwarefilterpolicy","microsoft.exchange.malwarefilterrule","microsoft.exchange.managementrole","microsoft.exchange.managementroleassignment","microsoft.exchange.managementroleentry","microsoft.exchange.messageclassification","microsoft.exchange.mobiledevicemailboxpolicy","microsoft.exchange.offlineaddressbook","microsoft.exchange.omeconfiguration","microsoft.exchange.onpremisesorganization","microsoft.exchange.organizationconfig","microsoft.exchange.organizationrelationship","microsoft.exchange.outboundconnector","microsoft.exchange.owamailboxpolicy","microsoft.exchange.partnerapplication","microsoft.exchange.perimeterconfiguration","microsoft.exchange.place","microsoft.exchange.policytipconfig","microsoft.exchange.quarantinepolicy","microsoft.exchange.recipientpermission","microsoft.exchange.remotedomain","microsoft.exchange.reportsubmissionpolicy","microsoft.exchange.reportsubmissionrule","microsoft.exchange.resourceconfiguration","microsoft.exchange.roleassignmentpolicy","microsoft.exchange.rolegroup","microsoft.exchange.safeattachmentpolicy","microsoft.exchange.safeattachmentrule","microsoft.exchange.safelinkspolicy","microsoft.exchange.safelinksrule","microsoft.exchange.sharedmailbox","microsoft.exchange.sharingpolicy","microsoft.exchange.sweeprule","microsoft.exchange.transportconfig","microsoft.exchange.transportrule","microsoft.entra.administrativeunit","microsoft.entra.application","microsoft.entra.attributeset","microsoft.entra.authenticationcontextclassreference","microsoft.entra.authenticationmethodpolicy","microsoft.entra.authenticationmethodpolicyauthenticator","microsoft.entra.authenticationmethodpolicyemail","microsoft.entra.authenticationmethodpolicyfido2","microsoft.entra.authenticationmethodpolicysms","microsoft.entra.authenticationmethodpolicysoftware","microsoft.entra.authenticationmethodpolicytemporary","microsoft.entra.authenticationmethodpolicyvoice","microsoft.entra.authenticationmethodpolicyx509","microsoft.entra.authenticationstrengthpolicy","microsoft.entra.authorizationpolicy","microsoft.entra.conditionalaccesspolicy","microsoft.entra.crosstenantaccesspolicy","microsoft.entra.crosstenantaccesspolicyconfigurationdefault","microsoft.entra.crosstenantaccesspolicyconfigurationpartner","microsoft.entra.entitlementmanagementaccesspackage","microsoft.entra.entitlementmanagementaccesspackageassignmentpolicy","microsoft.entra.entitlementmanagementaccesspackagecatalog","microsoft.entra.entitlementmanagementaccesspackagecatalogresource","microsoft.entra.entitlementmanagementconnectedorganization","microsoft.entra.externalidentitypolicy","microsoft.entra.group","microsoft.entra.grouplifecyclepolicy","microsoft.entra.groupsnamingpolicy","microsoft.entra.groupssettings","microsoft.entra.namedlocationpolicy","microsoft.entra.roledefinition","microsoft.entra.roleeligibilityschedulerequest","microsoft.entra.rolesetting","microsoft.entra.securitydefaults","microsoft.entra.serviceprincipal","microsoft.entra.socialidentityprovider","microsoft.entra.tenantdetails","microsoft.entra.tokenlifetimepolicy","microsoft.entra.user","microsoft.teams.apppermissionpolicy","microsoft.teams.appsetuppolicy","microsoft.teams.audioconferencingpolicy","microsoft.teams.callholdpolicy","microsoft.teams.callingpolicy","microsoft.teams.callparkpolicy","microsoft.teams.callqueue","microsoft.teams.channelspolicy","microsoft.teams.channel","microsoft.teams.channeltab","microsoft.teams.clientconfiguration","microsoft.teams.compliancerecordingpolicy","microsoft.teams.cortanapolicy","microsoft.teams.dialinconferencingtenantsettings","microsoft.teams.emergencycallingpolicy","microsoft.teams.emergencycallroutingpolicy","microsoft.teams.enhancedencryptionpolicy","microsoft.teams.eventspolicy","microsoft.teams.federationconfiguration","microsoft.teams.feedbackpolicy","microsoft.teams.filespolicy","microsoft.teams.grouppolicyassignment","microsoft.teams.guestcallingconfiguration","microsoft.teams.guestmeetingconfiguration","microsoft.teams.guestmessagingconfiguration","microsoft.teams.ipphonepolicy","microsoft.teams.meetingbroadcastconfiguration","microsoft.teams.meetingbroadcastpolicy","microsoft.teams.meetingconfiguration","microsoft.teams.meetingpolicy","microsoft.teams.messagingpolicy","microsoft.teams.mobilitypolicy","microsoft.teams.networkroamingpolicy","microsoft.teams.onlinevoicemailpolicy","microsoft.teams.onlinevoicemailusersettings","microsoft.teams.onlinevoiceuser","microsoft.teams.orgwideappsettings","microsoft.teams.pstnusage","microsoft.teams.shiftspolicy","microsoft.teams.templatespolicy","microsoft.teams.tenantdialplan","microsoft.teams.tenantnetworkregion","microsoft.teams.tenantnetworksite","microsoft.teams.tenantnetworksubnet","microsoft.teams.tenanttrustedipaddress","microsoft.teams.translationrule","microsoft.teams.unassignednumbertreatment","microsoft.teams.updatemanagementpolicy","microsoft.teams.upgradeconfiguration","microsoft.teams.upgradepolicy","microsoft.teams.user","microsoft.teams.usercallingsettings","microsoft.teams.userpolicyassignment","microsoft.teams.vdipolicy","microsoft.teams.voiceroute","microsoft.teams.voiceroutingpolicy","microsoft.teams.workloadpolicy","microsoft.teams.team","microsoft.intune.accountprotectionlocaladministratorpasswordsolutionpolicy","microsoft.intune.accountprotectionlocalusergroupmembershippolicy","microsoft.intune.accountprotectionpolicy","microsoft.intune.antiviruspolicywindows10settingcatalog","microsoft.intune.appconfigurationpolicy","microsoft.intune.applicationcontrolpolicywindows10","microsoft.intune.appprotectionpolicyandroid","microsoft.intune.appprotectionpolicyios","microsoft.intune.asrrulespolicywindows10","microsoft.intune.attacksurfacereductionrulespolicywindows10configmanager","microsoft.intune.deviceandappmanagementassignmentfilter","microsoft.intune.devicecategory","microsoft.intune.devicecleanuprule","microsoft.intune.devicecompliancepolicyandroid","microsoft.intune.devicecompliancepolicyandroiddeviceowner","microsoft.intune.devicecompliancepolicyandroidworkprofile","microsoft.intune.devicecompliancepolicyios","microsoft.intune.devicecompliancepolicymacos","microsoft.intune.devicecompliancepolicywindows10","microsoft.intune.deviceconfigurationadministrativetemplatepolicywindows10","microsoft.intune.deviceconfigurationcustompolicywindows10","microsoft.intune.deviceconfigurationdefenderforendpointonboardingpolicywindows10","microsoft.intune.deviceconfigurationdeliveryoptimizationpolicywindows10","microsoft.intune.deviceconfigurationdomainjoinpolicywindows10","microsoft.intune.deviceconfigurationemailprofilepolicywindows10","microsoft.intune.deviceconfigurationendpointprotectionpolicywindows10","microsoft.intune.deviceconfigurationfirmwareinterfacepolicywindows10","microsoft.intune.deviceconfigurationhealthmonitoringconfigurationpolicywindows10","microsoft.intune.deviceconfigurationidentityprotectionpolicywindows10","microsoft.intune.deviceconfigurationimportedpfxcertificatepolicywindows10","microsoft.intune.deviceconfigurationkioskpolicywindows10","microsoft.intune.deviceconfigurationnetworkboundarypolicywindows10","microsoft.intune.deviceconfigurationpkcscertificatepolicywindows10","microsoft.intune.deviceconfigurationpolicyandroiddeviceadministrator","microsoft.intune.deviceconfigurationpolicyandroiddeviceowner","microsoft.intune.deviceconfigurationpolicyandroidopensourceproject","microsoft.intune.deviceconfigurationpolicyandroidworkprofile","microsoft.intune.deviceconfigurationpolicyios","microsoft.intune.deviceconfigurationpolicymacos","microsoft.intune.deviceconfigurationpolicywindows10","microsoft.intune.deviceconfigurationscepcertificatepolicywindows10","microsoft.intune.deviceconfigurationsecureassessmentpolicywindows10","microsoft.intune.deviceconfigurationsharedmultidevicepolicywindows10","microsoft.intune.deviceconfigurationtrustedcertificatepolicywindows10","microsoft.intune.deviceconfigurationvpnpolicywindows10","microsoft.intune.deviceconfigurationwindowsteampolicywindows10","microsoft.intune.deviceconfigurationwirednetworkpolicywindows10","microsoft.intune.deviceenrollmentlimitrestriction","microsoft.intune.deviceenrollmentplatformrestriction","microsoft.intune.deviceenrollmentstatuspagewindows10","microsoft.intune.endpointdetectionandresponsepolicywindows10","microsoft.intune.exploitprotectionpolicywindows10settingcatalog","microsoft.intune.policysets","microsoft.intune.roleassignment","microsoft.intune.roledefinition","microsoft.intune.settingcatalogasrrulespolicywindows10","microsoft.intune.settingcatalogcustompolicywindows10","microsoft.intune.wificonfigurationpolicyandroiddeviceadministrator","microsoft.intune.wificonfigurationpolicyandroidenterprisedeviceowner","microsoft.intune.wificonfigurationpolicyandroidenterpriseworkprofile","microsoft.intune.wificonfigurationpolicyandroidforwork","microsoft.intune.wificonfigurationpolicyandroidopensourceproject","microsoft.intune.wificonfigurationpolicyios","microsoft.intune.wificonfigurationpolicymacos","microsoft.intune.wificonfigurationpolicywindows10","microsoft.intune.windowsautopilotdeploymentprofileazureadhybridjoined","microsoft.intune.windowsautopilotdeploymentprofileazureadjoined","microsoft.intune.windowsinformationprotectionpolicywindows10mdmenrolled","microsoft.intune.windowsupdateforbusinessfeatureupdateprofilewindows10","microsoft.intune.windowsupdateforbusinessringupdateprofilewindows10","microsoft.securityandcompliance.auditconfigurationpolicy","microsoft.securityandcompliance.autosensitivitylabelpolicy","microsoft.securityandcompliance.autosensitivitylabelrule","microsoft.securityandcompliance.caseholdpolicy","microsoft.securityandcompliance.caseholdrule","microsoft.securityandcompliance.compliancecase","microsoft.securityandcompliance.compliancesearch","microsoft.securityandcompliance.compliancesearchaction","microsoft.securityandcompliance.compliancetag","microsoft.securityandcompliance.deviceconditionalaccesspolicy","microsoft.securityandcompliance.deviceconfigurationpolicy","microsoft.securityandcompliance.dlpcompliancepolicy","microsoft.securityandcompliance.dlpcompliancerule","microsoft.securityandcompliance.fileplanpropertyauthority","microsoft.securityandcompliance.fileplanpropertycategory","microsoft.securityandcompliance.fileplanpropertycitation","microsoft.securityandcompliance.fileplanpropertydepartment","microsoft.securityandcompliance.fileplanpropertyreferenceid","microsoft.securityandcompliance.fileplanpropertysubcategory","microsoft.securityandcompliance.labelpolicy","microsoft.securityandcompliance.protectionalert","microsoft.securityandcompliance.retentioncompliancepolicy","microsoft.securityandcompliance.retentioncompliancerule","microsoft.securityandcompliance.retentioneventtype","microsoft.securityandcompliance.securityfilter","microsoft.securityandcompliance.sensitivitylabel","microsoft.securityandcompliance.supervisoryreviewpolicy","microsoft.securityandcompliance.supervisoryreviewrule"]},"properties":{}},"allOf":[{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.accepteddomain"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.accepteddomain"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.activesyncdeviceaccessrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.activesyncdeviceaccessrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.addressbookpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.addressbookpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.addresslist"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.addresslist"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.antiphishpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.antiphishpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.antiphishrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.antiphishrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.applicationaccesspolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.applicationaccesspolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.atppolicyforo365"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.atppolicyforo365"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.authenticationpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.authenticationpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.authenticationpolicyassignment"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.authenticationpolicyassignment"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.availabilityaddressspace"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.availabilityaddressspace"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.availabilityconfig"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.availabilityconfig"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.calendarprocessing"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.calendarprocessing"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.casmailboxplan"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.casmailboxplan"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.casmailboxsettings"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.casmailboxsettings"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.clientaccessrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.clientaccessrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.dataclassification"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.dataclassification"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.dataencryptionpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.dataencryptionpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.distributiongroup"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.distributiongroup"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.dkimsigningconfig"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.dkimsigningconfig"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.emailaddresspolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.emailaddresspolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.eopprotectionpolicyrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.eopprotectionpolicyrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.externalinoutlook"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.externalinoutlook"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.globaladdresslist"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.globaladdresslist"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.groupsettings"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.groupsettings"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.hostedconnectionfilterpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.hostedconnectionfilterpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.hostedcontentfilterpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.hostedcontentfilterpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.hostedcontentfilterrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.hostedcontentfilterrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.hostedoutboundspamfilterpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.hostedoutboundspamfilterpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.hostedoutboundspamfilterrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.hostedoutboundspamfilterrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.inboundconnector"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.inboundconnector"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.intraorganizationconnector"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.intraorganizationconnector"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.irmconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.irmconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.journalrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.journalrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.mailboxautoreplyconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.mailboxautoreplyconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.mailboxcalendarfolder"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.mailboxcalendarfolder"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.mailboxpermission"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.mailboxpermission"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.mailboxplan"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.mailboxplan"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.mailboxsettings"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.mailboxsettings"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.mailcontact"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.mailcontact"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.mailtips"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.mailtips"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.malwarefilterpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.malwarefilterpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.malwarefilterrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.malwarefilterrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.managementrole"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.managementrole"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.managementroleassignment"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.managementroleassignment"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.managementroleentry"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.managementroleentry"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.messageclassification"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.messageclassification"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.mobiledevicemailboxpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.mobiledevicemailboxpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.offlineaddressbook"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.offlineaddressbook"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.omeconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.omeconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.onpremisesorganization"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.onpremisesorganization"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.organizationconfig"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.organizationconfig"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.organizationrelationship"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.organizationrelationship"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.outboundconnector"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.outboundconnector"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.owamailboxpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.owamailboxpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.partnerapplication"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.partnerapplication"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.perimeterconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.perimeterconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.place"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.place"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.policytipconfig"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.policytipconfig"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.quarantinepolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.quarantinepolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.recipientpermission"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.recipientpermission"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.remotedomain"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.remotedomain"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.reportsubmissionpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.reportsubmissionpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.reportsubmissionrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.reportsubmissionrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.resourceconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.resourceconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.roleassignmentpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.roleassignmentpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.rolegroup"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.rolegroup"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.safeattachmentpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.safeattachmentpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.safeattachmentrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.safeattachmentrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.safelinkspolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.safelinkspolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.safelinksrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.safelinksrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.sharedmailbox"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.sharedmailbox"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.sharingpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.sharingpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.sweeprule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.sweeprule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.transportconfig"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.transportconfig"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.exchange.transportrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.exchange.transportrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.administrativeunit"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.administrativeunit"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.application"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.application"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.attributeset"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.attributeset"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authenticationcontextclassreference"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authenticationcontextclassreference"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authenticationmethodpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authenticationmethodpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authenticationmethodpolicyauthenticator"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authenticationmethodpolicyauthenticator"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authenticationmethodpolicyemail"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authenticationmethodpolicyemail"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authenticationmethodpolicyfido2"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authenticationmethodpolicyfido2"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authenticationmethodpolicysms"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authenticationmethodpolicysms"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authenticationmethodpolicysoftware"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authenticationmethodpolicysoftware"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authenticationmethodpolicytemporary"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authenticationmethodpolicytemporary"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authenticationmethodpolicyvoice"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authenticationmethodpolicyvoice"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authenticationmethodpolicyx509"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authenticationmethodpolicyx509"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authenticationstrengthpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authenticationstrengthpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.authorizationpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.authorizationpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.conditionalaccesspolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.conditionalaccesspolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.crosstenantaccesspolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.crosstenantaccesspolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.crosstenantaccesspolicyconfigurationdefault"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.crosstenantaccesspolicyconfigurationdefault"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.crosstenantaccesspolicyconfigurationpartner"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.crosstenantaccesspolicyconfigurationpartner"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.entitlementmanagementaccesspackage"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.entitlementmanagementaccesspackage"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.entitlementmanagementaccesspackageassignmentpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.entitlementmanagementaccesspackageassignmentpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.entitlementmanagementaccesspackagecatalog"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.entitlementmanagementaccesspackagecatalog"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.entitlementmanagementaccesspackagecatalogresource"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.entitlementmanagementaccesspackagecatalogresource"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.entitlementmanagementconnectedorganization"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.entitlementmanagementconnectedorganization"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.externalidentitypolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.externalidentitypolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.group"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.group"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.grouplifecyclepolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.grouplifecyclepolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.groupsnamingpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.groupsnamingpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.groupssettings"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.groupssettings"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.namedlocationpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.namedlocationpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.roledefinition"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.roledefinition"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.roleeligibilityschedulerequest"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.roleeligibilityschedulerequest"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.rolesetting"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.rolesetting"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.securitydefaults"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.securitydefaults"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.serviceprincipal"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.serviceprincipal"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.socialidentityprovider"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.socialidentityprovider"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.tenantdetails"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.tenantdetails"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.tokenlifetimepolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.tokenlifetimepolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.entra.user"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.entra.user"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.apppermissionpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.apppermissionpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.appsetuppolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.appsetuppolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.audioconferencingpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.audioconferencingpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.callholdpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.callholdpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.callingpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.callingpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.callparkpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.callparkpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.callqueue"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.callqueue"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.channelspolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.channelspolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.channel"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.channel"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.channeltab"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.channeltab"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.clientconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.clientconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.compliancerecordingpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.compliancerecordingpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.cortanapolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.cortanapolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.dialinconferencingtenantsettings"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.dialinconferencingtenantsettings"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.emergencycallingpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.emergencycallingpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.emergencycallroutingpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.emergencycallroutingpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.enhancedencryptionpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.enhancedencryptionpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.eventspolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.eventspolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.federationconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.federationconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.feedbackpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.feedbackpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.filespolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.filespolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.grouppolicyassignment"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.grouppolicyassignment"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.guestcallingconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.guestcallingconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.guestmeetingconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.guestmeetingconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.guestmessagingconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.guestmessagingconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.ipphonepolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.ipphonepolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.meetingbroadcastconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.meetingbroadcastconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.meetingbroadcastpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.meetingbroadcastpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.meetingconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.meetingconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.meetingpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.meetingpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.messagingpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.messagingpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.mobilitypolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.mobilitypolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.networkroamingpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.networkroamingpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.onlinevoicemailpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.onlinevoicemailpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.onlinevoicemailusersettings"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.onlinevoicemailusersettings"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.onlinevoiceuser"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.onlinevoiceuser"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.orgwideappsettings"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.orgwideappsettings"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.pstnusage"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.pstnusage"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.shiftspolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.shiftspolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.templatespolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.templatespolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.tenantdialplan"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.tenantdialplan"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.tenantnetworkregion"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.tenantnetworkregion"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.tenantnetworksite"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.tenantnetworksite"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.tenantnetworksubnet"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.tenantnetworksubnet"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.tenanttrustedipaddress"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.tenanttrustedipaddress"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.translationrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.translationrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.unassignednumbertreatment"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.unassignednumbertreatment"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.updatemanagementpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.updatemanagementpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.upgradeconfiguration"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.upgradeconfiguration"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.upgradepolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.upgradepolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.user"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.user"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.usercallingsettings"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.usercallingsettings"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.userpolicyassignment"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.userpolicyassignment"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.vdipolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.vdipolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.voiceroute"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.voiceroute"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.voiceroutingpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.voiceroutingpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.workloadpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.workloadpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.teams.team"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.teams.team"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.accountprotectionlocaladministratorpasswordsolutionpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.accountprotectionlocaladministratorpasswordsolutionpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.accountprotectionlocalusergroupmembershippolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.accountprotectionlocalusergroupmembershippolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.accountprotectionpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.accountprotectionpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.antiviruspolicywindows10settingcatalog"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.antiviruspolicywindows10settingcatalog"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.appconfigurationpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.appconfigurationpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.applicationcontrolpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.applicationcontrolpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.appprotectionpolicyandroid"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.appprotectionpolicyandroid"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.appprotectionpolicyios"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.appprotectionpolicyios"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.asrrulespolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.asrrulespolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.attacksurfacereductionrulespolicywindows10configmanager"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.attacksurfacereductionrulespolicywindows10configmanager"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceandappmanagementassignmentfilter"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceandappmanagementassignmentfilter"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.devicecategory"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.devicecategory"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.devicecleanuprule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.devicecleanuprule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.devicecompliancepolicyandroid"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.devicecompliancepolicyandroid"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.devicecompliancepolicyandroiddeviceowner"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.devicecompliancepolicyandroiddeviceowner"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.devicecompliancepolicyandroidworkprofile"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.devicecompliancepolicyandroidworkprofile"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.devicecompliancepolicyios"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.devicecompliancepolicyios"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.devicecompliancepolicymacos"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.devicecompliancepolicymacos"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.devicecompliancepolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.devicecompliancepolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationadministrativetemplatepolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationadministrativetemplatepolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationcustompolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationcustompolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationdefenderforendpointonboardingpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationdefenderforendpointonboardingpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationdeliveryoptimizationpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationdeliveryoptimizationpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationdomainjoinpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationdomainjoinpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationemailprofilepolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationemailprofilepolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationendpointprotectionpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationendpointprotectionpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationfirmwareinterfacepolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationfirmwareinterfacepolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationhealthmonitoringconfigurationpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationhealthmonitoringconfigurationpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationidentityprotectionpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationidentityprotectionpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationimportedpfxcertificatepolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationimportedpfxcertificatepolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationkioskpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationkioskpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationnetworkboundarypolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationnetworkboundarypolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationpkcscertificatepolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationpkcscertificatepolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationpolicyandroiddeviceadministrator"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationpolicyandroiddeviceadministrator"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationpolicyandroiddeviceowner"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationpolicyandroiddeviceowner"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationpolicyandroidopensourceproject"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationpolicyandroidopensourceproject"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationpolicyandroidworkprofile"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationpolicyandroidworkprofile"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationpolicyios"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationpolicyios"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationpolicymacos"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationpolicymacos"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationscepcertificatepolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationscepcertificatepolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationsecureassessmentpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationsecureassessmentpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationsharedmultidevicepolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationsharedmultidevicepolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationtrustedcertificatepolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationtrustedcertificatepolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationvpnpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationvpnpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationwindowsteampolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationwindowsteampolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceconfigurationwirednetworkpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceconfigurationwirednetworkpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceenrollmentlimitrestriction"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceenrollmentlimitrestriction"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceenrollmentplatformrestriction"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceenrollmentplatformrestriction"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.deviceenrollmentstatuspagewindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.deviceenrollmentstatuspagewindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.endpointdetectionandresponsepolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.endpointdetectionandresponsepolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.exploitprotectionpolicywindows10settingcatalog"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.exploitprotectionpolicywindows10settingcatalog"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.policysets"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.policysets"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.roleassignment"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.roleassignment"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.roledefinition"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.roledefinition"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.settingcatalogasrrulespolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.settingcatalogasrrulespolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.wificonfigurationpolicyandroiddeviceadministrator"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.wificonfigurationpolicyandroiddeviceadministrator"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.wificonfigurationpolicyandroidenterprisedeviceowner"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.wificonfigurationpolicyandroidenterprisedeviceowner"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.wificonfigurationpolicyandroidenterpriseworkprofile"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.wificonfigurationpolicyandroidenterpriseworkprofile"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.wificonfigurationpolicyandroidforwork"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.wificonfigurationpolicyandroidforwork"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.wificonfigurationpolicyandroidopensourceproject"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.wificonfigurationpolicyandroidopensourceproject"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.wificonfigurationpolicyios"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.wificonfigurationpolicyios"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.wificonfigurationpolicymacos"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.wificonfigurationpolicymacos"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.wificonfigurationpolicywindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.wificonfigurationpolicywindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.windowsautopilotdeploymentprofileazureadhybridjoined"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.windowsautopilotdeploymentprofileazureadhybridjoined"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.windowsautopilotdeploymentprofileazureadjoined"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.windowsautopilotdeploymentprofileazureadjoined"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.windowsinformationprotectionpolicywindows10mdmenrolled"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.windowsinformationprotectionpolicywindows10mdmenrolled"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.windowsupdateforbusinessfeatureupdateprofilewindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.windowsupdateforbusinessfeatureupdateprofilewindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.intune.windowsupdateforbusinessringupdateprofilewindows10"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.intune.windowsupdateforbusinessringupdateprofilewindows10"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.auditconfigurationpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.auditconfigurationpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.autosensitivitylabelpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.autosensitivitylabelpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.autosensitivitylabelrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.autosensitivitylabelrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.caseholdpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.caseholdpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.caseholdrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.caseholdrule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.compliancecase"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.compliancecase"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.compliancesearch"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.compliancesearch"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.compliancesearchaction"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.compliancesearchaction"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.compliancetag"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.compliancetag"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.deviceconditionalaccesspolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.deviceconditionalaccesspolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.deviceconfigurationpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.deviceconfigurationpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.dlpcompliancepolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.dlpcompliancepolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.dlpcompliancerule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.dlpcompliancerule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.fileplanpropertyauthority"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.fileplanpropertyauthority"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.fileplanpropertycategory"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.fileplanpropertycategory"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.fileplanpropertycitation"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.fileplanpropertycitation"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.fileplanpropertydepartment"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.fileplanpropertydepartment"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.fileplanpropertyreferenceid"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.fileplanpropertyreferenceid"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.fileplanpropertysubcategory"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.fileplanpropertysubcategory"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.labelpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.labelpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.protectionalert"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.protectionalert"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.retentioncompliancepolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.retentioncompliancepolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.retentioncompliancerule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.retentioncompliancerule"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.retentioneventtype"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.retentioneventtype"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.securityfilter"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.securityfilter"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.sensitivitylabel"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.sensitivitylabel"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.supervisoryreviewpolicy"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.supervisoryreviewpolicy"}}}},{"if":{"properties":{"resourceType":{"const":"microsoft.securityandcompliance.supervisoryreviewrule"}}},"then":{"properties":{"properties":{"$ref":"#/$defs/microsoft.securityandcompliance.supervisoryreviewrule"}}}}],"required":["resourceType","displayName","properties"]}}}}}}
</schema>

[User] Provide a JSON object that satisfies the schema "configurationMonitor Schema". Here are the required top‑level fields: none (all optional). Return only the valid JSON object.

This resource configures the Accepted Email Domains in Exchange Online.

Schema for microsoft.exchange.accepteddomain

Specify the Fully Qualified Domain Name for the AcceptedDomain.

Identity

Specify if the AcceptedDomain should exist or not.

Ensure

The type of AcceptedDomain.  Currently the EXOAcceptedDomain DSC Resource accepts a value of 'Authoritative' and 'InternalRelay'.

DomainType

The MatchSubDomains parameter must be false on Authoritative domains. The default value is false.

MatchSubDomains

OutboundOnly can only be enabled if the DomainType parameter is set to Authoritative or InternalRelay. The default value is false.

OutboundOnly

This resource configures Active Sync Device Access Rules in Exchange Online.

Schema for microsoft.exchange.activesyncdeviceaccessrule

The Identity parameter specifies the identity of the device access rule.

Identity

The AccessLevel parameter specifies whether the devices are allowed, blocked or quarantined.

AccessLevel

DeviceModel DeviceType DeviceOS UserAgent XMSWLHeader

The Characteristic parameter specifies the device characteristic or category that's used by the rule.

Characteristic

The QueryString parameter specifies the device identifier that's used by the rule. This parameter uses a text value that's used with Characteristic parameter value to define the device.

QueryString

Specify if the Active Sync Device Access Rule should exist or not.

Ensure

This resource configures Address Book Policies in Exchange Online.

Schema for microsoft.exchange.addressbookpolicy

The Name parameter specifies the name that you want this address book policy to be called.

Name

The AddressLists parameter specifies the address lists that will be used by mailbox users who are assigned this address book policy. This parameter accepts multiple values.

AddressLists

The GlobalAddressList parameter specifies the identity of the global address list (GAL) that will be used by mailbox users who are assigned this address book policy. You can specify only one GAL for each address book policy.

GlobalAddressList

The OfflineAddressBook parameter specifies the identity of the offline address book (OAB) that will be used by mailbox users who are assigned this address book policy. You can specify only one OAB for each address book policy.

OfflineAddressBook

The RoomList parameter specifies the name of the room address list.

RoomList

Specify if the Address Book Policy should exist or not.

Ensure

This resource configures Exchange Online address lists.

Schema for microsoft.exchange.addresslist

The Name parameter specifies a unique name for the address list.

Name

The ConditionalCompany parameter specifies a precanned filter that's based on the value of the recipient's Company property.

ConditionalCompany

The ConditionalCustomAttribute1 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute1 property.

The ConditionalCustomAttribute10 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute10 property.

The ConditionalCustomAttribute11 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute11 property.

The ConditionalCustomAttribute12 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute12 property.

The ConditionalCustomAttribute13 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute13 property.

The ConditionalCustomAttribute14 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute14 property.

The ConditionalCustomAttribute15 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute15 property.

The ConditionalCustomAttribute2 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute2 property.

The ConditionalCustomAttribute3 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute3 property.

The ConditionalCustomAttribute4 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute4 property.

The ConditionalCustomAttribute5 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute5 property.

The ConditionalCustomAttribute6 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute6 property.

The ConditionalCustomAttribute7 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute7 property.

The ConditionalCustomAttribute8 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute8 property.

The ConditionalCustomAttribute9 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute9 property.

The ConditionalDepartment parameter specifies a precanned filter that's based on the value of the recipient's Department property.

ConditionalDepartment

The ConditionalStateOrProvince parameter specifies a precanned filter that's based on the value of the recipient's StateOrProvince property.

ConditionalStateOrProvince

The DisplayName parameter specifies the display name of the address list.

DisplayName

AllRecipients MailboxUsers MailContacts MailGroups MailUsers Resources

The IncludedRecipients parameter specifies a precanned filter that's based on the recipient type.

IncludedRecipients

The RecipientFilter parameter specifies a custom OPath filter that's based on the value of any available recipient property.

RecipientFilter

Specifies if this AddressList should exist.

Ensure

This resource configures an Anti-Phish Policy in Exchange Online.
Reference: https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/new-antiphishpolicy?view=exchange-ps

Schema for microsoft.exchange.antiphishpolicy

The Identity parameter specifies the name of the antiphishing policy that you want to modify.

Identity

Specify if this policy should exist or not.

Ensure

The AdminDisplayName parameter specifies a description for the policy.

AdminDisplayName

The PhishThresholdLevel parameter specifies the tolerance level that's used by machine learning in the handling of phishing messages.

PhishThresholdLevel

The AuthenticationFailAction parameter specifies the action to take when the message fails composite authentication.

AuthenticationFailAction

BccMessage Delete MoveToJmf NoAction Quarantine Redirect

The TargetedUserProtectionAction parameter specifies the action to take on detected user impersonation messages for the users specified by the TargetedUsersToProtect parameter.

TargetedUserProtectionAction

Specify if this policy should be enabled. Default is $true.

Enabled

The EnableFirstContactSafetyTips parameter specifies whether to enable or disable the safety tip that's shown when recipients first receive an email from a sender or do not often receive email from a sender.

EnableFirstContactSafetyTips

The EnableMailboxIntelligence parameter specifies whether to enable or disable mailbox intelligence (the first contact graph) in domain and user impersonation protection.

EnableMailboxIntelligence

The EnableMailboxIntelligenceProtection specifies whether to enable or disable enhanced impersonation results based on each user's individual sender map. This intelligence allows Microsoft 365 to customize user impersonation detection and better handle false positives.

EnableMailboxIntelligenceProtection

The EnableOrganizationDomainsProtection parameter specifies whether to enable domain impersonation protection for all registered domains in the Office 365 organization.

EnableOrganizationDomainsProtection

The EnableSimilarDomainsSafetyTips parameter specifies whether to enable safety tips that are shown to recipients in messages for domain impersonation detections.

EnableSimilarDomainsSafetyTips

The EnableSimilarUsersSafetyTips parameter specifies whether to enable safety tips that are shown to recipients in messages for user impersonation detections.

EnableSimilarUsersSafetyTips

The EnableSpoofIntelligence parameter specifies whether to enable or disable antispoofing protection for the policy.

EnableSpoofIntelligence

The EnableTargetedDomainsProtection parameter specifies whether to enable domain impersonation protection for a list of specified domains.

EnableTargetedDomainsProtection

The EnableTargetedUserProtection parameter specifies whether to enable user impersonation protection for the users specified by the TargetedUsersToProtect parameter

EnableTargetedUserProtection

The EnableUnauthenticatedSender parameter enables or disables unauthenticated sender identification in Outlook.

EnableUnauthenticatedSender

The EnableUnusualCharactersSafetyTips parameter specifies whether to enable safety tips that are shown to recipients in messages for unusual characters in domain and user impersonation detections.

EnableUnusualCharactersSafetyTips

This setting is part of spoof protection. The EnableViaTag parameter enables or disables adding the via tag to the From address in Outlook.

EnableViaTag

Make this the default antiphishing policy

MakeDefault

The ExcludedDomains parameter specifies trusted domains that are excluded from scanning by antiphishing protection. You can specify multiple domains separated by commas.

ExcludedDomains

The ExcludedSenders parameter specifies a list of trusted sender email addresses that are excluded from scanning by antiphishing protection. You can specify multiple email addresses separated by commas.

ExcludedSenders

The HonorDmarcPolicy enables or disables using the sender's DMARC policy to determine what to do to messages that fail DMARC checks.

HonorDmarcPolicy

The ImpersonationProtectionState parameter specifies the configuration of impersonation protection.

ImpersonationProtectionState

The MailboxIntelligenceProtectionAction parameter specifies what to do with messages that fail mailbox intelligence protection.

MailboxIntelligenceProtectionAction

The MailboxIntelligenceProtectionActionRecipients parameter specifies the recipients to add to detected messages when the MailboxIntelligenceProtectionAction parameter is set to the value Redirect or BccMessage.

MailboxIntelligenceProtectionActionRecipients

The MailboxIntelligenceQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by mailbox intelligence.

MailboxIntelligenceQuarantineTag

The SpoofQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by spoof intelligence.

SpoofQuarantineTag

The TargetedDomainActionRecipients parameter specifies the recipients to add to detected domain impersonation messages when the TargetedDomainProtectionAction parameter is set to the value Redirect or BccMessage. A valid value for this parameter is an email address. You can specify multiple email addresses separated by commas.

TargetedDomainActionRecipients

The TargetedDomainProtectionAction parameter specifies the action to take on detected domain impersonation messages.

TargetedDomainProtectionAction

The TargetedDomainsToProtect parameter specifies the domains that are included in domain impersonation protection when the EnableTargetedDomainsProtection parameter is set to $true.

TargetedDomainsToProtect

The TargetedDomainQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by domain impersonation protection.

TargetedDomainQuarantineTag

The TargetedUserActionRecipients parameter specifies the replacement or additional recipients for detected user impersonation messages when the TargetedUserProtectionAction parameter is set to the value Redirect or BccMessage. A valid value for this parameter is an email address. You can specify multiple email addresses separated by commas.

TargetedUserActionRecipients

The TargetedUsersToProtect parameter specifies the users that are included in user impersonation protection when the EnableTargetedUserProtection parameter is set to $true.

TargetedUsersToProtect

The TargetedUserQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by user impersonation protection.

TargetedUserQuarantineTag

DmarcQuarantineAction

DmarcRejectAction

This resource configures an Anti-Phish Rule in Exchange Online.
Reference: https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/new-antiphishRule?view=exchange-ps

Schema for microsoft.exchange.antiphishrule

The Identity parameter specifies the name of the antiphishing rule that you want to modify.

Identity

Specify if this rule should exist or not.

Ensure

The AntiPhishPolicy parameter specifies the name of the antiphishing policy that's associated with the antiphishing rule.

AntiPhishPolicy

Specify if this rule should be enabled. Default is $true.

Enabled

The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.

Priority

The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.

Comments

The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

ExceptIfRecipientDomainIs

The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

ExceptIfSentTo

The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.

ExceptIfSentToMemberOf

The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

RecipientDomainIs

The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

SentTo

The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.

SentToMemberOf

This resource configures Applications Access Policies in Exchange Online.

Schema for microsoft.exchange.applicationaccesspolicy

The Identity parameter specifies the application access policy that you want to modify.

Identity

The AccessRight parameter specifies the permission that you want to assign in the application access policy.

AccessRight

The AppID parameter specifies the GUID of the apps to include in the policy.

AppID

The PolicyScopeGroupID parameter specifies the recipient to define in the policy. You can use any value that uniquely identifies the recipient.

PolicyScopeGroupId

The Description parameter specifies a description for the policy.

Description

Specify if the Application Access Policy should exist or not.

Ensure

This resource configures the Advanced Threat Protection (ATP) policy
in Office 365.  Tenant must be subscribed to ATP.

Schema for microsoft.exchange.atppolicyforo365

Specifies the resource is a single instance, the value must be 'Yes'

IsSingleInstance

The Identity parameter specifies the ATP policy that you want to modify. There's only one policy named Default.

Identity

Since there is only one policy, the default policy, this must be set to 'Present'

Ensure

The AllowSafeDocsOpen parameter specifies whether users can click through and bypass the Protected View container even when Safe Documents identifies a file as malicious.

AllowSafeDocsOpen

The EnableATPForSPOTeamsODB parameter specifies whether ATP is enabled for SharePoint Online, OneDrive for Business and Microsoft Teams. Default is $false.

EnableATPForSPOTeamsODB

The EnableSafeDocs parameter specifies whether to enable the Safe Documents feature in the organization. Default is $false.

EnableSafeDocs

This resource configures Authentication Policies in Exchange Online.

Schema for microsoft.exchange.authenticationpolicy

The Identity parameter specifies the authentication policy you want to view or modify.

Identity

The AllowBasicAuthActiveSync switch specifies whether to allow Basic authentication with Exchange Active Sync.

AllowBasicAuthActiveSync

The AllowBasicAuthAutodiscover switch specifies whether to allow Basic authentication with Autodiscover.

AllowBasicAuthAutodiscover

The AllowBasicAuthImap switch specifies whether to allow Basic authentication with IMAP.

AllowBasicAuthImap

The AllowBasicAuthMapi switch specifies whether to allow Basic authentication with MAPI.

AllowBasicAuthMapi

The AllowBasicAuthOfflineAddressBook switch specifies whether to allow Basic authentication with Offline Address Books.

AllowBasicAuthOfflineAddressBook

The AllowBasicAuthOutlookService switch specifies whether to allow Basic authentication with the Outlook service.

AllowBasicAuthOutlookService

The AllowBasicAuthPop switch specifies whether to allow Basic authentication with POP.

AllowBasicAuthPop

The AllowBasicAuthPowerShell switch specifies whether to allow Basic authentication with PowerShell.

AllowBasicAuthPowershell

The AllowBasicAuthReporting Web Services switch specifies whether to allow Basic authentication with reporting web services.

AllowBasicAuthReportingWebServices

The AllowBasicAuthRpc switch specifies whether to allow Basic authentication with RPC.

AllowBasicAuthRpc

The AllowBasicAuthSmtp switch specifies whether to allow Basic authentication with SMTP.

AllowBasicAuthSmtp

The AllowBasicAuthWebServices switch specifies whether to allow Basic authentication with Exchange Web Services (EWS).

AllowBasicAuthWebServices

Specify if the authentication Policy should exist or not.

Ensure

This resource assigns Exchange Online Authentication Policies to users.

Schema for microsoft.exchange.authenticationpolicyassignment

Name of the user assigned to the authentication policy.

UserName

Name of the authentication policy.

AuthenticationPolicyName

Ensure

Create a new AvailabilityAddressSpace in your cloud-based organization.

Schema for microsoft.exchange.availabilityaddressspace

The Identity parameter specifies the AvailabilityAddressSpace you want to modify.

Identity

PerUserFB OrgWideFB OrgWideFBToken OrgWideFBBasic InternalProxy

The AccessMethod parameter specifies how the free/busy data is accessed. Valid values are:PerUserFB, OrgWideFB, OrgWideFBToken, OrgWideFBBasic,InternalProxy

AccessMethod

The Credentials parameter specifies the username and password that's used to access the Availability services in the target forest.

Credentials

The ForestName parameter specifies the SMTP domain name of the target forest for users whose free/busy data must be retrieved. If your users are distributed among multiple SMTP domains in the target forest, run the Add-AvailabilityAddressSpace command once for each SMTP domain.

ForestName

The TargetAutodiscoverEpr parameter specifies the Autodiscover URL of Exchange Web Services for the external organization. Exchange uses Autodiscover to automatically detect the correct server endpoint for external requests.

TargetAutodiscoverEpr

The TargetServiceEpr parameter specifies the Exchange Online Calendar Service URL of the external Microsoft 365 organization that you're trying to read free/busy information from.

TargetServiceEpr

The TargetTenantID parameter specifies the tenant ID of the external Microsoft 365 organization that you're trying to read free/busy information from.

TargetTenantId

Specifies if this AvailabilityAddressSpace should exist.

Ensure

This resource configures the Availability Config in Exchange Online.

Schema for microsoft.exchange.availabilityconfig

Specify the OrgWideAccount for the AvailabilityConfig.

OrgWideAccount

Specify if the AvailabilityConfig should exist or not.

Ensure

This resource configures the Calendar Processing settings Exchange Online.

Schema for microsoft.exchange.calendarprocessing

The Identity parameter specifies the resource mailbox that you want to view. You can use any value that uniquely identifies the mailbox.

Identity

The AddAdditionalResponse parameter specifies whether additional information (the value of the AdditionalResponse parameter) is added to meeting request responses

AddAdditionalResponse

The AdditionalResponse parameter specifies the additional information to be included in responses to meeting requests when the value of the AddAdditionalResponse parameter is $true. If the value contains spaces, enclose the value in quotation marks.

AdditionalResponse

The AddNewRequestsTentatively parameter specifies whether new meeting requests are added to the calendar as tentative

AddNewRequestsTentatively

The AddOrganizerToSubject parameter specifies whether the meeting organizer's name is used as the subject of the meeting request.

AddOrganizerToSubject

The AllBookInPolicy parameter specifies whether to automatically approve in-policy requests from all users to the resource mailbox.

AllBookInPolicy

The AllowConflicts parameter specifies whether to allow conflicting meeting requests.

AllowConflicts

The AllowRecurringMeetings parameter specifies whether to allow recurring meetings in meeting requests.

AllowRecurringMeetings

The AllRequestInPolicy parameter specifies whether to allow all users to submit in-policy requests to the resource mailbox.

AllRequestInPolicy

The AllRequestOutOfPolicy parameter specifies whether to allow all users to submit out-of-policy requests to the resource mailbox.

AllRequestOutOfPolicy

The AutomateProcessing parameter enables or disables calendar processing on the mailbox.

AutomateProcessing

The BookingType parameter specifies how reservations work on the resource mailbox.

BookingType

The BookingWindowInDays parameter specifies the maximum number of days in advance that the resource can be reserved. A valid value is an integer from 0 through 1080. The default value is 180 days. The value 0 means today.

BookingWindowInDays

The BookInPolicy parameter specifies users or groups who are allowed to submit in-policy meeting requests to the resource mailbox that are automatically approved. You can use any value that uniquely identifies the user or group.

BookInPolicy

The ConflictPercentageAllowed parameter specifies the maximum percentage of meeting conflicts for new recurring meeting requests. A valid value is an integer from 0 through 100. The default value is 0.

ConflictPercentageAllowed

The DeleteAttachments parameter specifies whether to remove attachments from all incoming messages.

DeleteAttachments

The DeleteComments parameter specifies whether to remove or keep any text in the message body of incoming meeting requests.

DeleteComments

The DeleteNonCalendarItems parameter specifies whether to remove or keep all non-calendar-related messages that are received by the resource mailbox.

DeleteNonCalendarItems

The DeleteSubject parameter specifies whether to remove or keep the subject of incoming meeting requests.

DeleteSubject

EnableAutoRelease

The EnableResponseDetails parameter specifies whether to include the reasons for accepting or declining a meeting in the response email message.

EnableResponseDetails

The EnforceCapacity parameter specifies whether to restrict the number of attendees to the capacity of the workspace. For example, if capacity is set to 10, then only 10 people can book the workspace.

EnforceCapacity

The EnforceSchedulingHorizon parameter controls the behavior of recurring meetings that extend beyond the date specified by the BookingWindowInDays parameter.

EnforceSchedulingHorizon

The ForwardRequestsToDelegates parameter specifies whether to forward incoming meeting requests to the delegates that are configured for the resource mailbox.

ForwardRequestsToDelegates

The MaximumConflictInstances parameter specifies the maximum number of conflicts for new recurring meeting requests when the AllowRecurringMeetings parameter is set to $true. A valid value is an integer from 0 through INT32 (2147483647). The default value is 0.

MaximumConflictInstances

The MaximumDurationInMinutes parameter specifies the maximum duration in minutes for meeting requests. A valid value is an integer from 0 through INT32 (2147483647). The default value is 1440 (24 hours).

MaximumDurationInMinutes

The MinimumDurationInMinutes parameter specifies the minimum duration in minutes for meeting requests in workspace mailboxes. A valid value is an integer from 0 through INT32 (2147483647). The default value is 0, which means there is no minimum duration.

MinimumDurationInMinutes

The OrganizerInfo parameter specifies whether the resource mailbox sends organizer information when a meeting request is declined because of conflicts.

OrganizerInfo

PostReservationMaxClaimTimeInMinutes

The ProcessExternalMeetingMessages parameter specifies whether to process meeting requests that originate outside the Exchange organization.

ProcessExternalMeetingMessages

The RemoveCanceledMeetings parameter specifies whether to automatically delete meetings that were cancelled by the organizer from the resource mailbox's calendar.

RemoveCanceledMeetings

The RemoveForwardedMeetingNotifications parameter specifies whether forwarded meeting notifications are moved to the Deleted Items folder after they're processed by the Calendar Attendant.

RemoveForwardedMeetingNotifications

The RemoveOldMeetingMessages parameter specifies whether the Calendar Attendant removes old and redundant updates and responses.

RemoveOldMeetingMessages

The RemovePrivateProperty parameter specifies whether to clear the private flag for incoming meetings that were sent by the organizer in the original requests.

RemovePrivateProperty

RequestInPolicy

The RequestOutOfPolicy parameter specifies users who are allowed to submit out-of-policy requests that require approval by a resource mailbox delegate. You can use any value that uniquely identifies the user.

RequestOutOfPolicy

The ResourceDelegates parameter specifies users can approve or reject requests that are sent to the resource mailbox. You can use any value that uniquely identifies the user.

ResourceDelegates

The ScheduleOnlyDuringWorkHours parameter specifies whether to allow meetings to be scheduled outside of the working hours that are defined for the resource mailbox.

ScheduleOnlyDuringWorkHours

The TentativePendingApproval parameter specifies whether to mark pending requests as tentative on the calendar.

TentativePendingApproval

Determines whether or not the instance exist.

Ensure

This resource configures Client Access services (CAS) mailbox plans
in cloud-based organizations.

Schema for microsoft.exchange.casmailboxplan

The Identity parameter specifies the CAS Mailbox Plan that you want to modify.

Identity

The display name of the CAS Mailbox Plan.

DisplayName

CASMailboxPlans cannot be created/removed in O365.  This must be set to 'Present'

Ensure

The ActiveSyncEnabled parameter enables or disables access to the mailbox by using Exchange Active Sync. Default is $true.

ActiveSyncEnabled

The ImapEnabled parameter enables or disables access to the mailbox by using IMAP4 clients. The default value is $true for all CAS mailbox plans except ExchangeOnlineDeskless which is $false by default.

ImapEnabled

The OwaMailboxPolicy parameter specifies the Outlook on the web (formerly known as Outlook Web App) mailbox policy for the mailbox plan. The default value is OwaMailboxPolicy-Default. You can use the Get-OwaMailboxPolicy cmdlet to view the available Outlook on the web mailbox policies.

OwaMailboxPolicy

The PopEnabled parameter enables or disables access to the mailbox by using POP3 clients. Default is $true.

PopEnabled

This resource configures CAS mailbox settings.

Schema for microsoft.exchange.casmailboxsettings

The Identity parameter specifies the mailbox that you want to configure.

Identity

TheActiveSyncAllowedDeviceIDs parameter specifies one or more Exchange ActiveSync device IDs that are allowed to synchronize with the mailbox.

ActiveSyncAllowedDeviceIDs

The ActiveSyncBlockedDeviceIDs parameter specifies one or more Exchange ActiveSync device IDs that aren't allowed to synchronize with the mailbox.

ActiveSyncBlockedDeviceIDs

The ActiveSyncDebugLogging parameter enables or disables Exchange ActiveSync debug logging for the mailbox.

ActiveSyncDebugLogging

The ActiveSyncEnabled parameter enables or disables access to the mailbox using Exchange ActiveSync.

ActiveSyncEnabled

The ActiveSyncMailboxPolicy parameter specifies the Exchange ActiveSync mailbox policy for the mailbox.

ActiveSyncMailboxPolicy

The ActiveSyncSuppressReadReceipt parameter controls the behavior of read receipts for Exchange ActiveSync clients that access the mailbox.

ActiveSyncSuppressReadReceipt

The EwsAllowEntourage parameter enables or disables access to the mailbox by Microsoft Entourage clients that use Exchange Web Services.

EwsAllowEntourage

The EwsAllowList parameter specifies the Exchange Web Services applications (user agent strings) that are allowed to access the mailbox.

EwsAllowList

The EwsAllowMacOutlook parameter enables or disables access to the mailbox by Outlook for Mac clients that use Exchange Web Services.

EwsAllowMacOutlook

The EwsAllowOutlook parameter enables or disables access to the mailbox by Outlook clients that use Exchange Web Services.

EwsAllowOutlook

The EwsApplicationAccessPolicy parameter controls access to the mailbox using Exchange Web Services applications.

EwsApplicationAccessPolicy

The EwsBlockList parameter specifies the Exchange Web Services applications (user agent strings) that aren't allowed to access the mailbox using Exchange Web Services.

EwsBlockList

The EwsEnabled parameter enables or disables access to the mailbox using Exchange Web Services clients.

EwsEnabled

The ImapEnabled parameter enables or disables access to the mailbox using IMAP4 clients.

ImapEnabled

The ImapMessagesRetrievalMimeFormat parameter specifies the message format for IMAP4 clients that access the mailbox.

ImapMessagesRetrievalMimeFormat

The ImapForceICalForCalendarRetrievalOption parameter specifies how meeting requests are presented to IMAP4 clients that access the mailbox.

ImapForceICalForCalendarRetrievalOption

The ImapSuppressReadReceipt parameter controls the behavior of read receipts for IMAP4 clients that access the mailbox.

ImapSuppressReadReceipt

The ImapUseProtocolDefaults parameter specifies whether to use the IMAP4 protocol defaults for the mailbox.

ImapUseProtocolDefaults

The MacOutlookEnabled parameter enables or disables access to the mailbox using Outlook for Mac clients that use Microsoft Sync technology.

MacOutlookEnabled

The MAPIEnabled parameter enables or disables access to the mailbox using MAPI clients (for example, Outlook).

MAPIEnabled

The OneWinNativeOutlookEnabled parameter enables or disables access to the mailbox using the new Outlook for Windows.

OneWinNativeOutlookEnabled

The OutlookMobileEnabled parameter enables or disables access to the mailbox using Outlook for iOS and Android.

OutlookMobileEnabled

The OWAEnabled parameter enables or disables access to the mailbox using Outlook on the web (formerly known as Outlook Web App or OWA).

OWAEnabled

The OWAforDevicesEnabled parameter enables or disables access to the mailbox using the older Outlook Web App (OWA) app on iOS and Android devices.

OWAforDevicesEnabled

The OwaMailboxPolicy parameter specifies the Outlook on the web mailbox policy for the mailbox.

OwaMailboxPolicy

The PopEnabled parameter enables or disables access to the mailbox using POP3 clients.

PopEnabled

The PopForceICalForCalendarRetrievalOption parameter specifies how meeting requests are presented to POP3 clients that access the mailbox.

PopForceICalForCalendarRetrievalOption

The PopMessagesRetrievalMimeFormat parameter specifies the message format for POP3 clients that access the mailbox.

PopMessagesRetrievalMimeFormat

The PopSuppressReadReceipt parameter controls the behavior of read receipts for POP3 clients that access the mailbox.

PopSuppressReadReceipt

The PopUseProtocolDefaults parameter specifies whether to use the POP3 protocol defaults for the mailbox.

PopUseProtocolDefaults

The PublicFolderClientAccess parameter enables or disables access to public folders in Microsoft Outlook.

PublicFolderClientAccess

The ShowGalAsDefaultView parameter specifies whether the global address list (GAL) is the default recipient picker for messages.

ShowGalAsDefaultView

The SmtpClientAuthenticationDisabled parameter specifies whether to disable authenticated SMTP (SMTP AUTH) for the mailbox.

SmtpClientAuthenticationDisabled

The UniversalOutlookEnabled parameter enables or disables access to the mailbox using Windows 10 Mail and Calendar.

UniversalOutlookEnabled

Present ensures the Mailbox CAS settings are applied.

Ensure

This resource configures Client Access sRules.
Client Access Rules help you control access to your organization based
on the properties of the connection.

Note: Not all authentication types are supported for all protocols.

The supported authentication types per protocol can be found here:
https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/client-access-rules/client-access-rules

Schema for microsoft.exchange.clientaccessrule

The Identity parameter specifies the client access rule that you want to modify.

Identity

The Action parameter specifies the action for the client access rule. Valid values for this parameter are AllowAccess and DenyAccess.

Action

AdfsAuthentication BasicAuthentication CertificateBasedAuthentication NonBasicAuthentication OAuthAuthentication

The AnyOfAuthenticationTypes parameter specifies a condition for the client access rule that is based on the client's authentication type. Valid values for this parameter are AdfsAuthentication, BasicAuthentication, CertificateBasedAuthentication, NonBasicAuthentication, OAuthAuthentication.

AnyOfAuthenticationTypes

The AnyOfClientIPAddressesOrRanges parameter specifies a condition for the client access rule that is based on the client's IP address. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.

AnyOfClientIPAddressesOrRanges

ExchangeActiveSync ExchangeAdminCenter ExchangeWebServices IMAP4 OfflineAddressBook OutlookAnywhere OutlookWebApp POP3 PowerShellWebServices RemotePowerShell REST UniversalOutlook

The AnyOfProtocols parameter specifies a condition for the client access rule that is based on the client's protocol. Valid values for this parameter are ExchangeActiveSync,ExchangeAdminCenter,ExchangeWebServices,IMAP4,OfflineAddressBook,OutlookAnywhere,OutlookWebApp,POP3,PowerShellWebServices,RemotePowerShell,REST,UniversalOutlook.

AnyOfProtocols

The Enabled parameter specifies whether the client access rule is enabled or disabled. Default is $true.

Enabled

The ExceptAnyOfAuthenticationTypes parameter specifies an exception for the client access rule that is based on the client's authentication type. Valid values for this parameter are AdfsAuthentication, BasicAuthentication, CertificateBasedAuthentication, NonBasicAuthentication, OAuthAuthentication.

ExceptAnyOfAuthenticationTypes

The ExceptAnyOfClientIPAddressesOrRanges parameter specifies an exception for the client access rule that is based on the client's IP address. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.

ExceptAnyOfClientIPAddressesOrRanges

The ExceptAnyOfProtocols parameter specifies an exception for the client access rule that is based on the client's protocol. Valid values for this parameter are ExchangeActiveSync,ExchangeAdminCenter,ExchangeWebServices,IMAP4,OfflineAddressBook,OutlookAnywhere,OutlookWebApp,POP3,PowerShellWebServices,RemotePowerShell,REST,UniversalOutlook.

ExceptAnyOfProtocols

The ExceptUsernameMatchesAnyOfPatterns parameter specifies an exception for the client access rule that is based on the user's account name.

ExceptUsernameMatchesAnyOfPatterns

The Priority parameter specifies a priority value for the client access rule. A lower integer value indicates a higher priority, and a higher priority rule is evaluated before a lower priority rule. The default value is 1.

Priority

The RuleScope parameter specifies the scope of the client access rule. Valid values are All and Users

RuleScope

The UserRecipientFilter parameter specifies a condition for the client access rule that uses OPath filter syntax to identify the user.

UserRecipientFilter

The UsernameMatchesAnyOfPatterns parameter specifies a condition for the client access rule that is based on the user's account name.

UsernameMatchesAnyOfPatterns

Specifies if this Client Access Rule should exist.

Ensure

Create a new data classification policy in your cloud-based organization.

Schema for microsoft.exchange.dataclassification

The Identity parameter specifies the data classification rule that you want to modify.

Identity

The Description parameter specifies a description for the data classification rule. You use the Description parameter with the Locale and Name parameters to specify descriptions for the data classification rule in different languages.

Description

The Fingerprints parameter specifies the byte-encoded document files that are used as fingerprints by the data classification rule.

Fingerprints

IsDefault is used with the Locale parameter to specify the default language for the data classification rule.

IsDefault

The Locale parameter adds or removes languages that are associated with the data classification rule.

Locale

The Name parameter specifies a name for the data classification rule. The value must be less than 256 characters.

Name

Specifies if this policy should exist.

Ensure

Create a new Data Encryption policy in your cloud-based organization.

Schema for microsoft.exchange.dataencryptionpolicy

The Identity parameter specifies the data encryption policy that you want to modify.

Identity

The AzureKeyIDs parameter specifies the URI values of the Azure Key Vault keys to associate with the data encryption policy.

AzureKeyIDs

The Description parameter specifies an optional description for the data encryption policy

Description

The Enabled parameter enables or disable the data encryption policy.

Enabled

The Name parameter specifies the unique name for the data encryption policy.

Name

The PermanentDataPurgeContact parameter specifies a contact for the purge of all data that's encrypted by the data encryption policy.

PermanentDataPurgeContact

The PermanentDataPurgeReason parameter specifies a descriptive reason for the purge of all data that's encrypted by the data encryption policy

PermanentDataPurgeReason

Specifies if this policy should exist.

Ensure

This resource configures Exchange Online distribution groups.

Schema for microsoft.exchange.distributiongroup

The Identity parameter specifies the distribution group or mail-enabled security group that you want to modify. You can use any value that uniquely identifies the group.

Identity

The Name parameter specifies a unique name for the address list.

Name

Exchange alias (also known as the mail nickname) for the recipient

Alias

Is Bcc blocked for the distribution group.

BccBlocked

The ByPassNestedModerationEnabled parameter specifies how to handle message approval when a moderated group contains other moderated groups as members.

BypassNestedModerationEnabled

Description of the distribution group.

Description

The DisplayName parameter specifies the display name of the group. The display name is visible in the Exchange admin center and in address lists. The maximum length is 256 characters.

DisplayName

The HiddenGroupMembershipEnabled switch specifies whether to hide the members of the distribution group from members of the group and users who aren't members of the group.

HiddenGroupMembershipEnabled

The ManagedBy parameter specifies an owner for the group. A group must have at least one owner.

ManagedBy

The MemberDepartRestriction parameter specifies the restrictions that you put on requests to leave the group. Valid values are: Open & Closed

MemberDepartRestriction

The MemberJoinRestriction parameter specifies the restrictions that you put on requests to join the group. Valid values are: Open, Closed & ApprovalRequired

MemberJoinRestriction

The Members parameter specifies the recipients (mail-enabled objects) that are members of the group. You can use any value that uniquely identifies the recipient.

Members

The ModeratedBy parameter specifies one or more moderators for this group. A moderator approves messages sent to the group before the messages are delivered. A moderator must be a mailbox, mail user, or mail contact in your organization. You can use any value that uniquely identifies the moderator.

ModeratedBy

The ModerationEnabled parameter specifies whether moderation is enabled for this recipient.

ModerationEnabled

The Notes parameters specifies additional information about the object.

Notes

The OrganizationalUnit parameter specifies the location in Active Directory where the group is created.

OrganizationalUnit

The PrimarySmtpAddress parameter specifies the primary return email address that's used for the recipient.

PrimarySmtpAddress

The RequireSenderAuthenticationEnabled parameter specifies whether to accept messages only from authenticated (internal) senders.

RequireSenderAuthenticationEnabled

The RoomList switch specifies that all members of this distribution group are room mailboxes. You don't need to specify a value with this switch.

RoomList

The AcceptMessagesOnlyFrom parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.

AcceptMessagesOnlyFrom

The AcceptMessagesOnlyFromDLMembers parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.

AcceptMessagesOnlyFromDLMembers

The AcceptMessagesOnlyFromSendersOrMembers parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.

AcceptMessagesOnlyFromSendersOrMembers

This parameter specifies a value for the CustomAttribute1 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute1

This parameter specifies a value for the CustomAttribute2 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute2

This parameter specifies a value for the CustomAttribute3 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute3

This parameter specifies a value for the CustomAttribute4 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute4

This parameter specifies a value for the CustomAttribute5 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute5

This parameter specifies a value for the CustomAttribute6 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute6

This parameter specifies a value for the CustomAttribute7 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute7

This parameter specifies a value for the CustomAttribute8 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute8

This parameter specifies a value for the CustomAttribute9 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute9

This parameter specifies a value for the CustomAttribute10 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute10

This parameter specifies a value for the CustomAttribute11 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute11

This parameter specifies a value for the CustomAttribute12 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute12

This parameter specifies a value for the CustomAttribute13 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute13

This parameter specifies a value for the CustomAttribute14 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute14

This parameter specifies a value for the CustomAttribute15 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters. If the value contains spaces, enclose the value in quotation marks.

CustomAttribute15

The EmailAddresses parameter specifies all email addresses (proxy addresses) for the recipient, including the primary SMTP address. In on-premises Exchange organizations, the primary SMTP address and other proxy addresses are typically set by email address policies. However, you can use this parameter to configure other proxy addresses for the recipient.

EmailAddresses

The GrantSendOnBehalfTo parameter specifies who can send on behalf of this group. Although messages send on behalf of the group clearly show the sender in the From field (<Sender> on behalf of <Group>), replies to these messages are delivered to the group, not the sender.

GrantSendOnBehalfTo

The HiddenFromAddressListsEnabled parameter specifies whether this recipient is visible in address lists.

HiddenFromAddressListsEnabled

The SendOofMessageToOriginatorEnabled parameter specifies how to handle out of office (OOF) messages for members of the group.

SendOofMessageToOriginatorEnabled

The SendModerationNotifications parameter specifies when moderation notification messages are sent. Valid values are: Always, Internal, Never.

SendModerationNotifications

The Type parameter specifies the type of group that you want to create. Valid values are: Distribution, Security

Type

Specifies if this AddressList should exist.

Ensure

This resource configures the DomainKeys Identified Mail (DKIM) signing policy
settings for domains in a cloud-based organization.

Schema for microsoft.exchange.dkimsigningconfig

The Identity parameter specifies the DKIM signing policy that you want to modify.  This should be the FQDN.

Identity

The AdminDisplayName parameter specifies a description for the policy.

AdminDisplayName

The BodyCanonicalization parameter specifies the canonicalization algorithm that's used to create and verify the message body part of the DKIM signature. This value effectively controls the sensitivity of DKIM to changes to the message body in transit. Valid values are 'Simple' or 'Relaxed'.  'Relaxed' is the default.

BodyCanonicalization

The HeaderCanonicalization parameter specifies the canonicalization algorithm that's used to create and verify the message header part of the DKIM signature. This value effectively controls the sensitivity of DKIM to changes to the message headers in transit. Valid values are 'Simple' or 'Relaxed'.  'Relaxed' is the default.

HeaderCanonicalization

The KeySize parameter specifies the size in bits of the public key that's used in the DKIM signing policy. Valid values are 1024 and 2048

KeySize

The Enabled parameter specifies whether the DKIM Signing Configuration is enabled or disabled. Default is $true.

Enabled

Specifies if this Client Access Rule should exist.

Ensure

This resource configures Email address policies in Exchange Online.

Schema for microsoft.exchange.emailaddresspolicy

The Name parameter specifies the unique name of the email address policy. The maximum length is 64 characters.

Name

The Priority parameter specifies the order that the email address policies are evaluated. By default, every time that you add a new email address policy, the policy is assigned a priority of N+1, where N is the number of email address policies that you've created.

Priority

The EnabledEmailAddressTemplates parameter specifies the rules in the email address policy that are used to generate email addresses for recipients.

EnabledEmailAddressTemplates

The EnabledPrimarySMTPAddressTemplate parameter specifies the specifies the rule in the email address policy that's used to generate the primary SMTP email addresses for recipients. You can use this parameter instead of the EnabledEmailAddressTemplates if the policy only applies the primary email address and no additional proxy addresses.

EnabledPrimarySMTPAddressTemplate

The ManagedByFilter parameter specifies the email address policies to apply to Office 365 groups based on the properties of the users who create the Office 365 groups.

ManagedByFilter

Specify if the Email Address Policy should exist or not.

Ensure

This resource configures EOP Protection Policy Rules.

Schema for microsoft.exchange.eopprotectionpolicyrule

The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.

Comments

The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email addresses in the specified domains. You can specify multiple domains separated by commas.

ExceptIfRecipientDomainIs

The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

ExceptIfSentTo

The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.

ExceptIfSentToMemberOf

The Identity parameter specifies the rule that you want to view. You can use any value that uniquely identifies the rule.

Identity

This parameter define if the rule is enabled or disabled

State

The Name parameter specifies a unique name for the rule. The maximum length is 64 characters.

Name

The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.

Priority

The RecipientDomainIs parameter specifies a condition that looks for recipients with email addresses in the specified domains. You can specify multiple domains separated by commas.

RecipientDomainIs

The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

SentTo

The SentToMemberOf parameter specifies a condition that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You can use any value that uniquely identifies the group.

SentToMemberOf

Present ensures the instance exists, absent ensures it is removed.

Ensure

This resource will use Set-ExternalInOutlook cmdlet to modify the configuration of external sender identification that's available in Outlook, Outlook for Mac, Outlook on the web, and Outlook for iOS and Android.

Schema for microsoft.exchange.externalinoutlook

OrganisationIDParameter, not needed for cmdlet Functionality, use 'ExternalinOutlook' to use the same configuration for multiple Tenants

Identity

The Enabled parameter enables or disables external sender identification in supported versions of Outlook. Valid values are:$true: External sender identification in Outlook is enabled. An External icon is added in the area of the subject line of messages from external senders. To exempt specific senders or sender domains from this identification, use the AllowList parameter.$false: External sender identification in Outlook is disabled.

Enabled

The AllowList parameter specifies exceptions to external sender identification in supported versions of Outlook. Messages received from the specified senders or senders in the specified domains don't receive native External sender identification. The allow list uses the 5322.From address (also known as the From address or P2 sender). Valid values are an individual domain (contoso.com), a domain and all subdomains (*.contoso.com) or email addresses (admin@contoso.com).

AllowList

Ensure

This resource configures Global Address Lists in Exchange Online.

Schema for microsoft.exchange.globaladdresslist

The Name parameter specifies the unique name of the GAL. The maximum length is 64 characters.

Name

The ConditionalCompany parameter specifies a precanned filter that's based on the value of the recipient's Company property.

ConditionalCompany

The ConditionalCustomAttribute1 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute1 property.

The ConditionalCustomAttribute10 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute10 property.

The ConditionalCustomAttribute11 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute11 property.

The ConditionalCustomAttribute12 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute12 property.

The ConditionalCustomAttribute13 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute13 property.

The ConditionalCustomAttribute14 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute14 property.

The ConditionalCustomAttribute15 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute15 property.

The ConditionalCustomAttribute2 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute2 property.

The ConditionalCustomAttribute3 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute3 property.

The ConditionalCustomAttribute4 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute4 property.

The ConditionalCustomAttribute5 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute5 property.

The ConditionalCustomAttribute6 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute6 property.

The ConditionalCustomAttribute7 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute7 property.

The ConditionalCustomAttribute8 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute8 property.

The ConditionalCustomAttribute9 parameter specifies a precanned filter that's based on the value of the recipient's CustomAttribute9 property.

The ConditionalDepartment parameter specifies a precanned filter that's based on the value of the recipient's Department property.

ConditionalDepartment

The ConditionalStateOrProvince parameter specifies a precanned filter that's based on the value of the recipient's StateOrProvince property.

ConditionalStateOrProvince

The IncludedRecipients parameter specifies a precanned filter that's based on the recipient type.

IncludedRecipients

The RecipientFilter parameter specifies an OPath filter that's based on the value of any available recipient property.

RecipientFilter

Specify if the Global Address List should exist or not.

Ensure

This resource configures settings on groups
such as the custom attributes and language.

Schema for microsoft.exchange.groupsettings

The DisplayName parameter specifies the name of the Microsoft 365 Group. The display name is visible in the Exchange admin center, address lists, and Outlook. The maximum length is 64 characters.

DisplayName

The unique Id of the group

Id

The AcceptMessagesOnlyFromSendersOrMembers parameter specifies who is allowed to send messages to this recipient. Messages from other senders are rejected.

AcceptMessagesOnlyFromSendersOrMembers

Private

AccessType

The AlwaysSubscribeMembersToCalendarEvents switch controls the default subscription settings of new members that are added to the Microsoft 365 Group. Changing this setting doesn't affect existing group members.

AlwaysSubscribeMembersToCalendarEvents

AuditLogAgeLimit

The AutoSubscribeNewMembers switch specifies whether to automatically subscribe new members that are added to the Microsoft 365 Group to conversations and calendar events. Only users that are added to the group after you enable this setting are automatically subscribed to the group.

AutoSubscribeNewMembers

The CalendarMemberReadOnly parameter specifies whether to set read-only Calendar permissions to the Microsoft 365 Group for members of the group.

CalendarMemberReadOnly

The CalendarMemberReadOnly switch specifies whether to set read-only Calendar permissions to the Microsoft 365 Group for members of the group.

Classification

ConnectorsEnabled

This parameter specifies a value for the CustomAttribute1 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute1

This parameter specifies a value for the CustomAttribute2 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute2

This parameter specifies a value for the CustomAttribute3 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute3

This parameter specifies a value for the CustomAttribute4 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute4

This parameter specifies a value for the CustomAttribute5 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute5

This parameter specifies a value for the CustomAttribute6 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute6

This parameter specifies a value for the CustomAttribute7 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute7

This parameter specifies a value for the CustomAttribute8 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute8

This parameter specifies a value for the CustomAttribute9 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute9

This parameter specifies a value for the CustomAttribute10 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute10

This parameter specifies a value for the CustomAttribute11 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute11

This parameter specifies a value for the CustomAttribute12 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute12

This parameter specifies a value for the CustomAttribute13 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute13

This parameter specifies a value for the CustomAttribute14 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute14

This parameter specifies a value for the CustomAttribute15 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. The maximum length is 1024 characters.

CustomAttribute15

The DataEncryptionPolicy parameter specifies the data encryption policy that's applied to the Microsoft 365 Group.

DataEncryptionPolicy

The EmailAddresses parameter specifies all the email addresses (proxy addresses) for the recipient, including the primary SMTP address.

EmailAddresses

This parameter specifies a value for the ExtensionCustomAttribute1 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.

This parameter specifies a value for the ExtensionCustomAttribute2 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.

This parameter specifies a value for the ExtensionCustomAttribute3 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.

This parameter specifies a value for the ExtensionCustomAttribute4 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.

This parameter specifies a value for the ExtensionCustomAttribute5 property on the recipient. You can use this property to store custom information about the recipient, and to identify the recipient in filters. You can specify up to 1300 values separated by commas.

The GrantSendOnBehalfTo parameter specifies who can send on behalf of this Microsoft 365 Group.

GrantSendOnBehalfTo

HiddenFromAddressListsEnabled

The HiddenFromExchangeClientsEnabled switch specifies whether the Microsoft 365 Group is hidden from Outlook clients connected to Microsoft 365.

HiddenFromExchangeClientsEnabled

The InformationBarrierMode parameter specifies the information barrier mode for the Microsoft 365 Group.

InformationBarrierMode

This parameter specifies whether or not members are allow to edit content.

IsMemberAllowedToEditContent

The Language parameter specifies language preference for the Microsoft 365 Group.

Language

The MailboxRegion parameter specifies the preferred data location (PDL) for the Microsoft 365 Group in multi-geo environments.

MailboxRegion

The MailTip parameter specifies the custom MailTip text for this recipient. The MailTip is shown to senders when they start drafting an email message to this recipient.

MailTip

The MailTipTranslations parameter specifies additional languages for the custom MailTip text that's defined by the MailTip parameter.

MailTipTranslations

The MaxReceiveSize parameter specifies the maximum size of an email message that can be sent to this group. Messages that exceed the maximum size are rejected by the group.

MaxReceiveSize

The MaxSendSize parameter specifies the maximum size of an email message that can be sent by this group.

MaxSendSize

The ModeratedBy parameter specifies one or more moderators for this recipient. A moderator approves messages sent to the recipient before the messages are delivered. A moderator must be a mailbox, mail user, or mail contact in your organization. You can use any value that uniquely identifies the moderator.

ModeratedBy

The ModerationEnabled parameter specifies whether moderation is enabled for this recipient.

ModerationEnabled

The Notes parameter specifies the description of the Microsoft 365 Group. If the value contains spaces, enclose the value in quotation marks.

Notes

The PrimarySmtpAddress parameter specifies the primary return email address that's used for the recipient. You can't use the EmailAddresses and PrimarySmtpAddress parameters in the same command.

PrimarySmtpAddress

The RejectMessagesFromSendersOrMembers parameter specifies who isn't allowed to send messages to this recipient. Messages from these senders are rejected.

RejectMessagesFromSendersOrMembers

The RequireSenderAuthenticationEnabled parameter specifies whether to accept messages only from authenticated (internal) senders.

RequireSenderAuthenticationEnabled

The SensitivityLabelId parameter specifies the GUID value of the sensitivity label that's assigned to the Microsoft 365 Group.

SensitivityLabelId

The SubscriptionEnabled switch specifies whether the group owners can enable subscription to conversations and calendar events on the groups they own.

SubscriptionEnabled

The UnifiedGroupWelcomeMessageEnabled switch specifies whether to enable or disable sending system-generated welcome messages to users who are added as members to the Microsoft 365 Group.

UnifiedGroupWelcomeMessageEnabled

This resource configures the settings of connection filter policies
in your cloud-based organization.

Schema for microsoft.exchange.hostedconnectionfilterpolicy

The Identity parameter specifies the Hosted Connection Filter Policy that you want to modify.

Identity

The AdminDisplayName parameter specifies a description for the policy.

AdminDisplayName

The EnableSafeList parameter enables or disables use of the safe list. The safe list is a dynamic allow list in the Microsoft datacenter that requires no customer configuration. Valid input for this parameter is $true or $false. The default value is $false.

EnableSafeList

The IPAllowList parameter specifies IP addresses from which messages are always allowed. Messages from the IP addresses you specify won't be identified as spam, despite any other spam characteristics of the messages. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.

IPAllowList

The IPBlockList parameter specifies IP addresses from which messages are never allowed. Messages from the IP addresses you specify are blocked without any further spam scanning. Valid values for this parameter are: A single IP address, an IP address range, a CIDR IP.

IPBlockList

The MakeDefault parameter makes the specified policy the default connection filter policy. Default is $false.

MakeDefault

Specifies if this Hosted Connection Filter Policy should exist.

Ensure

Schema for microsoft.exchange.hostedcontentfilterpolicy

The Identity parameter specifies the name of the Hosted Content Filter Policy that you want to modify.

Identity

The AddXHeaderValue parameter specifies the X-header value to add to spam messages when an action parameter is set to the value AddXHeader.

AddXHeaderValue

AdminDisplayName

The AllowedSenderDomains parameter specifies trusted domains that aren't processed by the spam filter.

AllowedSenderDomains

The AllowedSenders parameter specifies a list of trusted senders that aren't processed by the spam filter.

AllowedSenders

The BlockedSenderDomains parameter specifies domains that are always marked as spam sources.

BlockedSenderDomains

The BlockedSenders parameter specifies senders that are always marked as spam sources.

BlockedSenders

The BulkQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as bulk email.

BulkQuarantineTag

MoveToJmf AddXHeader ModifySubject Redirect Delete Quarantine NoAction

The BulkSpamAction parameter specifies the action to take on messages that are classified as bulk email.

BulkSpamAction

The BulkThreshold parameter specifies the Bulk Complaint Level (BCL) threshold setting. Valid values are from 1 - 9, where 1 marks most bulk email as spam, and 9 allows the most bulk email to be delivered. The default value is 7.

BulkThreshold

The DownloadLink parameter shows or hides a link in end-user spam notification messages to download the Junk Email Reporting Tool plugin for Outlook. Valid input for this parameter is $true or $false. The default value is $false.

DownloadLink

The EnableEndUserSpamNotification parameter enables for disables sending end-user spam quarantine notification messages. Valid input for this parameter is $true or $false. The default value is $false.

EnableEndUserSpamNotifications

The EnableLanguageBlockList parameter enables or disables blocking email messages that are written in specific languages, regardless of the message contents. Valid input for this parameter is $true or $false. The default value is $false.

EnableLanguageBlockList

The EnableRegionBlockList parameter enables or disables blocking email messages that are sent from specific countries or regions, regardless of the message contents. Valid input for this parameter is $true or $false. The default value is $false.

EnableRegionBlockList

The EndUserSpamNotificationCustomSubject parameter specifies a custom subject for end-user spam notification messages.

EndUserSpamNotificationCustomSubject

The EndUserSpamNotificationFrequency parameter specifies the repeat interval in days that end-user spam notification messages are sent. Valid input for this parameter is an integer between 1 and 15. The default value is 3.

EndUserSpamNotificationFrequency

Default English French German Italian Japanese Spanish Korean Portuguese Russian ChineseSimplified ChineseTraditional Amharic Arabic Bulgarian BengaliIndia Catalan Czech Cyrillic Danish Greek Estonian Basque Farsi Finnish Filipino Galician Gujarati Hebrew Hindi Croatian Hungarian Indonesian Icelandic Kazakh Kannada Lithuanian Latvian Malayalam Marathi Malay Dutch NorwegianNynorsk Norwegian Oriya Polish PortuguesePortugal Romanian Slovak Slovenian SerbianCyrillic Serbian Swedish Swahili Tamil Telugu Thai Turkish Ukrainian Urdu Vietnamese

The EndUserSpamNotificationLanguage parameter specifies the language of end-user spam notification messages. The default value is Default. This means the default language of end-user spam notification messages is the default language of the cloud-based organization.

EndUserSpamNotificationLanguage

The HighConfidencePhishAction parameter specifies the action to take on messages that are marked as high confidence phishing

HighConfidencePhishAction

The HighConfidencePhishQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as high confidence phishing.

HighConfidencePhishQuarantineTag

The HighConfidenceSpamAction parameter specifies the action to take on messages that are classified as high confidence spam.

HighConfidenceSpamAction

The HighConfidenceSpamQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as high confidence spam.

HighConfidenceSpamQuarantineTag

The IncreaseScoreWithBizOrInfoUrls parameter increases the spam score of messages that contain links to .biz or .info domains. Valid values for this parameter are Off, On or Test. The default value is Off.

IncreaseScoreWithBizOrInfoUrls

The IncreaseScoreWithImageLinks parameter increases the spam score of messages that contain image links to remote websites. Valid values for this parameter are Off, On or Test. The default value is Off.

IncreaseScoreWithImageLinks

The IncreaseScoreWithNumericIps parameter increases the spam score of messages that contain links to IP addresses. Valid values for this parameter are Off, On or Test. The default value is Off.

IncreaseScoreWithNumericIps

The IncreaseScoreWithRedirectToOtherPort parameter increases the spam score of messages that contain links that redirect to other TCP ports. Valid values for this parameter are Off, On or Test. The default value is Off.

IncreaseScoreWithRedirectToOtherPort

The InlineSafetyTipsEnabled parameter specifies whether to enable or disable safety tips that are shown to recipients in messages. The default is $true

InlineSafetyTipsEnabled

Default HighConfidencePhish Phish HighConfidenceSpam Spam Disabled

The IntraOrgFilterState parameter specifies whether to enable anti-spam filtering for messages sent between internal users (users in the same organization).

IntraOrgFilterState

The LanguageBlockList parameter specifies the languages to block when messages are blocked based on their language. Valid input for this parameter is a supported ISO 639-1 lowercase two-letter language code. You can specify multiple values separated by commas. This parameter is only use when the EnableRegionBlockList parameter is set to $true.

LanguageBlockList

The MakeDefault parameter makes the specified content filter policy the default content filter policy. The default value is $false

MakeDefault

The MarkAsSpamBulkMail parameter classifies the message as spam when the message is identified as a bulk email message. Valid values for this parameter are Off, On or Test. The default value is On.

MarkAsSpamBulkMail

The MarkAsSpamEmbedTagsInHtml parameter classifies the message as spam when the message contains HTML <embed> tags. Valid values for this parameter are Off, On or Test. The default value is Off.

MarkAsSpamEmbedTagsInHtml

The MarkAsSpamEmptyMessages parameter classifies the message as spam when the message is empty. Valid values for this parameter are Off, On or Test. The default value is Off.

MarkAsSpamEmptyMessages

The MarkAsSpamFormTagsInHtml parameter classifies the message as spam when the message contains HTML <form> tags. Valid values for this parameter are Off, On or Test. The default value is Off.

MarkAsSpamFormTagsInHtml

The MarkAsSpamFramesInHtml parameter classifies the message as spam when the message contains HTML <frame> or <iframe> tags. Valid values for this parameter are Off, On or Test. The default value is Off.

MarkAsSpamFramesInHtml

The MarkAsSpamFromAddressAuthFail parameter classifies the message as spam when Sender ID filtering encounters a hard fail. Valid values for this parameter are Off or On. The default value is Off.

MarkAsSpamFromAddressAuthFail

The MarkAsSpamJavaScriptInHtml parameter classifies the message as spam when the message contains JavaScript or VBScript. Valid values for this parameter are Off, On or Test. The default value is Off.

MarkAsSpamJavaScriptInHtml

The MarkAsSpamNdrBackscatter parameter classifies the message as spam when the message is a non-delivery report (NDR) to a forged sender. Valid values for this parameter are Off or On. The default value is Off.

MarkAsSpamNdrBackscatter

The MarkAsSpamObjectTagsInHtml parameter classifies the message as spam when the message contains HTML <object> tags. Valid values for this parameter are Off, On or Test. The default value is Off.

MarkAsSpamObjectTagsInHtml

The MarkAsSpamSensitiveWordList parameter classifies the message as spam when the message contains words from the sensitive words list. Valid values for this parameter are Off, On or Test. The default value is Off.

MarkAsSpamSensitiveWordList

The MarkAsSpamSpfRecordHardFail parameter classifies the message as spam when Sender Policy Framework (SPF) record checking encounters a hard fail. Valid values for this parameter are Off or On. The default value is Off.

MarkAsSpamSpfRecordHardFail

The MarkAsSpamWebBugsInHtml parameter classifies the message as spam when the message contains web bugs. Valid values for this parameter are Off, On or Test. The default value is Off.

MarkAsSpamWebBugsInHtml

The ModifySubjectValue parameter specifies the text to prepend to the existing subject of spam messages when an action parameter is set to the value ModifySubject.

ModifySubjectValue

The PhishSpamAction parameter specifies the action to take on messages that are classified as phishing

PhishSpamAction

The PhishQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as phishing.

PhishQuarantineTag

The SpamQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as spam.

SpamQuarantineTag

The QuarantineRetentionPeriod parameter specifies the length of time in days that spam messages remain in the quarantine. Valid input for this parameter is an integer between 1 and 30. The default value is 15.

QuarantineRetentionPeriod

The RedirectToRecipients parameter specifies the replacement recipients in spam messages when an action parameter is set to the value Redirect. The action parameters that use the value of RedirectToRecipients are BulkSpamAction, HighConfidencePhishAction, HighConfidenceSpamAction, PhishSpamAction and SpamAction.

RedirectToRecipients

The RegionBlockList parameter specifies the region to block when messages are blocked based on their source region. Valid input for this parameter is a supported ISO 3166-1 uppercase two-letter country code. You can specify multiple values separated by commas. This parameter is only used when the EnableRegionBlockList parameter is set to $true.

RegionBlockList

The SpamAction parameter specifies the action to take on messages that are classified as spam (not high confidence spam, bulk email, or phishing).

SpamAction

The TestModeAction parameter specifies the additional action to take on messages that match any of the IncreaseScoreWith or MarkAsSpam parameters that are set to the value Test.

TestModeAction

The TestModeBccToRecipients parameter specifies the blind carbon copy recipients to add to spam messages when the TestModeAction action parameter is set to the value BccMessage.

TestModeBccToRecipients

The PhishZapEnabled parameter enables or disables zero-hour auto purge (ZAP) to detect phishing messages in delivered messages in Exchange Online mailboxes.

PhishZapEnabled

The SpamZapEnabled parameter enables or disables zero-hour auto purge (ZAP) to detect spam in delivered messages in Exchange Online mailboxes.

SpamZapEnabled

Specify if this policy should exist or not.

Ensure

This resource configures an Hosted Content Filter Rule in Exchange Online.
Reference: https://docs.microsoft.com/en-us/powershell/module/exchange/advanced-threat-protection/new-HostedContentFilterRule?view=exchange-ps

Schema for microsoft.exchange.hostedcontentfilterrule

The Identity parameter specifies the name of the HostedContentFilter rule that you want to modify.

Identity

The HostedContentFilterPolicy parameter specifies the name of the HostedContentFilter policy that's associated with the HostedContentFilter rule.

HostedContentFilterPolicy

Specify if this rule should be enabled. Default is $true.

Enabled

The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.

Priority

The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.

Comments

The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

ExceptIfRecipientDomainIs

The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

ExceptIfSentTo

The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.

ExceptIfSentToMemberOf

The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

RecipientDomainIs

The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

SentTo

The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.

SentToMemberOf

Specify if this rule should exist or not.

Ensure

This resource configures the settings of the outbound spam filter policy
in your cloud-based organization.

Schema for microsoft.exchange.hostedoutboundspamfilterpolicy

The Identity parameter specifies the name of the policy that you want to modify. There is only one policy named 'Default'

Identity

The AdminDisplayName parameter specifies a description for the policy.

AdminDisplayName

The BccSuspiciousOutboundAdditionalRecipients parameter specifies the recipients to add to the Bcc field of outgoing spam messages. Valid input for this parameter is an email address. Separate multiple email addresses with commas.

BccSuspiciousOutboundAdditionalRecipients

The BccSuspiciousOutboundMail parameter enables or disables adding recipients to the Bcc field of outgoing spam messages. Valid input for this parameter is $true or $false. The default value is $false. You specify the additional recipients using the BccSuspiciousOutboundAdditionalRecipients parameter.

BccSuspiciousOutboundMail

The NotifyOutboundSpam parameter enables or disables sending notification messages to administrators when an outgoing message is determined to be spam. Valid input for this parameter is $true or $false. The default value is $false. You specify the administrators to notify by using the NotifyOutboundSpamRecipients parameter.

NotifyOutboundSpam

The NotifyOutboundSpamRecipients parameter specifies the administrators to notify when an outgoing message is determined to be spam. Valid input for this parameter is an email address. Separate multiple email addresses with commas.

NotifyOutboundSpamRecipients

The RecipientLimitInternalPerHour parameter specifies the maximum number of internal recipients that a user can send to within an hour. A valid value is 0 to 10000. The default value is 0, which means the service defaults are used.

RecipientLimitInternalPerHour

The RecipientLimitPerDay parameter specifies the maximum number of recipients that a user can send to within a day. A valid value is 0 to 10000. The default value is 0, which means the service defaults are used.

RecipientLimitPerDay

The RecipientLimitExternalPerHour parameter specifies the maximum number of external recipients that a user can send to within an hour. A valid value is 0 to 10000. The default value is 0, which means the service defaults are used.

RecipientLimitExternalPerHour

The ActionWhenThresholdReached parameter specifies the action to take when any of the limits specified in the policy are reached. Valid values are: Alert, BlockUser, BlockUserForToday. BlockUserForToday is the default value.

ActionWhenThresholdReached

The AutoForwardingMode specifies how the policy controls automatic email forwarding to outbound recipients. Valid values are: Automatic, On, Off.

AutoForwardingMode

Specify if this policy should exist or not.

Ensure

This resource configures an Hosted Content Filter Rule in Exchange Online.
Reference: https://docs.microsoft.com/en-us/powershell/module/exchange/new-hostedoutboundspamfilterrule?view=exchange-ps

Schema for microsoft.exchange.hostedoutboundspamfilterrule

The Identity parameter specifies the name of the HostedOutboundSpamFilter rule that you want to modify.

Identity

The HostedOutboundSpamFilterPolicy parameter specifies the name of the HostedOutboundSpamFilter policy that's associated with the HostedOutboundSpamFilter rule.

HostedOutboundSpamFilterPolicy

Specify if this rule should be enabled. Default is $true.

Enabled

The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.

Priority

The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.

Comments

The ExceptIfSenderDomainIs parameter specifies an exception that looks for senders with email address in the specified domains. You can specify multiple domains separated by commas.

ExceptIfSenderDomainIs

The ExceptIfFrom parameter specifies an exception that looks for messages from specific senders. You can use any value that uniquely identifies the sender.

ExceptIfFrom

The ExceptIfFromMemberOf parameter specifies an exception that looks for messages sent by group members. You can use any value that uniquely identifies the group.

ExceptIfFromMemberOf

The SenderDomainIs parameter specifies a condition that looks for senders with email address in the specified domains. You can specify multiple domains separated by commas.

SenderDomainIs

The From parameter specifies a condition that looks for messages from specific senders. You can use any value that uniquely identifies the sender.

From

The FromMemberOf parameter specifies a condition that looks for messages sent by group members. You can use any value that uniquely identifies the group.

FromMemberOf

Specify if this rule should exist or not.

Ensure

This resource configures an Inbound connector in your cloud-based organization.

Schema for microsoft.exchange.inboundconnector

The Identity parameter specifies the outbound connector that you want to modify.

Identity

The AssociatedAcceptedDomains parameter specifies the accepted domains that the connector applies to, thereby limiting its scope. For example, you can apply the connector to a specific accepted domain in your organization, such as contoso.com.

AssociatedAcceptedDomains

The CloudServicesMailEnabled parameter specifies whether the connector is used for hybrid mail flow between an on-premises Exchange environment and Microsoft Office 365. Specifically, this parameter controls how certain internal X-MS-Exchange-Organization-* message headers are handled in messages that are sent between accepted domains in the on-premises and cloud organizations. These headers are collectively known as cross-premises headers. DO NOT USE MANUALLY!

CloudServicesMailEnabled

The Comment parameter specifies an optional comment.

Comment

The ConnectorSource parameter specifies how the connector is created. DO NOT CHANGE THIS!

ConnectorSource

The ConnectorType parameter specifies a category for the domains that are serviced by the connector. Valid values are Partner and OnPremises

ConnectorType

The EFSkipIPs parameter specifies the source IP addresses to skip in Enhanced Filtering for Connectors when the EFSkipLastIP parameter value is $false.

EFSkipIPs

The EFSkipLastIP parameter specifies the behavior of Enhanced Filtering for Connectors.

EFSkipLastIP

The EFUsers parameter specifies the recipients that Enhanced Filtering for Connectors applies to.

EFUsers

Specifies whether connector is enabled.

Enabled

The RequireTLS parameter specifies that all messages received by this connector require TLS transmission. Valid values for this parameter are $true or $false. The default value is $false. When the RequireTLS parameter is set to $true, all messages received by this connector require TLS transmission.

RequireTls

The RestrictDomainsToCertificate parameter specifies that Office 365 should identify incoming messages that are eligible for this connector by verifying that the remote server authenticates using a TLS certificate that has the TlsSenderCertificateName in the Subject.

RestrictDomainsToCertificate

The RestrictDomainsToIPAddresses parameter, when set to $true, automatically rejects mail from the domains specified by the SenderDomains parameter if the mail originates from an IP address that isn't specified by the SenderIPAddresses parameter.

RestrictDomainsToIPAddresses

The SenderDomains parameter specifies the remote domains from which this connector accepts messages, thereby limiting its scope. You can use a wildcard character to specify all subdomains of a specified domain, as shown in the following example: *.contoso.com. However, you can't embed a wildcard character, as shown in the following example: domain.*.contoso.com.

SenderDomains

The SenderIPAddresses parameter specifies the remote IP addresses from which this connector accepts messages.

SenderIPAddresses

The TlsSenderCertificateName parameter specifies the certificate used by the sender's domain when the RequireTls parameter is set to $true. Valid input for the TlsSenderCertificateName parameter is an SMTP domain.

TlsSenderCertificateName

The TreatMessagesAsInternal parameter specifies an alternative method to identify messages sent from an on-premises organization as internal messages. You should only consider using this parameter when your on-premises organization doesn't use Exchange.

TreatMessagesAsInternal

Specifies if this Outbound connector should exist.

Ensure

Create a new EXOIntraOrganizationConnector in your cloud-based organization.

Schema for microsoft.exchange.intraorganizationconnector

The Identity parameter specifies the intraorg connector that you want to modify.

Identity

The DiscoveryEndpoint parameter specifies the externally-accessible URL that's used for the Autodiscover service for the domain that's configured in the Intra-Organization connector.

DiscoveryEndpoint

Specifies whether connector is enabled.

Enabled

The TargetAddressDomains parameter specifies the domain namespaces that will be used in the Intra-organization connector. These domains must have valid Autodiscover endpoints defined in their organizations. The domains and their associated Autodiscover endpoints are used by the Intra-Organization connector for feature and service connectivity. You can specify multiple domains separated by commas.

TargetAddressDomains

The TargetSharingEpr parameter specifies the URL of the target Exchange Web Services that will be used in the Intra-Organization connector.

TargetSharingEpr

Specifies if this Intra-Organization connector should exist.

Ensure

Modify the resource Configuration policy in your cloud-based organization.

Schema for microsoft.exchange.irmconfiguration

Only valid value is 'Yes'.

IsSingleInstance

The AutomaticServiceUpdateEnabled parameter specifies whether to allow the automatic addition of new features within Azure Information Protection for your cloud-based organization.

AutomaticServiceUpdateEnabled

The AzureRMSLicensingEnabled parameter specifies whether the Exchange Online organization can to connect directly to Azure Rights Management.

AzureRMSLicensingEnabled

The DecryptAttachmentForEncryptOnly parameter specifies whether mail recipients have unrestricted rights on the attachment or not for Encrypt-only mails sent using Microsoft Purview Message Encryption.

DecryptAttachmentForEncryptOnly

The EDiscoverySuperUserEnabled parameter specifies whether members of the Discovery Management role group can access IRM-protected messages in a discovery mailbox that were returned by a discovery search.

EDiscoverySuperUserEnabled

The EnablePdfEncryption parameter specifies whether to enable the encryption of PDF attachments using Microsoft Purview Message Encryption.

EnablePdfEncryption

The InternalLicensingEnabled parameter specifies whether to enable IRM features for messages that are sent to internal and external recipients.

InternalLicensingEnabled

The JournalReportDecryptionEnabled parameter specifies whether to enable journal report decryption.

JournalReportDecryptionEnabled

The LicensingLocation parameter specifies the RMS licensing URLs. You can specify multiple URL values separated by commas.

LicensingLocation

This parameter is available only in the cloud-based service.

RejectIfRecipientHasNoRights

The RMSOnlineKeySharingLocation parameter specifies the Azure Rights Management URL that's used to get the trusted publishing domain (TPD) for the Exchange Online organization.

RMSOnlineKeySharingLocation

The SearchEnabled parameter specifies whether to enable searching of IRM-encrypted messages in Outlook on the web (formerly known as Outlook Web App).

SearchEnabled

The SimplifiedClientAccessDoNotForwardDisabled parameter specifies whether to disable Do not forward in Outlook on the web.

SimplifiedClientAccessDoNotForwardDisabled

The SimplifiedClientAccessEnabled parameter specifies whether to enable the Protect button in Outlook on the web.

SimplifiedClientAccessEnabled

The SimplifiedClientAccessEncryptOnlyDisabled parameter specifies whether to disable Encrypt only in Outlook on the web.

SimplifiedClientAccessEncryptOnlyDisabled

The TransportDecryptionSetting parameter specifies the transport decryption configuration.

TransportDecryptionSetting

Specifies if this Outbound connector should exist.

Ensure

This resource allows to configure Journal Rules in Exchange Online.

Schema for microsoft.exchange.journalrule

Name of the Journal Rule

Name

The JournalEmailAddress parameter specifies a recipient object to which journal reports are sent. You can use any value that uniquely identifies the recipient.

JournalEmailAddress

The Recipient parameter specifies the SMTP address of a mailbox, contact, or distribution group to journal. If you specify a distribution group, all recipients in that distribution group are journaled. All messages sent to or from a recipient are journaled.

Recipient

Specifies whether the Journal Rule is enabled or not.

Enabled

The Scope parameter specifies the scope of email messages to which the journal rule is applied

RuleScope

Present ensures the rule exists, Absent that it does not.

Ensure

This resource configures the Auto Reply settings of mailboxes.

Schema for microsoft.exchange.mailboxautoreplyconfiguration

The Identity parameter specifies the mailbox that you want to modify. You can use any value that uniquely identifies the mailbox.

Identity

User Principal Name of the mailbox owner

Owner

The AutoDeclineFutureRequestsWhenOOF parameter specifies whether to automatically decline new meeting requests that are sent to the mailbox during the scheduled time period when Automatic Replies are being sent.

AutoDeclineFutureRequestsWhenOOF

The AutoReplyState parameter specifies whether the mailbox is enabled for Automatic Replies. Valid values are: Enabled, Disabled, Scheduled

AutoReplyState

The CreateOOFEvent parameter specifies whether to create a calendar event that corresponds to the scheduled time period when Automatic Replies are being sent for the mailbox.

CreateOOFEvent

The DeclineAllEventsForScheduledOOF parameter specifies whether to decline all existing calendar events in the mailbox during the scheduled time period when Automatic Replies are being sent.

DeclineAllEventsForScheduledOOF

The DeclineEventsForScheduledOOF parameter specifies whether it's possible to decline existing calendar events in the mailbox during the scheduled time period when Automatic Replies are being sent.

DeclineEventsForScheduledOOF

The DeclineMeetingMessage parameter specifies the text in the message when meetings requests that are sent to the mailbox are automatically declined.

DeclineMeetingMessage

The EndTime parameter specifies the end date and time that Automatic Replies are sent for the mailbox. You use this parameter only when the AutoReplyState parameter is set to Scheduled, and the value of this parameter is meaningful only when AutoReplyState is Scheduled.

EndTime

The EventsToDeleteIDs parameter specifies the calendar events to delete from the mailbox when the DeclineEventsForScheduledOOF parameter is set to $true.

EventsToDeleteIDs

The ExternalAudience parameter specifies whether Automatic Replies are sent to external senders. Valid values are: None, Known, All

ExternalAudience

The ExternalMessage parameter specifies the Automatic Replies message that's sent to external senders or senders outside the organization. If the value contains spaces, enclose the value in quotation marks.

ExternalMessage

The InternalMessage parameter specifies the Automatic Replies message that's sent to internal senders or senders within the organization. If the value contains spaces, enclose the value in quotation marks.

InternalMessage

The OOFEventSubject parameter specifies the subject for the calendar event that's automatically created when the CreateOOFEvent parameter is set to $true.

OOFEventSubject

The StartTime parameter specifies the start date and time that Automatic Replies are sent for the specified mailbox. You use this parameter only when the AutoReplyState parameter is set to Scheduled, and the value of this parameter is meaningful only when AutoReplyState is Scheduled.

StartTime

Represents the existence of the instance. This must be set to 'Present'

Ensure

This resource configures calendar publishing or sharing settings on a mailbox
for the visibility of calendar information to external users.

Schema for microsoft.exchange.mailboxcalendarfolder

The Identity parameter specifies the calendar folder that you want to modify.

Identity

The DetailLevel parameter specifies the level of calendar detail that's published and available to anonymous users.

DetailLevel

OneDay ThreeDays OneWeek OneMonth ThreeMonths SixMonths OneYear

The PublishDateRangeFrom parameter specifies the start date of calendar information to publish (past information).

PublishDateRangeFrom

The PublishDateRangeTo parameter specifies the end date of calendar information to publish (future information).

PublishDateRangeTo

The PublishEnabled parameter specifies whether to publish the specified calendar information.

PublishEnabled

The SearchableUrlEnabled parameter specifies whether the published calendar URL is discoverable on the web.

SearchableUrlEnabled

The SharedCalendarSyncStartDate parameter specifies the limit for past events in the shared calendar that are visible to delegates. A copy of the shared calendar within the specified date range is stored in the delegate's mailbox.

SharedCalendarSyncStartDate

Determines whether or not the instance exist.

Ensure

Use this resource to modify the permissions of mailbox.

Schema for microsoft.exchange.mailboxpermission

The Identity parameter specifies the mailbox where you want to assign permissions to the user. You can use any value that uniquely identifies the mailbox.

Identity

The AccessRights parameter specifies the permission that you want to add for the user on the mailbox. Valid values are: ChangeOwner, ChangePermission, DeleteItem, ExternalAccount, FullAccess and ReadPermission.

AccessRights

The User parameter specifies who gets the permissions on the mailbox.

User

None All Children Descendents SelfAndChildren

The InheritanceType parameter specifies how permissions are inherited by folders in the mailbox. Valid values are: None, All, Children, Descendents, SelfAndChildren.

InheritanceType

The Owner parameter specifies the owner of the mailbox object.

Owner

The Deny switch specifies that the permissions you're adding are Deny permissions.

Deny

Determines whether or not the permission should exist on the mailbox.

Ensure

Identity AccessRights User InheritanceType

Use this resource to modify the settings of mailbox plans in the cloud-based service.

Schema for microsoft.exchange.mailboxplan

The Identity parameter specifies the Mailbox Plan that you want to modify.

Identity

The display name of the mailbox plan.

DisplayName

MailboxPlans cannot be created/removed in O365.  This must be set to 'Present'

Ensure

The IssueWarningQuota parameter specifies the warning threshold for the size of the mailboxes that are created or enabled using the mailbox plan.

IssueWarningQuota

The MaxReceiveSize parameter specifies the maximum size of a message that can be sent to the mailbox.

MaxReceiveSize

The MaxSendSize parameter specifies the maximum size of a message that can be sent by the mailbox.

MaxSendSize

The ProhibitSendQuota parameter specifies a size limit for the mailbox.

ProhibitSendQuota

The ProhibitSendReceiveQuota parameter specifies a size limit for the mailbox.

ProhibitSendReceiveQuota

The RetainDeletedItemsFor parameter specifies the length of time to keep soft-deleted items for the mailbox.

RetainDeletedItemsFor

The RetentionPolicy parameter specifies the retention policy that's applied to the mailbox.

RetentionPolicy

The RoleAssignmentPolicy parameter specifies the role assignment policy that's applied to the mailbox.

RoleAssignmentPolicy

This resource configures settings on Mailboxes
such as the Regional settings and its timezone.

Schema for microsoft.exchange.mailboxsettings

The display name of the Shared Mailbox

DisplayName

The name of the Time Zone to assign to the mailbox

TimeZone

The code of the Locale to assign to the mailbox

Locale

Present ensures the Mailbox Settings are applied

Ensure

This resource configures Exchange Online address lists.

Schema for microsoft.exchange.mailcontact

The Name parameter specifies a unique name for the mail contact.

Name

The ExternalEmailAddress parameter specifies the target email address of the mail contact or mail user. By default, this value is used as the primary email address of the mail contact or mail user.

ExternalEmailAddress

The Alias parameter specifies the Exchange alias (also known as the mail nickname) for the recipient. This value identifies the recipient as a mail-enabled object, and shouldn't be confused with multiple email addresses for the same recipient (also known as proxy addresses). A recipient can have only one Alias value. The maximum length is 64 characters.

Alias

The DisplayName parameter specifies the display name of the mail contact. The display name is visible in the Exchange admin center and in address lists.

DisplayName

The FirstName parameter specifies the user's first name.

FirstName

The Initials parameter specifies the user's middle initials.

Initials

The LastName parameter specifies the user's last name.

LastName

The MacAttachmentFormat parameter specifies the Apple Macintosh operating system attachment format to use for messages sent to the mail contact or mail user. Valid values are: BinHex, UuEncode, AppleSingle, AppleDouble

MacAttachmentFormat

The MessageBodyFormat parameter specifies the message body format for messages sent to the mail contact or mail user. Valid values are: Text, Html, TextAndHtml

MessageBodyFormat

The MessageFormat parameter specifies the message format for messages sent to the mail contact or mail user. Valid values are: Mime, Text

MessageFormat

The ModeratedBy parameter specifies one or more moderators for this mail contact. A moderator approves messages sent to the mail contact before the messages are delivered. A moderator must be a mailbox, mail user, or mail contact in your organization.

ModeratedBy

The ModerationEnabled parameter specifies whether moderation is enabled for this recipient.

ModerationEnabled

The OrganizationalUnit parameter specifies the location in Active Directory where the new contact is created.

OrganizationalUnit

The SendModerationNotifications parameter specifies when moderation notification messages are sent. Valid values are: ALways, Internal, Never

SendModerationNotifications

The UsePreferMessageFormat specifies whether the message format settings configured for the mail user or mail contact override the global settings configured for the remote domain or configured by the message sender

UsePreferMessageFormat

The CustomAttribute1 parameter specifies the value of the CustomAttribute1

CustomAttribute1

The CustomAttribute2 parameter specifies the value of the CustomAttribute2

CustomAttribute2

The CustomAttribute3 parameter specifies the value of the CustomAttribute3

CustomAttribute3

The CustomAttribute4 parameter specifies the value of the CustomAttribute4

CustomAttribute4

The CustomAttribute5 parameter specifies the value of the CustomAttribute5

CustomAttribute5

The CustomAttribute6 parameter specifies the value of the CustomAttribute6

CustomAttribute6

The CustomAttribute7 parameter specifies the value of the CustomAttribute7

CustomAttribute7

The CustomAttribute8 parameter specifies the value of the CustomAttribute8

CustomAttribute8

The CustomAttribute9 parameter specifies the value of the CustomAttribute9

CustomAttribute9

The CustomAttribute10 parameter specifies the value of the CustomAttribute10

CustomAttribute10

The CustomAttribute11 parameter specifies the value of the CustomAttribute11

CustomAttribute11

The CustomAttribute12 parameter specifies the value of the CustomAttribute12

CustomAttribute12

The CustomAttribute13 parameter specifies the value of the CustomAttribute13

CustomAttribute13

The CustomAttribute14 parameter specifies the value of the CustomAttribute14

CustomAttribute14

The CustomAttribute15 parameter specifies the value of the CustomAttribute15

CustomAttribute15

The ExtensionCustomAttribute1 parameter specifies the value of the ExtensionCustomAttribute1

The ExtensionCustomAttribute2 parameter specifies the value of the ExtensionCustomAttribute2

The ExtensionCustomAttribute3 parameter specifies the value of the ExtensionCustomAttribute3

The ExtensionCustomAttribute4 parameter specifies the value of the ExtensionCustomAttribute4

The ExtensionCustomAttribute5 parameter specifies the value of the ExtensionCustomAttribute5

Specifies if this Contact should exist.

Ensure

This resource allows to configure Mailtips behaviors in Exchange Online.

Schema for microsoft.exchange.mailtips

Only valid value is 'Yes'.

IsSingleInstance

Specifies whether MailTips are enabled.

MailTipsAllTipsEnabled

Specifies whether MailTips that rely on group metrics data are enabled.

MailTipsGroupMetricsEnabled

Specifies what a large audience is.

MailTipsLargeAudienceThreshold

Specifies whether MailTips that rely on mailbox data (out-of-office or full mailbox) are enabled.

MailTipsMailboxSourcedTipsEnabled

Specifies whether MailTips for external recipients are enabled.

MailTipsExternalRecipientsTipsEnabled

Specifies if this MailTip should exist.

Ensure

Create or modify a EXOMalwareFilterPolicy in your cloud-based organization.

Schema for microsoft.exchange.malwarefilterpolicy

The Identity parameter specifies the MalwareFilterPolicy you want to modify.

Identity

The AdminDisplayName parameter specifies a description for the policy. If the value contains spaces, enclose the value in quotation marks.

AdminDisplayName

The CustomExternalBody parameter specifies the body of the custom notification message for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation marks.

CustomExternalBody

The CustomExternalSubject parameter specifies the subject of the custom notification message for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation marks.

CustomExternalSubject

The CustomFromAddress parameter specifies the From address of the custom notification message for malware detections in messages from internal or external senders.

CustomFromAddress

The CustomFromName parameter specifies the From name of the custom notification message for malware detections in messages from internal or external senders. If the value contains spaces, enclose the value in quotation marks.

CustomFromName

The CustomInternalBody parameter specifies the body of the custom notification message for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation marks.

CustomInternalBody

The CustomInternalSubject parameter specifies the subject of the custom notification message for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation marks.

CustomInternalSubject

The CustomNotifications parameter enables or disables custom notification messages for malware detections in messages from internal or external senders. Valid values are: $true, $false.

CustomNotifications

The EnableExternalSenderAdminNotifications parameter enables or disables sending malware detection notification messages to an administrator for messages from external senders. Valid values are: $true, $false.

EnableExternalSenderAdminNotifications

The EnableFileFilter parameter enables or disables common attachment blocking - also known as the Common Attachment Types Filter.Valid values are: $true, $false.

EnableFileFilter

The EnableInternalSenderAdminNotifications parameter enables or disables sending malware detection notification messages to an administrator for messages from internal senders. Valid values are: $true, $false.

EnableInternalSenderAdminNotifications

The ExternalSenderAdminAddress parameter specifies the email address of the administrator who will receive notification messages for malware detections in messages from external senders.

ExternalSenderAdminAddress

The FileTypeAction parameter specifies what's done to messages that contain one or more attachments where the file extension is included in the FileTypes parameter (common attachment blocking). Valid values are Quarantine and Reject. The default value is Reject.

FileTypeAction

The FileTypes parameter specifies the file types that are automatically blocked by common attachment blocking (also known as the Common Attachment Types Filter), regardless of content.

FileTypes

The InternalSenderAdminAddress parameter specifies the email address of the administrator who will receive notification messages for malware detections in messages from internal senders.

InternalSenderAdminAddress

MakeDefault makes this malware filter policy the default policy. Valid values are: $true, $false.

MakeDefault

The QuarantineTag specifies the quarantine policy that's used on messages that are quarantined as malware.

QuarantineTag

The ZapEnabled parameter enables or disables zero-hour auto purge (ZAP) for malware. ZAP detects malware in unread messages that have already been delivered to the user's Inbox. Valid values are: $true, $false.

ZapEnabled

Specifies if this MalwareFilterPolicy should exist.

Ensure

Create or modify a new EXOMalwareFilterRule in your cloud-based organization.

Schema for microsoft.exchange.malwarefilterrule

The Identity parameter specifies the EXO resource you want to modify.

Identity

The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.

Comments

The Enabled parameter enables or disables the malware filter rule. Valid input for this parameter is $true or $false. The default value is $true.

Enabled

The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

ExceptIfRecipientDomainIs

The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

ExceptIfSentTo

The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.

ExceptIfSentToMemberOf

The MalwareFilterPolicy parameter specifies the malware filter policy to apply to messages that match the conditions defined by this malware filter rule.

MalwareFilterPolicy

The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.

Priority

The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

RecipientDomainIs

The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

SentTo

The SentToMemberOf parameter specifies a condition that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You can use any value that uniquely identifies the group.

SentToMemberOf

Specifies if the Malware Filter Rule should exist.

Ensure

This resource configures RBAC Management Roles in Exchange Online.

Schema for microsoft.exchange.managementrole

The Name parameter specifies the name of the role. The maximum length of the name is 64 characters.

Name

The Parent parameter specifies the identity of the role to copy. Mandatory for management role creation/update or when Ensure=Present. Non-mandatory for Ensure=Absent

Parent

The Description parameter specifies the description that's displayed when the management role is viewed using the Get-ManagementRole cmdlet.

Description

Specify if the Management Role should exist or not.

Ensure

This resource configures RBAC Management Roles Assignments in Exchange Online.

Schema for microsoft.exchange.managementroleassignment

The Name parameter specifies a name for the new management role assignment. The maximum length of the name is 64 characters.

Name

The Role parameter specifies the existing role to assign. You can use any value that uniquely identifies the role.

Role

The App parameter specifies the service principal to assign the management role to. Specifically, the ServiceId GUID value from the output of the Get-ServicePrincipal cmdlet (for example, 6233fba6-0198-4277-892f-9275bf728bcc).

App

The Policy parameter specifies the name of the management role assignment policy to assign the management role to.

Policy

The SecurityGroup parameter specifies the name of the management role group or mail-enabled universal security group to assign the management role to.

SecurityGroup

The User parameter specifies the name or alias of the user to assign the management role to.

User

The CustomRecipientWriteScope parameter specifies the existing recipient-based management scope to associate with this management role assignment.

CustomRecipientWriteScope

The CustomResourceScope parameter specifies the custom management scope to associate with this management role assignment. You can use any value that uniquely identifies the management scope.

CustomResourceScope

The ExclusiveConfigWriteScope parameter specifies the exclusive configuration-based management scope to associate with the new role assignment.

ExclusiveRecipientWriteScope

The RecipientAdministrativeUnitScope parameter specifies the administrative unit to scope the new role assignment to.

RecipientAdministrativeUnitScope

The RecipientOrganizationalUnitScope parameter specifies the OU to scope the new role assignment to. If you use the RecipientOrganizationalUnitScope parameter, you can't use the CustomRecipientWriteScope or ExclusiveRecipientWriteScope parameters.

RecipientOrganizationalUnitScope

The RecipientRelativeWriteScope parameter specifies the type of restriction to apply to a recipient scope. The available types are None, Organization, MyGAL, Self, and MyDistributionGroups. The RecipientRelativeWriteScope parameter is automatically set when the CustomRecipientWriteScope or RecipientOrganizationalUnitScope parameters are used.

RecipientRelativeWriteScope

Specify if the Management Role Assignment should exist or not.

Ensure

This resource configures RBAC Management Roles Entries in Exchange Online.

Schema for microsoft.exchange.managementroleentry

The Identity parameter specifies the role entry that you want to modify.

Identity

The Parameters parameter specifies the parameters to be added to or removed from the role entry.

Parameters

Cmdlet Script ApplicationPermission WebService

The Type parameter specifies the type of role entry to return.

Type

Create a new Message Classification policy in your cloud-based organization.

Schema for microsoft.exchange.messageclassification

The Identity parameter specifies the OME Configuration policy that you want to modify.

Identity

The ClassificationID parameter specifies the classification ID (GUID) of an existing message classification that you want to import and use in your Exchange organization.

ClassificationID

The DisplayName parameter specifies the title of the message classification that's displayed in Outlook and selected by users.

DisplayName

Highest Higher High MediumHigh Medium MediumLow Low Lower Lowest

The DisplayPrecedence parameter specifies the relative precedence of the message classification to other message classifications that may be applied to a specified message.

DisplayPrecedence

The Name parameter specifies the unique name for the message classification.

Name

The PermissionMenuVisible parameter specifies whether the values that you entered for the DisplayName and RecipientDescription parameters are displayed in Outlook as the user composes a message.

PermissionMenuVisible

The RecipientDescription parameter specifies the detailed text that's shown to Outlook recipient when they receive a message that has the message classification applied.

RecipientDescription

The RetainClassificationEnabled parameter specifies whether the message classification should persist with the message if the message is forwarded or replied to.

RetainClassificationEnabled

The SenderDescription parameter specifies the detailed text that's shown to Outlook senders when they select a message classification to apply to a message before they send the message.

SenderDescription

Specifies if this Outbound connector should exist.

Ensure

This resource configures Mobile Device Mailbox Policies in Exchange Online.

Schema for microsoft.exchange.mobiledevicemailboxpolicy

The Name parameter specifies the friendly name of the mobile device mailbox policy.

Name

The AllowApplePushNotifications parameter specifies whether push notifications are allowed to Apple mobile devices.

AllowApplePushNotifications

The AllowBluetooth parameter specifies whether the Bluetooth capabilities are allowed on the mobile phone. The available options are Disable, HandsfreeOnly, and Allow. The default value is Allow.

AllowBluetooth

The AllowBrowser parameter indicates whether Microsoft Pocket Internet Explorer is allowed on the mobile phone. This parameter doesn't affect third-party browsers.

AllowBrowser

The AllowCamera parameter specifies whether the mobile phone's camera is allowed.

AllowCamera

The AllowConsumerEmail parameter specifies whether the mobile phone user can configure a personal email account on the mobile phone.

AllowConsumerEmail

The AllowDesktopSync parameter specifies whether the mobile phone can synchronize with a desktop computer through a cable.

AllowDesktopSync

The AllowExternalDeviceManagement parameter specifies whether an external device management program is allowed to manage the mobile phone.

AllowExternalDeviceManagement

The AllowGooglePushNotifications parameter controls whether the user can receive push notifications from Google for Outlook on the web for devices.

AllowGooglePushNotifications

The AllowHTMLEmail parameter specifies whether HTML email is enabled on the mobile phone.

AllowHTMLEmail

The AllowInternetSharing parameter specifies whether the mobile phone can be used as a modem to connect a computer to the Internet.

AllowInternetSharing

The AllowIrDA parameter specifies whether infrared connections are allowed to the mobile phone.

AllowIrDA

The AllowMobileOTAUpdate parameter specifies whether the Exchange ActiveSync mailbox policy can be sent to the mobile phone over a cellular data connection.

AllowMobileOTAUpdate

The AllowMicrosoftPushNotifications parameter specifies whether push notifications are enabled on the mobile device.

AllowMicrosoftPushNotifications

The AllowNonProvisionableDevices parameter specifies whether all mobile phones can synchronize with the server running Exchange.

AllowNonProvisionableDevices

The AllowPOPIMAPEmail parameter specifies whether the user can configure a POP3 or IMAP4 email account on the mobile phone.

AllowPOPIMAPEmail

The AllowRemoteDesktop parameter specifies whether the mobile phone can initiate a remote desktop connection.

AllowRemoteDesktop

The AllowSimplePassword parameter specifies whether a simple device password is allowed. A simple device password is a password that has a specific pattern, such as 1111 or 1234.

AllowSimplePassword

The AllowSMIMEEncryptionAlgorithmNegotiation parameter specifies whether the messaging application on the mobile device can negotiate the encryption algorithm if a recipient's certificate doesn't support the specified encryption algorithm.

AllowSMIMEEncryptionAlgorithmNegotiation

The AllowSMIMESoftCerts parameter specifies whether S/MIME software certificates are allowed.

AllowSMIMESoftCerts

The AllowStorageCard parameter specifies whether the mobile phone can access information stored on a storage card.

AllowStorageCard

The AllowTextMessaging parameter specifies whether text messaging is allowed from the mobile phone.

AllowTextMessaging

The AllowUnsignedApplications parameter specifies whether unsigned applications can be installed on the mobile phone.

AllowUnsignedApplications

The AllowUnsignedInstallationPackages parameter specifies whether unsigned installation packages can be executed on the mobile phone.

AllowUnsignedInstallationPackages

The AllowWiFi parameter specifies whether wireless Internet access is allowed on the mobile phone.

AllowWiFi

The AlphanumericPasswordRequired parameter specifies whether the password for the mobile phone must be alphanumeric.

AlphanumericPasswordRequired

The ApprovedApplicationList parameter specifies a list of approved applications for the mobile phone.

ApprovedApplicationList

The AttachmentsEnabled parameter specifies whether attachments can be downloaded.

AttachmentsEnabled

The DeviceEncryptionEnabled parameter specifies whether encryption is enabled.

DeviceEncryptionEnabled

The DevicePolicyRefreshInterval parameter specifies how often the policy is sent from the server to the mobile phone.

DevicePolicyRefreshInterval

The IrmEnabled parameter specifies whether Information Rights Management (IRM) is enabled for the mailbox policy.

IrmEnabled

The IsDefault parameter specifies whether this policy is the default Mobile Device mailbox policy.

IsDefault

The MaxAttachmentSize parameter specifies the maximum size of attachments that can be downloaded to the mobile phone.

MaxAttachmentSize

All TwoWeeks OneMonth ThreeMonths SixMonths

The MaxCalendarAgeFilter parameter specifies the maximum range of calendar days that can be synchronized to the device.

MaxCalendarAgeFilter

All OneDay ThreeDays OneWeek TwoWeeks OneMonth

The MaxEmailAgeFilter parameter specifies the maximum number of days of email items to synchronize to the mobile phone.

MaxEmailAgeFilter

The MaxEmailBodyTruncationSize parameter specifies the maximum size at which email messages are truncated when synchronized to the mobile phone. The value is specified in kilobytes (KB).

MaxEmailBodyTruncationSize

The MaxEmailHTMLBodyTruncationSize parameter specifies the maximum size at which HTML-formatted email messages are synchronized to the mobile phone. The value is specified in KB.

MaxEmailHTMLBodyTruncationSize

The MaxInactivityTimeDeviceLock parameter specifies the length of time that the mobile phone can be inactive before the password is required to reactivate it.

MaxInactivityTimeLock

The MaxPasswordFailedAttempts parameter specifies the number of attempts a user can make to enter the correct password for the mobile phone. You can enter any number from 4 through 16 or the value Unlimited.

MaxPasswordFailedAttempts

The MinPasswordComplexCharacters parameter specifies the character sets that are required in the password of the mobile device.

MinPasswordComplexCharacters

The MinPasswordLength parameter specifies the minimum number of characters in the mobile device password.

MinPasswordLength

The PasswordEnabled parameter specifies whether a password is required on the mobile device.

PasswordEnabled

The PasswordExpiration parameter specifies how long a password can be used on a mobile device before the user is forced to change the password.

PasswordExpiration

The PasswordHistory parameter specifies the number of unique new passwords that need to be created on the mobile device before an old password can be reused.

PasswordHistory

The PasswordRecoveryEnabled parameter specifies whether the recovery password for the mobile device is stored in Exchange.

PasswordRecoveryEnabled

The RequireDeviceEncryption parameter specifies whether encryption is required on the mobile device.

RequireDeviceEncryption

The RequireEncryptedSMIMEMessages parameter specifies whether the mobile device must send encrypted S/MIME messages.

RequireEncryptedSMIMEMessages

The RequireEncryptionSMIMEAlgorithm parameter specifies the algorithm that's required to encrypt S/MIME messages on a mobile device.

RequireEncryptionSMIMEAlgorithm

The RequireSignedSMIMEAlgorithm parameter specifies the algorithm that's used to sign S/MIME messages on the mobile device.

RequireManualSyncWhenRoaming

RequireSignedSMIMEAlgorithm

The RequireSignedSMIMEMessages parameter specifies whether the mobile device must send signed S/MIME messages.

RequireSignedSMIMEMessages

The RequireStorageCardEncryption parameter specifies whether storage card encryption is required on the mobile device.

RequireStorageCardEncryption

The UnapprovedInROMApplicationList parameter specifies a list of applications that can't be run in ROM on the mobile device.

UnapprovedInROMApplicationList

The UNCAccessEnabled parameter specifies whether access to Microsoft Windows file shares is enabled from the mobile device.

UNCAccessEnabled

The WSSAccessEnabled parameter specifies whether access to Microsoft Windows SharePoint Services is enabled from the mobile device.

WSSAccessEnabled

Specify if the Mobile Device Mailbox Policy should exist or not.

Ensure

This resource configures Offline Address Books in Exchange Online.

Schema for microsoft.exchange.offlineaddressbook

The Name parameter specifies the unique name of the Offline Address Book. The maximum length is 64 characters.

Name

The AddressLists parameter specifies the address lists or global address lists that are included in the OAB. You can use any value that uniquely identifies the address list.

AddressLists

The ConfiguredAttributes parameter specifies the recipient MAPI properties that are available in the OAB.

ConfiguredAttributes

The DiffRetentionPeriod parameter specifies the number of days that the OAB difference files are stored on the server.

DiffRetentionPeriod

The IsDefault parameter specifies whether the OAB is used by all mailboxes and mailbox databases that don't have an OAB specified.

IsDefault

Specify if the Offline Address Book should exist or not.

Ensure

Create a new OME Configuration policy in your cloud-based organization.

Schema for microsoft.exchange.omeconfiguration

The Identity parameter specifies the OME Configuration policy that you want to modify.

Identity

The BackgroundColor parameter specifies the background color

BackgroundColor

The DisclaimerText parameter specifies the disclaimer text in the email that contains the encrypted message

DisclaimerText

The EmailText parameter specifies the default text that accompanies encrypted email messages.

EmailText

The ExternalMailExpiryInDays parameter specifies the number of days that the encrypted message is available to external recipients in the Microsoft 365 portal. A valid value is an integer from 0 to 730.

ExternalMailExpiryInDays

The IntroductionText parameter specifies the default text that accompanies encrypted email messages.

IntroductionText

The OTPEnabled parameter specifies whether to allow recipients to use a one-time passcode to view encrypted messages.

OTPEnabled

The PortalText parameter specifies the text that appears at the top of the encrypted email viewing portal.

PortalText

The PrivacyStatementUrl parameter specifies the Privacy Statement link in the encrypted email notification message.

PrivacyStatementUrl

The ReadButtonText parameter specifies the text that appears on the 'Read the message' button.

ReadButtonText

The SocialIdSignIn parameter specifies whether a user is allowed to view an encrypted message in the Microsoft 365 admin center using their own social network id (Google, Yahoo, and Microsoft account).

SocialIdSignIn

Specifies if this Outbound connector should exist.

Ensure

This resource configures On-Premises Organization in Exchange Online.

Schema for microsoft.exchange.onpremisesorganization

The Identity parameter specifies the identity of the on-premises organization object.

Identity

The HybridDomains parameter specifies the domains that are configured in the hybrid deployment between an Office 365 tenant and an on-premises Exchange organization. The domains specified in this parameter must match the domains listed in the HybridConfiguration Active Directory object for the on-premises Exchange organization configured by the Hybrid Configuration wizard.

HybridDomains

The InboundConnector parameter specifies the name of the inbound connector configured on the Microsoft Exchange Online Protection (EOP) service for a hybrid deployment configured with an on-premises Exchange organization.

InboundConnector

The OutboundConnector parameter specifies the name of the outbound connector configured on the EOP service for a hybrid deployment configured with an on-premises Exchange organization.

OutboundConnector

The OrganizationName parameter specifies the Active Directory object name of the on-premises Exchange organization.

OrganizationName

The OrganizationGuid parameter specifies the globally unique identifier (GUID) of the on-premises Exchange organization object in the Office 365 tenant.

OrganizationGuid

The OrganizationRelationship parameter specifies the organization relationship configured by the Hybrid Configuration wizard on the Office 365 tenant as part of a hybrid deployment with an on-premises Exchange organization. This organization relationship defines the federated sharing features enabled on the Office 365 tenant.

OrganizationRelationship

The Comment parameter specifies an optional comment.

Comment

Specify if the On-Premises Organization should exist or not.

Ensure

This resource configures the Exchange Online organization-wide
settings.

Schema for microsoft.exchange.organizationconfig

Only valid value is 'Yes'.

IsSingleInstance

The ActivityBasedAuthenticationTimeoutEnabled parameter specifies whether the timed logoff feature is enabled. The default value is $true

ActivityBasedAuthenticationTimeoutEnabled

The ActivityBasedAuthenticationTimeoutInterval parameter specifies the time span for logoff. You enter this value as a time span: hh:mm:ss where hh = hours, mm = minutes and ss = seconds. Valid values for this parameter are from 00:05:00 to 08:00:00 (5 minutes to 8 hours). The default value is 06:00:00 (6 hours).

ActivityBasedAuthenticationTimeoutInterval

The ActivityBasedAuthenticationTimeoutWithSingleSignOnEnabled parameter specifies whether to keep single sign-on enabled. The default value is $true.

ActivityBasedAuthenticationTimeoutWithSingleSignOnEnabled

The AppsForOfficeEnabled parameter specifies whether to enable apps for Outlook features. By default, the parameter is set to $true. If the flag is set to $false, no new apps can be activated for any user in the organization.

AppsForOfficeEnabled

The AsyncSendEnabled parameter specifies whether to enable or disable async send in Outlook on the web.

AsyncSendEnabled

The AuditDisabled parameter specifies whether to disable or enable mailbox auditing for the organization.

AuditDisabled

Setting this parameter to $true will cause unknown users to be redirected to the on-premises endpoint and will allow on-premises users to discover their mailbox automatically.

AutodiscoverPartialDirSync

The AutoExpandingArchive switch enables the unlimited archiving feature (called auto-expanding archiving) in an Exchange Online organization. You don't need to specify a value with this switch.

AutoExpandingArchive

No description available for BlockMoveMessagesForGroupFolders

BlockMoveMessagesForGroupFolders

The BookingsAddressEntryRestricted parameter specifies whether addresses can be collected from Bookings customers.

BookingsAddressEntryRestricted

The BookingsAuthEnabled parameter specifies whether to enforce authentication to access all published Bookings pages.

BookingsAuthEnabled

No description available for BookingsBlockedWordsEnabled

BookingsBlockedWordsEnabled

The BookingsCreationOfCustomQuestionsRestricted parameter specifies whether Bookings admins can add custom questions.

BookingsCreationOfCustomQuestionsRestricted

The BookingsEnabled parameter specifies whether to enable Microsoft Bookings in an organization.

BookingsEnabled

The BookingsExposureOfStaffDetailsRestricted parameter specifies whether the attributes of internal Bookings staff members are visible to external Bookings customers.

BookingsExposureOfStaffDetailsRestricted

The BookingsMembershipApprovalRequired parameter enables a membership approval requirement when new staff members are added to Bookings calendars.

BookingsMembershipApprovalRequired

No description available for BookingsNamingPolicyEnabled

BookingsNamingPolicyEnabled

No description available for BookingsNamingPolicyPrefix

BookingsNamingPolicyPrefix

No description available for BookingsNamingPolicyPrefixEnabled

BookingsNamingPolicyPrefixEnabled

No description available for BookingsNamingPolicySuffix

BookingsNamingPolicySuffix

No description available for BookingsNamingPolicySuffixEnabled

BookingsNamingPolicySuffixEnabled

The BookingsNotesEntryRestricted parameter specifies whether appointment notes can be collected from Bookings customers.

BookingsNotesEntryRestricted

The BookingsPaymentsEnabled parameter specifies whether to enable online payment node inside Bookings.

BookingsPaymentsEnabled

The BookingsPhoneNumberEntryRestricted parameter specifies whether phone numbers can be collected from Bookings customers.

BookingsPhoneNumberEntryRestricted

No description available for BookingsSearchEngineIndexDisabled

BookingsSearchEngineIndexDisabled

No description available for BookingsSmsMicrosoftEnabled

BookingsSmsMicrosoftEnabled

The BookingsSocialSharingRestricted parameter allows you to control whether, or not, your users can see social sharing options inside Bookings.

BookingsSocialSharingRestricted

The ByteEncoderTypeFor7BitCharsets parameter specifies the 7-bit transfer encoding method for MIME format for messages sent to this remote domain.

No description available for ComplianceMLBgdCrawlEnabled

ComplianceMLBgdCrawlEnabled

The ConnectorsActionableMessagesEnabled parameter specifies whether to enable or disable actionable buttons in messages (connector cards) from connected apps on Outlook on the web.

ConnectorsActionableMessagesEnabled

The ConnectorsEnabled parameter specifies whether to enable or disable all connected apps in organization.

ConnectorsEnabled

The ConnectorsEnabledForOutlook parameter specifies whether to enable or disable connected apps in Outlook on the web.

ConnectorsEnabledForOutlook

The ConnectorsEnabledForSharepoint parameter specifies whether to enable or disable connected apps on Sharepoint.

ConnectorsEnabledForSharepoint

The ConnectorsEnabledForTeams parameter specifies whether to enable or disable connected apps on Teams.

ConnectorsEnabledForTeams

The ConnectorsEnabledForYammer parameter specifies whether to enable or disable connected apps on Yammer.

ConnectorsEnabledForYammer

Enable Customer Lockbox.

CustomerLockboxEnabled

The DefaultAuthenticationPolicy parameter specifies the authentication policy that's used for the whole organization. You can use any value that uniquely identifies the policy.

DefaultAuthenticationPolicy

The DefaultGroupAccessType parameter specifies the default access type for Office 365 groups.

DefaultGroupAccessType

The DefaultMinutesToReduceLongEventsBy parameter specifies the number of minutes to reduce calendar events by if the events are 60 minutes or longer.

DefaultMinutesToReduceLongEventsBy

The DefaultMinutesToReduceShortEventsBy parameter specifies the number of minutes to reduce calendar events by if the events are less than 60 minutes long.

DefaultMinutesToReduceShortEventsBy

The DefaultPublicFolderAgeLimit parameter specifies the default age limit for the contents of public folders across the entire organization. Content in a public folder is automatically deleted when this age limit is exceeded. This attribute applies to all public folders in the organization that don't have their own AgeLimit setting. To specify a value, enter it as a time span: dd.hh:mm:ss where d = days, h = hours, m = minutes, and s = seconds. Or, enter the value $null. The default value is blank ($null).

DefaultPublicFolderAgeLimit

The DefaultPublicFolderDeletedItemRetention parameter specifies the default value of the length of time to retain deleted items for public folders across the entire organization. This attribute applies to all public folders in the organization that don't have their own RetainDeletedItemsFor attribute set.

DefaultPublicFolderDeletedItemRetention

The DefaultPublicFolderIssueWarningQuota parameter specifies the default value across the entire organization for the public folder size at which a warning message is sent to this folder's owners, warning that the public folder is almost full. This attribute applies to all public folders within the organization that don't have their own warning quota attribute set. The default value of this attribute is unlimited. The valid input range for this parameter is from 0 through 2199023254529 bytes(2 TB). If you enter a value of unlimited, no size limit is imposed on the public folder.

DefaultPublicFolderIssueWarningQuota

The DefaultPublicFolderMaxItemSize parameter specifies the default maximum size for posted items within public folders across the entire organization. Items larger than the value of the DefaultPublicFolderMaxItemSize parameter are rejected. This attribute applies to all public folders within the organization that don't have their own MaxItemSize attribute set. The default value of this attribute is unlimited.

DefaultPublicFolderMaxItemSize

The DefaultPublicFolderMovedItemRetention parameter specifies how long items that have been moved between mailboxes are kept in the source mailbox for recovery purposes before being removed by the Public Folder Assistant.

DefaultPublicFolderMovedItemRetention

The DefaultPublicFolderProhibitPostQuota parameter specifies the size of a public folder at which users are notified that the public folder is full. Users can't post to a folder whose size is larger than the DefaultPublicFolderProhibitPostQuota parameter value. The default value of this attribute is unlimited.

DefaultPublicFolderProhibitPostQuota

The DirectReportsGroupAutoCreationEnabled parameter specifies whether to enable or disable the automatic creation of direct report Office 365 groups.

DirectReportsGroupAutoCreationEnabled

The DisablePlusAddressInRecipients parameter specifies whether to enable or disable plus addressing (also known as subaddressing) for Exchange Online mailboxes.

DisablePlusAddressInRecipients

The DistributionGroupDefaultOU parameter specifies the container where distribution groups are created by default.

DistributionGroupDefaultOU

The DistributionGroupNameBlockedWordsList parameter specifies words that can't be included in the names of distribution groups. Separate multiple values with commas.

DistributionGroupNameBlockedWordsList

The DistributionGroupNamingPolicy parameter specifies the template applied to the name of distribution groups that are created in the organization. You can enforce that a prefix or suffix be applied to all distribution groups. Prefixes and suffixes can be either a string or an attribute, and you can combine strings and attributes.

DistributionGroupNamingPolicy

The ElcProcessingDisabled parameter specifies whether to enable or disable the processing of mailboxes by the Managed Folder Assistant.

ElcProcessingDisabled

The EnableOutlookEvents parameter specifies whether Outlook or Outlook on the web automatically discovers events from email messages and adds them to user calendars.

EnableOutlookEvents

The EndUserDLUpgradeFlowsDisabled parameter specifies whether to prevent users from upgrading their own distribution groups to Office 365 groups in an Exchange Online organization.

EndUserDLUpgradeFlowsDisabled

The EwsAllowEntourage parameter specifies whether to enable or disable Entourage 2008 to access Exchange Web Services (EWS) for the entire organization.

EwsAllowEntourage

The EwsAllowList parameter specifies the applications that are allowed to access EWS or REST when the EwsApplicationAccessPolicy parameter is set to EwsAllowList. Other applications that aren't specified by this parameter aren't allowed to access EWS or REST. You identify the application by its user agent string value. Wildcard characters (*) are supported.

EwsAllowList

The EwsAllowMacOutlook parameter enables or disables access to mailboxes by Outlook for Mac clients that use Exchange Web Services (for example, Outlook for Mac 2011 or later).

EwsAllowMacOutlook

The EwsAllowOutlook parameter enables or disables access to mailboxes by Outlook clients that use Exchange Web Services. Outlook uses Exchange Web Services for free/busy, out-of-office settings, and calendar sharing.

EwsAllowOutlook

The EwsApplicationAccessPolicy parameter specifies the client applications that have access to EWS and REST.

EwsApplicationAccessPolicy

The EwsBlockList parameter specifies the applications that aren't allowed to access EWS or REST when the EwsApplicationAccessPolicy parameter is set to EnforceBlockList. All other applications that aren't specified by this parameter are allowed to access EWS or REST. You identify the application by its user agent string value. Wildcard characters (*) are supported.

EwsBlockList

The EwsEnabled parameter specifies whether to globally enable or disable EWS access for the entire organization, regardless of what application is making the request.

EwsEnabled

The ExchangeNotificationEnabled parameter enables or disables Exchange notifications sent to administrators regarding their organizations. Valid input for this parameter is $true or $false.

ExchangeNotificationEnabled

The ExchangeNotificationRecipients parameter specifies the recipients for Exchange notifications sent to administrators regarding their organizations. If the ExchangeNotificationEnabled parameter is set to $false, no notification messages are sent. Be sure to enclose values that contain spaces in quotation marks and separate multiple values with commas. If this parameter isn't set, Exchange notifications are sent to all administrators.

ExchangeNotificationRecipients

The FindTimeAttendeeAuthenticationEnabled parameter controls whether attendees are required to verify their identity in meeting polls using the FindTime Outlook add-in.

FindTimeAttendeeAuthenticationEnabled

The FindTimeAutoScheduleDisabled parameter controls automatically scheduling the meeting once a consensus is reached in meeting polls using the FindTime Outlook add-in.

FindTimeAutoScheduleDisabled

The FindTimeLockPollForAttendeesEnabled controls whether the Lock poll for attendees setting is managed by the organization.

FindTimeLockPollForAttendeesEnabled

The FindTimeOnlineMeetingOptionDisabled parameter controls the availability of the Online meeting checkbox for Teams in meeting polls using the FindTime Outlook add-in.

FindTimeOnlineMeetingOptionDisabled

The FocusedInboxOn parameter enables or disables Focused Inbox for the organization.

FocusedInboxOn

The HierarchicalAddressBookRoot parameter specifies the user, contact, or group to be used as the root organization for a hierarchical address book in the Exchange organization. You can use any value that uniquely identifies the recipient.

HierarchicalAddressBookRoot

The IPListBlocked parameter specifies the blocked IP addresses that aren't allowed to connect to Exchange Online organization. These settings affect client connections that use Basic authentication where on-premises Active Directory Federation Services (ADFS) servers federate authentication with Azure Active Directory. Note that the new settings might take up to 4 hours to fully propagate across the service.

IPListBlocked

No description available for IsGroupFoldersAndRulesEnabled

IsGroupFoldersAndRulesEnabled

No description available for IsGroupMemberAllowedToEditContent

IsGroupMemberAllowedToEditContent

The LeanPopoutEnabled parameter specifies whether to enable faster loading of pop-out messages in Outlook on the web for Internet Explorer and Microsoft Edge.

LeanPopoutEnabled

The LinkPreviewEnabled parameter specifies whether link preview of URLs in email messages is allowed for the organization.

LinkPreviewEnabled

The MailTipsAllTipsEnabled parameter specifies whether MailTips are enabled. The default value is $true.

MailTipsAllTipsEnabled

The MailTipsExternalRecipientsTipsEnabled parameter specifies whether MailTips for external recipients are enabled. The default value is $false.

MailTipsExternalRecipientsTipsEnabled

The MailTipsGroupMetricsEnabled parameter specifies whether MailTips that rely on group metrics data are enabled. The default value is $true.

MailTipsGroupMetricsEnabled

The MailTipsLargeAudienceThreshold parameter specifies what a large audience is. The default value is 25.

MailTipsLargeAudienceThreshold

The MailTipsMailboxSourcedTipsEnabled parameter specifies whether MailTips that rely on mailbox data (out-of-office or full mailbox) are enabled.

MailTipsMailboxSourcedTipsEnabled

No description available for MaskClientIpInReceivedHeadersEnabled.

MaskClientIpInReceivedHeadersEnabled

No description available for MatchSenderOrganizerProperties.

MatchSenderOrganizerProperties

No description available for MessageHighlightsEnabled.

MessageHighlightsEnabled

The MessageRecallEnabled parameter enables or disables the message recall feature in the organization.

MessageRecallEnabled

The MessageRemindersEnabled parameter enables or disables the message reminders feature in the organization.

MessageRemindersEnabled

The MobileAppEducationEnabled specifies whether to show or hide the Outlook for iOS and Android education reminder in Outlook on the web.

MobileAppEducationEnabled

The OAuth2ClientProfileEnabled parameter enables or disables modern authentication in the Exchange organization.

The OnlineMeetingsByDefaultEnabled parameter specifies whether to set all meetings as Teams by default during meeting creation.

OnlineMeetingsByDefaultEnabled

The OutlookGifPickerDisabled parameter disables the GIF Search (powered by Bing) feature that's built into the Compose page in Outlook on the web.

OutlookGifPickerDisabled

The OutlookMobileGCCRestrictionsEnabled parameter specifies whether to enable or disable features within Outlook for iOS and Android that are not FedRAMP compliant for Office 365 US Government Community Cloud (GCC) customers.

OutlookMobileGCCRestrictionsEnabled

The OutlookPayEnabled parameter enables or disables Payments in Outlook in the Office 365 organization.

OutlookPayEnabled

No description available for OutlookTextPredictionDisabled.

OutlookTextPredictionDisabled

The PublicComputersDetectionEnabled parameter specifies whether Outlook on the web will detect when a user signs from a public or private computer or network, and then enforces the attachment handling settings from public networks. The default is $false. However, if you set this parameter to $true, Outlook on the web will determine if the user is signing in from a public computer, and all public attachment handling rules will be applied and enforced.

PublicComputersDetectionEnabled

The PublicFoldersEnabled parameter specifies how public folders are deployed in your organization.

PublicFoldersEnabled

The PublicFolderShowClientControl parameter enables or disables access to public folders in Microsoft Outlook.

PublicFolderShowClientControl

The ReadTrackingEnabled parameter specifies whether the tracking for read status for messages in an organization is enabled. The default value is $false.

ReadTrackingEnabled

No description available for RecallReadMessagesEnabled.

RecallReadMessagesEnabled

The RemotePublicFolderMailboxes parameter specifies the identities of the public folder objects (represented as mail user objects locally) corresponding to the public folder mailboxes created in the remote forest. The public folder values set here are used only if the public folder deployment is a remote deployment.

RemotePublicFolderMailboxes

The SendFromAliasEnabled parameter allows mailbox users to send messages using aliases (proxy addresses). It does this by disabling the rewriting of aliases to their primary SMTP address. This change is implemented in the Exchange Online service

SendFromAliasEnabled

No description available for SharedDomainEmailAddressFlowEnabled.

SharedDomainEmailAddressFlowEnabled

The ShortenEventScopeDefault parameter specifies whether calendar events start late or end early in the organization.

ShortenEventScopeDefault

The SiteMailboxCreationURL parameter specifies the URL that's used to create site mailboxes. Site mailboxes improve collaboration and user productivity by allowing access to both SharePoint documents and Exchange email in Outlook 2013 or later.

SiteMailboxCreationURL

The SmtpActionableMessagesEnabled parameter specifies whether to enable or disable action buttons in email messages in Outlook on the web.

SmtpActionableMessagesEnabled

The VisibleMeetingUpdateProperties parameter specifies whether meeting message updates will be auto-processed on behalf of attendees. Auto-processed updates are applied to the attendee's calendar item, and then the meeting message is moved to the deleted items. The attendee never sees the update in their inbox, but their calendar is updated.

VisibleMeetingUpdateProperties

The WebPushNotificationsDisabled parameter specifies whether to enable or disable Web Push Notifications in Outlook on the Web. This feature provides web push notifications which appear on a user's desktop while the user is not using Outlook on the Web. This brings awareness of incoming messages while they are working elsewhere on their computer.

WebPushNotificationsDisabled

The WebSuggestedRepliesDisabled parameter specifies whether to enable or disable Suggested Replies in Outlook on the web. This feature provides suggested replies to emails so users can easily and quickly respond to messages.

WebSuggestedRepliesDisabled

The WorkspaceTenantEnabled parameter enables or disables workspace booking in the organization.

WorkspaceTenantEnabled

This resource configures the Organization Relationship in Exchange Online.

Schema for microsoft.exchange.organizationrelationship

The Name parameter specifies the unique name of the organization relationship. The maximum length is 64 characters.

Name

The ArchiveAccessEnabled parameter specifies whether the organization relationship has been configured to provide remote archive access.

ArchiveAccessEnabled

The DeliveryReportEnabled parameter specifies whether Delivery Reports should be shared over the organization relationship.

DeliveryReportEnabled

The DomainNames parameter specifies the SMTP domains of the external organization. You can specify multiple domains separated by commas.

DomainNames

The Enabled parameter specifies whether to enable the organization relationship.

Enabled

The FreeBusyAccessEnabled parameter specifies whether the organization relationship should be used to retrieve free/busy information from the external organization.

FreeBusyAccessEnabled

The FreeBusyAccessLevel parameter specifies the maximum amount of detail returned to the requesting organization. Valid values are: None, AvailabilityOnly or LimitedDetails

FreeBusyAccessLevel

The FreeBusyAccessScope parameter specifies a mail-enabled security group in the internal organization that contains users whose free/busy information is accessible by an external organization. You can use any value that uniquely identifies the group.

FreeBusyAccessScope

The MailboxMoveEnabled parameter specifies whether the organization relationship enables moving mailboxes to or from the external organization.

MailboxMoveEnabled

Inbound Outbound RemoteInbound RemoteOutbound None

The MailboxMoveCapability parameter is used in cross-tenant mailbox migrations.

MailboxMoveCapability

The MailboxMovePublishedScopes parameter is used in cross-tenant mailbox migrations to specify the mail-enabled security groups whose members are allowed to migrate.

MailboxMovePublishedScopes

The MailTipsAccessEnabled parameter specifies whether MailTips for users in this organization are returned over this organization relationship.

MailTipsAccessEnabled

The MailTipsAccessLevel parameter specifies the level of MailTips data externally shared over this organization relationship. This parameter can have the following values: All, Limited, None

MailTipsAccessLevel

The MailTipsAccessScope parameter specifies a mail-enabled security group in the internal organization that contains users whose free/busy information is accessible by an external organization. You can use any value that uniquely identifies the group.

MailTipsAccessScope

The OAuthApplicationId is used in cross-tenant mailbox migrations to specify the application ID of the mailbox migration app that you consented to.

OauthApplicationId

The OrganizationContact parameter specifies the email address that can be used to contact the external organization (for example, administrator@fourthcoffee.com).

OrganizationContact

The PhotosEnabled parameter specifies whether photos for users in the internal organization are returned over the organization relationship.

PhotosEnabled

The TargetApplicationUri parameter specifies the target Uniform Resource Identifier (URI) of the external organization. The TargetApplicationUri parameter is specified by Exchange when requesting a delegated token to retrieve free and busy information, for example, mail.contoso.com.

TargetApplicationUri

The TargetAutodiscoverEpr parameter specifies the Autodiscover URL of Exchange Web Services for the external organization. Exchange uses Autodiscover to automatically detect the correct Exchangeserver endpoint to use for external requests.

TargetAutodiscoverEpr

The TargetOwaURL parameter specifies the Outlook on the web (formerly Outlook Web App) URL of the external organization that's defined in the organization relationship. It is used for Outlook on the web redirection in a cross-premise Exchange scenario. Configuring this attribute enables users in the organization to use their current Outlook on the web URL to access Outlook on the web in the external organization.

TargetOwaURL

The TargetSharingEpr parameter specifies the URL of the target Exchange Web Services for the external organization.

TargetSharingEpr

Specify if the OrganizationRelationship should exist or not.

Ensure

Create a new Inbound connector in your cloud-based organization.

Schema for microsoft.exchange.outboundconnector

The Identity parameter specifies the outbound connector that you want to modify.

Identity

Specifies whether connector is enabled.

Enabled

Specifies whether connector should use MXRecords for target resolution.

UseMXRecord

The Comment parameter specifies an optional comment.

Comment

The ConnectorSource parameter specifies how the connector is created. DO NOT CHANGE THIS!

ConnectorSource

The ConnectorType parameter specifies a category for the domains that are serviced by the connector.

ConnectorType

The RecipientDomains parameter specifies the domain that the Outbound connector routes mail to. You can specify multiple domains separated by commas.

RecipientDomains

The SmartHosts parameter specifies the smart hosts the Outbound connector uses to route mail. This parameter is required if you set the UseMxRecord parameter to $false and must be specified on the same command line.

SmartHosts

The TlsDomain parameter specifies the domain name that the Outbound connector uses to verify the FQDN of the target certificate when establishing a TLS secured connection. This parameter is only used if the TlsSettings parameter is set to DomainValidation. Valid input for the TlsDomain parameter is an SMTP domain. You can use a wildcard character to specify all subdomains of a specified domain, as shown in the following example: *.contoso.com. However, you can't embed a wildcard character, as shown in the following example: domain.*.contoso.com

TlsDomain

The TlsSettings parameter specifies the TLS authentication level that's used for outbound TLS connections established by this Outbound connector.

TlsSettings

The IsTransportRuleScoped parameter specifies whether the Outbound connector is associated with a transport rule (also known as a mail flow rule).

IsTransportRuleScoped

The RouteAllMessagesViaOnPremises parameter specifies that all messages serviced by this connector are first routed through the on-premises messaging system (Centralized mailrouting).

RouteAllMessagesViaOnPremises

CloudServicesMailEnabled

The AllAcceptedDomains parameter specifies whether the Outbound connector is used in hybrid organizations where message recipients are in accepted domains of the cloud-based organization.

AllAcceptedDomains

The SenderRewritingEnabled parameter specifies that all messages that normally qualify for SRS rewriting are rewritten for routing through the on-premises email system.

SenderRewritingEnabled

The TestMode parameter specifies whether you want to enabled or disable test mode for the Outbound connector.

TestMode

The ValidationRecipients parameter specifies the email addresses of the validation recipients for the Outbound connector. You can specify multiple email addresses separated by commas.

ValidationRecipients

Specifies if this Outbound connector should exist.

Ensure

This resource configures OWA Mailbox Policies in Exchange Online.

Schema for microsoft.exchange.owamailboxpolicy

The Name parameter specifies the unique name for the policy. The maximum length is 64 characters.

Name

The AccountTransferEnabled parameter specifies whether to enable or disable QR code sign-in. By default, QR code sign-in is enabled.

AccountTransferEnabled

The ActionForUnknownFileAndMIMETypes parameter specifies how to handle file types that aren't specified in the Allow, Block, and Force Save lists for file types and MIME types

ActionForUnknownFileAndMIMETypes

The ActiveSyncIntegrationEnabled parameter specifies whether to enable or disable Exchange ActiveSync settings in Outlook on the web.

ActiveSyncIntegrationEnabled

No description available.

AdditionalAccountsEnabled

The AdditionalStorageProvidersAvailable parameter specifies whether to allow additional storage providers (for example, Box, Dropbox, Facebook, Google Drive, Egnyte, personal OneDrive) attachments in Outlook on the web.

AdditionalStorageProvidersAvailable

The AllAddressListsEnabled parameter specifies which address lists are available in Outlook on the web.

AllAddressListsEnabled

The AllowCopyContactsToDeviceAddressBook parameter specifies whether users can copy the contents of their Contacts folder to a mobile device's native address book when using Outlook on the web for devices.

AllowCopyContactsToDeviceAddressBook

The AllowedFileTypes parameter specifies the attachment file types (file extensions) that can be saved locally or viewed from Outlook on the web.

AllowedFileTypes

The AllowedMimeTypes parameter specifies the MIME extensions of attachments that allow the attachments to be saved locally or viewed from Outlook on the web.

AllowedMimeTypes

The BlockedFileTypes parameter specifies a list of attachment file types (file extensions) that can't be saved locally or viewed from Outlook on the web.

BlockedFileTypes

The BlockedMimeTypes parameter specifies MIME extensions in attachments that prevent the attachments from being saved locally or viewed from Outlook on the web.

BlockedMimeTypes

No description available.

BookingsMailboxCreationEnabled

No description available.

ChangeSettingsAccountEnabled

The ClassicAttachmentsEnabled parameter specifies whether users can attach local files as regular email attachments in Outlook on the web.

ClassicAttachmentsEnabled

The ConditionalAccessPolicy parameter specifies the Outlook on the Web Policy for limited access. For this feature to work properly, you also need to configure a Conditional Access policy in the Azure Active Directory Portal.

ConditionalAccessPolicy

The DefaultTheme parameter specifies the default theme that's used in Outlook on the web when the user hasn't selected a theme. The default value is blank ($null).

DefaultTheme

The DirectFileAccessOnPrivateComputersEnabled parameter specifies the left-click options for attachments in Outlook on the web for private computer sessions.

DirectFileAccessOnPrivateComputersEnabled

The DirectFileAccessOnPrivateComputersEnabled parameter specifies the left-click options for attachments in Outlook on the web for public computer sessions.

DirectFileAccessOnPublicComputersEnabled

The DisableFacebook switch specifies whether users can synchronize their Facebook contacts to their Contacts folder in Outlook on the web. By default, Facebook integration is enabled.

DisableFacebook

The DisplayPhotosEnabled parameter specifies whether users see sender photos in Outlook on the web.

DisplayPhotosEnabled

The ExplicitLogonEnabled parameter specifies whether to allow a user to open someone else's mailbox in Outlook on the web (provided that user has permissions to the mailbox).

ExplicitLogonEnabled

The ExternalImageProxyEnabled parameter specifies whether to load all external images through the Outlook external image proxy.

ExternalImageProxyEnabled

The ExternalSPMySiteHostURL specifies the My Site Host URL for external users.

ExternalSPMySiteHostURL

The FeedbackEnabled parameter specifies whether to enable or disable inline feedback surveys in Outlook on the web.

FeedbackEnabled

The ForceSaveAttachmentFilteringEnabled parameter specifies whether files are filtered before they can be saved from Outlook on the web.

ForceSaveAttachmentFilteringEnabled

The ForceSaveFileTypes parameter specifies the attachment file types (file extensions) that can only be saved from Outlook on the web (not opened).

ForceSaveFileTypes

The ForceSaveMimeTypes parameter specifies the MIME extensions in attachments that only allow the attachments to be saved locally (not opened).

ForceSaveMimeTypes

The ForceWacViewingFirstOnPrivateComputers parameter specifies whether private computers must first preview an Office file as a web page in Office Online Server (formerly known as Office Web Apps Server and Web Access Companion Server) before opening the file in the local application.

ForceWacViewingFirstOnPrivateComputers

The ForceWacViewingFirstOnPublicComputers parameter specifies whether public computers must first preview an Office file as a web page in Office Online Server before opening the file in the local application.

ForceWacViewingFirstOnPublicComputers

The FreCardsEnabled parameter specifies whether the theme, signature, and phone cards are available in Outlook on the web.

FreCardsEnabled

The GlobalAddressListEnabled parameter specifies whether the global address list is available in Outlook on the web.

GlobalAddressListEnabled

The GroupCreationEnabled parameter specifies whether Office 365 group creation is available in Outlook on the web.

GroupCreationEnabled

The InstantMessagingEnabled parameter specifies whether instant messaging is available in Outlook on the web.

InstantMessagingEnabled

The InstantMessagingType parameter specifies the type of instant messaging provider in Outlook on the web.

InstantMessagingType

The InterestingCalendarsEnabled parameter specifies whether interesting calendars are available in Outlook on the web.

InterestingCalendarsEnabled

The InternalSPMySiteHostURL specifies the My Site Host URL for internal users.

InternalSPMySiteHostURL

The IRMEnabled parameter specifies whether Information Rights Management (IRM) features are available in Outlook on the web.

IRMEnabled

No description available.

ItemsToOtherAccountsEnabled

The IsDefault switch specifies whether the Outlook on the web policy is the default policy that's used to configure the Outlook on the web settings for new mailboxes.

IsDefault

The JournalEnabled parameter specifies whether the Journal folder is available in Outlook on the web.

JournalEnabled

The LocalEventsEnabled parameter specifies whether local events calendars are available in Outlook on the web.

LocalEventsEnabled

The LogonAndErrorLanguage parameter specifies the language that used in Outlook on the web for forms-based authentication and for error messages when a user's current language setting can't be read. A valid value is a supported Microsoft Windows Language Code Identifier (LCID). For example, 1033 is US English.

LogonAndErrorLanguage

No description available.

MessagePreviewsDisabled

The NotesEnabled parameter specifies whether the Notes folder is available in Outlook on the web.

NotesEnabled

The NpsSurveysEnabled parameter specifies whether to enable or disable the Net Promoter Score (NPS) survey in Outlook on the web. The survey allows uses to rate Outlook on the web on a scale of 1 to 5, and to provide feedback and suggested improvements in free text.

NpsSurveysEnabled

The OneWinNativeOutlookEnabled parameter controls the availability of the new Outlook for Windows App.

OneWinNativeOutlookEnabled

When the OrganizationEnabled parameter is set to $false, the Automatic Reply option doesn't include external and internal options, the address book doesn't show the organization hierarchy, and the Resources tab in Calendar forms is disabled.

OrganizationEnabled

The OnSendAddinsEnabled parameter specifies whether to enable or disable on send add-ins in Outlook on the web (add-ins that support events when a user clicks Send).

OnSendAddinsEnabled

The OutboundCharset parameter specifies the character set that's used for outgoing messages in Outlook on the web.

OutboundCharset

The OutlookBetaToggleEnabled parameter specifies whether to enable or disable the Outlook on the web Preview toggle. The Preview toggle allows users to try the new Outlook on the web experience.

OutlookBetaToggleEnabled

The OWALightEnabled parameter controls the availability of the light version of Outlook on the web.

OWALightEnabled

No description available.

PersonalAccountsEnabled

The PersonalAccountCalendarsEnabled parameter specifies whether to allow users to connect to their personal Outlook.com or Google Calendar in Outlook on the web.

PersonalAccountCalendarsEnabled

The PhoneticSupportEnabled parameter specifies phonetically spelled entries in the address book. This parameter is available for use in Japan.

PhoneticSupportEnabled

The PlacesEnabled parameter specifies whether to enable or disable Places in Outlook on the web. Places lets users search, share, and map location details by using Bing.

PlacesEnabled

The PremiumClientEnabled parameter controls the availability of the full version of Outlook Web App.

PremiumClientEnabled

The PrintWithoutDownloadEnabled specifies whether to allow printing of supported files without downloading the attachment in Outlook on the web.

PrintWithoutDownloadEnabled

The ProjectMocaEnabled parameter enables or disables access to Project Moca in Outlook on the web.

ProjectMocaEnabled

The PublicFoldersEnabled parameter specifies whether a user can browse or read items in public folders in Outlook Web App.

PublicFoldersEnabled

The RecoverDeletedItemsEnabled parameter specifies whether a user can use Outlook Web App to view, recover, or delete permanently items that have been deleted from the Deleted Items folder.

RecoverDeletedItemsEnabled

The ReferenceAttachmentsEnabled parameter specifies whether users can attach files from the cloud as linked attachments in Outlook on the web.

ReferenceAttachmentsEnabled

The RemindersAndNotificationsEnabled parameter specifies whether notifications and reminders are enabled in Outlook on the web.

RemindersAndNotificationsEnabled

The ReportJunkEmailEnabled parameter specifies whether users can report messages to Microsoft or unsubscribe from messages in Outlook on the web.

ReportJunkEmailEnabled

The RulesEnabled parameter specifies whether a user can view, create, or modify server-side rules in Outlook on the web.

RulesEnabled

The SatisfactionEnabled parameter specifies whether to enable or disable the satisfaction survey.

SatisfactionEnabled

The SaveAttachmentsToCloudEnabled parameter specifies whether users can save regular email attachments to the cloud.

SaveAttachmentsToCloudEnabled

The SearchFoldersEnabled parameter specifies whether Search Folders are available in Outlook on the web.

SearchFoldersEnabled

The SetPhotoEnabled parameter specifies whether users can add, change, and remove their sender photo in Outlook on the web.

SetPhotoEnabled

The SetPhotoURL parameter controls where users go to select their photo. Note that you can't specify a URL that contains one or more picture files, as there is no mechanism to copy a URL photo to the properties of the users' Exchange Online mailboxes.

SetPhotoURL

No description available.

ShowOnlineArchiveEnabled

The SignaturesEnabled parameter specifies whether to enable or disable the use of signatures in Outlook on the web.

SignaturesEnabled

The SkipCreateUnifiedGroupCustomSharepointClassification parameter specifies whether to skip a custom SharePoint page during the creation of Office 365 Groups in Outlook web app.

SkipCreateUnifiedGroupCustomSharepointClassification

The TeamSnapCalendarsEnabled parameter specifies whether to allow users to connect to their personal TeamSnap calendars in Outlook on the web.

TeamSnapCalendarsEnabled

The TextMessagingEnabled parameter specifies whether users can send and receive text messages in Outlook on the web.

TextMessagingEnabled

The ThemeSelectionEnabled parameter specifies whether users can change the theme in Outlook on the web.

ThemeSelectionEnabled

The UMIntegrationEnabled parameter specifies whether Unified Messaging (UM) integration is enabled in Outlook on the web.

UMIntegrationEnabled

The UseGB18030 parameter specifies whether to use the GB18030 character set instead of GB2312 in Outlook on the web.

UseGB18030

The UseISO885915 parameter specifies whether to use the character set ISO8859-15 instead of ISO8859-1 in Outlook on the web.

UseISO885915

The UserVoiceEnabled parameter specifies whether to enable or disable Outlook UserVoice in Outlook on the web. Outlook UserVoice is a customer feedback area that's available in Office 365.

UserVoiceEnabled

The WacEditingEnabled parameter specifies whether to enable or disable editing documents in Outlook on the web by using Office Online Server (formerly known as Office Web Apps Server and Web Access Companion Server).

WacEditingEnabled

The WacExternalServicesEnabled parameter specifies whether to enable or disable external services when viewing documents in Outlook on the web (for example, machine translation) by using Office Online Server.

WacExternalServicesEnabled

The WacOMEXEnabled parameter specifies whether to enable or disable apps for Outlook in Outlook on the web in Office Online Server.

WacOMEXEnabled

The WacViewingOnPrivateComputersEnabled parameter specifies whether to enable or disable web viewing of supported Office documents private computer sessions in Office Online Server (formerly known as Office Web Apps Server and Web Access Companion Server). By default, all Outlook on the web sessions are considered to be on private computers.

WacViewingOnPrivateComputersEnabled

The WacViewingOnPublicComputersEnabled parameter specifies whether to enable or disable web viewing of supported Office documents in public computer sessions in Office Online Server.

WacViewingOnPublicComputersEnabled

The WeatherEnabled parameter specifies whether to enable or disable weather information in the calendar in Outlook on the web.

WeatherEnabled

The WebPartsFrameOptionsType parameter specifies what sources can access web parts in IFRAME or FRAME elements in Outlook on the web.

WebPartsFrameOptionsType

Specify if the OWA Mailbox Policy should exist or not.

Ensure

This resource configures Partner Applications in Exchange Online.

Schema for microsoft.exchange.partnerapplication

The Name parameter specifies a new name for the partner application.

Name

The ApplicationIdentifier parameter specifies a unique application identifier for the partner application that uses an authorization server.

ApplicationIdentifier

The AcceptSecurityIdentifierInformation parameter specifies whether Exchange should accept security identifiers (SIDs) from another trusted Active Directory forest for the partner application.

AcceptSecurityIdentifierInformation

The AccountType parameter specifies the type of Microsoft account that's required for the partner application.

AccountType

The Enabled parameter specifies whether the partner application is enabled.

Enabled

The LinkedAccount parameter specifies a linked Active Directory user account for the application.

LinkedAccount

Specify if the Partner Application should exist or not.

Ensure

Modify the perimeter Configuration policy in your cloud-based organization.

Schema for microsoft.exchange.perimeterconfiguration

Only valid value is 'Yes'.

IsSingleInstance

Use the GatewayIPAddresses parameter to create or modify a list of gateway server IP addresses to add to IP safelists.

GatewayIPAddresses

Specifies if this Outbound connector should exist.

Ensure

This resource configures a place in Exchange Online (e.g., room).

Schema for microsoft.exchange.place

The Identity parameter specifies the room mailbox that you want to modify. You can use any value that uniquely identifies the room.

Identity

The display name of the place.

DisplayName

The AudioDeviceName parameter specifies the name of the audio device in the room. If the value contains spaces, enclose the value in quotation marks.

AudioDeviceName

The Building parameter specifies the building name or building number that the room is in. If the value contains spaces, enclose the value in quotation marks.

Building

The Capacity parameter specifies the capacity of the room. A valid value is an integer.

Capacity

The City parameter specifies the room's city. If the value contains spaces, enclose the value in quotation marks.

City

The CountryOrRegion parameter specifies the room's country or region. A valid value is a valid ISO 3166-1 two-letter country code (for example, AU for Australia) or the corresponding friendly name for the country (which might be different from the official ISO 3166 Maintenance Agency short name).

CountryOrRegion

Desks

The DisplayDeviceName parameter specifies the name of the display device in the room. If the value contains spaces, enclose the value in quotation marks.

DisplayDeviceName

The Floor parameter specifies the floor number that the room is on.

Floor

The FloorLabel parameter specifies a descriptive label for the floor that the room is on. If the value contains spaces, enclose the value in quotation marks.

FloorLabel

The GeoCoordinates parameter specifies the room's location in latitude, longitude and (optionally) altitude coordinates.

GeoCoordinates

The IsWheelChairAccessible parameter specifies whether the room is wheelchair accessible.

IsWheelChairAccessible

The Label parameter specifies a descriptive label for the room (for example, a number or name). If the value contains spaces, enclose the value in quotation marks.

Label

The MTREnabled parameter identifies the room as configured with a Microsoft Teams room system. You can add Teams room systems as audio sources in Teams meetings that involve the room.

MTREnabled

The ParentId parameter specifies the ID of a Place in the parent location hierarchy in Microsoft Places.

ParentId

The ParentType parameter specifies the parent type of the ParentId in Microsoft Places. Valid values are: Floor, Section

ParentType

The Phone parameter specifies the room's telephone number.

Phone

The PostalCode parameter specifies the room's postal code.

PostalCode

The State parameter specifies the room's state or province.

State

The Street parameter specifies the room's physical address.

Street

The Tags parameter specifies additional features of the room (for example, details like the type of view or furniture type).

Tags

The VideoDeviceName parameter specifies the name of the video device in the room. If the value contains spaces, enclose the value in quotation marks.

VideoDeviceName

Specifies if this Outbound connector should exist.

Ensure

This resource configures Policy Tips in Exchange Online.

Schema for microsoft.exchange.policytipconfig

The Name parameter specifies the custom Policy Tip you want to modify.

Name

The Value parameter specifies the text that's displayed by the Policy Tip.

Value

Specify if the Policy Tip Config should exist or not.

Ensure

Create or modify a EXOQuarantinePolicy in your cloud-based organization.

Schema for microsoft.exchange.quarantinepolicy

The Identity parameter specifies the QuarantinePolicy you want to modify.

Identity

The EndUserQuarantinePermissionsValue parameter specifies the end-user permissions for the quarantine policy.

EndUserQuarantinePermissionsValue

The ESNEnabled parameter specifies whether to enable quarantine notifications (formerly known as end-user spam notifications) for the policy.

ESNEnabled

The MultiLanguageCustomDisclaimer parameter specifies the custom disclaimer text to use near the bottom of quarantine notifications.

MultiLanguageCustomDisclaimer

The MultiLanguageSenderName parameter specifies the email sender's display name to use in quarantine notifications.

MultiLanguageSenderName

The MultiLanguageSetting parameter specifies the language of quarantine notifications.

MultiLanguageSetting

The OrganizationBrandingEnabled parameter enables or disables organization branding in the end-user quarantine notification messages.

OrganizationBrandingEnabled

Specifies if this QuarantinePolicy should exist.

Ensure

The EndUserSpamNotificationFrequency parameter species how often quarantine notifications are sent to users. Valid values are: 04:00:00 (4 hours),1.00:00:00 (1 day),7.00:00:00 (7 days)

EndUserSpamNotificationFrequency

The QuarantinePolicyType parameter filters the results by the specified quarantine policy type. Valid values are: QuarantinePolicy, GlobalQuarantinePolicy

QuarantinePolicyType

This parameter is reserved for internal Microsoft use.

EndUserSpamNotificationFrequencyInDays

CustomDisclaimer

The EndUserSpamNotificationCustomFromAddress specifies the email address of an existing internal sender to use as the sender for quarantine notifications. To set this parameter back to the default email address quarantine@messaging.microsoft.com, use the value $null.

EndUserSpamNotificationCustomFromAddress

The EsnCustomSubject parameter specifies the text to use in the Subject field of quarantine notifications.This setting is available only in the built-in quarantine policy named DefaultGlobalTag that controls global quarantine policy settings.

EsnCustomSubject

This resource allows users to retrieve Office 365 Recipient Permissions.

Schema for microsoft.exchange.recipientpermission

The mailbox the permission should be given on.

Identity

The account to give the permission to.

Trustee

The access rights granted to the account. Only 'SendAs' is supported.

AccessRights

Present ensures the group exists, absent ensures it is removed

Ensure

This resource configures the Remote Email Domains in Exchange Online.

Schema for microsoft.exchange.remotedomain

Specify the Identity for the RemoteDomain.

Identity

The DomainName parameter specifies the SMTP domain that you want to establish as a remote domain. A valid value is an SMTP domain (for example, contoso.com). The maximum length is 256 characters.

DomainName

Specify if the RemoteDomain should exist or not.

Ensure

External ExternalLegacy InternalLegacy None

The AllowedOOFType parameter specifies the type of automatic replies or out-of-office (also known as OOF) notifications than can be sent to recipients in the remote domain. Valid values are: External, ExternalLegacy, InternalLegacy or None

AllowedOOFType

The AutoForwardEnabled parameter specifies whether to allow messages that are auto-forwarded by client email programs in your organization.

AutoForwardEnabled

The AutoReplyEnabled parameter specifies whether to allow messages that are automatic replies from client email programs in your organization (for example, automatic reply messages that are generated by rules in Outlook).

AutoReplyEnabled

The ByteEncoderTypeFor7BitCharsets parameter specifies the 7-bit transfer encoding method for MIME format for messages sent to this remote domain.

The CharacterSet parameter specifies a character set for MIME messages without defined character sets that are sent from your organization to recipients in the remote domain.

CharacterSet

The ContentType parameter specifies the outbound message content type and formatting.

ContentType

The DeliveryReportEnabled parameter specifies whether to allow delivery reports from client software in your organization to recipients in the remote domain.

DeliveryReportEnabled

The DisplaySenderName parameter specifies whether to show the sender's Display Name in the From email address for messages sent to recipients in the remote domain.

DisplaySenderName

The IsInternal parameter specifies whether the recipients in the remote domain are considered to be internal recipients.

IsInternal

The LineWrapSize parameter specifies the line-wrap size for messages to recipients in the remote domain. Valid values are an integer from 0 through 132 or the value to unlimited. The default value is unlimited.

LineWrapSize

The MeetingForwardNotificationEnabled parameter specifies whether to enable meeting forward notifications for recipients in the remote domain.

MeetingForwardNotificationEnabled

The Name parameter specifies a unique name for the remote domain object. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.

Name

The NDREnabled parameter specifies whether to allow non-delivery reports (also known NDRs or bounce messages) from your organization to recipients in the remote domain.

NDREnabled

The NonMimeCharacterSet parameter specifies a character set for plain text messages without defined character sets that are sent from your organization to recipients in the remote domain.

NonMimeCharacterSet

The PreferredInternetCodePageForShiftJis parameter specifies the specific code page to use for Shift JIS character encoding in messages that are sent to recipients in the remote domain.

PreferredInternetCodePageForShiftJis

The RequiredCharsetCoverage parameter specifies a percentage threshold for characters in a message that must match to apply your organization's preferred character set before switching to automatic character set detection.

RequiredCharsetCoverage

The TargetDeliveryDomain parameter specifies whether the remote domain is used in cross-forest deployments to generate target email addresses for new mail users that represent users in the other organization (for example, all mailboxes hosted on Exchange Online are represented as mail users in your on-premises organization).

TargetDeliveryDomain

The TNEFEnabled parameter specifies whether Transport Neutral Encapsulation Format (TNEF) message encoding is used on messages sent to the remote domain.

TNEFEnabled

The TrustedMailInboundEnabled parameter specifies whether messages from senders in the remote domain are treated as trusted messages.

TrustedMailInboundEnabled

The TrustedMailOutboundEnabled parameter specifies whether messages sent to recipients in the remote domain are treated as trusted messages.

TrustedMailOutboundEnabled

The UseSimpleDisplayName parameter specifies whether the sender's simple display name is used for the From email address in messages sent to recipients in the remote domain.

UseSimpleDisplayName

Create or modify an EXOReportSubmissionPolicy in your cloud-based organization.

Schema for microsoft.exchange.reportsubmissionpolicy

Specifies the resource is a single instance, the value must be 'Yes'.

IsSingleInstance

The DisableQuarantineReportingOption parameter allows or prevents users from reporting messages in quarantine.

DisableQuarantineReportingOption

The EnableCustomNotificationSender parameter specifies whether a custom sender email address is used for result messages after an admin reviews and marks the reported messages as junk, not junk, or phishing.

EnableCustomNotificationSender

The EnableOrganizationBranding parameter specifies whether to show the company logo in the footer of result messages that users receive after an admin reviews and marks the reported messages as junk, not junk, or phishing.

EnableOrganizationBranding

The EnableReportToMicrosoft parameter specifies whether Microsoft integrated reporting experience is enabled or disabled.

EnableReportToMicrosoft

The EnableThirdPartyAddress parameter specifies whether you're using third-party reporting tools in Outlook instead of Microsoft tools to send messages to the reporting mailbox in Exchange Online.

EnableThirdPartyAddress

The EnableUserEmailNotification parameter species whether users receive result messages after an admin reviews and marks the reported messages as junk, not junk, or phishing.

EnableUserEmailNotification

The JunkReviewResultMessage parameter specifies the custom text to use in result messages after an admin reviews and marks the reported messages as junk.

JunkReviewResultMessage

The NotJunkReviewResultMessage parameter specifies the custom text to use in result messages after an admin reviews and marks the reported messages as not junk.

NotJunkReviewResultMessage

The NotificationFooterMessage parameter specifies the custom footer text to use in email notifications after an admin reviews and marks the reported messages as junk, not junk, or phishing.

NotificationFooterMessage

The NotificationSenderAddress parameter specifies the sender email address to use in result messages after an admin reviews and marks the reported messages as junk, not junk, or phishing.

NotificationSenderAddress

The PhishingReviewResultMessage parameter specifies the custom text to use in result messages after an admin reviews and marks the reported messages as phishing.

PhishingReviewResultMessage

The PostSubmitMessage parameter specifies the custom pop-up message text to use in Outlook notifications after users report messages.

PostSubmitMessage

The PostSubmitMessageEnabled parameter enables or disables the pop-up Outlook notifications that users see after they report messages using Microsoft reporting tools.

PostSubmitMessageEnabled

The PostSubmitMessage parameter parameter specifies the custom pop-up message title to use in Outlook notifications after users report messages.

PostSubmitMessageTitle

The PreSubmitMessage parameter specifies the custom pop-up message text to use in Outlook notifications before users report messages.

PreSubmitMessage

The PreSubmitMessageEnabled parameter enables or disables the pop-up Outlook notifications that users see before they report messages using Microsoft reporting tools.

PreSubmitMessageEnabled

The PreSubmitMessage parameter parameter specifies the custom pop-up message title to use in Outlook notifications before users report messages.

PreSubmitMessageTitle

The ReportJunkAddresses parameter specifies the email address of the reporting mailbox in Exchange Online to receive user reported messages in reporting in Outlook using Microsoft or third-party reporting tools in Outlook.

ReportJunkAddresses

The ReportJunkToCustomizedAddress parameter specifies whether to send user reported messages from Outlook (using Microsoft or third-party reporting tools) to the reporting mailbox as part of reporting in Outlook.

ReportJunkToCustomizedAddress

The ReportNotJunkAddresses parameter specifies the email address of the reporting mailbox in Exchange Online to receive user reported messages in reporting in Outlook using Microsoft or third-party reporting tools in Outlook.

ReportNotJunkAddresses

The ReportNotJunkToCustomizedAddress parameter specifies whether to send user reported messages from Outlook (using Microsoft or third-party reporting tools) to the reporting mailbox as part of reporting in Outlook.

ReportNotJunkToCustomizedAddress

The ReportPhishAddresses parameter specifies the email address of the reporting mailbox in Exchange Online to receive user reported messages in reporting in Outlook using Microsoft or third-party reporting tools in Outlook.

ReportPhishAddresses

The ReportPhishToCustomizedAddress parameter specifies whether to send user reported messages from Outlook (using Microsoft or third-party reporting tools) to the reporting mailbox as part of reporting in Outlook.

ReportPhishToCustomizedAddress

Use the ThirdPartyReportAddresses parameter to specify the email address of the reporting mailbox when you're using a third-party product for user submissions instead of reporting in Outlook.

ThirdPartyReportAddresses

Specifies if this report submission policy should exist.

Ensure

Create or modify an EXOReportSubmissionRule in your cloud-based organization.

Schema for microsoft.exchange.reportsubmissionrule

Specifies the resource is a single instance, the value must be 'Yes'.

IsSingleInstance

The Identity parameter specifies the report submission rule that you want to modify.

Identity

The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time.

Comments

The SentTo parameter specifies the email address of the reporting mailbox in Exchange Online where user reported messages are sent.

SentTo

Specifies if this report submission rule should exist.

Ensure

Modify the resource Configuration policy in your cloud-based organization.

Schema for microsoft.exchange.resourceconfiguration

Only valid value is 'Yes'.

IsSingleInstance

The ResourcePropertySchema parameter specifies the custom resource property that you want to make available to room or equipment mailboxes. This parameter uses the syntax Room/<Text> or Equipment/<Text> where the <Text> value doesn't contain spaces. For example, Room/Whiteboard or Equipment/Van.

ResourcePropertySchema

Specifies if this Outbound connector should exist.

Ensure

This resource configures Role Assignment Policies in Exchange Online.

Schema for microsoft.exchange.roleassignmentpolicy

The Name parameter specifies the new name of the assignment policy. The maximum length is 64 characters.

Name

The Description parameter specifies the description that's displayed when the role assignment policy is viewed using the Get-RoleAssignmentPolicy cmdlet.

Description

The IsDefault switch makes the assignment policy the default assignment policy.

IsDefault

The Roles parameter specifies the management roles to assign to the role assignment policy when it's created.

Roles

Specify if the Role Assignment Policy should exist or not.

Ensure

This resource configures Role Groups in Exchange Online.

Schema for microsoft.exchange.rolegroup

The Name parameter specifies the name of the role. The maximum length of the name is 64 characters.

Name

The Description parameter specifies the description that's displayed when the role group is viewed using the Get-RoleGroup cmdlet. Enclose the description in quotation marks

Description

The Members parameter specifies the mailboxes or mail-enabled USGs to add as a member of the role group. You can identify the user or group by the name, DN, or primary SMTP address value. You can specify multiple members separated by commas (Value1,Value2,...ValueN). If the value contains spaces, enclose the value in quotation marks

Members

The Roles parameter specifies the management roles to assign to the role group when it's created. If a role name contains spaces, enclose the name in quotation marks. If you want to assign more that one role, separate the role names with commas.

Roles

Specify if the Role Group should exist or not.

Ensure

This resource configures the settings of the Safe Attachments policies
in your cloud-based organization.

Schema for microsoft.exchange.safeattachmentpolicy

The Identity parameter specifies the name of the SafeAttachmentpolicy that you want to modify.

Identity

The Action parameter specifies the action for the Safe Attachments policy.

Action

The ActionOnError parameter specifies the error handling option for Safe Attachments scanning (what to do if scanning times out or an error occurs). Valid values are: $true: The action specified by the Action parameter is applied to messages even when the attachments aren't successfully scanned. $false: The action specified by the Action parameter isn't applied to messages when the attachments aren't successfully scanned. This is the default value.

ActionOnError

The AdminDisplayName parameter specifies a description for the policy.

AdminDisplayName

Specify if this policy should be enabled. Default is $true.

Enable

The QuarantineTag specifies the quarantine policy that's used on messages that are quarantined as malware by Safe Attachments.

QuarantineTag

The Redirect parameter specifies whether to send detected malware attachments to another email address. Valid values are: $true: Malware attachments are sent to the email address specified by the RedirectAddress parameter. $false: Malware attachments aren't sent to another email address. This is the default value.

Redirect

The RedirectAddress parameter specifies the email address where detected malware attachments are sent when the Redirect parameter is set to the value $true.

RedirectAddress

Specify if this policy should exist or not.

Ensure

This resource configures an Safe Attachment Rule in Exchange Online.

Schema for microsoft.exchange.safeattachmentrule

The Identity parameter specifies the name of the SafeAttachment rule that you want to modify.

Identity

The SafeAttachmentPolicy parameter specifies the name of the SafeAttachment policy that's associated with the SafeAttachment rule.

SafeAttachmentPolicy

Specify if this rule should be enabled. Default is $true.

Enabled

The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.

Priority

The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.

Comments

The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

ExceptIfRecipientDomainIs

The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

ExceptIfSentTo

The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.

ExceptIfSentToMemberOf

The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

RecipientDomainIs

The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

SentTo

The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.

SentToMemberOf

Specify if this rule should exist or not.

Ensure

This resource configures the settings of the SafeLinks policies
in your cloud-based organization.

Schema for microsoft.exchange.safelinkspolicy

The Identity parameter specifies the SafeLinks policy that you want to modify.

Identity

Ensure

The AdminDisplayName parameter specifies a description for the policy.

AdminDisplayName

The AllowClickThrough parameter specifies whether to allow users to click through to the original URL on warning pages.

AllowClickThrough

The custom notification text specifies the customized notification text to show to users.

CustomNotificationText

The DeliverMessageAfterScan parameter specifies whether to deliver email messages only after Safe Links scanning is complete. Valid values are: $true: Wait until Safe Links scanning is complete before delivering the message. $false: If Safe Links scanning can't complete, deliver the message anyway. This is the default value.

DeliverMessageAfterScan

The DoNotRewriteUrls parameter specifies a URL that's skipped by Safe Links scanning. You can specify multiple values separated by commas.

DoNotRewriteUrls

The EnableForInternalSenders parameter specifies whether the Safe Links policy is applied to messages sent between internal senders and internal recipients within the same Exchange Online organization.

EnableForInternalSenders

The EnableOrganizationBranding parameter specifies whether your organization's logo is displayed on Safe Links warning and notification pages.

EnableOrganizationBranding

The EnableSafeLinksForOffice parameter specifies whether to enable Safe Links protection for supported Office desktop, mobile, or web apps.

EnableSafeLinksForOffice

The EnableSafeLinksForTeams parameter specifies whether Safe Links is enabled for Microsoft Teams. Valid values are: $true: Safe Links is enabled for Teams. If a protected user clicks a malicious link in a Teams conversation, group chat, or from channels, a warning page will appear in the default web browser. $false: Safe Links isn't enabled for Teams. This is the default value.

EnableSafeLinksForTeams

The EnableSafeLinksForEmail parameter specifies whether to enable Safe Links protection for email messages. Valid values are: $true: Safe Links is enabled for email. When a user clicks a link in an email, the link is checked by Safe Links. If the link is found to be malicious, a warning page appears in the default web browser. $false: Safe Links isn't enabled for email. This is the default value.

EnableSafeLinksForEmail

The DisableUrlRewrite parameter specifies whether to rewrite (wrap) URLs in email messages. Valid values are: $true: URLs in messages are not rewritten, but messages are still scanned by Safe Links prior to delivery. Time of click checks on links are done using the Safe Links API in supported Outlook clients (currently, Outlook for Windows and Outlook for Mac). Typically, we don't recommend using this value. $false: URLs in messages are rewritten. API checks still occur on unwrapped URLs in supported clients if the user is in a valid Safe Links policy. This is the default value.

DisableUrlRewrite

The ScanUrls parameter specifies whether to enable or disable the scanning of links in email messages. Valid values are: $true: Scanning links in email messages is enabled. $false: Scanning links in email messages is disabled. This is the default value.

ScanUrls

The TrackClicks parameter specifies whether to track user clicks related to Safe Links protection of links.

TrackClicks

The UseTranslatedNotificationText specifies whether to use Microsoft Translator to automatically localize the custom notification text that you specified with the CustomNotificationText parameter.

UseTranslatedNotificationText

This resource configures an SafeLinks Rule in Exchange Online.

Schema for microsoft.exchange.safelinksrule

The Identity parameter specifies the name of the SafeLink rule that you want to modify.

Identity

Specify if this rule should exist or not.

Ensure

The SafeLinksPolicy parameter specifies the name of the SafeLink policy that's associated with the SafeLinksing rule.

SafeLinksPolicy

Specify if this rule should be enabled. Default is $true.

Enabled

The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.

Priority

The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.

Comments

The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

ExceptIfRecipientDomainIs

The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

ExceptIfSentTo

The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.

ExceptIfSentToMemberOf

The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

RecipientDomainIs

The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

SentTo

The SentToMemberOf parameter looks for messages sent to members of groups. You can use any value that uniquely identifies the group.

SentToMemberOf

This resource allows users to create Office 365 Shared Mailboxes.

Schema for microsoft.exchange.sharedmailbox

The display name of the Shared Mailbox

DisplayName

The unique identifier of the Shared Mailbox

Identity

The primary email address of the Shared Mailbox

PrimarySMTPAddress

The alias of the Shared Mailbox

Alias

The EmailAddresses parameter specifies all the email addresses (proxy addresses) for the Shared Mailbox

EmailAddresses

Present ensures the group exists, absent ensures it is removed

Ensure

This resource configures Sharing Policies in Exchange Online.

Schema for microsoft.exchange.sharingpolicy

The Name parameter specifies the unique name of the sharing policy. The maximum length is 64 characters.

Name

The Default switch specifies that the sharing policy is the default sharing policy for all mailboxes.

Default

The Enabled parameter specifies whether to enable the sharing policy. Valid values for this parameter are $true or $false.

Enabled

The Domains parameter specifies domains to which this policy applies and the sharing policy action.

Domains

Specify if the Sharing Policy should exist or not.

Ensure

Use this resource to create Sweep rules in mailboxes. Sweep rules run at regular intervals to help keep your Inbox clean.

Schema for microsoft.exchange.sweeprule

The Name parameter specifies the name of the Sweep rule. If the value contains spaces, enclose the value in quotation marks.

Name

The Provider parameter specifies the provider for the Sweep rule. If the value contains spaces, enclose the value in quotation marks. For Sweep rules that you create in Outlook on the web, the default value is Exchange16.

Provider

The DestinationFolder parameter specifies an action for the Sweep rule that moves messages to the specified folder.

DestinationFolder

The Enabled parameter specifies whether the Sweep rule is enabled or disabled.

Enabled

The KeepForDays parameter specifies an action for the Sweep rule that specifies the number of days to keep messages that match the conditions of the rule. After the number of days have passed, the messages are moved to the location that's specified by the DestinationFolder parameter (by default, the Deleted Items folder). You can't use this parameter with the KeepLatest parameter and the Sweep rule must contain a KeepForDays or KeepLatest parameter value.

KeepForDays

The KeepLatest parameter specifies an action for the Sweep rule that specifies the number of messages to keep that match the conditions of the rule. After the number of messages is exceeded, the oldest messages are moved to the location that's specified by the DestinationFolder parameter (by default, the Deleted Items folder). You can't use this parameter with the KeepForDays parameter and the Sweep rule must contain a KeepForDays or KeepLatest parameter value.

KeepLatest

The Mailbox parameter specifies the mailbox where you want to create the Sweep rule. You can use any value that uniquely identifies the mailbox.

Mailbox

The SenderName parameter specifies a condition for the Sweep rule that looks for the specified sender in messages. For internal senders, you can use any value that uniquely identifies the sender.

SenderName

The SourceFolder parameter specifies a condition for the Sweep rule that looks for messages in the specified folder.

SourceFolder

The SystemCategory parameter specifies a condition for the sweep rule that looks for messages with the specified system category. System categories are available to all mailboxes in the organization.

SystemCategory

Specify if this rule should exist or not.

Ensure

This resource configures the Exchange Online transport
settings.

Schema for microsoft.exchange.transportconfig

Specifies the resource is a single instance, the value must be 'Yes'.

IsSingleInstance

The AddressBookPolicyRoutingEnabled parameter controls how recipients are resolved in an organization that uses address book policies to create separate virtual organizations within the same Exchange organization.

AddressBookPolicyRoutingEnabled

Allow legacy TLS clients

AllowLegacyTLSClients

The ClearCategories parameter keeps or removes Microsoft Outlook message categories during content conversion.

ClearCategories

The ConvertDisclaimerWrapperToEml parameter specifies whether the original message will be added as a TNEF attachment or a regular EML attachment to a disclaimer.

ConvertDisclaimerWrapperToEml

The DSNConversionMode parameter controls how Exchange handles delivery status notifications that are generated by earlier versions of Exchange or other messaging systems.

DSNConversionMode

The ExternalDelayDsnEnabled parameter specifies whether a delay delivery status notification (DSN) message should be created for external messages that couldn't be immediately delivered.

ExternalDelayDsnEnabled

The ExternalDsnDefaultLanguage parameter specifies which Exchange server language should be used by default when you create external DSN messages.

ExternalDsnDefaultLanguage

The ExternalDsnLanguageDetectionEnabled parameter specifies whether the server should try to send an external DSN message in the same language as the original message that generated the notification.

ExternalDsnLanguageDetectionEnabled

The ExternalDsnReportingAuthority parameter specifies the domain in the machine-readable part of external DSN messages.

ExternalDsnReportingAuthority

The ExternalDsnSendHtml parameter specifies whether external DSN messages should be HTML or plain text.

ExternalDsnSendHtml

The ExternalPostmasterAddress parameter specifies the email address in the From header field of an external DSN message.

ExternalPostmasterAddress

The HeaderPromotionModeSetting parameter specifies whether named properties are created for custom X-headers on messages received.

HeaderPromotionModeSetting

The InternalDelayDsnEnabled parameter specifies whether a delay DSN message should be created for messages sent to or from recipients or senders in the same Exchange organization that couldn't be immediately delivered.

InternalDelayDsnEnabled

The InternalDsnDefaultLanguage parameter specifies which Exchange server language should be used by default when you create internal DSN messages.

InternalDsnDefaultLanguage

The InternalDsnLanguageDetectionEnabled parameter specifies whether the server should try to send an internal DSN message in the same language as the original message that generated the notification.

InternalDsnLanguageDetectionEnabled

The InternalDsnReportingAuthority parameter specifies the domain in the machine-readable part of internal DSN messages.

InternalDsnReportingAuthority

The InternalDsnSendHtml parameter specifies whether internal DSN messages should be HTML or plain text.

InternalDsnSendHtml

The JournalMessageExpirationDays parameter extends the number of days that undeliverable journal reports are queued before they expire.

JournalMessageExpirationDays

The JournalingReportNdrTo parameter specifies the email address to which journal reports are sent if the journaling mailbox is unavailable.

JournalingReportNdrTo

The MaxRecipientEnvelopeLimit parameter specifies the maximum number of recipients in a message.

MaxRecipientEnvelopeLimit

Reply all storm block duration hours.

ReplyAllStormBlockDurationHours

Reply all storm detection minimum recipients.

ReplyAllStormDetectionMinimumRecipients

Reply all storm detection minimum replies.

ReplyAllStormDetectionMinimumReplies

Reply all storm protection enabled.

ReplyAllStormProtectionEnabled

The Rfc2231EncodingEnabled parameter specifies whether the RFC 2231 encoding of MIME parameters for outbound messages is enabled in your organization.

The SmtpClientAuthenticationDisabled parameter specifies whether to disable authenticated SMTP (SMTP AUTH) for the whole organization.

SmtpClientAuthenticationDisabled

This resource configures Transport Rules in Exchange Online.

Schema for microsoft.exchange.transportrule

The Name parameter specifies the display name of the transport rule to be created. The maximum length is 64 characters.

Name

This parameter specifies a condition or part of a condition for the rule. The name of the corresponding exception parameter starts with ExceptIf.

ADComparisonAttribute

ADComparisonOperator

The ActivationDate parameter specifies when the rule starts processing messages. The rule won't take any action on messages until the specified date/time.

ActivationDate

The AddManagerAsRecipientType parameter specifies an action that delivers or redirects messages to the user that's defined in the sender's Manager attribute.

AddManagerAsRecipientType

The AddToRecipients parameter specifies an action that adds recipients to the To field of messages.

AddToRecipients

The AnyOfCcHeader parameter specifies a condition that looks for recipients in the Cc field of messages.

AnyOfCcHeader

The AnyOfCcHeaderMemberOf parameter specifies a condition that looks for group members in the Cc field of messages.

AnyOfCcHeaderMemberOf

The AnyOfRecipientAddressContainsWords parameter specifies a condition that looks for words in recipient email addresses.

AnyOfRecipientAddressContainsWords

The AnyOfRecipientAddressMatchesPatterns parameter specifies a condition that looks for text patterns in recipient email addresses by using regular expressions.

AnyOfRecipientAddressMatchesPatterns

The AnyOfToCcHeader parameter specifies a condition that looks for recipients in the To or Cc fields of messages.

AnyOfToCcHeader

The AnyOfToCcHeaderMemberOf parameter specifies a condition that looks for group members in the To and Cc fields of messages.

AnyOfToCcHeaderMemberOf

The AnyOfToHeader parameter specifies a condition that looks for recipients in the To field of messages.

AnyOfToHeader

The AnyOfToHeaderMemberOf parameter specifies a condition that looks for group members in the To field of messages.

AnyOfToHeaderMemberOf

The ApplyClassification parameter specifies an action that applies a message classification to messages.

ApplyClassification

The ApplyHtmlDisclaimerFallbackAction parameter specifies what to do if the HTML disclaimer can't be added to a message.

ApplyHtmlDisclaimerFallbackAction

The ApplyHtmlDisclaimerLocation parameter specifies where to insert the HTML disclaimer text in the body of messages.

ApplyHtmlDisclaimerLocation

The ApplyHtmlDisclaimerText parameter specifies an action that adds the disclaimer text to messages.

ApplyHtmlDisclaimerText

The ApplyOME parameter specifies an action that encrypts messages and their attachments by using Office 365 Message Encryption.

ApplyOME

The ApplyRightsProtectionCustomizationTemplate parameter specifies an action that applies a custom branding template for OME encrypted messages.

ApplyRightsProtectionCustomizationTemplate

The ApplyRightsProtectionTemplate parameter specifies an action that applies rights management service (RMS) templates to messages.

ApplyRightsProtectionTemplate

The AttachmentContainsWords parameter specifies a condition that looks for words in message attachments.

AttachmentContainsWords

The AttachmentExtensionMatchesWords parameter specifies a condition that looks for words in the file name extensions of message attachments.

AttachmentExtensionMatchesWords

The AttachmentHasExecutableContent parameter specifies a condition that looks for executable content in message attachments.

AttachmentHasExecutableContent

The AttachmentIsPasswordProtected parameter specifies a condition that looks for password protected files in messages (because the contents of the file can't be inspected).

AttachmentIsPasswordProtected

The AttachmentIsUnsupported parameter specifies a condition that looks for unsupported file types in messages.

AttachmentIsUnsupported

The AttachmentMatchesPatterns parameter specifies a condition that looks for text patterns in the content of message attachments by using regular expressions.

AttachmentMatchesPatterns

The AttachmentNameMatchesPatterns parameter specifies a condition that looks for text patterns in the file name of message attachments by using regular expressions.

AttachmentNameMatchesPatterns

The AttachmentProcessingLimitExceeded parameter specifies a condition that looks for messages where attachment scanning didn't complete.

AttachmentProcessingLimitExceeded

The AttachmentPropertyContainsWords parameter specifies a condition that looks for words in the properties of attached Office documents.

AttachmentPropertyContainsWords

The AttachmentSizeOver parameter specifies a condition that looks for messages where any attachment is greater than the specified size.

AttachmentSizeOver

The BetweenMemberOf1 parameter specifies a condition that looks for messages that are sent between group members.

BetweenMemberOf1

The BetweenMemberOf2 parameter specifies a condition that looks for messages that are sent between group members.

BetweenMemberOf2

The BlindCopyTo parameter specifies an action that adds recipients to the Bcc field of messages.

BlindCopyTo

The Comments parameter specifies optional descriptive text for the rule. The length of the comment can't exceed 1024 characters.

Comments

The ContentCharacterSetContainsWords parameter specifies a condition that looks for character set names in messages.

ContentCharacterSetContainsWords

The CopyTo parameter specifies an action that adds recipients to the Cc field of messages.

CopyTo

The DeleteMessage parameter specifies an action that silently drops messages without an NDR.

DeleteMessage

The DlpPolicy parameter specifies the data loss prevention (DLP) policy that's associated with the rule.

DlpPolicy

The Enabled parameter specifies whether the new rule is created as enabled or disabled.

Enabled

The ExceptIfADComparisonAttribute parameter specifies an exception that compares an Active Directory attribute between the sender and all recipients of the message.

ExceptIfADComparisonAttribute

The ExceptIfADComparisonOperator parameter specifies the comparison operator for the ExceptIfADComparisonAttribute parameter.

ExceptIfADComparisonOperator

The ExceptIfAnyOfCcHeader parameter specifies an exception that looks for recipients in the Cc field of messages.

ExceptIfAnyOfCcHeader

The ExceptIfAnyOfCcHeaderMemberOf parameter specifies an exception that looks for group members in the Cc field of messages. You can use any value that uniquely identifies the group.

ExceptIfAnyOfCcHeaderMemberOf

The ExceptIfAnyOfRecipientAddressContainsWords parameter specifies an exception that looks for words in recipient email addresses.

ExceptIfAnyOfRecipientAddressContainsWords

The ExceptIfAnyOfRecipientAddressMatchesPatterns parameter specifies an exception that looks for text patterns in recipient email addresses by using regular expressions.

ExceptIfAnyOfRecipientAddressMatchesPatterns

The ExceptIfAnyOfToCcHeader parameter specifies an exception that looks for recipients in the To or Cc fields of messages.

ExceptIfAnyOfToCcHeader

The ExceptIfAnyOfToCcHeaderMemberOf parameter specifies an exception that looks for group members in the To and Cc fields of messages.

ExceptIfAnyOfToCcHeaderMemberOf

The ExceptIfAnyOfToHeader parameter specifies an exception that looks for recipients in the To field of messages.

ExceptIfAnyOfToHeader

The ExceptIfAnyOfToHeaderMemberOf parameter specifies an exception that looks for group members in the To field of messages.

ExceptIfAnyOfToHeaderMemberOf

The ExceptIfAttachmentContainsWords parameter specifies an exception that looks for words in message attachments.

ExceptIfAttachmentContainsWords

The ExceptIfAttachmentExtensionMatchesWords parameter specifies an exception that looks for words in the file name extensions of message attachments.

ExceptIfAttachmentExtensionMatchesWords

The ExceptIfAttachmentHasExecutableContent parameter specifies an exception that looks for executable content in message attachments.

ExceptIfAttachmentHasExecutableContent

The ExceptIfAttachmentIsPasswordProtected parameter specifies an exception that looks for password protected files in messages (because the contents of the file can't be inspected).

ExceptIfAttachmentIsPasswordProtected

The ExceptIfAttachmentIsUnsupported parameter specifies an exception that looks for unsupported file types in messages.

ExceptIfAttachmentIsUnsupported

The ExceptIfAttachmentMatchesPatterns parameter specifies an exception that looks for text patterns in the content of message attachments by using regular expressions.

ExceptIfAttachmentMatchesPatterns

The ExceptIfAttachmentNameMatchesPatterns parameter specifies an exception that looks for text patterns in the file name of message attachments by using regular expressions.

ExceptIfAttachmentNameMatchesPatterns

The ExceptIfAttachmentPropertyContainsWords parameter specifies an exception that looks for words in the properties of attached Office documents.

ExceptIfAttachmentPropertyContainsWords

The ExceptIfAttachmentProcessingLimitExceeded parameter specifies an exception that looks for messages where attachment scanning didn't complete.

ExceptIfAttachmentProcessingLimitExceeded

The ExceptIfAttachmentSizeOver parameter specifies an exception that looks for messages where any attachment is greater than the specified size.

ExceptIfAttachmentSizeOver

The ExceptIfBetweenMemberOf1 parameter specifies an exception that looks for messages that are sent between group members.

The ExceptIfBetweenMemberOf2 parameter specifies an exception that looks for messages that are sent between group members.

The ExceptIfContentCharacterSetContainsWords parameter specifies an exception that looks for character set names in messages.

ExceptIfContentCharacterSetContainsWords

The ExceptIfFrom parameter specifies an exception that looks for messages from specific senders.

ExceptIfFrom

The ExceptIfFromAddressContainsWords parameter specifies an exception that looks for words in the sender's email address.

ExceptIfFromAddressContainsWords

The ExceptIfFromAddressMatchesPatterns parameter specifies an exception that looks for text patterns in the sender's email address by using regular expressions.

ExceptIfFromAddressMatchesPatterns

The ExceptIfFromMemberOf parameter specifies an exception that looks for messages sent by group members.

ExceptIfFromMemberOf

The ExceptIfFromScope parameter specifies an exception that looks for the location of message senders.

ExceptIfFromScope

The ExceptIfHasClassification parameter specifies an exception that looks for messages with the specified message classification.

ExceptIfHasClassification

The ExceptIfHasNoClassification parameter specifies an exception that looks for messages with or without any message classifications.

ExceptIfHasNoClassification

DEPRECATED

ExceptIfHasSenderOverride

The ExceptIfHeaderContainsMessageHeader parameter specifies the name of header field in the message header when searching for the words specified by the ExceptIfHeaderContainsWords parameter.

ExceptIfHeaderContainsMessageHeader

The ExceptIfHeaderContainsWords parameter specifies an exception that looks for words in a header field.

ExceptIfHeaderContainsWords

The ExceptIfHeaderMatchesMessageHeader parameter specifies the name of header field in the message header when searching for the text patterns specified by the ExceptIfHeaderMatchesPatterns parameter.

ExceptIfHeaderMatchesMessageHeader

The ExceptIfHeaderMatchesPatterns parameter specifies an exception that looks for text patterns in a header field by using regular expressions.

ExceptIfHeaderMatchesPatterns

The ExceptIfManagerAddresses parameter specifies the users (managers) for the ExceptIfManagerForEvaluatedUser parameter.

ExceptIfManagerAddresses

The ExceptIfManagerForEvaluatedUser parameter specifies an exception that looks for users in the Manager attribute of senders or recipients.

ExceptIfManagerForEvaluatedUser

OOF AutoForward Encrypted Calendaring PermissionControlled Voicemail Signed ApprovalRequest ReadReceipt

The ExceptIfMessageTypeMatches parameter specifies an exception that looks for messages of the specified type.

ExceptIfMessageTypeMatches

DEPRECATED

ExceptIfMessageContainsDataClassifications

The ExceptIfMessageSizeOver parameter specifies an exception that looks for messages larger than the specified size.

ExceptIfMessageSizeOver

The ExceptIfRecipientADAttributeContainsWords parameter specifies an exception that looks for words in the Active Directory attributes of recipients.

ExceptIfRecipientADAttributeContainsWords

The ExceptIfRecipientADAttributeMatchesPatterns parameter specifies an exception that looks for text patterns in the Active Directory attributes of recipients by using regular expressions.

ExceptIfRecipientADAttributeMatchesPatterns

The ExceptIfRecipientAddressContainsWords parameter specifies an exception that looks for words in recipient email addresses.

ExceptIfRecipientAddressContainsWords

The ExceptIfRecipientAddressMatchesPatterns parameter specifies an exception that looks for text patterns in recipient email addresses by using regular expressions.

ExceptIfRecipientAddressMatchesPatterns

The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email address in the specified domains.

ExceptIfRecipientDomainIs

This parameter is reserved for internal Microsoft use.

ExceptIfRecipientInSenderList

The ExceptIfSCLOver parameter specifies an exception that looks for the SCL value of messages

ExceptIfSCLOver

The ExceptIfSenderADAttributeContainsWords parameter specifies an exception that looks for words in Active Directory attributes of message senders.

ExceptIfSenderADAttributeContainsWords

The ExceptIfSenderADAttributeMatchesPatterns parameter specifies an exception that looks for text patterns in Active Directory attributes of message senders by using regular expressions.

ExceptIfSenderADAttributeMatchesPatterns

The ExceptIfSenderDomainIs parameter specifies an exception that looks for senders with email address in the specified domains.

ExceptIfSenderDomainIs

ExceptIfSenderInRecipientList

The ExceptIfSenderIpRanges parameter specifies an exception that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.

ExceptIfSenderIpRanges

The ExceptIfSenderManagementRelationship parameter specifies an exception that looks for the relationship between the sender and recipients in messages.

ExceptIfSenderManagementRelationship

The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

ExceptIfSentTo

The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group.

ExceptIfSentToMemberOf

InOrganization NotInOrganization ExternalPartner ExternalNonPartner

The ExceptIfSentToScope parameter specifies an exception that looks for the location of a recipient.

ExceptIfSentToScope

The ExceptIfSubjectContainsWords parameter specifies an exception that looks for words in the Subject field of messages.

ExceptIfSubjectContainsWords

The ExceptIfSubjectMatchesPatterns parameter specifies an exception that looks for text patterns in the Subject field of messages by using regular expressions.

ExceptIfSubjectMatchesPatterns

The ExceptIfSubjectOrBodyContainsWords parameter specifies an exception that looks for words in the Subject field or body of messages.

ExceptIfSubjectOrBodyContainsWords

The ExceptIfSubjectOrBodyMatchesPatterns parameter specifies an exception that looks for text patterns in the Subject field or body of messages.

ExceptIfSubjectOrBodyMatchesPatterns

The ExceptIfWithImportance parameter specifies an exception that looks for messages with the specified importance level.

ExceptIfWithImportance

The ExpiryDate parameter specifies when this rule will stop processing messages. The rule won't take any action on messages after the specified date/time.

ExpiryDate

The From parameter specifies a condition that looks for messages from specific senders. You can use any value that uniquely identifies the sender.

From

The FromAddressContainsWords parameter specifies a condition that looks for words in the sender's email address.

FromAddressContainsWords

The FromAddressMatchesPatterns parameter specifies a condition that looks for text patterns in the sender's email address by using regular expressions.

FromAddressMatchesPatterns

The FromMemberOf parameter specifies a condition that looks for messages sent by group members.

FromMemberOf

The FromScope parameter specifies a condition that looks for the location of message senders.

FromScope

The GenerateIncidentReport parameter specifies where to send the incident report that's defined by the IncidentReportContent parameter.

GenerateIncidentReport

The GenerateNotification parameter specifies an action that sends a notification message to recipients.

GenerateNotification

The HasClassification parameter specifies a condition that looks for messages with the specified message classification.

HasClassification

The HasNoClassification parameter specifies a condition that looks for messages with or without any message classifications.

HasNoClassification

DEPRECATED

HasSenderOverride

The HeaderContainsMessageHeader parameter specifies the name of header field in the message header when searching for the words specified by the HeaderContainsWords parameter.

HeaderContainsMessageHeader

The HeaderContainsWords parameter specifies a condition that looks for words in a header field.

HeaderContainsWords

The HeaderMatchesMessageHeader parameter specifies the name of header field in the message header when searching for the text patterns specified by the HeaderMatchesPatterns parameter.

HeaderMatchesMessageHeader

The HeaderMatchesPatterns parameter specifies a condition that looks for text patterns in a header field by using regular expressions.

HeaderMatchesPatterns

The IncidentReportContent parameter specifies the message properties that are included in the incident report that's generated when a message violates a DLP policy.

IncidentReportContent

The ManagerAddresses parameter specifies the users (managers) for the ExceptIfManagerForEvaluatedUser parameter.

ManagerAddresses

The ManagerForEvaluatedUser parameter specifies a condition that looks for users in the Manager attribute of senders or recipients.

ManagerForEvaluatedUser

DEPRECATED

MessageContainsDataClassifications

The MessageSizeOver parameter specifies a condition that looks for messages larger than the specified size. The size includes the message and all attachments.

MessageSizeOver

The MessageTypeMatches parameter specifies a condition that looks for messages of the specified type.

MessageTypeMatches

The Mode parameter specifies how the rule operates.

Mode

The ModerateMessageByManager parameter specifies an action that forwards messages for approval to the user that's specified in the sender's Manager attribute.

ModerateMessageByManager

The ModerateMessageByUser parameter specifies an action that forwards messages for approval to the specified users.

ModerateMessageByUser

NotifyOnly RejectMessage RejectUnlessFalsePositiveOverride RejectUnlessSilentOverride RejectUnlessExplicitOverride

DEPRECATED

NotifySender

The PrependSubject parameter specifies an action that adds text to add to the beginning of the Subject field of messages.

PrependSubject

The Priority parameter specifies a priority value for the rule that determines the order of rule processing.

Priority

The Quarantine parameter specifies an action that quarantines messages.

Quarantine

The RecipientADAttributeContainsWords parameter specifies a condition that looks for words in the Active Directory attributes of recipients.

RecipientADAttributeContainsWords

The RecipientADAttributeMatchesPatterns parameter specifies a condition that looks for text patterns in the Active Directory attributes of recipients by using regular expressions.

RecipientADAttributeMatchesPatterns

The RecipientAddressContainsWords parameter specifies a condition that looks for words in recipient email addresses.

RecipientAddressContainsWords

The RecipientAddressMatchesPatterns parameter specifies a condition that looks for text patterns in recipient email addresses by using regular expressions.

RecipientAddressMatchesPatterns

The RecipientAddressType parameter specifies how conditions and exceptions check recipient email addresses.

RecipientAddressType

The RecipientDomainIs parameter specifies a condition that looks for recipients with email address in the specified domains.

RecipientDomainIs

This parameter is reserved for internal Microsoft use.

RecipientInSenderList

The RedirectMessageTo parameter specifies a rule action that redirects messages to the specified recipients.

RedirectMessageTo

The RejectMessageEnhancedStatusCode parameter specifies the enhanced status code that's used when the rule rejects messages.

RejectMessageEnhancedStatusCode

The RejectMessageReasonText parameter specifies the explanation text that's used when the rule rejects messages.

RejectMessageReasonText

The RemoveHeader parameter specifies an action that removes a header field from the message header.

RemoveHeader

The RemoveOME parameter specifies an action that removes the previous version of Office 365 Message Encryption from messages and their attachments.

RemoveOME

The RemoveOMEv2 parameter specifies an action that removes Office 365 Message Encryption from messages and their attachments.

RemoveOMEv2

This parameter specifies an action or part of an action for the rule.

RemoveRMSAttachmentEncryption

The RouteMessageOutboundConnector parameter specifies an action that routes messages through the specified Outbound connector in Office 365.

RouteMessageOutboundConnector

The RouteMessageOutboundRequireTls parameter specifies an action that uses Transport Layer Security (TLS) encryption to deliver messages outside your organization.

RouteMessageOutboundRequireTls

The RuleErrorAction parameter specifies what to do if rule processing can't be completed on messages.

RuleErrorAction

The RuleSubType parameter specifies the rule type.

RuleSubType

The SCLOver parameter specifies a condition that looks for the SCL value of messages

SCLOver

The SenderADAttributeContainsWords parameter specifies a condition that looks for words in Active Directory attributes of message senders.

SenderADAttributeContainsWords

The SenderADAttributeMatchesPatterns parameter specifies a condition that looks for text patterns in Active Directory attributes of message senders by using regular expressions.

SenderADAttributeMatchesPatterns

The SenderAddressLocation parameter specifies where to look for sender addresses in conditions and exceptions that examine sender email addresses.

SenderAddressLocation

The SenderDomainIs parameter specifies a condition that looks for senders with email address in the specified domains.

SenderDomainIs

This parameter is reserved for internal Microsoft use.

SenderInRecipientList

The SenderIpRanges parameter specifies a condition that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.

SenderIpRanges

The SenderManagementRelationship parameter specifies a condition that looks for the relationship between the sender and recipients in messages.

SenderManagementRelationship

The SentTo parameter specifies a condition that looks for recipients in messages.

SentTo

The SentToMemberOf parameter specifies a condition that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups.

SentToMemberOf

The SentToScope parameter specifies a condition that looks for the location of recipients.

SentToScope

The SetAuditSeverity parameter specifies an action that sets the severity level of the incident report and the corresponding entry that's written to the message tracking log when messages violate DLP policies.

SetAuditSeverity

The SetHeaderName parameter specifies an action that adds or modifies a header field in the message header.

SetHeaderName

The SetHeaderValue parameter specifies an action that adds or modifies a header field in the message header.

SetHeaderValue

The SetSCL parameter specifies an action that adds or modifies the SCL value of messages.

SetSCL

The StopRuleProcessing parameter specifies an action that stops processing more rules.

StopRuleProcessing

The SubjectContainsWords parameter specifies a condition that looks for words in the Subject field of messages.

SubjectContainsWords

The SubjectMatchesPatterns parameter specifies a condition that looks for text patterns in the Subject field of messages by using regular expressions.

SubjectMatchesPatterns

The SubjectOrBodyContainsWords parameter specifies a condition that looks for words in the Subject field or body of messages.

SubjectOrBodyContainsWords

The SubjectOrBodyMatchesPatterns parameter specifies a condition that looks for text patterns in the Subject field or body of messages.

SubjectOrBodyMatchesPatterns

The WithImportance parameter specifies a condition that looks for messages with the specified importance level.

WithImportance

Specify if the Transport Rule should exist or not.

Ensure

This resource configures an Azure AD Administrative Unit.

Schema for microsoft.entra.administrativeunit

DisplayName of the Administrative Unit

DisplayName

Object-Id of the Administrative Unit

Id

Description of the Administrative Unit

Description

Visibility of the Administrative Unit. Specify HiddenMembership if members of the AU are hidden

Visibility

Specify membership type. Possible values are Assigned and Dynamic. Note that the functionality is currently in preview.

MembershipType

Specify membership rule. Requires that MembershipType is set to Dynamic. Note that the functionality is currently in preview.

MembershipRule

Specify dynamic membership-rule processing-state. Valid values are 'On' and 'Paused'. Requires that MembershipType is set to Dynamic. Note that the functionality is currently in preview.

MembershipRuleProcessingState

Schema for MSFT_MicrosoftGraphMember

Identity of member. For users, specify a UserPrincipalName. For groups, devices and serviceprincipals, specify DisplayName

Identity

Specify User, Group or Device to interpret the identity for Members. Specify User, Group or ServicePrincipal for ScopedRoleMembers.

Type

Specify members. Only specify if MembershipType is NOT set to Dynamic

Members

Schema for MSFT_MicrosoftGraphScopedRoleMembership

Name of the Azure AD Role that is assigned. See https://learn.microsoft.com/en-us/azure/active-directory/roles/admin-units-assign-roles#roles-that-can-be-assigned-with-administrative-unit-scope

RoleName

Member that is assigned the scoped role. Note: Any groups must be role-enabled

RoleMemberInfo

Identity

Type

Specify Scoped Role Membership. Note: Any groups must be role-enabled

ScopedRoleMembers

Present ensures the Administrative Unit exists, absent ensures it is removed.

Ensure

This resource configures an Azure Active Directory Application.

Schema for microsoft.entra.application

DisplayName of the app

DisplayName

ObjectID of the app.

ObjectId

AppId for the app.

AppId

Indicates whether this application is available in other tenants.

AvailableToOtherTenants

A free text field to provide a description of the application object to end users. The maximum allowed size is 1024 characters.

Description

A bitmask that configures the groups claim issued in a user or OAuth 2.0 access token that the application expects.

GroupMembershipClaims

The URL to the application's homepage.

Homepage

User-defined URI(s) that uniquely identify a Web application within its Azure AD tenant, or within a verified custom domain.

IdentifierUris

Specifies the fallback application type as public client, such as an installed application running on a mobile device. The default value is false, which means the fallback application type is confidential client such as web app. There are certain scenarios where Microsoft Entra ID cannot determine the client application type (for example, ROPC flow where it is configured without specifying a redirect URI). In those cases, Microsoft Entra ID will interpret the application type based on the value of this property.

IsFallbackPublicClient

Client applications that are tied to this resource application.

KnownClientApplications

The logout url for this application.

LogoutURL

Specifies whether this application is a public client (such as an installed application running on a mobile device). Default is false.

PublicClient

Specifies the URLs that user tokens are sent to for sign in, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to.

ReplyURLs

UPN or ObjectID values of the app's owners.

Owners

Specify if the Azure AD App should exist or not.

Ensure

Schema for MSFT_AADApplicationPermission

Name of the requested permission.

Name

Name of the API from which the permission comes from.

SourceAPI

Type of permission.

Type

Represented whether or not the Admin consent been granted on the app.

AdminConsentGranted

API permissions for the Azure Active Directory Application.

Permissions

Represents a group of related custom security attribute definitions.

Schema for microsoft.entra.attributeset

Identifier for the attribute set that is unique within a tenant. Can be up to 32 characters long and include Unicode characters. Cannot contain spaces or special characters. Cannot be changed later. Case insensitive

Id

Description

Maximum number of custom security attributes that can be defined in this attribute set. Default value is null. If not specified, the administrator can add up to the maximum of 500 active attributes per tenant. Can be changed later.

MaxAttributesPerSet

Present ensures the policy exists, absent ensures it is removed.

Ensure

Represents a Microsoft Entra authentication context class reference. Authentication context class references are custom values that define a Conditional Access authentication requirement

Schema for microsoft.entra.authenticationcontextclassreference

Identifier used to reference the authentication context class. The id is used to trigger step-up authentication for the referenced authentication requirements and is the value that will be issued in the acrs claim of an access token. This value in the claim is used to verify that the required authentication context has been satisfied. The allowed values are c1 through c25.

Id

A friendly name that identifies the authenticationContextClassReference object when building user-facing admin experiences. For example, a selection UX

DisplayName

A short explanation of the policies that are enforced by authenticationContextClassReference. This value should be used to provide secondary text to describe the authentication context class reference when building user-facing admin experiences. For example, a selection UX.

Description

Indicates whether the authenticationContextClassReference has been published by the security admin and is ready for use by apps. When it's set to false, it shouldn't be shown in admin UX experiences because the value isn't currently available for selection.

IsAvailable

Ensure

Azure AD Authentication Method Policy

Schema for microsoft.entra.authenticationmethodpolicy

A description of the policy.

Description

The name of the policy.

DisplayName

preMigration migrationInProgress migrationComplete unknownFutureValue

The state of migration of the authentication methods policy from the legacy multifactor authentication and self-service password reset (SSPR) policies. The possible values are: premigration - means the authentication methods policy is used for authentication only, legacy policies are respected. migrationInProgress - means the authentication methods policy is used for both authentication and SSPR, legacy policies are respected. migrationComplete - means the authentication methods policy is used for authentication and SSPR, legacy policies are ignored. unknownFutureValue - Evolvable enumeration sentinel value. Do not use.

PolicyMigrationState

The version of the policy in use.

PolicyVersion

Days before the user will be asked to reconfirm their method.

ReconfirmationInDays

Enforce registration at sign-in time. This property can be used to remind users to set up targeted authentication methods.

RegistrationEnforcement

Run campaigns to remind users to setup targeted authentication methods.

AuthenticationMethodsRegistrationCampaign

Azure AD Authentication Method Policy

Schema for MSFT_MicrosoftGraphExcludeTarget

The object identifier of an Azure AD user or group.

Id

The type of the authentication method target. Possible values are: user, group, unknownFutureValue.

TargetType

Users and groups of users that are excluded from being prompted to set up the authentication method.

ExcludeTargets

Azure AD Authentication Method Policy

Schema for MSFT_MicrosoftGraphAuthenticationMethodsRegistrationCampaignIncludeTarget

Id

The authentication method that the user is prompted to register. The value must be microsoftAuthenticator.

TargetedAuthenticationMethod

TargetType

Users and groups of users that are prompted to set up the authentication method.

IncludeTargets

Specifies the number of days that the user sees a prompt again if they select 'Not now' and snoozes the prompt. Minimum 0 days. Maximum: 14 days. If the value is '0'  The user is prompted during every MFA attempt.

SnoozeDurationInDays

default enabled disabled unknownFutureValue

Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.

State

Prompt users with their most-preferred credential for multifactor authentication.

SystemCredentialPreferences

Azure AD Authentication Method Policy

Schema for MSFT_AADAuthenticationMethodPolicyExcludeTarget

The object identifier of an Azure AD group.

Id

The type of the authentication method target. Possible values are: group and unknownFutureValue.

TargetType

Users and groups excluded from the preferred authentication method experience of the system.

ExcludeTargets

Azure AD Authentication Method Policy

Schema for MSFT_AADAuthenticationMethodPolicyIncludeTarget

The ID of the entity targeted.

Id

The kind of entity targeted. Possible values are: user, group.

TargetType

Users and groups included in the preferred authentication method experience of the system.

IncludeTargets

Indicates whether the feature is enabled or disabled. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set, and uses the default behavior of Azure Active Directory for the setting. The default value is disabled.

State

The unique identifier for an entity. Read-only.

Id

Present ensures the policy exists, absent ensures it is removed.

Ensure

Azure AD Authentication Method Policy Authenticator

Schema for microsoft.entra.authenticationmethodpolicyauthenticator

A collection of Microsoft Authenticator settings such as number matching and location context, and whether they are enabled for all users or specific users only.

FeatureSettings

Determines whether users will be able to approve push notifications on other Microsoft applications such as Outlook Mobile.

CompanionAppAllowedState

A single entity that's excluded from using this feature.

ExcludeTarget

The ID of the entity that's targeted in the include or exclude rule or all_users to target all users.

Id

group administrativeUnit role unknownFutureValue

The kind of entity that's targeted. The possible values are: group, administrativeUnit, role, unknownFutureValue.

TargetType

A single entity that's allowed to use this feature.

IncludeTarget

Id

TargetType

Enable or disable the feature. Possible values are: default, enabled, disabled, unknownFutureValue. The default value is used when the configuration hasn't been explicitly set and uses the default behavior of Azure AD for the setting. The default value is disabled.

State

Determines whether the user's Authenticator app will show them the client app they are signing into.

DisplayAppInformationRequiredState

ExcludeTarget

Id

TargetType

IncludeTarget

Id

TargetType

State

Determines whether the user's Authenticator app will show them the geographic location of where the authentication request originated from.

DisplayLocationInformationRequiredState

ExcludeTarget

Id

TargetType

IncludeTarget

Id

TargetType

State

Specifies whether the user needs to enter a number in the Authenticator app from the login screen to complete their login. Value is ignored for phone sign-in notifications.

NumberMatchingRequiredState

ExcludeTarget

Id

TargetType

IncludeTarget

Id

TargetType

State

true if users can use the OTP code generated by the Microsoft Authenticator app, false otherwise.

IsSoftwareOathEnabled

Schema for MSFT_AADAuthenticationMethodPolicyAuthenticatorExcludeTarget

The object identifier of an Azure AD group.

Id

The type of the authentication method target. Possible values are: group and unknownFutureValue.

TargetType

Displayname of the groups of users that are excluded from a policy.

ExcludeTargets

Schema for MSFT_AADAuthenticationMethodPolicyAuthenticatorIncludeTarget

Id

TargetType

Displayname of the groups of users that are included from a policy.

IncludeTargets

The state of the policy. Possible values are: enabled, disabled.

State

The unique identifier for an entity. Read-only.

Id

Present ensures the policy exists, absent ensures it is removed.

Ensure

Azure AD Authentication Method Policy Email

Schema for microsoft.entra.authenticationmethodpolicyemail

Determines whether email OTP is usable by external users for authentication. Possible values are: default, enabled, disabled, unknownFutureValue. Tenants in the default state who did not use public preview will automatically have email OTP enabled beginning in October 2021.

AllowExternalIdToUseEmailOtp

Schema for MSFT_AADAuthenticationMethodPolicyEmailExcludeTarget

Id

TargetType

ExcludeTargets

Schema for MSFT_AADAuthenticationMethodPolicyEmailIncludeTarget

Id

TargetType

IncludeTargets

State

Id

Ensure

Azure AD Authentication Method Policy Fido2

Schema for microsoft.entra.authenticationmethodpolicyfido2

Determines whether attestation must be enforced for FIDO2 security key registration.

IsAttestationEnforced

Determines if users can register new FIDO2 security keys.

IsSelfServiceRegistrationAllowed

Controls whether key restrictions are enforced on FIDO2 security keys, either allowing or disallowing certain key types as defined by Authenticator Attestation GUID (AAGUID), an identifier that indicates the type (e.g. make and model) of the authenticator.

KeyRestrictions

A collection of Authenticator Attestation GUIDs. AADGUIDs define key types and manufacturers.

AaGuids

Enforcement type. Possible values are: allow, block.

EnforcementType

Determines if the configured key enforcement is enabled.

IsEnforced

Schema for MSFT_AADAuthenticationMethodPolicyFido2ExcludeTarget

Id

TargetType

ExcludeTargets

Schema for MSFT_AADAuthenticationMethodPolicyFido2IncludeTarget

Id

TargetType

IncludeTargets

State

Id

Ensure

Azure AD Authentication Method Policy Sms

Schema for microsoft.entra.authenticationmethodpolicysms

Schema for MSFT_AADAuthenticationMethodPolicySmsExcludeTarget

The object identifier of an Azure AD group.

Id

The type of the authentication method target. Possible values are: group and unknownFutureValue.

TargetType

Displayname of the groups of users that are excluded from a policy.

ExcludeTargets

Schema for MSFT_AADAuthenticationMethodPolicySmsIncludeTarget

Id

TargetType

Displayname of the groups of users that are included from a policy.

IncludeTargets

The state of the policy. Possible values are: enabled, disabled.

State

The unique identifier for an entity. Read-only.

Id

Present ensures the policy exists, absent ensures it is removed.

Ensure

Azure AD Authentication Method Policy Software

Schema for microsoft.entra.authenticationmethodpolicysoftware

Schema for MSFT_AADAuthenticationMethodPolicySoftwareExcludeTarget

Id

TargetType

ExcludeTargets

Schema for MSFT_AADAuthenticationMethodPolicySoftwareIncludeTarget

Id

TargetType

IncludeTargets

State

Id

Ensure

Azure AD Authentication Method Policy Temporary

Schema for microsoft.entra.authenticationmethodpolicytemporary

Default length in characters of a Temporary Access Pass object. Must be between 8 and 48 characters.

DefaultLength

Default lifetime in minutes for a Temporary Access Pass. Value can be any integer between the minimumLifetimeInMinutes and maximumLifetimeInMinutes.

DefaultLifetimeInMinutes

If true, all the passes in the tenant will be restricted to one-time use. If false, passes in the tenant can be created to be either one-time use or reusable.

IsUsableOnce

Maximum lifetime in minutes for any Temporary Access Pass created in the tenant. Value can be between 10 and 43200 minutes (equivalent to 30 days).

MaximumLifetimeInMinutes

Minimum lifetime in minutes for any Temporary Access Pass created in the tenant. Value can be between 10 and 43200 minutes (equivalent to 30 days).

MinimumLifetimeInMinutes

Schema for MSFT_AADAuthenticationMethodPolicyTemporaryExcludeTarget

Id

TargetType

ExcludeTargets

Schema for MSFT_AADAuthenticationMethodPolicyTemporaryIncludeTarget

Id

TargetType

IncludeTargets

State

Id

Ensure

Azure AD Authentication Method Policy Voice

Schema for microsoft.entra.authenticationmethodpolicyvoice

true if users can register office phones, otherwise, false.

IsOfficePhoneAllowed

Schema for MSFT_AADAuthenticationMethodPolicyVoiceExcludeTarget

Id

TargetType

ExcludeTargets

Schema for MSFT_AADAuthenticationMethodPolicyVoiceIncludeTarget

Id

TargetType

IncludeTargets

State

Id

Ensure

Azure AD Authentication Method Policy X509

Schema for microsoft.entra.authenticationmethodpolicyx509

Defines strong authentication configurations. This configuration includes the default authentication mode and the different rules for strong authentication bindings.

AuthenticationModeConfiguration

Schema for MSFT_MicrosoftGraphX509CertificateRule

The identifier of the X.509 certificate. Required.

Identifier

The type of strong authentication mode. The possible values are: x509CertificateSingleFactor, x509CertificateMultiFactor, unknownFutureValue. Required.

The type of the X.509 certificate mode configuration rule. The possible values are: issuerSubject, policyOID, unknownFutureValue. Required.

Rules are configured in addition to the authentication mode to bind a specific x509CertificateRuleType to an x509CertificateAuthenticationMode. For example, bind the policyOID with identifier 1.32.132.343 to x509CertificateMultiFactor authentication mode.

Rules

The type of strong authentication mode. The possible values are: x509CertificateSingleFactor, x509CertificateMultiFactor, unknownFutureValue.

Schema for MSFT_MicrosoftGraphX509CertificateUserBinding

The priority of the binding. Azure AD uses the binding with the highest priority. This value must be a non-negative integer and unique in the collection of objects in the certificateUserBindings property of an x509CertificateAuthenticationMethodConfiguration object. Required

Priority

Defines the Azure AD user property of the user object to use for the binding. The possible values are: userPrincipalName, onPremisesUserPrincipalName, email. Required.

UserProperty

The field on the X.509 certificate to use for the binding. The possible values are: PrincipalName, RFC822Name.

Defines fields in the X.509 certificate that map to attributes of the Azure AD user object in order to bind the certificate to the user. The priority of the object determines the order in which the binding is carried out. The first binding that matches will be used and the rest ignored.

CertificateUserBindings

Schema for MSFT_AADAuthenticationMethodPolicyX509ExcludeTarget

The object identifier of an Azure AD group.

Id

The type of the authentication method target. Possible values are: group and unknownFutureValue.

TargetType

Displayname of the groups of users that are excluded from a policy.

ExcludeTargets

Schema for MSFT_AADAuthenticationMethodPolicyX509IncludeTarget

Id

Determines if the user is enforced to register the authentication method.

isRegistrationRequired

TargetType

Displayname of the groups of users that are included from a policy.

IncludeTargets

The state of the policy. Possible values are: enabled, disabled.

State

The unique identifier for an entity. Read-only.

Id

Present ensures the policy exists, absent ensures it is removed.

Ensure

Azure AD Authentication Strength Policy

Schema for microsoft.entra.authenticationstrengthpolicy

The name of the policy.

DisplayName

A description of the policy.

Description

The unique identifier of the policy.

Id

The authentication method combinations allowed by this authentication strength policy.

AllowedCombinations

Ensure

This resource configures the Azure Active Directory Authorization Policy.

The policy is managed using the BETA API, some properties may have been added in the API but not in the resource

## Azure AD Permissions

To authenticate via Microsoft Graph, this resource required the following Application permissions:

* **Automate**
  * Policy.Read.All
  * Policy.ReadWrite.Authorization

* **Export**
  * Policy.Read.All

NOTE: All permissions listed above require admin consent.

Schema for microsoft.entra.authorizationpolicy

Only valid value is 'Yes'.

IsSingleInstance

Display name for this policy.

DisplayName

Description of this policy.

Description

Boolean Indicates whether users can sign up for email based subscriptions.

AllowedToSignUpEmailBasedSubscriptions

Boolean Indicates whether the Self-Serve Password Reset feature can be used by users on the tenant.

AllowedToUseSSPR

Boolean Indicates whether a user can join the tenant by email validation.

AllowEmailVerifiedUsersToJoinOrganization

None AdminsAndGuestInviters AdminsGuestInvitersAndAllMembers Everyone

Indicates who can invite external users to the organization. Possible values are: None, AdminsAndGuestInviters, AdminsGuestInvitersAndAllMembers, Everyone. Everyone is the default setting for all cloud environments except US Government.

AllowInvitesFrom

Boolean To disable the use of MSOL PowerShell, set this property to true. This will also disable user-based access to the legacy service endpoint used by MSOL PowerShell. This does not affect Azure AD Connect or Microsoft Graph.

BlockMsolPowershell

Boolean Indicates whether the default user role can create applications.

DefaultUserRoleAllowedToCreateApps

Boolean Indicates whether the default user role can create security groups.

DefaultUserRoleAllowedToCreateSecurityGroups

Indicates whether the registered owners of a device can read their own BitLocker recovery keys with default user role.

DefaultUserRoleAllowedToReadBitlockerKeysForOwnedDevice

Indicates whether the default user role can create tenants. This setting corresponds to the Restrict non-admin users from creating tenants setting in the User settings menu in the Azure portal. When this setting is false, users assigned the Tenant Creator role can still create tenants.

DefaultUserRoleAllowedToCreateTenants

Boolean Indicates whether the default user role can read other users.

DefaultUserRoleAllowedToReadOtherUsers

The role that should be granted to guest users. Refer to List unifiedRoleDefinitions to find the list of available role templates. Only supported roles today are User, Guest User, and Restricted Guest User (2af84b1e-32c8-42b7-82bc-daa82404023b).

GuestUserRole

String collection Indicates if user consent to apps is allowed, and if it is, which permission to grant consent and which app consent policy (permissionGrantPolicy) govern the permission for users to grant consent. Value should be in the format managePermissionGrantsForSelf.{id}, where {id} is the id of a built-in or custom app consent policy. An empty list indicates user consent to apps is disabled.

PermissionGrantPolicyIdsAssignedToDefaultUserRole

Specify that the Azure Authorization Policy should exist.

Ensure

This resource configures an Azure Active Directory Conditional Access Policy.

Schema for microsoft.entra.conditionalaccesspolicy

DisplayName of the AAD CA Policy

DisplayName

Specifies the GUID for the Policy.

Id

Specifies the State of the Policy.

State

Cloud Apps in scope of the Policy.

IncludeApplications

Rule syntax is similar to that used for membership rules for groups in Microsoft Entra ID.

ApplicationsFilter

Mode to use for the filter. Possible values are include or exclude.

ApplicationsFilterMode

Cloud Apps out of scope of the Policy.

ExcludeApplications

User Actions in scope of the Policy.

IncludeUserActions

Users in scope of the Policy.

IncludeUsers

Users out of scope of the Policy.

ExcludeUsers

Groups in scope of the Policy.

IncludeGroups

Groups out of scope of the Policy.

ExcludeGroups

AAD Admin Roles in scope of the Policy.

IncludeRoles

AAD Admin Roles out of scope of the Policy.

ExcludeRoles

Represents the Included internal guests or external user types. This is a multi-valued property. Supported values are: b2bCollaborationGuest, b2bCollaborationMember, b2bDirectConnectUser, internalGuest, OtherExternalUser, serviceProvider and unknownFutureValue.

IncludeGuestOrExternalUserTypes

Represents the Included Tenants membership kind. The possible values are: all, enumerated, unknownFutureValue. enumerated references an object of conditionalAccessEnumeratedExternalTenants derived type.

IncludeExternalTenantsMembershipKind

Represents the Included collection of tenant ids in the scope of Conditional Access for guests and external users policy targeting.

IncludeExternalTenantsMembers

Represents the Excluded internal guests or external user types. This is a multi-valued property. Supported values are: b2bCollaborationGuest, b2bCollaborationMember, b2bDirectConnectUser, internalGuest, OtherExternalUser, serviceProvider and unknownFutureValue.

ExcludeGuestOrExternalUserTypes

Represents the Excluded Tenants membership kind. The possible values are: all, enumerated, unknownFutureValue. enumerated references an object of conditionalAccessEnumeratedExternalTenants derived type.

ExcludeExternalTenantsMembershipKind

Represents the Excluded collection of tenant ids in the scope of Conditional Access for guests and external users policy targeting.

ExcludeExternalTenantsMembers

Client Device Platforms in scope of the Policy.

IncludePlatforms

Client Device Platforms out of scope of the Policy.

ExcludePlatforms

AAD Named Locations in scope of the Policy.

IncludeLocations

AAD Named Locations out of scope of the Policy.

ExcludeLocations

Client Device Filter mode of the Policy.

DeviceFilterMode

Client Device Filter rule of the Policy.

DeviceFilterRule

AAD Identity Protection User Risk Levels in scope of the Policy.

UserRiskLevels

AAD Identity Protection Sign-in Risk Levels in scope of the Policy.

SignInRiskLevels

Client App types in scope of the Policy.

ClientAppTypes

Operator to be used for Grant Controls.

GrantControlOperator

List of built-in Grant Controls to be applied by the Policy.

BuiltInControls

Specifies, whether Application Enforced Restrictions are enabled in the Policy.

ApplicationEnforcedRestrictionsIsEnabled

Specifies, whether Cloud App Security is enforced by the Policy.

CloudAppSecurityIsEnabled

Specifies, what Cloud App Security control is enforced by the Policy.

CloudAppSecurityType

Sign in frequency time in the given unit to be enforced by the policy.

SignInFrequencyValue

Display name of the terms of use to assign.

TermsOfUse

Custom Controls assigned to the grant property of this policy.

CustomAuthenticationFactors

Sign in frequency unit (days/hours) to be interpreted by the policy.

SignInFrequencyType

Specifies, whether sign-in frequency is enforced by the Policy.

SignInFrequencyIsEnabled

Sign in frequency interval. Possible values are: 'timeBased', 'everyTime' and 'unknownFutureValue'.

SignInFrequencyInterval

Specifies, whether Browser Persistence is controlled by the Policy.

PersistentBrowserIsEnabled

Specifies, what Browser Persistence control is enforced by the Policy.

PersistentBrowserMode

Name of the associated authentication strength policy.

AuthenticationStrength

Names of the associated authentication flow transfer methods. Possible values are '', 'deviceCodeFlow', 'authenticationTransfer', or 'deviceCodeFlow,authenticationTransfer'.

TransferMethods

Authentication context class references.

AuthenticationContexts

Specify if the Azure AD CA Policy should exist or not.

Ensure

This resource manages Azure AD Cross Tenant Access Policies.

Schema for microsoft.entra.crosstenantaccesspolicy

Only valid value is 'Yes'.

IsSingleInstance

The name of the policy.

DisplayName

Used to specify which Microsoft clouds an organization would like to collaborate with. By default, this value is empty.

AllowedCloudEndpoints

Specify if the policy should exist or not.

Ensure

This resource manages Azure AD Cross Tenant Access Policies Configuration Default.

Schema for microsoft.entra.crosstenantaccesspolicyconfigurationdefault

Only valid value is 'Yes'.

IsSingleInstance

Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B collaboration.

The list of applications targeted with your cross-tenant access policy.

Applications

Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.

AccessType

Schema for MSFT_AADCrossTenantAccessPolicyTarget

The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.

Target

user group application unknownFutureValue

The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.

TargetType

Specifies whether to target users, groups, or applications with this rule.

Targets

The list of users and groups targeted with your cross-tenant access policy.

UsersAndGroups

AccessType

Target

TargetType

Targets

Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B collaboration.

Applications

AccessType

Target

TargetType

Targets

UsersAndGroups

AccessType

Target

TargetType

Targets

Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B direct connect.

Applications

AccessType

Target

TargetType

Targets

UsersAndGroups

AccessType

Target

TargetType

Targets

Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B direct connect.

Applications

AccessType

Target

TargetType

Targets

UsersAndGroups

AccessType

Target

TargetType

Targets

Determines the partner-specific configuration for trusting other Conditional Access claims from external Azure AD organizations.

InboundTrust

Specifies whether compliant devices from external Azure AD organizations are trusted.

IsCompliantDeviceAccepted

Specifies whether hybrid Azure AD joined devices from external Azure AD organizations are trusted.

IsHybridAzureADJoinedDeviceAccepted

Specifies whether MFA from external Azure AD organizations is trusted.

IsMfaAccepted

Specify if the instance should exist or not.

Ensure

This resource manages Azure AD Cross Tenant Access Policies Configuration Partner.

Schema for microsoft.entra.crosstenantaccesspolicyconfigurationpartner

The tenant identifier for the partner Azure Active Directory (Azure AD) organization.

PartnerTenantId

Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B collaboration.

The list of applications targeted with your cross-tenant access policy.

Applications

Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.

AccessType

This resource manages Azure AD Cross Tenant Access Policies Configuration Default.

The unique identifier of the user, group, or application; one of the following keywords: AllUsers and AllApplications; or for targets that are applications, you may use reserved values.

Target

The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.

TargetType

Specifies whether to target users, groups, or applications with this rule.

Targets

The list of users and groups targeted with your cross-tenant access policy.

UsersAndGroups

AccessType

Target

TargetType

Targets

Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B collaboration.

Applications

AccessType

Target

TargetType

Targets

UsersAndGroups

AccessType

Target

TargetType

Targets

Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B direct connect.

Applications

AccessType

Target

TargetType

Targets

UsersAndGroups

AccessType

Target

TargetType

Targets

Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B direct connect.

Applications

AccessType

Target

TargetType

Targets

UsersAndGroups

AccessType

Target

TargetType

Targets

Determines the partner-specific configuration for accepting trust claims from other tenant invitations.

AutomaticUserConsentSettings

Specifies whether you want to automatically trust Inbound invitations.

InboundAllowed

Specifies whether you want to automatically trust Outbound invitations.

OutboundAllowed

Determines the partner-specific configuration for trusting other Conditional Access claims from external Azure AD organizations.

InboundTrust

Specifies whether compliant devices from external Azure AD organizations are trusted.

IsCompliantDeviceAccepted

Specifies whether hybrid Azure AD joined devices from external Azure AD organizations are trusted.

IsHybridAzureADJoinedDeviceAccepted

Specifies whether MFA from external Azure AD organizations is trusted.

IsMfaAccepted

Specify if the policy should exist or not.

Ensure

This resource configures an Azure AD Entitlement Management Access Package.

Schema for microsoft.entra.entitlementmanagementaccesspackage

The display name of the access package.

DisplayName

The Id of the access package.

Id

Identifier of the access package catalog referencing this access package.

CatalogId

The description of the access package.

Description

Whether the access package is hidden from the requestor.

IsHidden

Indicates whether role scopes are visible.

IsRoleScopesVisible

Schema for MSFT_AccessPackageResourceRoleScope

The Id of the resource roleScope.

Id

The origine Id of the resource.

AccessPackageResourceOriginId

The display name of the resource role.

AccessPackageResourceRoleDisplayName

The resources and roles included in the access package.

AccessPackageResourceRoleScopes

The access packages whose assigned users are ineligible to be assigned this access package.

IncompatibleAccessPackages

The access packages that are incompatible with this package.

AccessPackagesIncompatibleWith

The groups whose members are ineligible to be assigned this access package.

IncompatibleGroups

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.

Schema for microsoft.entra.entitlementmanagementaccesspackageassignmentpolicy

The display name of the policy.

DisplayName

Id of the access package assignment policy.

Id

Identifier of the access package.

AccessPackageId

Who must review, and how often, the assignments to the access package from this policy. This property is null if reviews are not required.

AccessReviewSettings

acceptAccessRecommendation keepAccess removeAccess unknownFutureValue

The default decision to apply if the request is not reviewed within the period specified in durationInDays.

AccessReviewTimeoutBehavior

The number of days within which reviewers should provide input.

DurationInDays

Specifies whether to display recommendations to the reviewer. The default value is true

IsAccessRecommendationEnabled

Specifies whether the reviewer must provide justification for the approval. The default value is true.

IsApprovalJustificationRequired

If true, access reviews are required for assignments from this policy.

IsEnabled

The interval for recurrence, such as monthly or quarterly.

RecurrenceType

Who should be asked to do the review, either Self or Reviewers.

ReviewerType

Schema for MSFT_MicrosoftGraphuserset

The type of the resource

odataType

The id of the resource.

Id

Indicates whether the resource is a backup fallback approver.

IsBackup

The hierarchical level of the manager with respect to the requestor. For example, the direct manager of a requestor would have a managerLevel of 1, while the manager of the requestor's manager would have a managerLevel of 2. Default value for managerLevel is 1. Possible values for this property range from 1 to 2.

ManagerLevel

If the reviewerType is Reviewers, this collection specifies the users who will be reviewers, either by ID or as members of a group, using a collection of singleUser and groupMembers.

Reviewers

When the first review should start.

StartDateTime

Indicates whether a user can extend the access package assignment duration after approval.

CanExtend

The description of the policy.

Description

The number of days in which assignments from this policy last until they are expired.

DurationInDays

The expiration date for assignments created in this policy. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z

ExpirationDateTime

Schema for MSFT_MicrosoftGraphaccesspackagequestion

The type of the resource

odataType

ID of the question.

Id

Specifies whether the requestor is allowed to edit answers to questions.

IsAnswerEditable

Whether the requestor is required to supply an answer or not.

IsRequired

Relative position of this question when displaying a list of questions to the requestor.

Sequence

The text of the question to show to the requestor.

QuestionText

The fallback string, which is used when a requested localization is not available. Required.

DefaultText

This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.

Schema for MSFT_MicrosoftGraphaccessPackageLocalizedText

The text in the specific language. Required.

Text

The ISO code for the intended language. Required.

LanguageCode

Content represented in a format for a specific locale.

LocalizedTexts

Schema for MSFT_MicrosoftGraphaccessPackageAnswerChoice

The actual value of the selected choice. This is typically a string value which is understandable by applications. Required.

ActualValue

The localized display values shown to the requestor and approvers. Required.

displayValue

DefaultText

Text

LanguageCode

LocalizedTexts

List of answer choices.

Choices

Indicates whether requestor can select multiple choices as their answer.

AllowsMultipleSelection

This is the regex pattern that the corresponding text answer must follow.

RegexPattern

Indicates whether the answer will be in single or multiple line format.

IsSingleLineQuestion

Questions that are posed to the requestor.

Questions

Who must approve requests for access package in this policy.

RequestApprovalSettings

One of SingleStage, Serial, Parallel, NoApproval (default). NoApproval is used when isApprovalRequired is false.

ApprovalMode

Schema for MSFT_MicrosoftGraphapprovalstage1

The number of days that a request can be pending a response before it is automatically denied.

ApprovalStageTimeOutInDays

Indicates whether the approver is required to provide a justification for approving a request.

EscalationTimeInMinutes

If true, then one or more escalation approvers are configured in this approval stage.

IsApproverJustificationRequired

If escalation is required, the time a request can be pending a response from a primary approver.

IsEscalationEnabled

Schema for MSFT_MicrosoftGraphuserset

The type of the resource

odataType

The id of the resource.

Id

Indicates whether the resource is a backup fallback approver.

IsBackup

The hierarchical level of the manager with respect to the requestor. For example, the direct manager of a requestor would have a managerLevel of 1, while the manager of the requestor's manager would have a managerLevel of 2. Default value for managerLevel is 1. Possible values for this property range from 1 to 2.

ManagerLevel

The users who will be asked to approve requests. A collection of singleUser, groupMembers, requestorManager, internalSponsors and externalSponsors. When creating or updating a policy, include at least one userSet in this collection.

PrimaryApprovers

This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.

Schema for MSFT_MicrosoftGraphuserset

The type of the resource

odataType

The id of the resource.

Id

IsBackup

ManagerLevel

If escalation is enabled and the primary approvers do not respond before the escalation time, the escalationApprovers are the users who will be asked to approve requests. This can be a collection of singleUser, groupMembers, requestorManager, internalSponsors and externalSponsors. When creating or updating a policy, if there are no escalation approvers, or escalation approvers are not required for the stage, the value of this property should be an empty collection.

EscalationApprovers

If approval is required, the one or two elements of this collection define each of the stages of approval. An empty array if no approval is required.

ApprovalStages

Indicates whether approval is required for requests in this policy.

IsApprovalRequired

Indicates whether approval is required for a user to extend their assignment.

IsApprovalRequiredForExtension

Indicates whether the requestor is required to supply a justification in their request.

IsRequestorJustificationRequired

Who can request this access package from this policy.

RequestorSettings

Indicates whether new requests are accepted on this policy.

AcceptRequests

Schema for MSFT_MicrosoftGraphuserset

The type of the resource

odataType

The id of the resource.

Id

IsBackup

ManagerLevel

The users who are allowed to request on this policy, which can be singleUser, groupMembers, and connectedOrganizationMembers.

AllowedRequestors

Who can request.

ScopeType

Schema for MSFT_MicrosoftGraphcustomextensionhandler

Indicates which custom workflow extension will be executed at this stage.

CustomExtensionId

assignmentRequestCreated assignmentRequestApproved assignmentRequestGranted assignmentRequestRemoved assignmentFourteenDaysBeforeExpiration assignmentOneDayBeforeExpiration unknownFutureValue

Indicates the stage of the access package assignment request workflow when the access package custom extension runs.

Stage

Identifier of the stage.

Id

The collection of stages when to execute one or more custom access package workflow extensions.

CustomExtensionHandlers

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures an Azure AD Entitlement Management Access Package Catalog.

Schema for microsoft.entra.entitlementmanagementaccesspackagecatalog

The display name of the access package catalog.

DisplayName

The id of the access package catalog.

Id

Has the value Published if the access packages are available for management.

CatalogStatus

One of UserManaged or ServiceDefault.

CatalogType

The description of the access package catalog.

Description

Whether the access packages in this catalog can be requested by users outside of the tenant.

IsExternallyVisible

Ensure

This resource configures an Azure AD Entitlement Management Access Package Catalog Resource.

Schema for microsoft.entra.entitlementmanagementaccesspackagecatalogresource

The display name of the resource, such as the application name, group name or site name.

DisplayName

Id of the access package catalog resource.

Id

The unique ID of the access package catalog.

CatalogId

The name of the user or application that first added this resource. Read-only.

AddedBy

The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.

AddedOn

Schema for MSFT_MicrosoftGraphaccesspackageresourceattribute

Information about how to set the attribute, currently a accessPackageUserDirectoryAttributeStore object type.

AttributeDestination

Type of the access package resource attribute destination.

odataType

The name of the attribute in the end system.

AttributeName

Information about how to populate the attribute value when an accessPackageAssignmentRequest is being fulfilled, currently a accessPackageResourceAttributeQuestion object type.

AttributeSource

Type of the access package resource attribute source.

odataType

The question asked in order to get the value of the attribute.

Question

Type of the access package resource attribute question.

odataType

Id of the access package resource attribute question.

Id

Indicates whether the requestor is required to supply an answer or not.

IsRequired

Indicates whether the answer will be in single or multiple line format.

IsSingleLine

This is the regex pattern that the corresponding text answer must follow.

RegexPattern

Relative position of this question when displaying a list of questions to the requestor.

Sequence

The text of the question to show to the requestor.

QuestionText

The fallback string, which is used when a requested localization is not available. Required.

DefaultText

This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.

Schema for MSFT_MicrosoftGraphaccessPackageLocalizedText

The text in the specific language. Required.

Text

The ISO code for the intended language. Required.

LanguageCode

Content represented in a format for a specific locale.

LocalizedTexts

Indicates whether requestor can select multiple choices as their answer.

AllowsMultipleSelection

This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.

Schema for MSFT_MicrosoftGraphaccessPackageAnswerChoice

The actual value of the selected choice. This is typically a string value which is understandable by applications. Required.

ActualValue

The localized display values shown to the requestor and approvers. Required.

displayValue

The fallback string, which is used when a requested localization is not available. Required.

DefaultText

This resource configures an Azure AD Entitlement Management Access Package Assignment Policy.

Schema for MSFT_MicrosoftGraphaccessPackageLocalizedText

The text in the specific language. Required.

Text

The ISO code for the intended language. Required.

LanguageCode

Content represented in a format for a specific locale.

LocalizedTexts

List of answer choices.

Choices

Id of the access package resource attribute.

Id

Specifies whether or not an existing attribute value can be edited by the requester.

IsEditable

Specifies whether the attribute will remain in the end system after an assignment ends.

IsPersistedOnAssignmentRemoval

Contains information about the attributes to be collected from the requestor and sent to the resource application.

Attributes

A description for the resource.

Description

True if the resource is not yet available for assignment. Read-only.

IsPendingOnboarding

The unique identifier of the resource in the origin system. In the case of an Azure AD group, this is the identifier of the group.

OriginId

The type of the resource in the origin system.

OriginSystem

The type of the resource.

ResourceType

A unique resource locator for the resource, such as the URL for signing a user into an application.

Url

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures an Azure AD Entitlement Management Connected Organization.

Schema for microsoft.entra.entitlementmanagementconnectedorganization

The display name of the connected organization.

DisplayName

The Id of the Connected organization object.

Id

The description of the connected organization.

Description

Schema for MSFT_AADEntitlementManagementConnectedOrganizationIdentitySource

Type of the identity source.

odataType

The name of the Azure Active Directory tenant.

DisplayName

The ID of the Azure Active Directory tenant.

ExternalTenantId

The ID of the cloud where the tenant is located, one of microsoftonline.com, microsoftonline.us or partner.microsoftonline.cn.

CloudInstance

The domain name.

DomainName

The issuerURI of the incoming federation.

IssuerUri

The identity sources in this connected organization.

IdentitySources

The state of a connected organization defines whether assignment policies with requestor scope type AllConfiguredConnectedOrganizationSubjects are applicable or not.

State

Collection of objectID of external sponsors. the sponsor can be a user or a group.

ExternalSponsors

Collection of objectID of internal sponsors. the sponsor can be a user or a group.

InternalSponsors

Ensure

Represents the tenant-wide policy that controls whether external users can leave the guest Microsoft Entra tenant via self-service controls.

Schema for microsoft.entra.externalidentitypolicy

Only valid value is 'Yes'.

IsSingleInstance

Reserved for future use.

AllowDeletedIdentitiesDataRemoval

Defines whether external users can leave the guest tenant. If set to false, self-service controls are disabled, and the admin of the guest tenant must manually remove the external user from the guest tenant. When the external user leaves the tenant, their data in the guest tenant is first soft-deleted then permanently deleted in 30 days.

allowExternalIdentitiesToLeave

This resource configures an Azure Active Directory group. IMPORTANT: It does not support mail enabled security groups or mail enabled groups that are not unified or dynamic groups.

If using with AADUser, be aware that if AADUser->MemberOf is being specified and the referenced group is configured with AADGroup->Member then a conflict may arise if the two don't match. It is usually best to choose only one of them. See AADUser

Schema for microsoft.entra.group

DisplayName of the Azure Active Directory Group

DisplayName

Specifies a mail nickname for the group.

MailNickname

Specifies a description for the group.

Description

Specifies an ID for the group.

Id

User Service Principal values for the group's owners.

Owners

User Service Principal values for the group's members.

Members

Displayname values for the groups member of the group.

GroupAsMembers

DisplayName values for the groups that this group is a member of.

MemberOf

Specifies that the group is a dynamic group. To create a dynamic group, specify a value of DynamicMembership.

GroupTypes

Specifies the membership rule for a dynamic group.

MembershipRule

Specifies the rule processing state. The acceptable values for this parameter are: On. Process the group rule or Paused. Stop processing the group rule.

MembershipRuleProcessingState

Specifies whether the group is security enabled. For security groups, this value must be $True.

SecurityEnabled

Specifies whether this group is mail enabled. Currently, you cannot create mail enabled groups in Azure AD.

MailEnabled

Specifies whether this group can be assigned a role. Only available when creating a group and can't be modified after group is created.

IsAssignableToRole

DisplayName values for the roles that the group is assigned to.

AssignedToRole

This parameter determines the visibility of the group's content and members list.

Visibility

Schema for MSFT_AADGroupLicense

A collection of the unique identifiers for plans that have been disabled.

DisabledPlans

The unique identifier for the SKU.

SkuId

List of Licenses assigned to the group.

AssignedLicenses

Specify if the Azure AD Group should exist or not.

Ensure

DisplayName MailNickname SecurityEnabled MailEnabled

This resource configures an Azure Active Directory Group Lifecycle Policy (e.g. Expiration).

Schema for microsoft.entra.grouplifecyclepolicy

Only valid value is 'Yes'.

IsSingleInstance

The number of days a group can exist before it needs to be renewed.

GroupLifetimeInDays

This parameter allows the admin to select which office 365 groups the policy will apply to. 'None' will create the policy in a disabled state. 'All' will apply the policy to every Office 365 group in the tenant. 'Selected' will allow the admin to choose specific Office 365 groups that the policy will apply to.

ManagedGroupTypes

Notification emails for groups that have no owners will be sent to these email addresses.

AlternateNotificationEmails

Specify if the Azure AD Groups Lifecycle Policy should exist or not.

Ensure

IsSingleInstance GroupLifetimeInDays ManagedGroupTypes AlternateNotificationEmails

This resource configures an Azure Active Directory Group Naming Policy.

Schema for microsoft.entra.groupsnamingpolicy

Only valid value is 'Yes'.

IsSingleInstance

Prefixes and suffixes to add to the group name.

PrefixSuffixNamingRequirement

Comma delimited list of words that should be blocked from being included in groups' names.

CustomBlockedWordsList

Specify if the Azure AD Groups Naming Policy should exist or not.

Ensure

This resource configures an Azure Active Directory Groups Settings.

Schema for microsoft.entra.groupssettings

Only valid value is 'Yes'.

IsSingleInstance

The flag indicating whether Office 365 group creation is allowed in the directory by non-admin users. This setting does not require an Azure Active Directory Premium P1 license.

EnableGroupCreation

Boolean indicating whether or not sensitivity labels can be assigned to M365-groups.

EnableMIPLabels

Boolean indicating whether or not a guest user can be an owner of groups.

AllowGuestsToBeGroupOwner

Boolean indicating whether or not a guest user can have access to Office 365 groups content. This setting does not require an Azure Active Directory Premium P1 license.

AllowGuestsToAccessGroups

The url of a link to the guest usage guidelines.

GuestUsageGuidelinesUrl

Name of the security group for which the members are allowed to create Office 365 groups even when EnableGroupCreation == false.

GroupCreationAllowedGroupName

A boolean indicating whether or not is allowed to add guests to this directory.

AllowToAddGuests

A link to the Group Usage Guidelines.

UsageGuidelinesUrl

Boolean, a tenant-wide setting that assigns the default value to the writebackConfiguration/isEnabled property of new groups, if the property isn't specified during group creation. This setting is applicable when group writeback is configured in Microsoft Entra Connect.

NewUnifiedGroupWritebackDefault

Ensure

This resource configures the Azure AD Named Location Policies in Azure Active Directory

Schema for microsoft.entra.namedlocationpolicy

Specifies the Odata Type of a Named Location object in Azure Active Directory

OdataType

Specifies the ID of a Named Location in Azure Active Directory.

Id

Specifies the Display Name of a Named Location in Azure Active Directory

DisplayName

Specifies the IP ranges of the Named Location in Azure Active Directory

IpRanges

Specifies the isTrusted value for the Named Location (IP ranges only) in Azure Active Directory

IsTrusted

Specifies the countries and regions for the Named Location in Azure Active Directory

CountriesAndRegions

Determines what method is used to decide which country the user is located in. Possible values are clientIpAddress(default) and authenticatorAppGps.

CountryLookupMethod

Specifies the includeUnknownCountriesAndRegions value for the Named Location in Azure Active Directory

IncludeUnknownCountriesAndRegions

Specify if the Azure AD Named Location should exist or not.

Ensure

This resource configures an Azure Active Directory role definition.
To configure custom roles you require an Azure AD Premium P1 license.
The account used to configure role definitions based on this resource needs either to be a
"Global Administrator" or a "Privileged role administrator".

Schema for microsoft.entra.roledefinition

Specifies a display name for the role definition.

DisplayName

Specifies Id for the role definition.

Id

Specifies a description for the role definition.

Description

Specifies the resource scopes for the role definition.

ResourceScopes

Specifies whether the role definition is enabled.

IsEnabled

Specifies permissions for the role definition.

RolePermissions

Specifies template id for the role definition.

TemplateId

Specifies version for the role definition.

Version

Specify if the Azure AD Role definition should exist or not.

Ensure

Represents a request for a role eligibility for a principal through PIM. The role eligibility can be permanently eligible without an expiry date or temporarily eligible with an expiry date. Inherits from request.

Schema for microsoft.entra.roleeligibilityschedulerequest

User Principal Name of the eligibility request.

Principal

Role associated with the eligibility request.

RoleDefinition

Represented the type of principal to assign the request to. Accepted values are: Group and User.

PrincipalType

Identifier of the directory object representing the scope of the role eligibility. The scope of an role eligibility determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use / for tenant-wide scope. Use appScopeId to limit the scope to an application only. Either directoryScopeId or appScopeId is required.

DirectoryScopeId

Identifier for the Role Eligibility Schedule Request.

Id

Identifier of the app-specific scope when the role eligibility is scoped to an app. The scope of a role eligibility determines the set of resources for which the principal is eligible to access. App scopes are scopes that are defined and understood by this application only. Use / for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Either directoryScopeId or appScopeId is required.

AppScopeId

adminAssign adminUpdate adminRemove selfActivate selfDeactivate adminExtend adminRenew selfExtend selfRenew unknownFutureValue

Represents the type of operation on the role eligibility request.The possible values are: adminAssign, adminUpdate, adminRemove, selfActivate, selfDeactivate, adminExtend, adminRenew, selfExtend, selfRenew, unknownFutureValue.

Action

Determines whether the call is a validation or an actual call. Only set this property if you want to check whether an activation is subject to additional rules like MFA before actually submitting the request.

IsValidationOnly

A message provided by users and administrators when create they create the unifiedRoleEligibilityScheduleRequest object. Optional when action is adminRemove. Whether this property is required or optional is also dependent on the settings for the Azure AD role.

Justification

The period of the role eligibility. Optional when action is adminRemove. The period of eligibility is dependent on the settings of the Azure AD role.

ScheduleInfo

When the eligible or active assignment expires.

expiration

The requestor's desired duration of access represented in ISO 8601 format for durations. For example, PT3H refers to three hours. If specified in a request, endDateTime should not be present and the type property should be set to afterDuration.

duration

Timestamp of date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.

endDateTime

notSpecified noExpiration afterDateTime afterDuration

The requestor's desired expiration pattern type. The possible values are: notSpecified, noExpiration, afterDateTime, afterDuration.

type

The frequency of the eligible or active assignment. This property is currently unsupported in PIM.

recurrence

The frequency of an event.

pattern

The day of the month on which the event occurs.

dayOfMonth

sunday monday tuesday wednesday thursday friday saturday

A collection of the days of the week on which the event occurs. The possible values are: sunday, monday, tuesday, wednesday, thursday, friday, saturday

daysOfWeek

The first day of the week.

firstDayOfWeek

Specifies on which instance of the allowed days specified in daysOfWeek the event occurs, counted from the first instance in the month. The possible values are: first, second, third, fourth, last.

index

The number of units between occurrences, where units can be in days, weeks, months, or years, depending on the type.

interval

The month in which the event occurs. This is a number from 1 to 12.

month

daily weekly absoluteMonthly relativeMonthly absoluteYearly relativeYearly

The recurrence pattern type: daily, weekly, absoluteMonthly, relativeMonthly, absoluteYearly, relativeYearly.

type

The duration of an event.

range

The date to stop applying the recurrence pattern. Depending on the recurrence pattern of the event, the last occurrence of the meeting may not be this date.

endDate

The number of times to repeat the event. Required and must be positive if type is numbered.

numberOfOccurrences

Time zone for the startDate and endDate properties.

recurrenceTimeZone

The date to start applying the recurrence pattern. The first occurrence of the meeting may be this date or later, depending on the recurrence pattern of the event. Must be the same value as the start property of the recurring event.

startDate

The recurrence range. The possible values are: endDate, noEnd, numbered.

type

When the eligible or active assignment becomes active.

startDateTime

Ticket details linked to the role eligibility request including details of the ticket number and ticket system.

TicketInfo

The ticket number.

ticketNumber

The description of the ticket system.

ticketSystem

Present ensures the instance exists, absent ensures it is removed.

Ensure

This resource configure existing Azure roles. All UI parameters can be configured using this resource like:
- Notifications
- require approval / ticket / justification / MFA

Schema for microsoft.entra.rolesetting

RuleDefinition DisplayName

DisplayName

Specifies the RoleId.

Id

Activation maximum duration (hours).

ActivationMaxDuration

Require justification on activation (True/False)

ActivationReqJustification

Require ticket information on activation (True/False)

ActivationReqTicket

Require MFA on activation (True/False)

ActivationReqMFA

Require approval to activate (True/False)

ApprovaltoActivate

Approver User UPN and/or Group Displayname

ActivateApprover

Allow permanent eligible assignment (True/False)

PermanentEligibleAssignmentisExpirationRequired

Expire eligible assignments after (Days)

ExpireEligibleAssignment

Allow permanent active assignment (True/False)

PermanentActiveAssignmentisExpirationRequired

Expire active assignments after (Days)

ExpireActiveAssignment

Require Azure Multi-Factor Authentication on active assignment (True/False)

AssignmentReqMFA

Require justification on active assignment (True/False)

AssignmentReqJustification

Require Azure Multi-Factor Authentication on eligible assignment (True/False)

ElegibilityAssignmentReqMFA

Require justification on eligible assignment (True/False)

ElegibilityAssignmentReqJustification

Send notifications when members are assigned as eligible to this role: Role assignment alert, default recipient (True/False)

EligibleAlertNotificationDefaultRecipient

Send notifications when members are assigned as eligible to this role: Role assignment alert, additional recipient (UPN)

EligibleAlertNotificationAdditionalRecipient

Send notifications when members are assigned as eligible to this role: Role assignment alert, only critical Email (True/False)

EligibleAlertNotificationOnlyCritical

Send notifications when members are assigned as eligible to this role: Notification to the assigned user (assignee), default recipient (True/False)

EligibleAssigneeNotificationDefaultRecipient

Send notifications when members are assigned as eligible to this role: Notification to the assigned user (assignee), additional recipient (UPN)

EligibleAssigneeNotificationAdditionalRecipient

Send notifications when members are assigned as eligible to this role: Notification to the assigned user (assignee), only critical Email (True/False)

EligibleAssigneeNotificationOnlyCritical

Send notifications when members are assigned as eligible to this role: Request to approve a role assignment renewal/extension, default recipient (True/False)

EligibleApproveNotificationDefaultRecipient

Send notifications when members are assigned as eligible to this role: Request to approve a role assignment renewal/extension, additional recipient (UPN)

EligibleApproveNotificationAdditionalRecipient

Send notifications when members are assigned as eligible to this role: Request to approve a role assignment renewal/extension, only critical Email (True/False)

EligibleApproveNotificationOnlyCritical

Send notifications when members are assigned as active to this role: Role assignment alert, default recipient (True/False)

ActiveAlertNotificationDefaultRecipient

Send notifications when members are assigned as active to this role: Role assignment alert, additional recipient (UPN)

ActiveAlertNotificationAdditionalRecipient

Send notifications when members are assigned as active to this role: Role assignment alert, only critical Email (True/False)

ActiveAlertNotificationOnlyCritical

Send notifications when members are assigned as active to this role: Notification to the assigned user (assignee), default recipient (True/False)

ActiveAssigneeNotificationDefaultRecipient

Send notifications when members are assigned as active to this role: Notification to the assigned user (assignee), additional recipient (UPN)

ActiveAssigneeNotificationAdditionalRecipient

Send notifications when members are assigned as active to this role: Notification to the assigned user (assignee), only critical Email (True/False)

ActiveAssigneeNotificationOnlyCritical

Send notifications when members are assigned as active to this role: Request to approve a role assignment renewal/extension, default recipient (True/False)

ActiveApproveNotificationDefaultRecipient

Send notifications when members are assigned as active to this role: Request to approve a role assignment renewal/extension, additional recipient (UPN)

ActiveApproveNotificationAdditionalRecipient

Send notifications when members are assigned as active to this role: Request to approve a role assignment renewal/extension, only critical Email (True/False)

ActiveApproveNotificationOnlyCritical

Send notifications when eligible members activate this role: Role assignment alert, default recipient (True/False)

EligibleAssignmentAlertNotificationDefaultRecipient

Send notifications when eligible members activate this role: Role assignment alert, additional recipient (UPN)

EligibleAssignmentAlertNotificationAdditionalRecipient

Send notifications when eligible members activate this role: Role assignment alert, only critical Email (True/False)

EligibleAssignmentAlertNotificationOnlyCritical

Send notifications when eligible members activate this role: Notification to activated user (requestor), default recipient (True/False)

EligibleAssignmentAssigneeNotificationDefaultRecipient

Send notifications when eligible members activate this role: Notification to activated user (requestor), additional recipient (UPN)

EligibleAssignmentAssigneeNotificationAdditionalRecipient

Send notifications when eligible members activate this role: Notification to activated user (requestor), only critical Email (True/False)

EligibleAssignmentAssigneeNotificationOnlyCritical

Authorization context is required (True/False)

AuthenticationContextRequired

Descriptive name of associated authorization context

AuthenticationContextName

Authorization context id

AuthenticationContextId

Specify if the Azure AD role setting should exist or not.

Ensure

This resource configures the Security Defaults in Azure Active Directory.

Schema for microsoft.entra.securitydefaults

Only valid value is 'Yes'.

IsSingleInstance

Display name of the security defaults.

DisplayName

Description of the security defaults.

Description

Represents whether or not security defaults are enabled.

IsEnabled

Specify if the Azure AD App should exist or not.

Ensure

This resource configures an Azure Active Directory ServicePrincipal.

Schema for microsoft.entra.serviceprincipal

The unique identifier for the associated application.

AppId

Schema for MSFT_AADServicePrincipalRoleAssignment

Type of principal. Accepted values are User or Group

PrincipalType

Unique identity representing the principal.

Identity

App role assignments for this app or service, granted to users, groups, and other service principals.

AppRoleAssignedTo

The ObjectID of the ServicePrincipal

ObjectID

Displayname of the ServicePrincipal.

DisplayName

The alternative names for this service principal

AlternativeNames

True if the service principal account is enabled; otherwise, false.

AccountEnabled

Indicates whether an application role assignment is required.

AppRoleAssignmentRequired

Specifies the error URL of the ServicePrincipal.

ErrorUrl

Specifies the homepage of the ServicePrincipal.

Homepage

Specifies the LogoutURL of the ServicePrincipal.

LogoutUrl

Specifies the PublisherName of the ServicePrincipal.

PublisherName

The URLs that user tokens are sent to for sign in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application.

ReplyUrls

The URL for the SAML metadata of the ServicePrincipal.

SamlMetadataUrl

Specifies an array of service principal names. Based on the identifierURIs collection, plus the application's appId property, these URIs are used to reference an application's service principal.

ServicePrincipalNames

The type of the service principal.

ServicePrincipalType

Tags linked to this service principal.Note that if you intend for this service principal to show up in the All Applications list in the admin portal, you need to set this value to {WindowsAzureActiveDirectoryIntegratedApp}

Tags

Specify if the Azure AD App should exist or not.

Ensure

Represents identity providers with External Identities for both Microsoft Entra ID and Azure AD B2C tenants. For Microsoft Entra B2B scenarios in a Microsoft Entra tenant, the identity provider type can be Google or Facebook.

Schema for microsoft.entra.socialidentityprovider

The client identifier for the application obtained when registering the application with the identity provider.

ClientId

The client secret for the application that is obtained when the application is registered with the identity provider. This is write-only. A read operation returns ****.

ClientSecret

The display name of the identity provider.

DisplayName

AADSignup EmailOTP Microsoft MicrosoftAccount Google Amazon LinkedIn Facebook GitHub Twitter Weibo QQ WeChat

For a B2B scenario, possible values: Google, Facebook. For a B2C scenario, possible values: Microsoft, Google, Amazon, LinkedIn, Facebook, GitHub, Twitter, Weibo, QQ, WeChat.

IdentityProviderType

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures the Azure AD Tenant Details

Schema for microsoft.entra.tenantdetails

Only valid value is 'Yes'.

IsSingleInstance

Email-addresses from the people who should receive Marketing Notifications

MarketingNotificationEmails

Email-addresses from the people who should receive Security Compliance Notifications

SecurityComplianceNotificationMails

Phone Numbers from the people who should receive Security Notifications

SecurityComplianceNotificationPhones

Email-addresses from the people who should receive Technical Notifications

TechnicalNotificationMails

This resource configures the Azure AD Token Lifetime Policies

Schema for microsoft.entra.tokenlifetimepolicy

DisplayName of the Policy

DisplayName

ObjectID of the Policy.

Id

Description of the Policy.

Description

Definition of the Policy.

Definition

IsOrganizationDefault of the Policy.

IsOrganizationDefault

Specify if the Azure AD Policy should exist or not.

Ensure

This resource allows users to create Azure AD Users and assign them licenses, roles and/or groups.

If using with AADGroup, be aware that if AADUser->MemberOf is being specified and the referenced group is configured with AADGroup->Member then a conflict may arise if the two don't match. It is usually best to choose only one of them. See AADGroup

Schema for microsoft.entra.user

The login name of the user

UserPrincipalName

The display name for the user

DisplayName

The first name of the user

FirstName

The last name of the user

LastName

The list of Azure Active Directory roles assigned to the user.

Roles

The country code the user will be assigned to

UsageLocation

The account SKU Id for the license to be assigned to the user

LicenseAssignment

The City name of the user

City

The Country name of the user

Country

The Department name of the user

Department

The Fax Number of the user

Fax

The Groups that the user is a direct member of

MemberOf

The Mobile Phone Number of the user

MobilePhone

The Office Name of the user

Office

Specifies whether the user password expires periodically. Default value is false

PasswordNeverExpires

Specifies password policies for the user.

PasswordPolicies

The Phone Number of the user

PhoneNumber

The Postal Code of the user

PostalCode

The Preferred Language of the user

PreferredLanguage

Specifies the state or province where the user is located

State

Specifies the street address of the user

StreetAddress

Specifies the title of the user

Title

Specifies the title of the user

UserType

Present ensures the user exists, absent ensures it is removed

Ensure

Manages the Teams App Permission Policies.

Schema for microsoft.teams.apppermissionpolicy

Unique identifier to be assigned to the new Teams app permission policy. Use the 'Global' Identity if you wish to assign this policy to the entire tenant.

Identity

Enables administrators to provide explanatory text to accompany a Teams app permission policy.

Description

The types of apps for the Global Catalog.

GlobalCatalogAppsType

The types of apps for the Private Catalog.

PrivateCatalogAppsType

The types of apps for the Default Catalog.

DefaultCatalogAppsType

The list of apps for the Global Catalog.

GlobalCatalogApps

The list of apps for the Private Catalog.

PrivateCatalogApps

The list of apps for the Default Catalog.

DefaultCatalogApps

Present ensures the instance exists, absent ensures it is removed.

Ensure

Manages Teams app setup policies in your tenant.

Schema for microsoft.teams.appsetuppolicy

Unique identifier to be assigned to the new Teams app setup policy. Use the 'Global' Identity if you wish to assign this policy to the entire tenant.

Identity

Enables administrators to provide explanatory text to accompany a Teams app setup policy.

Description

Choose which apps and messaging extensions you want to be installed in your users' personal Teams environment and in meetings they create. Users can install other available apps from the Teams app store.

AppPresetList

Choose which apps and meeting extensions you want to be installed in your users' personal Teams environment and in meetings they create. Users can install other available apps from the Teams app store.

AppPresetMeetingList

Pinning an app displays the app in the app bar in Teams client. Admins can pin apps and they can allow users to pin apps. Pinning is used to highlight apps that are needed the most by users and promote ease of access.

PinnedAppBarApps

Apps are pinned in messaging extensions and into the ellipsis menu.

PinnedMessageBarApps

If you turn this on, the user's existing app pins will be added to the list of pinned apps set in this policy. Users can rearrange, add, and remove pins as they choose. If you turn this off, the user's existing app pins will be removed and replaced with the apps defined in this policy.

AllowUserPinning

This is also known as side loading. This setting determines if a user can upload a custom app package in the Teams app. Turning it on lets you create or develop a custom app to be used personally or across your organization without having to submit it to the Teams app store. Uploading a custom app also lets you test an app before you distribute it more widely by only assigning it to a single user or group of users.

AllowSideLoading

Ensure

Configures a Teams Audio Conferencing Policy.

Schema for microsoft.teams.audioconferencingpolicy

Specify the name of the policy that you are creating

Identity

Determines whether users of the Policy can have Toll free numbers

AllowTollFreeDialin

Determines the list of audio-conferencing Toll- and Toll-free telephone numbers that will be included in meetings invites created by users of this policy.

MeetingInvitePhoneNumbers

Ensure

Creates a new Teams call hold policy in your tenant. The Teams call hold policy is used to customize the call hold experience for Teams clients.

Schema for microsoft.teams.callholdpolicy

Unique identifier to be assigned to the new Teams call hold policy. Use the 'Global' Identity if you wish to assign this policy to the entire tenant.

Identity

A string representing the ID referencing an audio file uploaded via the Import-CsOnlineAudioFile cmdlet.

AudioFileId

Enables administrators to provide explanatory text to accompany a Teams call hold policy.

Description

Present ensures the instance exists, absent ensures it is removed.

Ensure

This resource configures a Teams Calling Policy.

More information: https://docs.microsoft.com/en-us/microsoftteams/teams-calling-policy

Schema for microsoft.teams.callingpolicy

Identity of the Teams Calling Policy.

Identity

Description of the Teams Calling Policy.

Description

Controls all calling capabilities in Teams. Turning this off will turn off all calling functionality in Teams. If you use Skype for Business for calling, this policy will not affect calling functionality in Skype for Business.

AllowPrivateCalling

Enables inbound calls to be routed to voice mail. Valid options are: AlwaysEnabled, AlwaysDisabled, UserOverride.

AllowVoicemail

Enables inbound calls to be routed to call groups.

AllowCallGroups

Enables inbound calls to be routed to delegates; allows delegates to make outbound calls on behalf of the users for whom they have delegated permissions.

AllowDelegation

Enables call forwarding or simultaneous ringing of inbound calls to other users in your tenant.

AllowCallForwardingToUser

Enables call forwarding or simultaneous ringing of inbound calls to any phone number.

AllowCallForwardingToPhone

Setting this parameter provides the ability to configure call redirection capabilities on Teams phones.

AllowCallRedirect

Determines whether the user is allowed to use SIP devices for calling on behalf of a Teams client.

AllowSIPDevicesCalling

Allows PSTN calling from the Team web client

AllowWebPSTNCalling

Setting this parameter to True will send calls through PSTN and incur charges rather than going through the network and bypassing the tolls.

PreventTollBypass

Enabled Disabled Unanswered UserOverride

Setting this parameter lets you configure how incoming calls are handled when a user is already in a call or conference or has a call placed on hold. New or incoming calls will be rejected with a busy signal. Valid options are: Enabled, Disabled and Unanswered.

BusyOnBusyEnabledType

Sets the expiration of the recorded 1:1 calls.

CallRecordingExpirationDays

Setting this parameter allows you to turn on or turn off music on hold when a PSTN caller is placed on hold. It is turned on by default. Valid options are: Enabled, Disabled, UserOverride. For now setting the value to UserOverride is the same as Enabled. This setting does not apply to call park and SLA boss delegate features. Valid options are: Enabled, Disabled, UserOverride.

MusicOnHoldEnabledType

This parameter is not available for use. Valid options are: Enabled, Disabled, UserOverride.

SafeTransferEnabled

Setting this parameter to True will allows 1:1 Calls to be recorded.

AllowCloudRecordingForCalls

Determines whether post-meeting captions and transcriptions are allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowTranscriptionforCalling

Determines whether real-time captions are available for the user in Teams meetings. Set this to DisabledUserOverride to allow user to turn on live captions. Set this to Disabled to prohibit.

LiveCaptionsEnabledTypeForCalling

This setting allows the tenant admin to enable or disable the Auto-Answer setting. Valid options are: Enabled, Disabled.

AutoAnswerEnabledType

Setting this parameter determines whether calls identified as Spam will be rejected or not (probably). Valid options are: Enabled, Disabled.

SpamFilteringEnabledType

Present ensures the policyexists, absent ensures it is removed.

Ensure

The TeamsCallParkPolicy controls whether or not users are able to leverage the call park feature in Microsoft Teams. Call park allows enterprise voice customers to place a call on hold and then perform a number of actions on that call: transfer to another department, retrieve via the same phone, or retrieve via a different Teams phone. The New-CsTeamsCallParkPolicy resource lets you create a new custom policy that can then be assigned to one or more specific users.

Schema for microsoft.teams.callparkpolicy

A unique identifier for the policy - this will be used to retrieve the policy later on to assign it to specific users.

Identity

If set to true, customers will be able to leverage the call park feature to place calls on hold and then decide how the call should be handled - transferred to another department, retrieved using the same phone, or retrieved using a different phone.

AllowCallPark

Description of the Teams Call Park Policy.

Description

Specify the number of seconds to wait before ringing the parker when the parked call hasn't been picked up. Value can be from 120 to 1800 (seconds).

ParkTimeoutSeconds

Specify the maximum value that a rendered pickup code can take. Value can be from 10 to 9999. Note: PickupRangeStart must be smaller than PickupRangeEnd.

PickupRangeEnd

Specify the minimum value that a rendered pickup code can take. Value can be from 10 to 9999.

PickupRangeStart

Present ensures the instance exists, absent ensures it is removed.

Ensure

This resource is used to manage Call Queue in your Skype for Business Online organization.

Schema for microsoft.teams.callqueue

The Name parameter specifies a unique name for the Call Queue.

Name

AgentAlertTime

The AllowOptOut parameter indicates whether or not agents can opt in or opt out from taking calls from a Call Queue.

AllowOptOut

The DistributionLists parameter lets you add all the members of the distribution lists to the Call Queue. This is a list of distribution list GUIDs. A service wide configurable maximum number of DLs per Call Queue are allowed. Only the first N (service wide configurable) agents from all distribution lists combined are considered for accepting the call. Nested DLs are supported. O365 Groups can also be used to add members to the Call Queue.

DistributionLists

The UseDefaultMusicOnHold parameter indicates that this Call Queue uses the default music on hold. This parameter cannot be specified together with MusicOnHoldAudioFileId.

UseDefaultMusicOnHold

The WelcomeMusicAudioFileId parameter represents the audio file to play when callers are connected with the Call Queue. This is the unique identifier of the audio file.

WelcomeMusicAudioFileId

The MusicOnHoldFileContent parameter represents music to play when callers are placed on hold. This is the unique identifier of the audio file. This parameter is required if the UseDefaultMusicOnHold parameter is not specified.

MusicOnHoldAudioFileId

DisconnectWithBusy Forward Voicemail SharedVoicemail

The OverflowAction parameter designates the action to take if the overflow threshold is reached. The OverflowAction property must be set to one of the following values: DisconnectWithBusy, Forward, Voicemail, and SharedVoicemail. The default value is DisconnectWithBusy.

OverflowAction

The OverflowActionTarget parameter represents the target of the overflow action. If the OverFlowAction is set to Forward, this parameter must be set to a Guid or a telephone number with a mandatory 'tel:' prefix. If the OverflowAction is set to SharedVoicemail, this parameter must be set to a group ID (Microsoft 365, Distribution list, or Mail-enabled security). Otherwise, this parameter is optional.

OverflowActionTarget

The OverflowThreshold parameter defines the number of calls that can be in the queue at any one time before the overflow action is triggered. The OverflowThreshold can be any integer value between 0 and 200, inclusive. A value of 0 causes calls not to reach agents and the overflow action to be taken immediately.

OverflowThreshold

Disconnect Forward Voicemail SharedVoicemail

The TimeoutAction parameter defines the action to take if the timeout threshold is reached. The TimeoutAction property must be set to one of the following values: Disconnect, Forward, Voicemail, and SharedVoicemail. The default value is Disconnect.

TimeoutAction

The TimeoutActionTarget represents the target of the timeout action. If the TimeoutAction is set to Forward, this parameter must be set to a Guid or a telephone number with a mandatory 'tel:' prefix. If the TimeoutAction is set to SharedVoicemail, this parameter must be set to an Office 365 Group ID. Otherwise, this field is optional.

TimeoutActionTarget

The TimeoutThreshold parameter defines the time (in seconds) that a call can be in the queue before that call times out. At that point, the system will take the action specified by the TimeoutAction parameter. The TimeoutThreshold can be any integer value between 0 and 2700 seconds (inclusive), and is rounded to the nearest 15th interval. For example, if set to 47 seconds, then it is rounded down to 45. If set to 0, welcome music is played, and then the timeout action will be taken.

TimeoutThreshold

The RoutingMethod defines how agents will be called in a Call Queue. If the routing method is set to Serial, then agents will be called one at a time. If the routing method is set to Attendant, then agents will be called in parallel. If routing method is set to RoundRobin, the agents will be called using Round Robin strategy so that all agents share the call-load equally. If routing method is set to LongestIdle, the agents will be called based on their idle time, i.e., the agent that has been idle for the longest period will be called.

RoutingMethod

The PresenceBasedRouting parameter indicates whether or not presence based routing will be applied while call being routed to Call Queue agents. When set to False, calls will be routed to agents who have opted in to receive calls, regardless of their presence state. When set to True, opted-in agents will receive calls only when their presence state is Available.

PresenceBasedRouting

The ConferenceMode parameter indicates whether or not Conference mode will be applied on calls for this Call queue. Conference mode significantly reduces the amount of time it takes for a caller to be connected to an agent, after the agent accepts the call.

ConferenceMode

The Users parameter lets you add agents to the Call Queue. This parameter expects a list of user unique identifiers (GUID).

Users

The LanguageId parameter indicates the language that is used to play shared voicemail prompts. This parameter becomes a required parameter If either OverflowAction or TimeoutAction is set to SharedVoicemail. You can query the supported languages using the Get-CsAutoAttendantSupportedLanguage cmdlet.

LanguageId

The OboResourceAccountIds parameter lets you add resource account with phone number to the Call Queue. The agents in the Call Queue will be able to make outbound calls using the phone number on the resource accounts. This is a list of resource account GUIDs. Only Call Queue managed by a Teams Channel will be able to use this feature.

OboResourceAccountIds

The OverflowDisconnectTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being disconnected due to overflow.

OverflowDisconnectTextToSpeechPrompt

The OverflowDisconnectAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being disconnected due to overflow.

OverflowDisconnectAudioFilePrompt

The OverflowRedirectPersonTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person in the organization due to overflow.

OverflowRedirectPersonTextToSpeechPrompt

The OverflowRedirectPersonAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person in the organization due to overflow.

OverflowRedirectPersonAudioFilePrompt

The OverflowRedirectVoiceAppsTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a voice application due to overflow.

OverflowRedirectVoiceAppTextToSpeechPrompt

The OverflowRedirectVoiceAppAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a voice application due to overflow.

OverflowRedirectVoiceAppAudioFilePrompt

The OverflowRedirectPhoneNumberTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to an external PSTN phone number due to overflow.

OverflowRedirectPhoneNumberTextToSpeechPrompt

The OverflowRedirectPhoneNumberAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to an external PSTN phone number due to overflow.

OverflowRedirectPhoneNumberAudioFilePrompt

The OverflowRedirectVoicemailTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person's voicemail due to overflow.

OverflowRedirectVoicemailTextToSpeechPrompt

The OverflowRedirectVoiceMailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person's voicemail due to overflow.

OverflowRedirectVoicemailAudioFilePrompt

OverflowSharedVoicemailTextToSpeechPrompt

The OverflowSharedVoicemailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is to be played as a greeting to the caller when transferred to shared voicemail on overflow. This parameter becomes a required parameter when OverflowAction is SharedVoicemail and OverflowSharedVoicemailTextToSpeechPrompt is null.

OverflowSharedVoicemailAudioFilePrompt

The EnableOverflowSharedVoicemailTranscription parameter is used to turn on transcription for voicemails left by a caller on overflow. This parameter is only applicable when OverflowAction is set to SharedVoicemail.

EnableOverflowSharedVoicemailTranscription

The TimeoutDisconnectTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being disconnected due to timeout.

TimeoutDisconnectTextToSpeechPrompt

The TimeoutDisconnectAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being disconnected due to timeout.

TimeoutDisconnectAudioFilePrompt

The TimeoutRedirectPersonTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person in the organization due to timeout.

TimeoutRedirectPersonTextToSpeechPrompt

The TimeoutRedirectPersonAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person in the organization due to timeout.

TimeoutRedirectPersonAudioFilePrompt

The TimeoutRedirectVoiceAppsTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a voice application due to timeout.

TimeoutRedirectVoiceAppTextToSpeechPrompt

The TimeoutRedirectVoiceAppAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a voice application due to timeout.

TimeoutRedirectVoiceAppAudioFilePrompt

The TimeoutRedirectPhoneNumberTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to an external PSTN phone number due to timeout.

TimeoutRedirectPhoneNumberTextToSpeechPrompt

The TimeoutRedirectPhoneNumberAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to an external PSTN phone number due to timeout.

TimeoutRedirectPhoneNumberAudioFilePrompt

The TimeoutRedirectVoicemailTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is played to the caller when being redirected to a person's voicemail due to timeout.

TimeoutRedirectVoicemailTextToSpeechPrompt

The TimeoutRedirectVoiceMailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is played to the caller when being redirected to a person's voicemail due to timeout.

TimeoutRedirectVoicemailAudioFilePrompt

The TimeoutSharedVoicemailTextToSpeechPrompt parameter indicates the Text-to-Speech (TTS) prompt which is to be played as a greeting to the caller when transferred to shared voicemail on timeout. This parameter becomes a required parameter when TimeoutAction is SharedVoicemail and TimeoutSharedVoicemailAudioFilePrompt is null.

TimeoutSharedVoicemailTextToSpeechPrompt

The TimeoutSharedVoicemailAudioFilePrompt parameter indicates the unique identifier for the Audio file prompt which is to be played as a greeting to the caller when transferred to shared voicemail on timeout. This parameter becomes a required parameter when TimeoutAction is SharedVoicemail and TimeoutSharedVoicemailTextToSpeechPrompt is null.

TimeoutSharedVoicemailAudioFilePrompt

The EnableTimeoutSharedVoicemailTranscription parameter is used to turn on transcription for voicemails left by a caller on timeout. This parameter is only applicable when TimeoutAction is set to SharedVoicemail.

EnableTimeoutSharedVoicemailTranscription

Id of the channel to connect a call queue to.

ChannelId

Guid should contain 32 digits with 4 dashes (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). This is the GUID of one of the owners of the team the channels belongs to.

ChannelUserObjectId

This is a list of GUIDs for users who are authorized to make changes to this call queue. The users must also have a TeamsVoiceApplications policy assigned. The GUID should contain 32 digits with 4 dashes (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx).

AuthorizedUsers

Present ensures the Team Message Policy exists, absent ensures it is removed

Ensure

This resource configures a Teams Channel Policy.

More information: https://docs.microsoft.com/en-us/microsoftteams/teams-policies

Schema for microsoft.teams.channelspolicy

Identity of the Teams Channel Policy.

Identity

Description of the Teams Channel Policy.

Description

Determines whether a user is allowed to share a shared channel with an external user. Set this to TRUE to allow. Set this FALSE to prohibit.

AllowChannelSharingToExternalUser

Determines whether a user is allowed to create an org-wide team. Set this to TRUE to allow. Set this FALSE to prohibit.

AllowOrgWideTeamCreation

Determines whether a user is allowed to discover private teams in suggestions and search results. Set this to TRUE to allow. Set this FALSE to prohibit.

EnablePrivateTeamDiscovery

Determines whether a user is allowed to create a private channel. Set this to TRUE to allow. Set this FALSE to prohibit.

AllowPrivateChannelCreation

Determines whether a user is allowed to create a shared channel. Set this to TRUE to allow. Set this FALSE to prohibit.

AllowSharedChannelCreation

Determines whether a user is allowed to participate in a shared channel that has been shared by an external user. Set this to TRUE to allow. Set this FALSE to prohibit.

AllowUserToParticipateInExternalSharedChannel

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource is used to add and update channels in existing Teams.

Schema for microsoft.teams.channel

Current channel name

DisplayName

Name of the team the Channel belongs to

TeamName

Team group ID, only used to target a Team when duplicated display names occurs.

GroupID

Used to update current channel name

NewDisplayName

Channel description

Description

Present ensures the Team channel exists, absent ensures it is removed

Ensure

This resource configures a new Custom tab in a Channel.

Schema for microsoft.teams.channeltab

Display Name of the Channel Tab.

DisplayName

Display Name of the Team.

TeamName

Display Name of the Channel.

ChannelName

Unique Id of the Team of the instance on the source tenant.

TeamId

Id of the Teams App associated with the custom tab.

TeamsApp

Index of the sort order for the custom tab.

SortOrderIndex

Url of the website linked to the Channel Tab.

WebSiteUrl

Url of the content linked to the Channel Tab.

ContentUrl

Url of the location used to remove the app.

RemoveUrl

Id of the Entity linked to the Channel Tab.

EntityId

Present ensures the Tab exists, absent ensures it is removed.

Ensure

This resource is used to configure the Teams client settings.

More information: https://docs.microsoft.com/en-us/microsoftteams/enable-features-office-365#teams-settings-and-teams-upgrade-settings-in-the-microsoft-teams-admin-center

Schema for microsoft.teams.clientconfiguration

The only valid input is Global - the tenant wide configuration

Identity

Designates whether users are able to leverage Box as a third party storage solution in Microsoft Teams. If $true, users will be able to add Box in the client and interact with the files stored there.

AllowBox

Designates whether users are able to leverage DropBox as a third party storage solution in Microsoft Teams. If $true, users will be able to add DropBox in the client and interact with the files stored there.

AllowDropBox

When set to $true, mail hooks are enabled, and users can post messages to a channel by sending an email to the email address of Teams channel.

AllowEmailIntoChannel

Designates whether users are able to leverage GoogleDrive as a third party storage solution in Microsoft Teams. If $true, users will be able to add Google Drive in the client and interact with the files stored there.

AllowGoogleDrive

Designates whether or not guest users in your organization will have access to the Teams client. If $true, guests in your tenant will be able to access the Teams client. Note that this setting has a core dependency on Guest Access being enabled in your Office 365 tenant.

AllowGuestUser

When set to $true, users will be able to see the organizational chart icon other users' contact cards, and when clicked, this icon will display the detailed organizational chart.

AllowOrganizationTab

Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the from party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed anonymous because it originated from the Surface Hub's device account. If set to $true, these device accounts will be able to send chat messages in Skype for Business Online (does not apply to Microsoft Teams).

AllowResourceAccountSendMessage

If set to $true, the Exchange address book policy (ABP) will be used to provide customized view of the global address book for each user. This is only a virtual separation and not a legal separation.

AllowScopedPeopleSearchandAccess

Designates whether users are able to leverage ShareFile as a third party storage solution in Microsoft Teams. If $true, users will be able to add ShareFile in the client and interact with the files stored there.

AllowShareFile

When set to $true, Teams conversations automatically show up in Skype for Business for users that aren't enabled for Teams.

AllowSkypeBusinessInterop

Designates whether users are able to leverage Egnyte as a third party storage solution in Microsoft Teams. If $true, users will be able to add Egnyte in the client and interact with the files stored there.

AllowEgnyte

This setting applies only to Skype for Business Online (not Microsoft Teams) and defines whether the user must provide a secondary form of authentication to access the meeting content from a resource device account. Meeting content is defined as files that are shared to the Content Bin - files that have been attached to the meeting.

ContentPin

Require a secondary form of authentication to access meeting content.

ResourceAccountContentAccess

Senders domains can be further restricted to ensure that only allowed SMTP domains can send emails to the Teams channels. This is a comma-separated string of the domains you'd like to allow to send emails to Teams channels.

RestrictedSenderList

Creates a new Teams recording policy for governing automatic policy-based recording in your tenant. Automatic policy-based recording is only applicable to Microsoft Teams users.

Schema for microsoft.teams.compliancerecordingpolicy

Unique identifier of the application instance of a policy-based recording application to be retrieved.

Identity

A list of application instances of policy-based recording applications to assign to this policy. The Id of each of these application instances must be the ObjectId of the application instance as obtained by the Get-CsOnlineApplicationInstance cmdlet.

ComplianceRecordingApplications

Enables administrators to provide explanatory text to accompany a Teams recording policy. For example, the Description might include information about the users the policy should be assigned to.

Description

Setting this attribute to true disables recording audio notifications for 1:1 calls that are under compliance recording.

DisableComplianceRecordingAudioNotificationForCalls

Controls whether this Teams recording policy is active or not.

Enabled

This parameter is reserved for future use.

WarnUserOnRemoval

Present ensures the instance exists, absent ensures it is removed.

Ensure

The CsTeamsCortanaPolicy resources enable administrators to control settings for Cortana voice assistant in Microsoft Teams.

Schema for microsoft.teams.cortanapolicy

Unique identifier for Teams cortana policy you're creating.

Identity

The value of this field indicates if Cortana is enabled and mode of invocation.

CortanaVoiceInvocationMode

Provide a description of your policy to identify purpose of creating it.

Description

Ensure

This resource configures a Teams User's Calling Settings.

More information: https://learn.microsoft.com/en-us/microsoftteams/user-call-settings

Schema for microsoft.teams.dialinconferencingtenantsettings

Only accepted value is Yes.

IsSingleInstance

Specifies the default value that gets assigned to the 'AllowPSTNOnlyMeetings' setting of users when they are enabled for dial-in conferencing, or when a user's dial-in conferencing provider is set to Microsoft. If set to $true, the 'AllowPSTNOnlyMeetings' setting of the user will also be set to true. If $false, the user setting will be false. The default value for AllowPSTNOnlyMeetingsByDefault is $false.

AllowPSTNOnlyMeetingsByDefault

Automatically Migrate User Meetings.

AutomaticallyMigrateUserMeetings

Automatically replace ACP Provider.

AutomaticallyReplaceAcpProvider

Specifies whether advisory emails will be sent to users when the events listed below occur. Setting the parameter to $true enables the emails to be sent, $false disables the emails. The default is $true.

AutomaticallySendEmailsToUsers

Enable Dial out join confirmation.

EnableDialOutJoinConfirmation

Specifies if, by default, announcements are made as users enter and exit a conference call. Set to $true to enable notifications, $false to disable notifications. The default is $true.

EnableEntryExitNotifications

Supported entry and exit announcement type.

EntryExitAnnouncementsType

This parameter allows tenant administrators to configure masking of PSTN participant phone numbers in the roster view for Microsoft Teams meetings enabled for Audio Conferencing, scheduled within the organization. Possible values are MaskedForExternalUsers, MaskedForAllUsers or NoMasking

MaskPstnNumbersType

Specifies the number of digits in the automatically generated PINs. Organizers can enter their PIN to start a meeting they scheduled if they join via phone and are the first person to join. The minimum value is 4, the maximum is 12, and the default is 5.

PinLength

This resource configures the Teams Emergency Calling Policies.

More information: https://docs.microsoft.com/en-us/microsoftteams/manage-emergency-calling-policies

Schema for microsoft.teams.emergencycallingpolicy

Identity of the Teams Emergency Calling Policy.

Identity

Description of the Teams Emergency Calling Policy.

Description

Allows the tenant administrator to configure a text string, which is shown at the top of the Calls app.

EnhancedEmergencyServiceDisclaimer

Enables ExternalLocationLookupMode. This mode allows users to set Emergency addresses for remote locations.

ExternalLocationLookupMode

This parameter represents PSTN number which can be dialed out if NotificationMode is set to either of the two Conference values.

NotificationDialOutNumber

NotificationGroup is a email list of users and groups to be notified of an emergency call.

NotificationGroup

The type of conference experience for security desk notification.

NotificationMode

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures the Teams Emergency Call Routing Policies.

More information: https://docs.microsoft.com/en-us/microsoftteams/manage-emergency-call-routing-policies

Schema for microsoft.teams.emergencycallroutingpolicy

Identity of the Teams Emergency Call Routing Policy.

Identity

Description of the Teams Emergency Call Routing Policy.

Description

Schema for MSFT_TeamsEmergencyNumber

Specifies the emergency phone number.

EmergencyDialString

For each Teams emergency number, you can specify zero or more emergency dial masks. A dial mask is a number that you want to translate into the value of the emergency dial number value when it is dialed.

EmergencyDialMask

Specify the online public switched telephone network (PSTN) usage

OnlinePSTNUsage

Emergency number(s) associated with the policy.

EmergencyNumbers

Flag to enable Enhanced Emergency Services

AllowEnhancedEmergencyServices

Ensure

Use this resource to create a new Teams enhanced encryption policy.

Schema for microsoft.teams.enhancedencryptionpolicy

Unique identifier assigned to the Teams enhanced encryption policy.

Identity

Determines whether End-to-end encrypted calling is available for the user in Teams. Set this to DisabledUserOverride to allow user to turn on End-to-end encrypted calls. Set this to Disabled to prohibit.

CallingEndtoEndEncryptionEnabledType

Enables administrators to provide explanatory text to accompany a Teams enhanced encryption policy.

Description

MeetingEndToEndEncryption

Present ensures the instance exists, absent ensures it is removed.

Ensure

This resource configures the Teams Events Policies.

Schema for microsoft.teams.eventspolicy

Identity of the Teams Events Policy.

Identity

Description of the Teams Events Policy.

Description

This setting governs if a user is allowed to edit the communication emails in Teams Town Hall or Teams Webinar events.

AllowEmailEditing

This setting governs access to the integrations tab in the event creation workflow.

AllowEventIntegrations

Determines if webinars are allowed by the policy or not.

AllowWebinars

This setting governs if a user can create town halls using Teams Events.

AllowTownhalls

This setting governs which users in a tenant can add which registration form questions to an event registration page for attendees to answer when registering for the event.

AllowedQuestionTypesInRegistrationForm

None InviteOnly EveryoneInCompanyIncludingGuests Everyone

This setting describes how IT admins can control which types of Town Hall attendees can have their recordings published.

AllowedTownhallTypesForRecordingPublish

This setting describes how IT admins can control which types of webinar attendees can have their recordings published.

AllowedWebinarTypesForRecordingPublish

Defines who is allowed to join the event.

EventAccessType

Present ensures the policy exists, absent ensures it is removed.

Ensure

This setting governs whether the user can enable the Comment Stream chat experience for Town Halls.

TownhallChatExperience

This setting governs whether the global admin disables this property and prevents the organizers from creating town halls that use Microsoft eCDN even though they have been assigned a Teams Premium license.

UseMicrosoftECDN

This resource is used to configure the Teams Federation Configuration (CsTenantFederationConfiguration).
In the Teams admin center this is available in 'External access' in the Users section.

More information: https://docs.microsoft.com/en-us/microsoftteams/manage-external-access

Schema for microsoft.teams.federationconfiguration

The only valid input is Global - the tenant wide configuration

Identity

When set to True users will be potentially allowed to communicate with users from other domains.

AllowFederatedUsers

List of federated domains to allow.

AllowedDomains

List of federated domains to block.

BlockedDomains

When set to True users will be potentially allowed to communicate with users who have accounts on public IM and presence providers.

AllowPublicUsers

Allows federation with people using Teams with an account that's not managed by an organization.

AllowTeamsConsumer

Allows people using Teams with an account that's not managed by an organization, to discover and start communication with users in your organization.

AllowTeamsConsumerInbound

When set to Blocked, all external access with users from Teams subscriptions that contain only trial licenses will be blocked. This means users from these trial-only tenants will not be able to reach to your users via chats, Teams calls, and meetings (using the users authenticated identity) and your users will not be able to reach users in these trial-only tenants. If this setting is set to Blocked, users from the trial-only tenant will also be removed from existing chats.

ExternalAccessWithTrialTenants

When set to True, messages sent from discovered partners are considered unverified. That means that those messages will be delivered only if they were sent from a person who is on the recipient's Contacts list.

TreatDiscoveredPartnersAsUnverified

When set to True, indicates that the users homed on Skype for Business Online use the same SIP domain as users homed on the on-premises version of Skype for Business Server.

SharedSipAddressSpace

When set to True, Teamsconsumer have access only to external user profiles

RestrictTeamsConsumerToExternalUserProfiles

New-CsTeamsFeedbackPolicy [-Identity] <string> [-UserInitiatedMode <string>] [-ReceiveSurveysMode <string>] [-AllowScreenshotCollection <bool>] [-AllowEmailCollection <bool>] [-AllowLogCollection <bool>] [-EnableFeatureSuggestions <bool>] [-Force] [-WhatIf] [-Confirm] [<CommonParameters>]

Schema for microsoft.teams.feedbackpolicy

Specify the name of the Teams Feedback Policy.

Identity

Specifies if users are allowed to give feedback.

UserInitiatedMode

Specifies if users are allowed to receive the survey.

ReceiveSurveysMode

Specifies if Screenshot Collection is enabled or not.

AllowScreenshotCollection

Specifies if Email Collection is enabled or not.

AllowEmailCollection

Specifies if Log Collection is enabled or not.

AllowLogCollection

Specifies if users are allowed to provide feature suggestions

EnableFeatureSuggestions

Present ensures the instance exists, absent ensures it is removed.

Ensure

New-CsTeamsFilesPolicy [-Identity] <string> [-NativeFileEntryPoints <string>] [-SPChannelFilesTab <string>] [-MsftInternalProcessingMode <string>] [-WhatIf] [-Confirm] [<CommonParameters>]

Schema for microsoft.teams.filespolicy

Specifies the policy instance name

Identity

Specifies whether users see the options to upload files from OneDrive for Business, other cloud storage services configured for the user account, and SharePoint Online

NativeFileEntryPoints

Specifies whether users see the Teams Files channel tab in any channel or in Teams chat.

SPChannelFilesTab

Ensure

This resource is used to assign Teams policy to a specified group

Schema for microsoft.teams.grouppolicyassignment

Group Displayname of the group the policies are assigned to

GroupDisplayName

GroupId, alternatively to Group Displayname

GroupId

ApplicationAccessPolicy CallingLineIdentity OnlineAudioConferencingRoutingPolicy OnlineVoicemailPolicy OnlineVoiceRoutingPolicy TeamsAudioConferencingPolicy TeamsCallHoldPolicy TeamsCallParkPolicy TeamsChannelsPolicy TeamsComplianceRecordingPolicy TeamsCortanaPolicy TeamsEmergencyCallingPolicy TeamsEnhancedEncryptionPolicy TeamsFeedbackPolicy TeamsFilesPolicy TeamsIPPhonePolicy TeamsMediaLoggingPolicy TeamsMeetingBroadcastPolicy TeamsMeetingPolicy TeamsMessagingPolicy TeamsMobilityPolicy TeamsRoomVideoTeleConferencingPolicy TeamsShiftsPolicy TeamsUpdateManagementPolicy TeamsVdiPolicy TeamsVideoInteropServicePolicy TenantDialPlan ExternalAccessPolicy TeamsAppSetupPolicy TeamsCallingPolicy TeamsEventsPolicy TeamsMeetingBrandingPolicy TeamsMeetingTemplatePermissionPolicy TeamsVerticalPackagePolicy

Teams PolicyType. The type of the policy to be assigned. Possible values:

PolicyType

Teams PolicyName. The name of the policy to be assigned.

PolicyName

Teams Priority. The rank of the policy assignment, relative to other group policy assignments for the same policy type

Priority

Present ensures the group policy assignment exists, absent ensures it is removed.

Ensure

This resource is used to configure the Teams guest calling configuration.

More information: https://docs.microsoft.com/en-us/microsoftteams/set-up-guests

Schema for microsoft.teams.guestcallingconfiguration

The only valid input is Global - the tenant wide configuration

Identity

Designates whether guests who have been enabled for Teams can use calling functionality. If $false, guests cannot call.

AllowPrivateCalling

This resource is used to configure the Teams Guest Meetings Configuration.

More information: https://docs.microsoft.com/en-us/microsoftteams/set-up-guests

Schema for microsoft.teams.guestmeetingconfiguration

Identity

Determines whether video is enabled in a user's meetings or calls. Set this to TRUE to allow guests to share their video. Set this to FALSE to prohibit guests from sharing their video.

AllowIPVideo

Determines whether real-time captions are available for guests in Teams meetings.

LiveCaptionsEnabledType

Determines the mode in which guests can share a screen in calls or meetings. Set this to SingleApplication to allow the user to share an application at a given point in time. Set this to EntireScreen to allow the user to share anything on their screens. Set this to Disabled to prohibit the user from sharing their screens.

ScreenSharingMode

Determines whether guests can start ad-hoc meetings. Set this to TRUE to allow guests to start ad-hoc meetings. Set this to FALSE to prohibit guests from starting ad-hoc meetings.

AllowMeetNow

Determines whether guests can enable post-meeting captions and transcriptions in meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowTranscription

This resource is used to configure the Teams Guest Messaging Configuration.

More information: https://docs.microsoft.com/en-us/microsoftteams/set-up-guests

Schema for microsoft.teams.guestmessagingconfiguration

Identity

Determines if a user is allowed to edit their own messages.

AllowUserEditMessage

Determines if a user is allowed to delete their own messages.

AllowUserDeleteMessage

Determines if a user is allowed to chat.

AllowUserChat

Turn this setting on to allow users to permanently delete their one-on-one chat, group chat, and meeting chat as participants (this deletes the chat only for them, not other users in the chat).

AllowUserDeleteChat

Determines Giphy content restrictions. Default value is Moderate, other options are Strict and NoRestriction.

GiphyRatingType

Determines if memes are available for use.

AllowMemes

Determines if stickers are available for use.

AllowStickers

Determines if Giphy are available for use.

AllowGiphy

Determines if Immersive Reader is enabled.

AllowImmersiveReader

New-CsTeamsIPPhonePolicy allows you to create a policy to manage features related to Teams phone experiences. Teams phone policies determine the features that are available to users.

Schema for microsoft.teams.ipphonepolicy

Specifies the policy instance name

Identity

Determines whether Better Together mode is enabled, phones can lock and unlock in an integrated fashion when connected to their Windows PC running a 64-bit Teams desktop client.

AllowBetterTogether

Determines whether the Home Screen feature of the Teams IP Phones is enabled.

AllowHomeScreen

Determines whether hot desking mode is enabled.

AllowHotDesking

Specifies the description of the policy

Description

Determines the idle timeout value in minutes for the signed in user account. When the timeout is reached, the account is logged out.

HotDeskingIdleTimeoutInMinutes

Determines whether a user can search the Global Address List in Common Area Phone Mode.

SearchOnCommonAreaPhoneMode

Determines the sign in mode for the device when signing in to Teams.

SignInMode

Present ensures the instance exists, absent ensures it is removed.

Ensure

This resource is used to configure the Teams Meeting Broadcast Settings.

More information: https://docs.microsoft.com/en-us/microsoftteams/teams-live-events/configure-teams-live-events

Schema for microsoft.teams.meetingbroadcastconfiguration

The only valid input is Global - the tenant wide configuration

Identity

Specifies a URL where broadcast event attendees can find support information or FAQs specific to that event. The URL will be displayed to the attendees during the broadcast.

SupportURL

If set to $true, Teams meeting broadcast streams are enabled to take advantage of the network and bandwidth management capabilities of your Software Defined Network (SDN) provider.

AllowSdnProviderForBroadcastMeeting

Specifies the Software Defined Network (SDN) provider's name. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.

SdnProviderName

Specifies the Software Defined Network (SDN) license identifier. This is required and provided by some SDN providers. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.

SdnLicenseId

Specifies the Software Defined Network (SDN) provider's HTTP API endpoint. This information is provided to you by the SDN provider. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.

SdnApiTemplateUrl

Specifies the Software Defined Network (SDN) provider's authentication token which is required to use their SDN license. This is required by some SDN providers who will give you the required token. This parameter is only required if AllowSdnProviderForBroadcastMeeting is set to $true.

SdnApiToken

This resource is used to configure the Teams Meeting Broadcast Policies.

More information: https://docs.microsoft.com/en-us/microsoftteams/teams-live-events/set-up-for-teams-live-events

Schema for microsoft.teams.meetingbroadcastpolicy

The identifier of the Teams Meeting Broadcast Policy.

Identity

Specifies whether this user can create broadcast events in Teams. This setting impacts broadcasts that use both self-service and external encoder production methods.

AllowBroadcastScheduling

Specifies whether real-time transcription and translation can be enabled in the broadcast event. Note: this setting is applicable to broadcast events that use Teams Meeting production only and does not apply when external encoder is used as production method.

AllowBroadcastTranscription

Everyone EveryoneInCompany InvitedUsersInCompany EveryoneInCompanyAndExternal InvitedUsersInCompanyAndExternal

Specifies the attendee visibility mode of the broadcast events created by this user.  This setting controls who can watch the broadcast event - e.g. anyone can watch this event including anonymous users or only authenticated users in my company can watch the event.  Note: this setting is applicable to broadcast events that use Teams Meeting production only and does not apply when external encoder is used as production method.

BroadcastAttendeeVisibilityMode

Specifies whether broadcast events created by this user are always recorded, never recorded or user can choose whether to record or not. Note: this setting is applicable to broadcast events that use Teams Meeting production only and does not apply when external encoder is used as production method.

BroadcastRecordingMode

Present ensures the Policy exists, absent ensures it is removed

Ensure

This resource is used to configure the Teams Meeting Configuration.

More information: https://docs.microsoft.com/en-us/microsoftteams/meeting-settings-in-teams

Schema for microsoft.teams.meetingconfiguration

Identity

URL to a logo image. This would be included in the meeting invite. Please ensure this URL is publicly accessible for invites that go beyond your federation boundaries.

LogoURL

URL to a website containing legal information and meeting disclaimers. This would be included in the meeting invite. Please ensure this URL is publicly accessible for invites that go beyond your federation boundaries.

LegalURL

URL to a website where users can obtain assistance on joining the meeting.This would be included in the meeting invite. Please ensure this URL is publicly accessible for invites that go beyond your federation boundaries.

HelpURL

Text to be used on custom meeting invitations.

CustomFooterText

Determines whether anonymous users are blocked from joining meetings in the tenant. Set this to TRUE to block anonymous users from joining. Set this to FALSE to allow anonymous users to join meetings.

DisableAnonymousJoin

Determines whether Quality of Service Marking for real-time media (audio, video, screen/app sharing) is enabled in the tenant. Set this to TRUE to enable and FALSE to disable.

EnableQoS

Determines the starting port number for client audio. Minimum allowed value: 1024 Maximum allowed value: 65535 Default value: 50000.

ClientAudioPort

Determines the total number of ports available for client audio. Default value is 20.

ClientAudioPortRange

Determines the starting port number for client video. Minimum allowed value: 1024 Maximum allowed value: 65535 Default value: 50020.

ClientVideoPort

Determines the total number of ports available for client video. Default value is 20.

ClientVideoPortRange

Determines the starting port number for client screen sharing or application sharing. Minimum allowed value: 1024 Maximum allowed value: 65535 Default value: 50040.

ClientAppSharingPort

Determines whether custom media port and range selections need to be enforced. When set to True, clients will use the specified port range for media traffic. When set to False (the default value) for any available port (from port 1024 through port 65535) will be used to accommodate media traffic.

ClientMediaPortRangeEnabled

Determines the total number of ports available for client sharing or application sharing. Default value is 20.

ClientAppSharingPortRange

This resource configures the Teams Meeting Policies.

More information: https://docs.microsoft.com/en-us/microsoftteams/meeting-policies-overview

Schema for microsoft.teams.meetingpolicy

Identity of the Teams Meeting Policy.

Identity

Description of the Teams Meeting Policy.

Description

Determines whether a user can schedule channel meetings. Set this to TRUE to allow a user to schedule channel meetings. Set this to FALSE to prohibit the user from scheduling channel meetings. Note this only restricts from scheduling and not from joining a meeting scheduled by another user.

AllowChannelMeetingScheduling

Determines whether a user can start ad-hoc meetings. Set this to TRUE to allow a user to start ad-hoc meetings. Set this to FALSE to prohibit the user from starting ad-hoc meetings.

AllowMeetNow

Determines whether a user can start private ad-hoc meetings. Set this to TRUE to allow a user to start private ad-hoc meetings. Set this to FALSE to prohibit the user from starting private ad-hoc meetings.

AllowPrivateMeetNow

Determines whether or not Chat will be enabled, enabled except anonymous or disabled for meetings.

MeetingChatEnabledType

Determines whether a user should have the option to view live captions or not in a meeting.

LiveCaptionsEnabledType

Determines whether audio is enabled in a user's meetings or calls. Set this to TRUE to allow the user to share their audioo. Set this to FALSE to prohibit the user from sharing their audio.

AllowIPAudio

Determines whether video is enabled in a user's meetings or calls. Set this to TRUE to allow the user to share their video. Set this to FALSE to prohibit the user from sharing their video.

AllowIPVideo

Determines whether or not a meeting Organizer can track join and leave times for all users within their meetings as well as download a roster.

AllowEngagementReport

Determines whether or not a user can use audio in a meeting that supports it.

IPAudioMode

Determines whether or not a user can use video in a meeting that supports it.  Can only be enabled if IPAudioMode is enabled

IPVideoMode

CURRENTLY DISABLED: Determines whether anonymous users can use the Call Me At feature for meeting audio.

AllowAnonymousUsersToDialOut

Determines whether anonymous users can initiate a meeting. Set this to TRUE to allow anonymous users to initiate a meeting. Set this to FALSE to prohibit them from initiating a meeting.

AllowAnonymousUsersToStartMeeting

Determines whether a user can schedule private meetings. Set this to TRUE to allow a user to schedule private meetings. Set this to FALSE to prohibit the user from scheduling private meetings. Note this only restricts from scheduling and not from joining a meeting scheduled by another user.

AllowPrivateMeetingScheduling

EveryoneInCompany Everyone EveryoneInSameAndFederatedCompany OrganizerOnly InvitedUsers EveryoneInCompanyExcludingGuests

Determines what types of participants will automatically be added to meetings organized by this user. Set this to EveryoneInCompany if you would like meetings to place every external user in the lobby but allow all users in the company to join the meeting immediately. Set this to Everyone if you'd like to admit anonymous users by default. Set this to EveryoneInSameAndFederatedCompany if you would like meetings to allow federated users to join like your company's users, but place all other external users in a lobby. Set this to InvitedUsers if you would like meetings to allow only the invited users.

AutoAdmittedUsers

Determines whether PSTN users should be automatically admitted to the meetings. Set this to TRUE to allow the PSTN user to be able bypass the meetinglobby. Set this to FALSE to prohibit the PSTN user from bypassing the meetinglobby.

AllowPSTNUsersToBypassLobby

Determines whether cloud recording is allowed in a user's meetings. Set this to TRUE to allow the user to be able to record meetings. Set this to FALSE to prohibit the user from recording meetings.

AllowCloudRecording

Determines whether cloud recording can be stored out of region for go-local tenants where recording is not yet enabled.

AllowRecordingStorageOutsideRegion

Determines if users can change the default value of the Who can present? setting in Meeting options in the Teams client. This policy setting affects all meetings, including Meet Now meetings.

DesignatedPresenterRoleMode

Determines whether a user can schedule Teams Meetings in Outlook desktop client. Set this to TRUE to allow the user to be able to schedule Teams meetings in Outlook client. Set this to FALSE to prohibit a user from scheduling Teams meeting in Outlook client.

AllowOutlookAddIn

Determines whether Powerpoint sharing is allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowPowerPointSharing

Determines whether participants can request or give control of screen sharing during meetings scheduled by this user. Set this to TRUE to allow the user to be able to give or request control. Set this to FALSE to prohibit the user from giving, requesting control in a meeting.

AllowParticipantGiveRequestControl

Determines whether external participants can request or give control of screen sharing during meetings scheduled by this user. Set this to TRUE to allow the user to be able to give or request control. Set this to FALSE to prohibit an external user from giving or requesting control in a meeting.

AllowExternalParticipantGiveRequestControl

Determines whether users are allowed to take shared notes. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowSharedNotes

Determines whether whiteboard is allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowWhiteboard

Determines whether real-time and/or post-meeting captions and transcriptions are allowed in a user's meetings. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowTranscription

Determines the media bit rate for audio/video/app sharing transmissions in meetings.

MediaBitRateKb

Determines the mode in which a user can share a screen in calls or meetings. Set this to SingleApplication to allow the user to share an application at a given point in time. Set this to EntireScreen to allow the user to share anything on their screens. Set this to Disabled to prohibit the user from sharing their screens.

ScreenSharingMode

NoFilters BlurOnly BlurAndDefaultBackgrounds AllFilters

Determines which background filters are available to meeting attendees.

VideoFiltersMode

Determines whether organizers can override lobby settings for both VOIP and PSTN. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowOrganizersToOverrideLobbySettings

Determines which Outlook Add-in the user will get as preferred Meeting provider(TeamsAndSfb or Teams).

PreferredMeetingProviderForIslandsMode

Determines whether a user is able to use NDI (Network Device Interface) in meetings - both for output and input streams.

AllowNDIStreaming

Determines what types of external meetings users can join. Enabled is able join all external meetings.

AllowUserToJoinExternalMeeting

Determines whether or not users will be able to enroll/capture their Biometric data: Face & Voice.

EnrollUserOverride

Determines whether or not biometric data will be used to distinguish and or attribute in the transcript.

RoomAttributeUserOverride

Determines whether or not meetings created by users with this policy are able to utilize the meeting overflow capability.

StreamingAttendeeMode

Determines whether or not meetings created by users with this policy are able to utilize the Camera Far-End PTZ Mode.

TeamsCameraFarEndPTZMode

Determines whether or not meetings created by users with this policy are able to utilize the Meeting Reactions feature.

AllowMeetingReactions

Specifies who can attend and register for webinars.

WhoCanRegister

AllowAnnotations

Determines whether anonymous users can join the meetings that impacted users organize. Set this to TRUE to allow anonymous users to join a meeting. Set this to FALSE to prohibit them from joining a meeting.

AllowAnonymousUsersToJoinMeeting

AllowMeetingCoach

Controls if a user can create a webinar meeting. The default value is True.

AllowMeetingRegistration

Determines whether network configuration setting lookups can be made by users who are not Enterprise Voice enabled. It is used to enable Network Roaming policies.

AllowNetworkConfigurationSettingsLookup

AllowWatermarkForCameraVideo

AllowWatermarkForScreenSharing

Specifies the number of days before meeting recordings will expire and move to the recycle bin. Value can be from 1 to 99,999 days. NOTE: You may opt to set Meeting Recordings to never expire by entering the value -1.

NewMeetingRecordingExpirationDays

Determines whether a user can add a URL for captions from a Communications Access Real-Time Translation (CART) captioner for providing real-time captions in meetings.

AllowCartCaptionsScheduling

AllowDocumentCollaboration

AllowedStreamingMediaInput

A user can join a Teams meeting anonymously using a Teams client or using a custom application built using Azure Communication Services. When anonymous meeting join is enabled, both types of clients may be used by default. This optional parameter can be used to block one of the client types that can be used. The allowed values are ACS (to block the use of Azure Communication Services clients) or Teams (to block the use of Teams clients). Both can also be specified, separated by a comma, but this is equivalent to disabling anonymous join completely.

BlockedAnonymousJoinClientTypes

Determines how channel meeting recordings are saved, permissioned, and who can download them.

ChannelRecordingDownload

ExplicitRecordingConsent

ForceStreamingAttendeeMode

InfoShownInReportMode

Determines how meeting organizers can configure a meeting for language interpretation, select attendees of the meeting to become interpreters that other attendees can select and listen to the real-time translation they provide.

LiveInterpretationEnabledType

Determines whether you provide support for your users to stream their Teams meetings to large audiences through Real-Time Messaging Protocol (RTMP).

LiveStreamingMode

Controls how the join information in meeting invitations is displayed by enforcing a common language or enabling up to two languages to be displayed. Note: All Teams supported languages can be specified using language codes.

MeetingInviteLanguages

QnAEngagementMode

RoomPeopleNameUserOverride

Possible values: EnabledUserOverride or Disabled.

SpeakerAttributionMode

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource is used to configure the Teams messaging policy.

More information: https://docs.microsoft.com/en-us/microsoftteams/messaging-policies-in-teams

Schema for microsoft.teams.messagingpolicy

Identity for the teams messaging policy you're modifying. To modify the global policy, use this syntax: -Identity global. To modify a per-user policy, use syntax similar to this: -Identity TeamsMessagingPolicy.

Identity

Report inappropriate content.

AllowCommunicationComplianceEndUserReporting

Determines is Fluid Collaboration should be enabled or not.

AllowFluidCollaborate

Report a security concern.

AllowSecurityEndUserReporting

Determines whether a user is allowed to access and post Giphys. Set this to TRUE to allow. Set this FALSE to prohibit.

AllowGiphy

Determines whether a user is allowed to access and post memes. Set this to TRUE to allow. Set this FALSE to prohibit.

AllowMemes

Determines whether owners are allowed to delete all the messages in their team. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowOwnerDeleteMessage

Determines whether a user is allowed to edit their own messages. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowUserEditMessage

Turn on this setting to let a user get text predictions for chat messages.

AllowSmartCompose

Turn this setting on to enable suggested replies for chat messages. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowSmartReply

Determines whether a user is allowed to access and post stickers. Set this to TRUE to allow. Set this FALSE to prohibit.

AllowStickers

Use this setting to turn automatic URL previewing on or off in messages. Set this to TRUE to turn on. Set this to FALSE to turn off.

AllowUrlPreviews

Determines whether a user is allowed to chat. Set this to TRUE to allow a user to chat across private chat, group chat and in meetings. Set this to FALSE to prohibit all chat.

AllowUserChat

Determines whether a user is allowed to delete their own messages. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowUserDeleteMessage

Determines whether a user is allowed to translate messages to their client languages. Set this to TRUE to allow. Set this to FALSE to prohibit.

AllowUserTranslation

Determines whether a user is allowed to use Immersive Reader for reading conversation messages. Set this to TRUE to allow. Set this FALSE to prohibit.

AllowImmersiveReader

Determines whether a user is allowed to remove a user from a conversation. Set this to TRUE to allow. Set this FALSE to prohibit.

AllowRemoveUser

Determines whether a user is allowed to send priorities messages. Set this to TRUE to allow. Set this FALSE to prohibit.

AllowPriorityMessages

Turn this setting on to allow users to permanently delete their 1:1, group chat, and meeting chat as participants (this deletes the chat only for them, not other users in the chat).

AllowUserDeleteChat

Determines whether a user is allowed to send video messages in Chat. Set this to TRUE to allow a user to send video messages. Set this to FALSE to prohibit sending video messages.

AllowVideoMessages

Provide a description of your policy to identify purpose of creating it.

Description

Determines the Giphy content restrictions applicable to a user. Set this to STRICT, MODERATE or NORESTRICTION.

GiphyRatingType

Use this setting to specify whether read receipts are user controlled, enabled for everyone, or disabled. Set this to UserPreference, Everyone or None.

ReadReceiptsEnabledType

Possible values are: DisabledUserOverride,EnabledUserOverride.

ChannelsInChatListEnabledType

Determines whether a user is allowed to send audio messages. Possible values are: ChatsAndChannels,ChatsOnly,Disabled.

AudioMessageEnabledType

Globally unique identifier (GUID) of the tenant account whose external user communication policy are being created.

Tenant

Present ensures the Team Message Policy exists, absent ensures it is removed

Ensure

The TeamsMobilityPolicy allows Admins to control Teams mobile usage for users.

Schema for microsoft.teams.mobilitypolicy

Specify the name of the Teams Mobility Policy.

Identity

Enables administrators to provide explanatory text about the policy. For example, the Description might indicate the users the policy should be assigned to.

Description

When set to WifiOnly, prohibits the user from making and receiving calls or joining meetings using VoIP calls on the mobile device while on a cellular data connection. Possible values are: WifiOnly, AllNetworks.

IPAudioMobileMode

When set to WifiOnly, prohibits the user from making and receiving video calls or enabling video in meetings using VoIP calls on the mobile device while on a cellular data connection. Possible values are: WifiOnly, AllNetworks.

IPVideoMobileMode

Determines the mobile dialer preference, possible values are: Teams, Native, UserOverride.

MobileDialerPreference

Present ensures the instance exists, absent ensures it is removed.

Ensure

New-CsTeamsNetworkRoamingPolicy allows IT Admins to create policies for Network Roaming and Bandwidth Control experiences in Microsoft Teams.

Schema for microsoft.teams.networkroamingpolicy

Specify the name of the Teams Network Roaming Policy.

Identity

Determines whether video is enabled in a user's meetings or calls. Set this to TRUE to allow the user to share their video. Set this to FALSE to prohibit the user from sharing their video.

AllowIPVideo

Description of the new policy to be created.

Description

Determines the media bit rate for audio/video/app sharing transmissions in meetings.

MediaBitRateKb

Ensure

This resource configures the Teams Online Voicemail Policies.

More information: https://learn.microsoft.com/en-us/microsoftteams/manage-voicemail-policies

Schema for microsoft.teams.onlinevoicemailpolicy

Identity of the Teams Online Voicemail Policy.

Identity

Controls if editing call answer rule settings are enabled or disabled for a user. Possible values are $true or $false.

EnableEditingCallAnswerRulesSetting

Allows you to disable or enable voicemail transcription. Possible values are $true or $false.

EnableTranscription

Allows you to disable or enable profanity masking for the voicemail transcriptions. Possible values are $true or $false.

EnableTranscriptionProfanityMasking

Allows you to disable or enable translation for the voicemail transcriptions. Possible values are $true or $false.

EnableTranscriptionTranslation

A duration of voicemail maximum recording length. The length should be between 30 seconds to 600 seconds.

MaximumRecordingLength

The primary (or first) language that voicemail system prompts will be presented in. Must also set SecondarySystemPromptLanguage. When set, this overrides the user language choice.

PrimarySystemPromptLanguage

The secondary language that voicemail system prompts will be presented in. Must also set PrimarySystemPromptLanguage and may not be the same value as PrimarySystemPromptanguage. When set, this overrides the user language choice.

SecondarySystemPromptLanguage

Specifies whether voicemail and transcription data are shared with the service for training and improving accuracy. Possible values are Defer and Deny.

ShareData

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures a Teams User's Online Voicemail Settings.

Schema for microsoft.teams.onlinevoicemailusersettings

The Identity parameter represents the ID of the specific user in your organization; this can be either a SIP URI or an Object ID.

Identity

DeclineCall PromptOnly PromptOnlyWithTransfer RegularVoicemail VoicemailWithTransferOption

The CallAnswerRule parameter represents the value of the call answer rule, which can be any of the following: DeclineCall, PromptOnly, PromptOnlyWithTransfer, RegularVoicemail, VoicemailWithTransferOption.

CallAnswerRule

The DefaultGreetingPromptOverwrite parameter represents the contents that overwrite the default normal greeting prompt. If the user's normal custom greeting is not set and DefaultGreetingPromptOverwrite is not empty, the voicemail service will play this overwrite greeting instead of the default normal greeting in the voicemail deposit scenario.

DefaultGreetingPromptOverwrite

The DefaultOofGreetingPromptOverwrite parameter represents the contents that overwrite the default out-of-office greeting prompt. If the user's out-of-office custom greeting is not set and DefaultOofGreetingPromptOverwrite is not empty, the voicemail service will play this overwrite greeting instead of the default out-of-office greeting in the voicemail deposit scenario.

DefaultOofGreetingPromptOverwrite

The OofGreetingEnabled parameter represents whether to play out-of-office greeting in voicemail deposit scenario.

OofGreetingEnabled

The OofGreetingFollowAutomaticRepliesEnabled parameter represents whether to play out-of-office greeting in voicemail deposit scenario when user set automatic replies in Outlook.

OofGreetingFollowAutomaticRepliesEnabled

The OofGreetingFollowCalendarEnabled parameter represents whether to play out-of-office greeting in voicemail deposit scenario when user set out-of-office in calendar.

OofGreetingFollowCalendarEnabled

The PromptLanguage parameter represents the language that is used to play voicemail prompts.

PromptLanguage

Specifies whether voicemail and transcription data is shared with the service for training and improving accuracy.

ShareData

The TransferTarget parameter represents the target to transfer the call when call answer rule set to PromptOnlyWithTransfer or VoicemailWithTransferOption. Value of this parameter should be a SIP URI of another user in your organization. For user with Enterprise Voice enabled, a valid telephone number could also be accepted as TransferTarget.

TransferTarget

The VoicemailEnabled parameter represents whether to enable voicemail service. If set to $false, the user has no voicemail service.

VoicemailEnabled

Ensure

This resource configures the Teams Online Voice User.

Schema for microsoft.teams.onlinevoiceuser

Specifies the identity of the target user.

Identity

Specifies the unique identifier of the emergency location to assign to the user. Location identities can be discovered by using the Get-CsOnlineLisLocation cmdlet.

LocationID

Specifies the telephone number to be assigned to the user. The value must be in E.164 format: +14255043920. Setting the value to $Null clears the user's telephone number.

TelephoneNumber

Present ensures the online voice user exists, absent ensures it is removed.

Ensure

This resource configures Org-Wide App Settings for Teams.

Schema for microsoft.teams.orgwideappsettings

Specifies the resource is a single instance, the value must be 'Yes'

IsSingleInstance

Determines whether or not to allow interaction with custom apps.

IsSideloadedAppsInteractionEnabled

This resource configures a Teams PSTN Usage.

More information: https://docs.microsoft.com/en-us/microsoftteams/direct-routing-voice-routing

Schema for microsoft.teams.pstnusage

An online PSTN usage (such as Local or Long Distance) that can be used in conjunction with voice routes and voice routing policies.

Usage

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource allows you to create a new TeamsShiftPolicy instance and set it's properties.

Schema for microsoft.teams.shiftspolicy

Specifies the policy instance name

Identity

Determines the grace period time in minutes between when the first shift starts or last shift ends and when access is blocked

AccessGracePeriodMinutes

Determines the Teams access type granted to the user. Today, only unrestricted access to Teams app is supported.

AccessType

Determines whether a user can manage a Shifts schedule as a team member.

EnableScheduleOwnerPermissions

Determines whether a user is given shift-based presence (On shift, Off shift, or Busy). This must be set in order to have any off shift warning message-specific settings.

EnableShiftPresence

Determines the frequency of warning dialog displayed when user opens Teams.

ShiftNoticeFrequency

Specifies a custom message. Must set ShiftNoticeMessageType to 'CustomMessage' to enforce this

ShiftNoticeMessageCustom

Specifies the warning message is shown in the blocking dialog when a user access Teams off shift hours. Select one of 7 Microsoft provided messages, a default message or a custom message.

ShiftNoticeMessageType

Present ensures the instance exists, absent ensures it is removed.

Ensure

This resource configures a Teams Templates Policy.

More information: https://learn.microsoft.com/en-us/microsoftteams/templates-policies

Schema for microsoft.teams.templatespolicy

Identity of the Teams Templates Policy.

Identity

Description of the Teams Templates Policy.

Description

The list of Teams templates to hide.

HiddenTemplates

Ensure

This resource is used to configure the tenant-wide dial plans for Microsoft Teams.

More information: https://docs.microsoft.com/en-us/microsoftteams/create-and-manage-dial-plans

Schema for microsoft.teams.tenantdialplan

The Identity parameter is a unique identifier that designates the name of the tenant dial plan. Identity is an alphanumeric string that cannot exceed 49 characters. Valid characters are alphabetic or numeric characters, hyphen (-) and dot (.). The value should not begin with a (.).

Identity

The Description parameter describes the tenant dial plan - what it's for, what type of user it applies to and any other information that helps to identify the purpose of the tenant dial plan. Maximum characters: 512.

Description

Schema for MSFT_TeamsVoiceNormalizationRule

A unique identifier for the rule. The Identity specified must include the scope followed by a slash and then the name; for example: site:Redmond/Rule1, where site:Redmond is the scope and Rule1 is the name. The name portion will automatically be stored in the Name property. You cannot specify values for Identity and Name in the same command.

Identity

The order in which rules are applied. A phone number might match more than one rule. This parameter sets the order in which the rules are tested against the number.

Priority

A friendly description of the normalization rule.

Description

A regular expression that the dialed number must match in order for this rule to be applied.

Pattern

The regular expression pattern that will be applied to the number to convert it to E.164 format.

Translation

If True, the result of applying this rule will be a number internal to the organization. If False, applying the rule results in an external number. This value is ignored if the value of the OptimizeDeviceDialing property of the associated dial plan is set to False.

IsInternalExtension

List of normalization rules that are applied to this dial plan.

NormalizationRules

The ExternalAccessPrefix parameter is a number (or set of numbers) that designates the call as external to the organization. (For example, to tenant-dial an outside line, first press 9.) This prefix is ignored by the normalization rules, although these rules are applied to the remainder of the number. The OptimizeDeviceDialing parameter must be set to True for this value to take effect. This parameter must match the regular expression [0-9]{1,4}: that is, it must be a value 0 through 9 and one to four digits in length. The default value is 9.

ExternalAccessPrefix

Specifies if the dial plan should optimize device dialing or not.

OptimizeDeviceDialing

The SimpleName parameter is a display name for the tenant dial plan. This name must be unique among all tenant dial plans within the Skype for Business Server deployment.This string can be up to 49 characters long. Valid characters are alphabetic or numeric characters, hyphen (-), dot (.) and parentheses (()).

SimpleName

Specify if this dial plan should exist or not.

Ensure

As an Admin, you can use the Windows PowerShell command, New-CsTenantNetworkRegion to define network regions. A network region interconnects various parts of a network across multiple geographic areas. The RegionID parameter is a logical name that represents the geography of the region, and has no dependencies or restrictions. Tenant network region is used for Location Based Routing.

Schema for microsoft.teams.tenantnetworkregion

Unique identifier for the network region to be created.

Identity

Name of the associated Central Site.

CentralSite

Provide a description of the network region to identify purpose of creating it.

Description

Present ensures the instance exists, absent ensures it is removed.

Ensure

As an Admin, you can use the Windows PowerShell command, New-CsTenantNetworkSite to define network sites. Network sites are defined as a collection of IP subnets. Each network site must be associated with a network region. Tenant network site is used for Location Based Routing.

Schema for microsoft.teams.tenantnetworksite

Unique identifier for the network site to be created.

Identity

Provide a description of the network site to identify purpose of creating it.

Description

This parameter is used to assign a custom emergency calling policy to a network site

EmergencyCallingPolicy

This parameter is used to assign a custom emergency call routing policy to a network site

EmergencyCallRoutingPolicy

This parameter determines whether the current site is enabled for location based routing.

EnableLocationBasedRouting

LocationPolicy is the identifier for the location policy which the current network site is associating to.

LocationPolicy

NetworkRegionID is the identifier for the network region which the current network site is associating to.

NetworkRegionID

NetworkRoamingPolicy is the identifier for the network roaming policy to which the network site will associate to.

NetworkRoamingPolicy

The address of current network site.

SiteAddress

Ensure

As an Admin, you can use the Windows PowerShell command, New-CsTenantNetworkSubnet to define network subnets and assign them to network sites. Each internal subnet may only be associated with one site. Tenant network subnet is used for Location Based Routing.

Schema for microsoft.teams.tenantnetworksubnet

This parameter determines the length of bits to mask to the subnet. IPv4 format subnet accepts maskbits from 0 to 32 inclusive. IPv6 format subnet accepts maskbits from 0 to 128 inclusive.

MaskBits

Unique identifier for the network subnet to be created.

Identity

Provide a description of the network subnet to identify purpose of creating it.

Description

NetworkSiteID is the identifier for the network site which the current network subnet is associating to.

NetworkSiteID

Ensure

As an Admin, you can use the Windows PowerShell command, New-CsTenantTrustedIPAddress to define external subnets and assign them to the tenant. You can define an unlimited number of external subnets for a tenant.

Schema for microsoft.teams.tenanttrustedipaddress

Unique identifier for the IP address to be created.

Identity

Provide a description of the trusted IP address to identify purpose of creating it.

Description

This parameter determines the length of bits to mask to the subnet.

MaskBits

Present ensures the instance exists, absent ensures it is removed.

Ensure

Cmdlet to create a new telephone number manipulation rule.

Schema for microsoft.teams.translationrule

The Identifier of the rule. This parameter is required and later used to assign the rule to the Inbound or Outbound Trunk Normalization policy.

Identity

A friendly description of the normalization rule.

Description

A regular expression that caller or callee number must match in order for this rule to be applied.

Pattern

The regular expression pattern that will be applied to the number to convert it.

Translation

Ensure

Creates a new treatment for how calls to an unassigned number range should be routed. The call can be routed to a user, an application or to an announcement service where a custom message will be played to the caller.

Schema for microsoft.teams.unassignednumbertreatment

The Id of the treatment.

Identity

Free format description of this treatment.

Description

A regular expression that the called number must match in order for the treatment to take effect. It is best practice to start the regular expression with the hat character and end it with the dollar character. You can use various regular expression test sites on the Internet to validate the expression.

Pattern

The identity of the destination the call should be routed to. Depending on the TargetType it should either be the ObjectId of the user or application instance/resource account or the AudioFileId of the uploaded audio file.

Target

The type of target used for the treatment. Allowed values are User, ResourceAccount and Announcement.

TargetType

The priority of the treatment. Used to distinguish identical patterns. The lower the priority the higher preference. The priority needs to be unique.

TreatmentPriority

Ensure

This resource configures the Teams Update policies. For additional information, please refer to https://docs.microsoft.com/en-us/MicrosoftTeams/public-preview-doc-updates#set-the-update-policy

Schema for microsoft.teams.updatemanagementpolicy

Identity of the Teams Update Management Policy.

Identity

The description of the Teams Update Management Policy.

Description

Determines if managed updates should be allowed or not.

AllowManagedUpdates

Determines if preview builds should be allowed or not.

AllowPreview

Disabled Enabled Forced FollowOfficePreview

Determines the ring of public previews to subscribes to.

AllowPublicPreview

Determines the day of week to perform the updates. Value should be between 0 and 6.

UpdateDayOfWeek

Determines the time of day to perform the updates. Must be a valid HH:MM format string with leading 0. For instance 08:30.

UpdateTime

Determines the time of day to perform the updates. Accepts a DateTime as string. Only the time will be considered.

UpdateTimeOfDay

NewTeamsAsDefault UserChoice MicrosoftChoice AdminDisabled NewTeamsOnly

Determines whether or not users will use the new Teams client.

UseNewTeamsClient

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures the Teams Upgrade settings.

More information: https://docs.microsoft.com/en-us/MicrosoftTeams/migration-interop-guidance-for-teams-with-skype

Schema for microsoft.teams.upgradeconfiguration

Specifies the resource is a single instance, the value must be 'Yes'

IsSingleInstance

The DownloadTeams property allows admins to control whether the Skype for Business client should automatically download Teams in the background. This Boolean setting is only honored on Windows clients, and only for certain values of the user's TeamsUpgradePolicy. If NotifySfbUser=true or if Mode=TeamsOnly in TeamsUpgradePolicy, this setting is honored. Otherwise it is ignored.

DownloadTeams

The SfBMeetingJoinUx property allows admins to specify which app is used to join Skype for Business meetings, even after the user has been upgraded to Teams. Allowed values are: 'SkypeMeetingsApp' and 'NativeLimitedClient'. 'NativeLimitedClient' means the existing Skype for Business rich client will be used, but since the user is upgraded, only meeting functionality is available. Calling and Messaging are done via Teams. 'SkypeMeetingsApp' means use the web-downloadable app. This setting can be useful for organizations that have upgraded to Teams and no longer want to install Skype for Business on their users' computers.

SfBMeetingJoinUx

This resource configures the Teams Upgrade policies.

More information: https://docs.microsoft.com/en-us/microsoftteams/meetings-first#prepare-for-teams-meetings-in-meetings-first

Schema for microsoft.teams.upgradepolicy

Identity of the Teams Upgrade Policy.

Identity

List of users that will be granted the Upgrade Policy to.

Users

Specifies whether to move existing Skype for Business meetings organized by the user to Teams. This parameter can only be true if the mode of the specified policy instance is either TeamsOnly or SfBWithTeamsCollabAndMeetings, and if the policy instance is being granted to a specific user. It not possible to trigger meeting migration when granting TeamsUpgradePolicy to the entire tenant.

MigrateMeetingsToTeams

This resource is used to add new users to a team

Schema for microsoft.teams.user

Team NAme

TeamName

UPN of user to add to Team

User

User role in Team

Role

Present ensures the Team user exists, absent ensures it is removed

Ensure

This resource configures a Teams User's Calling Settings.

More information: https://learn.microsoft.com/en-us/microsoftteams/user-call-settings

Schema for microsoft.teams.usercallingsettings

The Identity of the user to set call forwarding, simultaneous ringing and call group settings for. Can be specified using the ObjectId or the SIP address.

Identity

The group notification override that will be set on the specified user. The supported values are Ring, Mute and Banner.

GroupNotificationOverride

The order in which to call members of the Call Group. The supported values are Simultaneous and InOrder.

CallGroupOrder

The members of the Call Group. You need to always specify the full set of members as the parameter value. What you set here will overwrite the current call group membership.

CallGroupTargets

This parameter controls whether forwarding for unasnwered calls is enabled or not.

IsUnansweredEnabled

The time the call will ring the user before it is forwarded to the unanswered target. The supported format is hh:mm:ss and the delay range needs to be between 10 and 60 seconds in 10 seconds increments, i.e. 00:00:10, 00:00:20, 00:00:30, 00:00:40, 00:00:50 and 00:01:00. The default value is 20 seconds.

UnansweredDelay

The unanswered target. Supported type of values are ObjectId, SIP address and phone number. For phone numbers we support the following types of formats: E.164 (+12065551234 or +1206555000;ext=1234) or non-E.164 like 1234.

UnansweredTarget

Group MyDelegates SingleTarget Voicemail

The unanswered target type. Supported values are Voicemail, SingleTarget, MyDelegates and Group.

UnansweredTargetType

This parameter controls whether forwarding is enabled or not.

IsForwardingEnabled

The type of forwarding to set. Supported values are Immediate and Simultaneous

ForwardingType

The forwarding target type. Supported values are Voicemail, SingleTarget, MyDelegates and Group. Voicemail is only supported for Immediate forwarding.

ForwardingTargetType

The forwarding target. Supported types of values are ObjectId's, SIP addresses and phone numbers. For phone numbers we support the following types of formats: E.164 (+12065551234 or +1206555000;ext=1234) or non-E.164 like 1234.

ForwardingTarget

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource is used to assign Teams policy to a specified user.

Schema for microsoft.teams.userpolicyassignment

User Principal Name of the user representing the policy assignments.

User

Name of the Calling Line Policy.

CallingLineIdentity

Name of the External Access Policy.

ExternalAccessPolicy

Name of the Online Voicemail Policy.

OnlineVoicemailPolicy

Name of the Online VOice Routing Policy.

OnlineVoiceRoutingPolicy

Name of the Teams App Permission Policy.

TeamsAppPermissionPolicy

Name of the Teams App Setup Policy.

TeamsAppSetupPolicy

Name of the Teams Audio Conferencing Policy.

TeamsAudioConferencingPolicy

Name of the Teams Call Hold Policy.

TeamsCallHoldPolicy

Name of the Teams Calling Policy.

TeamsCallingPolicy

Name of the Teams Call Park Policy.

TeamsCallParkPolicy

Name of the Teams Channel Policy.

TeamsChannelsPolicy

Name of the Teams Emergency Calling Policy.

TeamsEmergencyCallingPolicy

Name of the Teams Emergency Call Routing Policy.

TeamsEmergencyCallRoutingPolicy

Name of the Teams Enhanced Encryption Policy.

TeamsEnhancedEncryptionPolicy

Name of the Teams Events Policy.

TeamsEventsPolicy

Name of the Teams Meeting Broadcast Policy.

TeamsMeetingBroadcastPolicy

Name of the Teams Meeting Policy.

TeamsMeetingPolicy

Name of the Teams Messaging Policy.

TeamsMessagingPolicy

Name of the Teams Mobility Policy.

TeamsMobilityPolicy

Name of the Teams Update Management Policy.

TeamsUpdateManagementPolicy

Name of the Teams Upgrade Policy.

TeamsUpgradePolicy

Name of the Tenant Dial Plan Policy.

TenantDialPlan

This resource implements Teams VDI Policies.

Schema for microsoft.teams.vdipolicy

Unique identity of the VDI Policy.

Identity

Disables Audio and Video in Calls and Meeting.

DisableAudioVideoInCallsAndMeetings

Disables Calls and Meetings.

DisableCallsAndMeetings

Present ensures the instance exists, absent ensures it is removed.

Ensure

This resource configures a Teams Voice Route.

More information: https://docs.microsoft.com/en-us/microsoftteams/direct-routing-voice-routing

Schema for microsoft.teams.voiceroute

Identity of the Teams Voice Route.

Identity

A description of what this online voice route is for.

Description

A regular expression that specifies the phone numbers to which this route applies. Numbers matching this pattern will be routed according to the rest of the routing settings.

NumberPattern

This parameter contains a list of online gateways associated with this online voice route.  Each member of this list must be the service Identity of the online PSTN gateway.

OnlinePstnGatewayList

A list of online PSTN usages (such as Local, Long Distance, etc.) that can be applied to this online voice route. The PSTN usage must be an existing usage (PSTN usages can be retrieved by calling the Get-CsOnlinePstnUsage cmdlet).

OnlinePstnUsages

A number could resolve to multiple online voice routes. The priority determines the order in which the routes will be applied if more than one route is possible.

Priority

Present ensures the route exists, absent ensures it is removed.

Ensure

This resource configures a Teams Voice Routing Policy.

More information: https://docs.microsoft.com/en-us/microsoftteams/manage-voice-routing-policies

Schema for microsoft.teams.voiceroutingpolicy

Identity of the Teams Voice Routing Policy.

Identity

A list of online PSTN usages (such as Local or Long Distance) that can be applied to this online voice routing policy. The online PSTN usage must be an existing usage (PSTN usages can be retrieved by calling the Get-CsOnlinePstnUsage cmdlet).

OnlinePstnUsages

Enables administrators to provide explanatory text to accompany an online voice routing policy. For example, the Description might include information about the users the policy should be assigned to.

Description

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resources implements a Teams workload policy.

Schema for microsoft.teams.workloadpolicy

Unique identity for the Teams workload policy

Identity

Allows calling.

AllowCalling

Allows pinning a call.

AllowCallingPinned

Allows meetins.

AllowMeeting

Allows pinning meetings.

AllowMeetingPinned

Allows messaging.

AllowMessaging

Allows pinning a message.

AllowMessagingPinned

Description of the policy.

Description

Ensure

This resource configures or creates a new Team.

Schema for microsoft.teams.team

Display Name of the Team

DisplayName

Description of Team.

Description

Team group ID, only used to target a Team when duplicated display names occurs.

GroupID

MailNickName of O365 Group associated with Team

MailNickName

Owners of the Team

Owner

Visibility of the Team

Visibility

Allow add or remove apps from the Team.

AllowAddRemoveApps

Allow giphy in Team.

AllowGiphy

Giphy content rating of the Team.

GiphyContentRating

Allow stickers and mimes in the Team.

AllowStickersAndMemes

Allow custom memes in Team.

AllowCustomMemes

Allow members to edit messages within Team.

AllowUserEditMessages

Allow members to delete messages within Team.

AllowUserDeleteMessages

Allow owners to delete messages within Team.

AllowOwnerDeleteMessages

Allow members to delete channels within Team.

AllowDeleteChannels

Allow members to manage connectors within Team.

AllowCreateUpdateRemoveConnectors

Allow members to manage tabs within Team.

AllowCreateUpdateRemoveTabs

Allow mentions in Team.

AllowTeamMentions

Allow channel mention in Team.

AllowChannelMentions

Allow guests to create and update channels in Team.

AllowGuestCreateUpdateChannels

Allow guests to delete channel in Team.

AllowGuestDeleteChannels

Allow members to create and update channels within Team.

AllowCreateUpdateChannels

determines whether or not private teams should be searchable from Teams clients for users who do not belong to that team.  Set to $false to make those teams not discoverable from Teams clients.

ShowInTeamsSearchAndSuggestions

Present ensures the Team exists, absent ensures it is removed.

Ensure

This resource configures an Intune Account Protection Local Administrator Password Solution Policy.

Schema for microsoft.intune.accountprotectionlocaladministratorpasswordsolutionpolicy

Identity of the account protection local administrator password solution policy.

Identity

Display name of the account protection local administrator password solution policy.

DisplayName

Description of the account protection local administrator password solution policy.

Description

Schema for MSFT_IntuneAccountProtectionLocalAdministratorPasswordSolutionPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the account protection local administrator password solution policy.

Assignments

Configures which directory the local admin account password is backed up to. 0 - Disabled, 1 - Azure AD, 2 - AD

BackupDirectory

Configures the maximum password age of the managed local administrator account for Azure AD. Minimum - 7, Maximum - 365

PasswordAgeDays_AAD

Configures the maximum password age of the managed local administrator account for Active Directory. Minimum - 1, Maximum - 365

PasswordAgeDays

Configures additional enforcement of maximum password age for the managed local administrator account.

PasswordExpirationProtectionEnabled

Configures how many previous encrypted passwords will be remembered in Active Directory. Minimum - 0, Maximum - 12

AdEncryptedPasswordHistorySize

Configures whether the password is encrypted before being stored in Active Directory.

AdPasswordEncryptionEnabled

Configures the name or SID of a user or group that can decrypt the password stored in Active Directory.

AdPasswordEncryptionPrincipal

Configures the name of the managed local administrator account.

AdministratorAccountName

Configures the password complexity of the managed local administrator account. 1 - Large letters, 2 - Large + small letters, 3 - Large + small letters + numbers, 4 - Large + small letters + numbers + special characters, 5 - Large letters + small letters + numbers + special characters (improved readability)

PasswordComplexity

Configures the length of the password of the managed local administrator account. Minimum - 8, Maximum - 64

PasswordLength

Specifies the actions to take upon expiration of the configured grace period. 1 - Reset password, 3 - Reset password and log off, 5 - Reset password and restart

PostAuthenticationActions

Specifies the amount of time (in hours) to wait after an authentication before executing the specified post-authentication actions. Minimum - 0, Maximum - 24

PostAuthenticationResetDelay

Present ensures the policy exists, absent ensures it is removed

Ensure

This resource configures a Intune Account Protection Local User Group Membership policy.

Schema for microsoft.intune.accountprotectionlocalusergroupmembershippolicy

Identity of the account protection policy.

Identity

Display name of the account protection rules policy.

DisplayName

Description of the account protection rules policy.

Description

Schema for MSFT_IntuneAccountProtectionLocalUserGroupMembershipPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the Intune Policy.

Assignments

Schema for MSFT_IntuneAccountProtectionLocalUserGroupCollection

The action to use for adding / removing members.

Action

The local groups to add / remove the members to / from. List of the following values: `administrators`, `users`, `guests`, `powerusers`, `remotedesktopusers`, `remotemanagementusers`

LocalGroups

The members to add / remove to / from the group. For AzureAD Users, use the format `AzureAD\\<UserPrincipalName>`. For groups, use the security identifier (SID).

Members

The type of the selection. Either users / groups from AzureAD, or by manual identifier.

UserSelectionType

Local User Group Collections of the Intune Policy.

LocalUserGroupCollection

Present ensures the site collection exists, absent ensures it is removed

Ensure

This resource configures a Intune Account Protection policy.

Schema for microsoft.intune.accountprotectionpolicy

Identity

DisplayName

Description

Schema for MSFT_IntuneAccountProtectionPolicyAssignments

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments of the Intune Policy.

Assignments

Block Windows Hello for Business.

WindowsHelloForBusinessBlocked

Minimum PIN length must be between 4 and 127. (4-127)

PinMinimumLength

Maximum PIN length must be between 4 and 127. (4-127)

PinMaximumLength

If required, user PIN must include at least one lowercase letter.

PinLowercaseCharactersUsage

If required, user PIN must include at least one uppercase letter.

PinUppercaseCharactersUsage

If required, user PIN must include at least one special character.

PinSpecialCharactersUsage

If configured, the user will be forced to change their PIN after the set number of days. (0, 730), 0 = Never

PinExpirationInDays

If configured, the user will not be able to reuse this number of previous PINs. (0, 50), 0 = Do not remember.

PinPreviousBlockCount

If enabled, the PIN recovery secret will be stored on the device and the user can change their PIN if needed. If disabled or not configured, the recovery secret will not be created or stored.

PinRecoveryEnabled

If you enable this policy setting, only devices with a usable TPM provision Windows Hello for Business. If you disable or do not configure this policy setting, the TPM is still preferred, but all devices provision Windows Hello for Business.

SecurityDeviceRequired

If allowed, Windows Hello for Business can authenticate using gestures, such as face and fingerprint. Users must still configure a PIN in case of failure.

UnlockWithBiometricsEnabled

If enabled, devices will use enhanced anti-spoofing, when available. If not configured, the client configuration for anti-spoofing will be honored.

EnhancedAntiSpoofingForFacialFeaturesEnabled

If configured, Windows Hello for Business can use certificates to authenticate to on-premise resources.

UseCertificatesForOnPremisesAuthEnabled

Enable Windows Hello security key as a logon credential for all PCs in the tenant.

UseSecurityKeyForSignin

notConfigured disable enableWithUEFILock enableWithoutUEFILock

Setting this Disable will disable the use of Credential Guard, which is the Windows default. Setting this to Enable with UEFI lock will enable Credential Guard and not allow it to be disabled remotely, as the UEFI persisted configuration must be manually cleared. Setting this to Enable without UEFI lock will enable Credential Guard and allow it to be turned off without physical access to the machine.

DeviceGuardLocalSystemAuthorityCredentialGuardSettings

Ensure

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for microsoft.intune.antiviruspolicywindows10settingcatalog

Display name of the endpoint protection policy for Windows 10.

DisplayName

Identity of the endpoint protection policy for Windows 10.

Identity

Description of the endpoint protection policy for Windows 10.

Description

Allows or disallows scanning of archives. (0: enable feature. 1: disable feature)

tamperprotection

Use this policy setting to specify if to display the Account protection area in Windows Defender Security Center. (0: disable feature. 1: enable feature)

disableaccountprotectionui

Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. (0: disable feature. 1: enable feature)

disableappbrowserui

Disable the Clear TPM button in Windows Security. (0: disable feature. 1: enable feature)

disablecleartpmbutton

Use this policy setting if you want to disable the display of the Device security area in the Windows Defender Security Center. (0: disable feature. 1: enable feature)

disabledevicesecurityui

Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. (0: disable feature. 1: enable feature)

disablefamilyui

Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. (0: disable feature. 1: enable feature)

disablehealthui

Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. (0: disable feature. 1: enable feature)

disablenetworkui

Use this policy setting if you want to disable the display of Windows Defender Security Center notifications. (0: disable feature. 1: enable feature)

disableenhancednotifications

Hide the recommendation to update TPM Firmware when a vulnerable firmware is detected. (0: disable feature. 1: enable feature)

disabletpmfirmwareupdatewarning

Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center.  (0: disable feature. 1: enable feature)

disablevirusui

Use this policy setting to hide the Ransomware data recovery area in Windows Defender Security Center. (0: disable feature. 1: enable feature)

hideransomwaredatarecovery

This policy setting hides the Windows Security notification area control. (0: disable feature. 1: enable feature)

hidewindowssecuritynotificationareacontrol

Enable this policy to display your company name and contact options in the notifications. (0: disable feature. 1: enable feature)

enablecustomizedtoasts

Enable this policy to have your company name and contact options displayed in a contact card fly out in Windows Defender Security Center. (0: disable feature. 1: enable feature)

enableinappcustomization

The company name that is displayed to the users. CompanyName is required for both EnableCustomizedToasts and EnableInAppCustomization.

companyname

The email address that is displayed to users. The default mail application is used to initiate email actions.

email

The phone number or Skype ID that is displayed to users. Skype is used to initiate the call.

phone

The help portal URL that is displayed to users. The default browser is used to initiate this action.

url

Allows or disallows scanning of archives. (0: disable feature. 1: enable feature)

allowarchivescanning

Allows or disallows Windows Defender Behavior Monitoring functionality. (0: disable feature. 1: enable feature)

allowbehaviormonitoring

To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. (0: disable feature. 1: enable feature)

allowcloudprotection

Allows or disallows Network Protection to enable datagram processing on Windows Server. (0: disable feature. 1: enable feature)

allowdatagramprocessingonwinserver

Allows or disallows scanning of email. (0: disable feature. 1: enable feature)

allowemailscanning

Allows or disallows a full scan of mapped network drives. (0: disable feature. 1: enable feature)

allowfullscanonmappednetworkdrives

Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned. (0: disable feature. 1: enable feature)

allowfullscanremovabledrivescanning

https://github.com/MicrosoftDocs/memdocs/issues/2250 (0: disable feature. 1: enable feature)

allowintrusionpreventionsystem

Allows or disallows Windows Defender IOAVP Protection functionality. (0: disable feature. 1: enable feature)

allowioavprotection

Allows or disallows Network Protection to be configured into block or audit mode on windows downlevel of RS3. (0: disable feature. 1: enable feature)

allownetworkprotectiondownlevel

Allows or disallows Windows Defender real-time Monitoring functionality. (0: disable feature. 1: enable feature)

allowrealtimemonitoring

Allows or disallows a scanning of network files. (0: disable feature. 1: enable feature)

allowscanningnetworkfiles

Allows or disallows Windows Defender Script Scanning functionality. (0: disable feature. 1: enable feature)

allowscriptscanning

Allows or disallows user access to the Windows Defender UI. I disallowed, all Windows Defender notifications will also be suppressed. (0: Prevents users from accessing UI. 1: Lets users access UI)

allowuseruiaccess

Represents the average CPU load factor for the Windows Defender scan (in percent).

avgcpuloadfactor

Specify the maximum folder depth to extract from archive files for scanning.

archivemaxdepth

Specify the maximum size, in KB, of archive files to be extracted and scanned.

archivemaxsize

This policy setting allows you to manage whether a check for new virus and spyware definitions will occur before running a scan. (0: disable feature. 1: enable feature)

checkforsignaturesbeforerunningscan

This policy setting determines how aggressive Microsoft Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer.(0: Default windows defender blocking level, 2: High blocking level, 4:High+ blocking level, 6:Zero tolerance blocking level)

cloudblocklevel

This feature allows Microsoft Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50.

cloudextendedtimeout

Time period (in days) that quarantine items will be stored on the system.

daystoretaincleanedmalware

This policy setting allows you to configure catch-up scans for scheduled full scans.  (1: disabled, 0: enabled)

disablecatchupfullscan

This policy setting allows you to configure catch-up scans for scheduled quick scans.  (1: disabled, 0: enabled)

disablecatchupquickscan

Disables or enables DNS over TCP Parsing for Network Protection. (0: enable feature. 1: disable feature)

disablednsovertcpparsing

Disables or enables HTTP Parsing for Network Protection. (0: enable feature. 1: disable feature)

disablehttpparsing

Disable Ssh Parsing (1: SSH parsing is disabled, 0: SSH parsing is enabled)

DisableSshParsing

This policy setting allows you to enable or disable low CPU priority for scheduled scans. (0: disable feature. 1: enable feature)

enablelowcpupriority

This policy allows you to turn on network protection (block/audit) or off. (0: disabled, 1: block mode, 2: audit mode)

enablenetworkprotection

Allows an administrator to specify a list of file type extensions to ignore during a scan.

excludedextensions

Allows an administrator to specify a list of directory paths to ignore during a scan.

excludedpaths

Allows an administrator to specify a list of files opened by processes to ignore during a scan.

excludedprocesses

Specifies the level of detection for potentially unwanted applications (PUAs). (0: disabled, 1: block mode, 2: audit mode)

puaprotection

Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. (0: Not configured, 2: Beta Channel, 3: Current Channel (Preview), 4: Current Channel (Staged), 5: Current Channel (Broad), 6: Critical)

engineupdateschannel

Allow managed devices to update through metered connections. (0: disabled, 1: enabled)

meteredconnectionupdates

Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout. (0: Not configured, 2: Beta Channel, 3: Current Channel (Preview), 4: Current Channel (Staged), 5: Current Channel (Broad), 6: Critical)

platformupdateschannel

Enable this policy to specify when devices receive Microsoft Defender security intelligence updates during the daily gradual rollout. (0: Not configured, 4: Current Channel (Staged), 5: Current Channel (Broad))

securityintelligenceupdateschannel

Controls which sets of files should be monitored. (0: Monitor all files (bi-directional), 1: Monitor incoming files, 2: Monitor outgoing files)

realtimescandirection

Selects whether to perform a quick scan or full scan. (1: Quick scan, 2: Full scan)

scanparameter

Selects the time of day that the Windows Defender quick scan should run.

schedulequickscantime

Selects the day that the Windows Defender scan should run. (0: Every day, 1: Sunday, 2: Monday, 3: Tuesday, 4: Wednesday, 5: Thursday, 6: Friday, 7: Saturday, 8: No scheduled scan)

schedulescanday

Selects the time of day that the Windows Defender scan should run. Must be between 0 and 1380 minutes.

schedulescantime

This setting disables TLS Parsing for Network Protection. (0: enabled, 1: disabled)

disabletlsparsing

Specifies if the start time of the scan is randomized. (0: no randomization, 1: randomized)

randomizescheduletasktimes

This setting allows you to configure the scheduler randomization in hours. The randomization interval is [1 - 23] hours.

schedulerrandomizationtime

This policy setting allows you to define the order in which different definition update sources should be contacted.

signatureupdatefallbackorder

This policy setting allows you to configure UNC file share sources for downloading definition updates.

signatureupdatefilesharessources

Specifies the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. Must be between 0 and 24 hours.

signatureupdateinterval

Checks for the user consent level in Windows Defender to send data. (0: Always prompt, 1: Send safe samples automatically, 2: Never send, 3: Send all samples automatically)

submitsamplesconsent

This policy setting controls whether or not complex list settings configured by a local administrator are merged with managed settings. (0: enable local admin merge, 1: disable local admin merge)

disablelocaladminmerge

Allows or disallows Windows Defender On Access Protection functionality. (0: disable feature. 1: enable feature)

allowonaccessprotection

clean quarantine remove allow userdefined block

Allows an administrator to specify low severity threats corresponding action ID to take.

lowseveritythreats

Allows an administrator to specify moderate severity threats corresponding action ID to take.

moderateseveritythreats

Allows an administrator to specify high severity threats corresponding action ID to take.

severethreats

Allows an administrator to specify severe threats corresponding action ID to take.

highseveritythreats

Template Id of the policy. 0: Windows Security Experience, 1: Defender Update controls, 2: Microsoft Defender Antivirus exclusions, 3: Microsoft Defender Antivirus

templateId

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed

Ensure

This resource configures the Intune App configuration policies.

Schema for microsoft.intune.appconfigurationpolicy

Key of the entity. Read-Only.

Id

Display name of the app configuration policy.

DisplayName

Description of the app configuration policy.

Description

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments of the Intune Policy.

Assignments

Schema for MSFT_IntuneAppConfigurationPolicyCustomSetting

Name of the custom setting.

name

Value of the custom setting.

value

Custom settings for the app configuration policy.

CustomSettings

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures a Intune Endpoint Protection Application Control policy for an Windows 10 Device.

Schema for microsoft.intune.applicationcontrolpolicywindows10

Display name of the endpoint protection application control policy for Windows 10.

DisplayName

Description of the endpoint protection application control policy for Windows 10.

Description

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments of the Intune Policy.

Assignments

App locker application control mode

AppLockerApplicationControl

Indicates whether or not SmartScreen will not present an option for the user to disregard the warning and run the app.

SmartScreenBlockOverrideForFiles

Enforce the use of SmartScreen for all users.

SmartScreenEnableInshell

Present ensures the site collection exists, absent ensures it is removed

Ensure

This resource configures an Intune app protection policy for an Android Device.

Schema for microsoft.intune.appprotectionpolicyandroid

Display name of the Android App Protection Policy.

DisplayName

Description of the Android App Protection Policy.

Description

The period after which access is checked when the device is not connected to the internet.

PeriodOfflineBeforeAccessCheck

The period after which access is checked when the device is connected to the internet.

PeriodOnlineBeforeAccessCheck

Sources from which data is allowed to be transferred. Possible values are: allApps, managedApps, none.

AllowedInboundDataTransferSources

Destinations to which data is allowed to be transferred. Possible values are: allApps, managedApps, none.

AllowedOutboundDataTransferDestinations

Indicates whether organizational credentials are required for app use.

OrganizationalCredentialsRequired

allApps managedAppsWithPasteIn managedApps blocked

The level to which the clipboard may be shared between apps on the managed device. Possible values are: allApps, managedAppsWithPasteIn, managedApps, blocked.

AllowedOutboundClipboardSharingLevel

Indicates whether the backup of a managed app's data is blocked.

DataBackupBlocked

Indicates whether device compliance is required.

DeviceComplianceRequired

Indicates whether internet links should be opened in the managed browser app, or any custom browser specified by CustomBrowserProtocol (for Android) or CustomBrowserPackageId/CustomBrowserDisplayName (for Android).

ManagedBrowserToOpenLinksRequired

Indicates whether users may use the Save As menu item to save a copy of protected files.

SaveAsBlocked

The amount of time an app is allowed to remain disconnected from the internet before all managed data it is wiped.

PeriodOfflineBeforeWipeIsEnforced

Indicates whether an app-level pin is required.

PinRequired

Indicates whether use of the app pin is required if the device pin is set.

DisableAppPinIfDevicePinIsSet

Maximum number of incorrect pin retry attempts before the managed app is either blocked or wiped.

MaximumPinRetries

Block simple PIN and require complex PIN to be set.

SimplePinBlocked

Minimum pin length required for an app-level pin if PinRequired is set to True.

MinimumPinLength

Character set which may be used for an app-level pin if PinRequired is set to True. Possible values are: numeric, alphanumericAndSymbol.

PinCharacterSet

Data storage locations where a user may store managed data.

AllowedDataStorageLocations

Indicates whether contacts can be synced to the user's device.

ContactSyncBlocked

TimePeriod before the all-level pin must be reset if PinRequired is set to True.

PeriodBeforePinReset

Indicates whether printing is allowed from managed apps.

PrintBlocked

Require user to apply Class 3 Biometrics on their Android device.

A PIN prompt will override biometric prompts if class 3 biometrics are updated on the device.

RequirePinAfterBiometricChange

Indicates whether use of the fingerprint reader is allowed in place of a pin if PinRequired is set to True.

FingerprintBlocked

List of IDs representing the Android apps controlled by this protection policy.

Apps

List of IDs of the groups assigned to this Android Protection Policy.

Assignments

List of IDs of the groups that are excluded from this Android Protection Policy.

ExcludedGroups

Present ensures the policy exists, absent ensures it is removed.

Ensure

Indicates in which managed browser(s) that internet links should be opened. Used in conjunction with CustomBrowserPackageId, CustomBrowserDisplayName and ManagedBrowserToOpenLinksRequired. Possible values are: notConfigured, microsoftEdge.

ManagedBrowser

Versions less than the specified version will block the managed app from accessing company data.

MinimumRequiredAppVersion

MinimumRequiredOSVersion

MinimumRequiredPatchVersion

Versions less than the specified version will result in warning message on the managed app

MinimumWarningAppVersion

MinimumWarningOSVersion

MinimumWarningPatchVersion

allApps allMicrosoftApps allCoreMicrosoftApps selectedPublicApps

The apps controlled by this protection policy, overrides any values in Apps unless this value is 'selectedPublicApps'.

AppGroupType

Indicates if the policy is deployed to any inclusion groups or not. Inherited from targetedManagedAppProtection.

IsAssigned

Indicates whether or not to Block the user from taking Screenshots.

ScreenCaptureBlocked

Indicates whether or not the 'Encrypt org data' value is enabled.  True = require

EncryptAppData

Indicates whether or not the 'Encrypt org data on enrolled devices' value is enabled.  False = require.  Only functions if EncryptAppData is set to True

DisableAppEncryptionIfDeviceEncryptionIsEnabled

The application name for browser associated with the 'Unmanaged Browser ID'. This name will be displayed to users if the specified browser is not installed.

CustomBrowserDisplayName

The application ID for a single browser. Web content (http/s) from policy managed applications will open in the specified browser.

CustomBrowserPackageId

Id of the Intune policy. To avoid creation of duplicate policies DisplayName will be searched for if the ID is not found

Id

This resource configures an Intune app protection policy for an iOS Device.

Schema for microsoft.intune.appprotectionpolicyios

Display name of the iOS App Protection Policy.

DisplayName

Identity of the iOS App Protection Policy.

Identity

Description of the iOS App Protection Policy.

Description

The period after which access is checked when the device is not connected to the internet.

PeriodOfflineBeforeAccessCheck

The period after which access is checked when the device is connected to the internet.

PeriodOnlineBeforeAccessCheck

Sources from which data is allowed to be transferred. Possible values are: allApps, managedApps, none.

AllowedInboundDataTransferSources

Destinations to which data is allowed to be transferred. Possible values are: allApps, managedApps, none.

AllowedOutboundDataTransferDestinations

Indicates whether organizational credentials are required for app use.

OrganizationalCredentialsRequired

The level to which the clipboard may be shared between apps on the managed device. Possible values are: allApps, managedAppsWithPasteIn, managedApps, blocked.

AllowedOutboundClipboardSharingLevel

Indicates whether the backup of a managed app's data is blocked.

DataBackupBlocked

Indicates whether device compliance is required.

DeviceComplianceRequired

Indicates whether internet links should be opened in the managed browser app, or any custom browser specified by CustomBrowserProtocol (for iOS) or CustomBrowserPackageId/CustomBrowserDisplayName (for Android).

ManagedBrowserToOpenLinksRequired

Indicates whether users may use the Save As menu item to save a copy of protected files.

SaveAsBlocked

The amount of time an app is allowed to remain disconnected from the internet before all managed data it is wiped.

PeriodOfflineBeforeWipeIsEnforced

Indicates whether an app-level pin is required.

PinRequired

Indicates whether use of the app pin is required if the device pin is set.

DisableAppPinIfDevicePinIsSet

Maximum number of incorrect pin retry attempts before the managed app is either blocked or wiped.

MaximumPinRetries

Block simple PIN and require complex PIN to be set.

SimplePinBlocked

Minimum pin length required for an app-level pin if PinRequired is set to True.

MinimumPinLength

Character set which may be used for an app-level pin if PinRequired is set to True. Possible values are: numeric, alphanumericAndSymbol.

PinCharacterSet

Data storage locations where a user may store managed data.

AllowedDataStorageLocations

Indicates whether contacts can be synced to the user's device.

ContactSyncBlocked

TimePeriod before the all-level pin must be reset if PinRequired is set to True.

PeriodBeforePinReset

Indicates whether printing is allowed from managed apps.

PrintBlocked

Indicates whether use of the fingerprint reader is allowed in place of a pin if PinRequired is set to True.

FingerprintBlocked

Indicates whether use of the FaceID is allowed in place of a pin if PinRequired is set to True.

FaceIdBlocked

Indicates in which managed browser(s) that internet links should be opened. When this property is configured, ManagedBrowserToOpenLinksRequired should be true. Possible values are: notConfigured, microsoftEdge.

ManagedBrowser

Versions less than the specified version will block the managed app from accessing company data.

MinimumRequiredAppVersion

Versions less than the specified version will result in warning message on the managed app from accessing company data.

MinimumWarningAppVersion

MinimumRequiredOSVersion

MinimumWarningOSVersion

MinimumRequiredSdkVersion

Versions less than or equal to the specified version will wipe the managed app and the associated company data.

MinimumWipeOSVersion

MinimumWipeAppVersion

Defines a managed app behavior, either block or wipe, when the device is either rooted or jailbroken, if DeviceComplianceRequired is set to true.

AppActionIfDeviceComplianceRequired

Defines a managed app behavior, either block or wipe, based on maximum number of incorrect pin retry attempts.

AppActionIfMaximumPinRetriesExceeded

Timeout in minutes for an app pin instead of non biometrics passcode .

PinRequiredInsteadOfBiometricTimeout

Specify the number of characters that may be cut or copied from Org data and accounts to any application. This setting overrides the AllowedOutboundClipboardSharingLevel restriction. Default value of '0' means no exception is allowed.

AllowedOutboundClipboardSharingExceptionLength

Specify app notification restriction.

NotificationRestriction

unspecified unmanaged mdm androidEnterprise

The intended app management levels for this policy.

TargetedAppManagementLevels

useDeviceSettings afterDeviceRestart whenDeviceLockedExceptOpenFiles whenDeviceLocked

Require app data to be encrypted.

AppDataEncryptionType

Apps in this list will be exempt from the policy and will be able to receive data from managed apps.

ExemptedAppProtocols

MinimumWipeSdkVersion

Semicolon separated list of device models allowed, as a string, for the managed app to work.

AllowedIosDeviceModels

Defines a managed app behavior, either block or wipe, if the specified device model is not allowed.

AppActionIfIosDeviceModelNotAllowed

Defines if open-in operation is supported from the managed app to the filesharing locations selected. This setting only applies when AllowedOutboundDataTransferDestinations is set to ManagedApps and DisableProtectionOfManagedOutboundOpenInData is set to False.

FilterOpenInToOnlyManagedApps

Disable protection of data transferred to other apps through IOS 'OpenIn' option. This setting is only allowed to be True when AllowedOutboundDataTransferDestinations is set to ManagedApps.

DisableProtectionOfManagedOutboundOpenInData

Protect incoming data from unknown source. This setting is only allowed to be True when AllowedInboundDataTransferSources is set to AllApps.

ProtectInboundDataFromUnknownSources

A custom browser protocol to open weblink on iOS.

CustomBrowserProtocol

List of IDs representing the iOS apps controlled by this protection policy.

Apps

List of IDs of the groups assigned to this iOS Protection Policy.

Assignments

List of IDs of the groups that are excluded from this iOS Protection Policy.

ExcludedGroups

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures a Intune Endpoint Protection Attack Surface Reduction rules policy for a Windows 10 Device.
This resource returns ASR rules created using deviceConfiguration Graph settings.

Schema for microsoft.intune.asrrulespolicywindows10

Identity of the endpoint protection attack surface protection rules policy for Windows 10.

Identity

Display name of the endpoint protection attack surface protection rules policy for Windows 10.

DisplayName

Description of the endpoint protection attack surface protection rules policy for Windows 10.

Description

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the Intune Policy.

Assignments

notConfigured userDefined block auditMode warn disable

This rule blocks processes created through PsExec and WMI from running.

ProcessCreationType

notConfigured userDefined enable auditMode

This rule provides an extra layer of protection against ransomware.

AdvancedRansomewareProtectionType

This rule prevents malware from abusing WMI to attain persistence on a device.

BlockPersistenceThroughWmiType

This rule detects suspicious properties within an obfuscated script.

ScriptObfuscatedMacroCodeType

This rule prevents VBA macros from calling Win32 APIs.

This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access.

OfficeAppsLaunchChildProcessType

notConfigured userDefined enable auditMode blockDiskModification auditDiskModification

This rule enable Controlled folder access which protects your data by checking apps against a list of known, trusted apps.

GuardMyFoldersType

With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards.

UntrustedUSBProcessType

Exclude files and paths from attack surface reduction rules

AttackSurfaceReductionExcludedPaths

This rule blocks executable files that don't meet a prevalence, age, or trusted list criteria, such as .exe, .dll, or .scr, from launching.

UntrustedExecutableType

notConfigured userDefined enable auditMode warn disable

This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.

OfficeCommunicationAppsLaunchChildProcess

This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers.

EmailContentExecutionType

This rule prevents scripts from launching potentially malicious downloaded content.

ScriptDownloadedPayloadExecutionType

List of additional folders that need to be protected

AdditionalGuardedFolders

notConfigured userDefined enable auditMode warn

This rule prevents attacks by blocking Adobe Reader from creating processes.

AdobeReaderLaunchChildProcess

This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.

OfficeAppsExecutableContentCreationOrLaunchType

This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS).

PreventCredentialStealingType

This rule blocks code injection attempts from Office apps into other processes.

OfficeAppsOtherProcessInjectionType

List of apps that have access to protected folders.

GuardedFoldersAllowedAppPaths

Present ensures the site collection exists, absent ensures it is removed

Ensure

This resource configures an Intune Endpoint Protection Attack Surface Reduction Rules policy for a Windows 10 Device for Configuration Manager.
This policy setting enables setting the state (Block/Audit/Off/Warn) for each attack surface reduction (ASR) rule. Each ASR rule listed can be set to one of the following states (Block/Audit/Off/Warn). The ASR rule ID and state should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid ASR rule ID, while the value contains the status ID indicating the status of the rule.

For more information about ASR rule ID and status ID, see Enable Attack Surface Reduction: https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.

Schema for microsoft.intune.attacksurfacereductionrulespolicywindows10configmanager

Identity of the endpoint protection attack surface protection rules policy for Windows 10.

Identity

Display name of the endpoint protection attack surface protection rules policy for Windows 10.

DisplayName

Description of the endpoint protection attack surface protection rules policy for Windows 10.

Description

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the endpoint protection attack surface protection rules policy for Windows 10.

Assignments

Exclude files and paths from attack surface reduction rules

AttackSurfaceReductionOnlyExclusions

This rule prevents an application from writing a vulnerable signed driver to disk.

BlockAbuseOfExploitedVulnerableSignedDrivers

This rule prevents attacks by blocking Adobe Reader from creating processes.

BlockAdobeReaderFromCreatingChildProcesses

This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access.

BlockAllOfficeApplicationsFromCreatingChildProcesses

This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS).

BlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem

This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers.

BlockExecutableContentFromEmailClientAndWebmail

This rule blocks executable files that don't meet a prevalence, age, or trusted list criteria, such as .exe, .dll, or .scr, from launching.

BlockExecutableFilesRunningUnlessTheyMeetPrevalenceAgeTrustedListCriterion

This rule detects suspicious properties within an obfuscated script.

BlockExecutionOfPotentiallyObfuscatedScripts

This rule prevents scripts from launching potentially malicious downloaded content.

BlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent

This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.

BlockOfficeApplicationsFromCreatingExecutableContent

This rule blocks code injection attempts from Office apps into other processes.

BlockOfficeApplicationsFromInjectingCodeIntoOtherProcesses

This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.

BlockOfficeCommunicationAppFromCreatingChildProcesses

This rule prevents malware from abusing WMI to attain persistence on a device.

BlockPersistenceThroughWMIEventSubscription

This rule blocks processes created through PsExec and WMI from running.

BlockProcessCreationsFromPSExecAndWMICommands

With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards.

BlockUntrustedUnsignedProcessesThatRunFromUSB

This rule prevents VBA macros from calling Win32 APIs.

This rule provides an extra layer of protection against ransomware.

UseAdvancedProtectionAgainstRansomware

List of additional folders that need to be protected

ControlledFolderAccessProtectedFolders

List of apps that have access to protected folders.

ControlledFolderAccessAllowedApplications

This rule enable Controlled folder access which protects your data by checking apps against a list of known, trusted apps.values 0:disable, 1:enable, 2:audit, 3: Block disk modification only, 4: Audit disk modification only

EnableControlledFolderAccess

Present ensures the policy exists, absent ensures it is removed

Ensure

This resource represents the properties of the Intune Assignment Filter.
For more information: https://docs.microsoft.com/en-us/graph/api/resources/intune-policyset-deviceandappmanagementassignmentfilter?view=graph-rest-beta

Schema for microsoft.intune.deviceandappmanagementassignmentfilter

DisplayName of the Assignment Filter.

DisplayName

Key of the Assignment Filter.

Identity

Description of the Assignment Filter.

Description

Rule definition of the Assignment Filter.

Rule

Platform

Ensure

This resource configures the Intune device categories.

Schema for microsoft.intune.devicecategory

Display name of the device category.

DisplayName

Description of the device category.

Description

Present ensures the category exists, absent ensures it is removed.

Ensure

This resource configures the Intune device cleanup rule.

Schema for microsoft.intune.devicecleanuprule

Only valid value is 'Yes'.

IsSingleInstance

Indicates whether the cleanup rule is enabled.

Enabled

Number of days until Intune devices are deleted. Minimum: 30, Maximum: 270.

DeviceInactivityBeforeRetirementInDays

Ensure

This resource configures the settings of Android device compliance policies
in your cloud-based organization.

## Parameters

### Microsoft Defender for Endpoint

* **Require the device to be at or under the machine risk score**
  Select the maximum allowed machine risk score for devices evaluated by Microsoft Defender for Endpoint. Devices that exceed this score get marked as noncompliant.
    * Not configured (_default_)
    * Clear
    * Low
    * Medium
    * High

### Device Health

* **Devices managed with device administrator**
  Device administrator capabilities are superseded by Android Enterprise.
    * Not configured (_default_)
    * Block - Blocking device administrator will guide users to move to Android Enterprise Personally-Owned and Corporate-Owned Work Profile management to regain access.

### Rooted devices
* **Prevent rooted devices from having corporate access. (This compliance check is supported for Android 4.0 and above.)**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Block - Mark rooted (jailbroken) devices as not compliant.

* **Require the device to be at or under the Device Threat Level**
  Use this setting to take the risk assessment from a connected Mobile Threat Defense service as a condition for compliance.
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Secured - This option is the most secure, as the device can't have any threats. If the device is detected with any level of threats, it's evaluated as noncompliant.
    * Low - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a noncompliant status.
    * Medium - The device is evaluated as compliant if existing threats on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be noncompliant.
    * High - This option is the least secure, and allows all threat levels. It may be useful if you're using this solution only for reporting purposes.

### Google Play Protect
* **Google Play Services is configured**
  Google Play services allows security updates, and is a base-level dependency for many security features on certified-Google devices.
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Require - Require that the Google Play services app is installed and enabled.

* **Up-to-date security provider**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Require - Require that an up-to-date security provider can protect a device from known vulnerabilities.

* **Threat scan on apps**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Require - Require that the Android Verify Apps feature is enabled.

* **SafetyNet device attestation**
  Enter the level of SafetyNet attestation that must be met. Your options:
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Check basic integrity
    * Check basic integrity & certified devices

### Device Properties
* **Operating System Version**
    * Minimum OS version
  When a device doesn't meet the minimum OS version requirement, it's reported as noncompliant. A link with information about how to upgrade is shown. The end user can choose to upgrade their device, and then get access to company resources.

  _By default, no version is configured._

    * Maximum OS version
  When a device is using an OS version later than the version specified in the rule, access to company resources is blocked. The user is asked to contact their IT admin. Until a rule is changed to allow the OS version, this device can't access company resources.

  _By default, no version is configured._

### System Security
* **Encryption**
  Encryption of data storage on a device
  Supported on Android 4.0 and later, or KNOX 4.0 and later.
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Require - Encrypt data storage on your devices. Devices are encrypted when you choose the Require a password to unlock mobile devices setting.

* **Device Security**
  Block apps from unknown sources
  Supported on Android 4.0 to Android 7.x. Not supported by Android 8.0 and later
    * Not configured (_default_) - this setting isn't evaluated for compliance or non-compliance.
    * Block - Block devices with Security > Unknown Sources enabled sources (_supported on Android 4.0 through Android 7.x. Not supported on Android 8.0 and later._).

  To side-load apps, unknown sources must be allowed. If you're not side-loading Android apps, then set this feature to Block to enable this compliance policy.

* **Company portal app runtime integrity**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Require - Choose Require to confirm the Company Portal app meets all the following requirements:
        * Has the default runtime environment installed
        * Is properly signed
        * Isn't in debug-mode

* **Block USB debugging on device**
  _(Supported on Android 4.2 or later)_

    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Block - Prevent devices from using the USB debugging feature.

* **Minimum security patch level**
  _(Supported on Android 6.0 or later)_

  Select the oldest security patch level a device can have. Devices that aren't at least at this patch level are noncompliant. The date must be entered in the YYYY-MM-DD format.

  _By default, no date is configured._

* **Restricted apps**
  Enter the App name and App bundle ID for apps that should be restricted, and then select Add. A device with at least one restricted app installed is marked as non-compliant.

### Password

The available settings for passwords vary by the version of Android on the device.

#### All Android devices
The following settings are supported on Android 4.0 or later, and Knox 4.0 and later.

* **Maximum minutes of inactivity before password is required**
  This setting specifies the length of time without user input after which the mobile device screen is locked. Options range from 1 Minute to 8 Hours. The recommended value is 15 Minutes.
    * Not configured (_default_)

#### Android 10 and later
The following settings are supported on Android 10 or later, but not on Knox.

* **Password complexity**
  _This setting is supported on Android 10 or later, but not on Samsung Knox. On devices that run Android 9 and earlier or Samsung Knox, settings for the password length and type override this setting for complexity._

  Specify the required password complexity.
    * None (_default_) - No password required.
    * Low - The password satisfies one of the following conditions:
        * Pattern
        * Numeric PIN has a repeating (4444) or ordered (1234, 4321, 2468) sequence.
    * Medium - The password satisfies one of the following conditions:
        * Numeric PIN doesn’t have a repeating (4444) or ordered (1234, 4321, 2468) sequence, and has minimum length of 4.
        * Alphabetic, with a minimum length of 4.
        * Alphanumeric, with a minimum length of 4.
    * High - The password satisfies one of the following conditions:
        * Numeric PIN doesn’t have a repeating (4444) or ordered (1234, 4321, 2468) sequence, and has minimum length of 8.
        * Alphabetic, with a minimum length of 6.
        * Alphanumeric, with a minimum length of 6.

#### Android 9 and earlier or Samsung Knox
_The following settings are supported on Android 9.0 and earlier, and any version of Samsung Knox._

* **Require a password to unlock mobile devices**
  This setting specifies whether to require users to enter a password before access is granted to information on their mobile devices. Recommended value: Require
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Require - Users must enter a password before they can access their device.

When set to Require, the following setting can be configured:

* **Required password type**
  Choose if a password should include only numeric characters, or a mix of numerals and other characters.
    * Device Default - To evaluate password compliance, be sure to select a password strength other than Device default.
    * Low security biometric
    * At least numeric
    * Numeric complex - Repeated or consecutive numerals, such as 1111 or 1234, aren't allowed.
    * At least alphabetic
    * At least alphanumeric
    * At least alphanumeric with symbols

  Based on the configuration of this setting, one or more of the following options are available:
    * Minimum password length
    Enter the minimum number of digits or characters that the user's password must have.
    * Maximum minutes of inactivity before password is required
    Enter the idle time before the user must reenter their password. When you choose Not configured (_default_), this setting isn't evaluated for compliance or non-compliance.
    * Number of days until password expires
    Select the number of days before the password expires and the user must create a new password.
    * Number of previous passwords to prevent reuse
    Enter the number of recent passwords that can't be reused. Use this setting to restrict the user from creating previously used passwords.

Schema for microsoft.intune.devicecompliancepolicyandroid

Display name of the Android device compliance policy.

DisplayName

Description of the Android device compliance policy.

Description

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the Intune Policy.

Assignments

PasswordRequired of the Android device compliance policy.

PasswordRequired

PasswordMinimumLength of the Android device compliance policy.

PasswordMinimumLength

deviceDefault alphabetic alphanumeric alphanumericWithSymbols lowSecurityBiometric numeric numericComplex any

PasswordRequiredType of the Android device compliance policy.

PasswordRequiredType

RequiredPasswordComplexity of the Android device compliance policy.

RequiredPasswordComplexity

PasswordMinutesOfInactivityBeforeLock of the Android device compliance policy.

PasswordMinutesOfInactivityBeforeLock

PasswordExpirationDays of the Android device compliance policy.

PasswordExpirationDays

PasswordPreviousPasswordBlockCount of the Android device compliance policy.

PasswordPreviousPasswordBlockCount

PasswordSignInFailureCountBeforeFactoryReset of the Android device compliance policy.

PasswordSignInFailureCountBeforeFactoryReset

SecurityPreventInstallAppsFromUnknownSources of the Android device compliance policy.

SecurityPreventInstallAppsFromUnknownSources

SecurityDisableUsbDebugging of the Android device compliance policy.

SecurityDisableUsbDebugging

SecurityRequireVerifyApps of the Android device compliance policy.

SecurityRequireVerifyApps

DeviceThreatProtectionEnabled of the Android device compliance policy.

DeviceThreatProtectionEnabled

unavailable secured low medium high notSet

DeviceThreatProtectionRequiredSecurityLevel of the Android device compliance policy.

DeviceThreatProtectionRequiredSecurityLevel

AdvancedThreatProtectionRequiredSecurityLevel of the Android device compliance policy.

AdvancedThreatProtectionRequiredSecurityLevel

SecurityBlockJailbrokenDevices of the Android device compliance policy.

SecurityBlockJailbrokenDevices

SecurityBlockDeviceAdministratorManagedDevices of the Android device compliance policy.

SecurityBlockDeviceAdministratorManagedDevices

OsMinimumVersion of the Android device compliance policy.

OsMinimumVersion

OsMaximumVersion of the Android device compliance policy.

OsMaximumVersion

MinAndroidSecurityPatchLevel of the Android device compliance policy.

MinAndroidSecurityPatchLevel

StorageRequireEncryption of the Android device compliance policy.

StorageRequireEncryption

SecurityRequireSafetyNetAttestationBasicIntegrity of the Android device compliance policy.

SecurityRequireSafetyNetAttestationBasicIntegrity

SecurityRequireSafetyNetAttestationCertifiedDevice of the Android device compliance policy.

SecurityRequireSafetyNetAttestationCertifiedDevice

SecurityRequireGooglePlayServices of the Android device compliance policy.

SecurityRequireGooglePlayServices

SecurityRequireUpToDateSecurityProviders of the Android device compliance policy.

SecurityRequireUpToDateSecurityProviders

SecurityRequireCompanyPortalAppIntegrity of the Android device compliance policy.

SecurityRequireCompanyPortalAppIntegrity

ConditionStatementId of the Android device compliance policy.

ConditionStatementId

RestrictedApps of the Android device compliance policy.

RestrictedApps

RoleScopeTagIds of the Android device compliance policy.

RoleScopeTagIds

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures the settings of Android Work Profile device compliance policies
in your cloud-based organization.

## Parameters

### Microsoft Defender for Endpoint - _for Personally-Owned Work Profile_

* **Require the device to be at or under the machine risk score**
  Select the maximum allowed machine risk score for devices evaluated by Microsoft Defender for Endpoint. Devices which exceed this score get marked as noncompliant.
    * Not configured (_default_)
    * Clear
    * Low
    * Medium
    * High

### Device Health - _for Personally-Owned Work Profile_
* **Rooted devices**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Block - Mark rooted (jailbroken) devices as not compliant.

* **Require the device to be at or under the Device Threat Level**
Select the maximum allowed device threat level evaluated by your mobile threat defense service. Devices that exceed this threat level are marked noncompliant. To use this setting, choose the allowed threat level:
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Secured - This option is the most secure, and means that the device can't have any threats. If the device is detected with any level of threats, it's evaluated as noncompliant.
    * Low - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a noncompliant status.
    * Medium - The device is evaluated as compliant if the threats that are present on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be noncompliant.
    * High - This option is the least secure, as it allows all threat levels. It may be useful if you're using this solution only for reporting purposes.

### Google Play Protect - _for Personally-Owned Work Profile_

* **Google Play Services is configured**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Require - Require that the Google Play services app is installed and enabled. Google Play services allows security updates, and is a base-level dependency for many security features on certified-Google devices.

* **Up-to-date security provider**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Require - Require that an up-to-date security provider can protect a device from known vulnerabilities.

* **SafetyNet device attestation**
  Enter the level of SafetyNet attestation that must be met. Your options:
    * Not configured (_default_) - Setting isn't evaluated for compliance or non-compliance.
    * Check basic integrity
    * Check basic integrity & certified devices

Note:
* On Android Enterprise devices, Threat scan on apps is a device configuration policy. Using a configuration policy, administrators can enable the setting on a device. See Android Enterprise device restriction settings.

### Device Properties - _for Personally-Owned Work Profile_

* **Operating System Version - *for Personally-Owned Work Profile***
    * Minimum OS version
      When a device doesn't meet the minimum OS version requirement, it's reported as non-compliant. A link with information on how to upgrade is shown. The end user can upgrade their device, and then access organization resources.

  _By default, no version is configured._

* **Maximum OS version**
  When a device is using an OS version later than the version in the rule, access to organization resources is blocked. The user is asked to contact their IT administrator. Until a rule is changed to allow the OS version, this device can't access organization resources.

  _By default, no version is configured._

### System security - for _Personally-Owned Work Profile_

* **Require a password to unlock mobile devices**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Require - Users must enter a password before they can access their device.

  _This setting applies at the device level. If you only need to require a password at the Personally-Owned Work Profile level, then use a configuration policy. See Android Enterprise device configuration settings._

* **Required password type**
  Choose if a password should include only numeric characters, or a mix of numerals and other characters. Your options:
    * Device Default
    * Low security biometric
    * At least numeric (_default_): Enter the minimum password length a user must enter, between 4 and 16 characters.
    * Numeric complex: Enter the minimum password length a user must enter, between 4 and 16 characters.
    * At least alphabetic: Enter the minimum password length a user must enter, between 4 and 16 characters.
    * At least alphanumeric: Enter the minimum password length a user must enter, between 4 and 16 characters.
    * At least alphanumeric with symbols: Enter the minimum password length a user must enter, between 4 and 16 characters.

  Depending on the password type you select, the following settings are available:
    * Maximum minutes of inactivity before password is required
    Enter the idle time before the user must reenter their password. Options include the default of Not configured, and from 1 Minute to 8 hours.
    * Number of days until password expires
    Enter the number of days, between 1-365, until the device password must be changed. For example, to change the password after 60 days, enter 60. When the password expires, users are prompted to create a new password.
    * Minimum password length
    Enter the minimum length the password must have, between 4 and 16 characters.
    * Number of previous passwords to prevent reuse
    Enter the number of recent passwords that can't be reused. Use this setting to restrict the user from creating previously used passwords.

### Encryption - _for Personally-Owned Work Profile_
* **Encryption of data storage on device**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Require - Encrypt data storage on your devices.

  You don't have to configure this setting because Android Enterprise devices enforce encryption.

### Device Security - _for Personally-Owned Work Profile_

* **Block apps from unknown sources**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Block - Block devices with Security > Unknown Sources enabled sources (supported on Android 4.0 through Android 7.x. Not supported by Android 8.0 and later).

  _To side-load apps, unknown sources must be allowed. If you're not side-loading Android apps, then set this feature to Block to enable this compliance policy._

* **Company portal app runtime integrity**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Require - Choose Require to confirm the Company Portal app meets all the following requirements:
        * Has the default runtime environment installed
        * Is properly signed
        * Isn't in debug-mode
        * Is installed from a known source

* **Block USB debugging on device**
    * Not configured (_default_) - This setting isn't evaluated for compliance or non-compliance.
    * Block - Prevent devices from using the USB debugging feature.

_You don't have to configure this setting because USB debugging is already disabled on Android Enterprise devices._

* **Minimum security patch level**
Select the oldest security patch level a device can have. Devices that aren't at least at this patch level are noncompliant. The date must be entered in the YYYY-MM-DD format.

_By default, no date is configured._

Schema for microsoft.intune.devicecompliancepolicyandroiddeviceowner

Display name of the Android Device Owner device compliance policy.

DisplayName

Description of the Android Device Owner device compliance policy.

Description

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the Intune Policy.

Assignments

DeviceThreatProtectionEnabled of the Android Device Owner device compliance policy.

DeviceThreatProtectionEnabled

DeviceThreatProtectionRequiredSecurityLevel of the Android Device Owner device compliance policy.

AdvancedThreatProtectionRequiredSecurityLevel of the Android Device Owner device compliance policy.

SecurityRequireSafetyNetAttestationBasicIntegrity of the Android Device Owner device compliance policy.

SecurityRequireSafetyNetAttestationCertifiedDevice of the Android Device Owner device compliance policy.

osMinimumVersion of the Android Device Owner device compliance policy.

osMinimumVersion

osMaximumVersion of the Android Device Owner device compliance policy.

osMaximumVersion

PasswordRequired of the Android Device Owner device compliance policy.

passwordRequired

PasswordMinimumLength of the Android Device Owner device compliance policy.

passwordMinimumLength

PasswordRequiredType of the Android Device Owner device compliance policy.

PasswordRequiredType

PasswordMinutesOfInactivityBeforeLock of the Android Device Owner device compliance policy.

PasswordMinutesOfInactivityBeforeLock

PasswordExpirationDays of the Android Device Owner device compliance policy.

PasswordExpirationDays

PasswordPreviousPasswordCountToBlock of the Android Device Owner device compliance policy.

PasswordPreviousPasswordCountToBlock

StorageRequireEncryption of the Android Device Owner device compliance policy.

StorageRequireEncryption

SecurityRequireIntuneAppIntegrity of the Android Device Owner device compliance policy.

SecurityRequireIntuneAppIntegrity

List of Scope Tags for this Entity instance. Inherited from deviceConfiguration

RoleScopeTagIds

Present ensures the policy exists, absent ensures it is removed

Ensure

Schema for microsoft.intune.devicecompliancepolicyandroidworkprofile

Display name of the AndroidWorkProfile device compliance policy.

DisplayName

Description of the AndroidWorkProfile device compliance policy.

Description

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the Intune Policy.

Assignments

PasswordRequired of the AndroidWorkProfile device compliance policy.

PasswordRequired

PasswordMinimumLength of the AndroidWorkProfile device compliance policy.

PasswordMinimumLength

PasswordRequiredType of the AndroidWorkProfile device compliance policy.

PasswordRequiredType

PasswordMinutesOfInactivityBeforeLock of the AndroidWorkProfile device compliance policy.

PasswordMinutesOfInactivityBeforeLock

PasswordExpirationDays of the AndroidWorkProfile device compliance policy.

PasswordExpirationDays

PasswordPreviousPasswordBlockCount of the AndroidWorkProfile device compliance policy.

PasswordPreviousPasswordBlockCount

PasswordSignInFailureCountBeforeFactoryReset of the AndroidWorkProfile device compliance policy.

SecurityPreventInstallAppsFromUnknownSources of the AndroidWorkProfile device compliance policy.

SecurityDisableUsbDebugging of the AndroidWorkProfile device compliance policy.

SecurityDisableUsbDebugging

SecurityRequireVerifyApps of the AndroidWorkProfile device compliance policy.

SecurityRequireVerifyApps

DeviceThreatProtectionEnabled of the AndroidWorkProfile device compliance policy.

DeviceThreatProtectionEnabled

DeviceThreatProtectionRequiredSecurityLevel of the AndroidWorkProfile device compliance policy.

AdvancedThreatProtectionRequiredSecurityLevel of the AndroidWorkProfile device compliance policy.

SecurityBlockJailbrokenDevices of the AndroidWorkProfile device compliance policy.

SecurityBlockJailbrokenDevices

OsMinimumVersion of the AndroidWorkProfile device compliance policy.

OsMinimumVersion

OsMaximumVersion of the AndroidWorkProfile device compliance policy.

OsMaximumVersion

MinAndroidSecurityPatchLevel of the AndroidWorkProfile device compliance policy.

MinAndroidSecurityPatchLevel

StorageRequireEncryption of the AndroidWorkProfile device compliance policy.

StorageRequireEncryption

SecurityRequireSafetyNetAttestationBasicIntegrity of the AndroidWorkProfile device compliance policy.

SecurityRequireSafetyNetAttestationCertifiedDevice of the AndroidWorkProfile device compliance policy.

SecurityRequireGooglePlayServices of the AndroidWorkProfile device compliance policy.

SecurityRequireGooglePlayServices

SecurityRequireUpToDateSecurityProviders of the AndroidWorkProfile device compliance policy.

SecurityRequireCompanyPortalAppIntegrity of the AndroidWorkProfile device compliance policy.

Require a specific SafetyNet evaluation type for compliance.

SecurityRequiredAndroidSafetyNetEvaluationType

RoleScopeTagIds of the AndroidWorkProfile device compliance policy.

RoleScopeTagIds

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures the Intune compliance policies for iOs devices.

Schema for microsoft.intune.devicecompliancepolicyios

Display name of the iOS device compliance policy.

DisplayName

Description of the iOS device compliance policy.

Description

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the Intune Policy.

Assignments

PasscodeBlockSimple of the iOS device compliance policy.

PasscodeBlockSimple

PasscodeExpirationDays of the iOS device compliance policy.

PasscodeExpirationDays

PasscodeMinimumLength of the iOS device compliance policy.

PasscodeMinimumLength

PasscodeMinutesOfInactivityBeforeLock of the iOS device compliance policy.

PasscodeMinutesOfInactivityBeforeLock

Minutes of inactivity before the screen times out.

PasscodeMinutesOfInactivityBeforeScreenTimeout

PasscodePreviousPasscodeBlockCount of the iOS device compliance policy.

PasscodePreviousPasscodeBlockCount

PasscodeMinimumCharacterSetCount of the iOS device compliance policy.

PasscodeMinimumCharacterSetCount

PasscodeRequiredType of the iOS device compliance policy.

PasscodeRequiredType

PasscodeRequired of the iOS device compliance policy.

PasscodeRequired

OsMinimumVersion of the iOS device compliance policy.

OsMinimumVersion

OsMaximumVersion of the iOS device compliance policy.

OsMaximumVersion

Minimum IOS build version.

OsMinimumBuildVersion

Maximum IOS build version.

OsMaximumBuildVersion

SecurityBlockJailbrokenDevices of the iOS device compliance policy.

SecurityBlockJailbrokenDevices

DeviceThreatProtectionEnabled of the iOS device compliance policy.

DeviceThreatProtectionEnabled

Require Mobile Threat Protection minimum risk level to report noncompliance.

MDATP Require Mobile Threat Protection minimum risk level to report noncompliance.

ManagedEmailProfileRequired of the iOS device compliance policy.

ManagedEmailProfileRequired

This resource configures the Intune compliance policies for iOs devices.

Schema for MSFT_appListItem

The application name.

name

The publisher of the application.

publisher

The Store URL of the application.

appStoreUrl

The application or bundle identifier of the application.

appId

Credentials of the Intune Admin

RestrictedApps

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures the settings of MacOS compliance policies
in your cloud-based organization.

## Parameters

### Device Health
* **Require a system integrity protection**
  *  Not configured _(default)_ - This setting isn't evaluated for compliance or non-compliance.
  *  Require - Require macOS devices to have System Integrity Protection enabled.

### Device Properties
* **Minimum OS required**
  When a device doesn't meet the minimum OS version requirement, it's reported as non-compliant. A link with information on how to upgrade is shown. The device user can choose to upgrade their device. After that, they can access organization resources.

* **Maximum OS version allowed**
  When a device uses an OS version later than the version in the rule, access to organization resources is blocked. The device user is asked to contact their IT administrator. The device can't access organization resources until a rule changes to allow the OS version.

* **Minimum OS build version**
  When Apple publishes security updates, the build number is typically updated, not the OS version. Use this feature to enter a minimum allowed build number on the device.

* **Maximum OS build version**
  When Apple publishes security updates, the build number is typically updated, not the OS version. Use this feature to enter a maximum allowed build number on the device.

## System security settings
### Password
* **Require a password to unlock mobile devices**
  * Not configured _(default)_
  * Require Users must enter a password before they can access their device.

* **Simple passwords**
  * Not configured _(default)_ - Users can create passwords simple like 1234 or 1111.
  * Block - Users can't create simple passwords, such as 1234 or 1111.

* **Minimum password length**
  * Enter the minimum number of digits or characters that the password must have.

* **Password type**
  * Choose if a password should have only Numeric characters, or if there should be a mix of numbers and other characters (Alphanumeric).

* **Number of non-alphanumeric characters in password**
  * Enter the minimum number of special characters, such as &, #, %, !, and so on, that must be in the password.

  Setting a higher number requires the user to create a password that is more complex.

* **Maximum minutes of inactivity before password is required**
  * Enter the idle time before the user must reenter their password.

* **Password expiration (days)**
  * Select the number of days before the password expires, and they must create a new one.

* **Number of previous passwords to prevent reuse**
  * Enter the number of previously used passwords that can't be used.

### Encryption
* **Encryption of data storage on device**
  * Not configured (_default_)
  * Require - Use _Require_ to encrypt data storage on your devices.

### Device Security
Firewall protects devices from unauthorized network access. You can use Firewall to control connections on a per-application basis.

* **Firewall**
  * Not configured _(default)_ - This setting leaves the firewall turned off, and network traffic is allowed (not blocked).
  * Enable - Use Enable to help protect devices from unauthorized access. Enabling this feature allows you to handle incoming internet connections, and use stealth mode.

* **Incoming connections**
  * Not configured _(default)_ - Allows incoming connections and sharing services.
  * Block - Block all incoming network connections except the connections required for basic internet services, such as DHCP, Bonjour, and IPSec. This setting also blocks all sharing services, including screen sharing, remote access, iTunes music sharing, and more.

* **Stealth Mode**
  * Not configured _(default)_ - This setting leaves stealth mode turned off.
  * Enable - Turn on stealth mode to prevent devices from responding to probing requests, which can be made my malicious users. When enabled, the device continues to answer incoming requests for authorized apps.

### Gatekeeper
For more information, see Gatekeeper on macOS.

* **Allow apps downloaded from these locations**
  Allows supported applications to be installed on your devices from different locations. Your location options:
  * Not configured _(default)_ - The gatekeeper option has no impact on compliance or non-compliance.
  * Mac App Store - Only install apps for the Mac app store. Apps can't be installed from third parties nor identified developers. If a user selects Gatekeeper to install apps outside the Mac App Store, then the device is considered not compliant.
  * Mac App Store and identified developers - Install apps for the Mac app store and from identified developers. macOS checks the identity of developers, and does some other checks to verify app integrity. If a user selects Gatekeeper to install apps outside these options, then the device is considered not compliant.
  * Anywhere - Apps can be installed from anywhere, and by any developer. This option is the least secure.

Schema for microsoft.intune.devicecompliancepolicymacos

Display name of the MacOS device compliance policy.

DisplayName

Description of the MacOS device compliance policy.

Description

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the Intune Policy.

Assignments

PasswordRequired of the MacOS device compliance policy.

PasswordRequired

PasswordBlockSimple of the MacOS device compliance policy.

PasswordBlockSimple

PasswordExpirationDays of the MacOS device compliance policy.

PasswordExpirationDays

PasswordMinimumLength of the MacOS device compliance policy.

PasswordMinimumLength

PasswordMinutesOfInactivityBeforeLock of the MacOS device compliance policy.

PasswordMinutesOfInactivityBeforeLock

PasswordPreviousPasswordBlockCount of the MacOS device compliance policy.

PasswordPreviousPasswordBlockCount

PasswordMinimumCharacterSetCount of the MacOS device compliance policy.

PasswordMinimumCharacterSetCount

PasswordRequiredType of the MacOS device compliance policy.

PasswordRequiredType

OsMinimumVersion of the MacOS device compliance policy.

OsMinimumVersion

OsMaximumVersion of the MacOS device compliance policy.

OsMaximumVersion

Minimum MacOS build version.

OsMinimumBuildVersion

Maximum MacOS build version.

OsMaximumBuildVersion

SystemIntegrityProtectionEnabled of the MacOS device compliance policy.

SystemIntegrityProtectionEnabled

DeviceThreatProtectionEnabled of the MacOS device compliance policy.

DeviceThreatProtectionEnabled

Unavailable Secured Low Medium High NotSet

DeviceThreatProtectionRequiredSecurityLevel of the MacOS device compliance policy.

AdvancedThreatProtectionRequiredSecurityLevel of the MacOS device compliance policy.

StorageRequireEncryption of the MacOS device compliance policy.

StorageRequireEncryption

notConfigured macAppStore macAppStoreAndIdentifiedDevelopers anywhere

System and Privacy setting that determines which download locations apps can be run from on a macOS device.

GatekeeperAllowedAppSource

FirewallEnabled of the MacOS device compliance policy.

FirewallEnabled

FirewallBlockAllIncoming of the MacOS device compliance policy.

FirewallBlockAllIncoming

FirewallEnableStealthMode of the MacOS device compliance policy.

FirewallEnableStealthMode

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures the settings of Windows 10 compliance policies
in your cloud-based organization.

## Parameters

### Device Health
#### Windows Health Attestation Service evaluation rules
* **Require BitLocker:**
  Windows BitLocker Drive Encryption encrypts all data stored on the Windows operating system volume. BitLocker uses the Trusted Platform Module (TPM) to help protect the Windows operating system and user data. It also helps confirm that a computer isn't tampered with, even if its left unattended, lost, or stolen. If the computer is equipped with a compatible TPM, BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys can't be accessed until the TPM verifies the state of the computer.
  * Not configured _(default)_ - This setting isn't evaluated for compliance or non-compliance.
  * Require - The device can protect data that's stored on the drive from unauthorized access when the system is off, or hibernates.

  Device HealthAttestation CSP - BitLockerStatus

* **Require Secure Boot to be enabled on the device:**
  * Not configured _(default)_ - This setting isn't evaluated for compliance or non-compliance.
  * Require - The system is forced to boot to a factory trusted state. The core components that are used to boot the machine must have correct cryptographic signatures that are trusted by the organization that manufactured the device. The UEFI firmware verifies the signature before it lets the machine start. If any files are tampered with, which breaks their signature, the system doesn't boot.

### Device Properties
#### Operating System Version
To discover build versions for all Windows 10 Feature Updates and Cumulative Updates (to be used in some of the fields below), see Windows 10 release information. Be sure to include the 10.0. prefix before the build numbers, as the following examples illustrate.

* **Minimum OS version:**
  Enter the minimum allowed version in the major.minor.build.revision number format. To get the correct value, open a command prompt, and type ver. The ver command returns the version in the following format:

  Microsoft Windows [Version 10.0.17134.1]

  When a device has an earlier version than the OS version you enter, it's reported as noncompliant. A link with information on how to upgrade is shown. The end user can choose to upgrade their device. After they upgrade, they can access company resources.

* **Maximum OS version:**
  Enter the maximum allowed version, in the major.minor.build.revision number format. To get the correct value, open a command prompt, and type ver. The ver command returns the version in the following format:

  Microsoft Windows [Version 10.0.17134.1]

  When a device is using an OS version later than the version entered, access to organization resources is blocked. The end user is asked to contact their IT administrator. The device can't access organization resources until the rule is changed to allow the OS version.

* **Minimum OS required for mobile devices:**
  Enter the minimum allowed version, in the major.minor.build number format.

  When a device has an earlier version that the OS version you enter, it's reported as noncompliant. A link with information on how to upgrade is shown. The end user can choose to upgrade their device. After they upgrade, they can access company resources.

* **Maximum OS required for mobile devices:**
  Enter the maximum allowed version, in the major.minor.build number.

  When a device is using an OS version later than the version entered, access to organization resources is blocked. The end user is asked to contact their IT administrator. The device can't access organization resources until the rule is changed to allow the OS version.

* **Valid operating system builds:**
  Specify a list of minimum and maximum operating system builds. Valid operating system builds provides additional flexibility when compared against minimum and maximum OS versions. Consider a scenario where minimum OS version is set to 10.0.18362.xxx (Windows 10 1903) and maximum OS version is set to 10.0.18363.xxx (Windows 10 1909). This configuration can allow a Windows 10 1903 device that doesn't have recent cumulative updates installed to be identified as compliant. Minimum and maximum OS versions might be suitable if you have standardized on a single Windows 10 release, but might not address your requirements if you need to use multiple builds, each with specific patch levels. In such a case, consider leveraging valid operating system builds instead, which allows multiple builds to be specified as per the following example.

  Example:
  The following table is an example of a range for the acceptable operating systems versions for different Windows 10 releases. In this example, three different Feature Updates have been allowed (1809, 1909 and 2004). Specifically, only those versions of Windows and which have applied cumulative updates from June to September 2020 will be considered to be compliant. This is sample data only. The table includes a first column that includes any text you want to describe the entry, followed by the minimum and maximum OS version for that entry. The second and third columns must adhere to valid OS build versions in the major.minor.build.revision number format. After you define one or more entries, you can Export the list as a comma-separated values (CSV) file.

  | Description                 | Minimum OS version | Maximum OS version |
  |-----------------------------|--------------------|--------------------|
  | Win 10 2004 (Jun-Sept 2020) | 10.0.19041.329     | 10.0.19041.508     |
  | Win 10 1909 (Jun-Sept 2020) | 10.0.18363.900     | 10.0.18363.1110    |
  | Win 10 1809 (Jun-Sept 2020) | 10.0.17763.1282    | 10.0.17763.1490    |

### Configuration Manager Compliance
Applies only to co-managed devices running Windows 10 and later. Intune-only devices return a not available status.

* **Require device compliance from Configuration Manager:**
  * Not configured _(default)_ - Intune doesn't check for any of the Configuration Manager settings for compliance.
  * Require - Require all settings (configuration items) in Configuration Manager to be compliant.

### System Security
#### Password
* **Require a password to unlock mobile devices:**
  * Not configured _(default)_ - This setting isn't evaluated for compliance or non-compliance.
  * Require - Users must enter a password before they can access their device.

* **Simple passwords:**
  * Not configured _(default)_ - Users can create simple passwords, such as 1234 or 1111.
  * Block - Users can't create simple passwords, such as 1234 or 1111.

* **Password type:**
  Choose the type of password or PIN required. Your options:
  * Device _(default)_  - Require a password, numeric PIN, or alphanumeric PIN
  * Numeric - Require a password or numeric PIN
  * Alphanumeric - Require a password, or alphanumeric PIN.
  When set to Alphanumeric, the following settings are available:

  * Password complexity:
    Your options:
    * Require digits and lowercase letters _(default)_
    * Require digits, lowercase letters, and uppercase letters
    * Require digits, lowercase letters, uppercase letters, and special characters

* **Minimum password length:**
    Enter the minimum number of digits or characters that the password must have.

* **Maximum minutes of inactivity before password is required:**
    Enter the idle time before the user must reenter their password.

* **Password expiration (days):**
    Enter the number of days before the password expires, and they must create a new one, from 1-730.

* **Number of previous passwords to prevent reuse:**
    Enter the number of previously used passwords that can't be used.

* **Require password when device returns from idle state (Mobile and Holographic):**
    * Not configured _(default)_
    * Require - Require device users to enter the password every time the device returns from an idle state.

  **Important**
  When the password requirement is changed on a Windows desktop, users are impacted the next time they sign in, as that's when the device goes from idle to active. Users with passwords that meet the requirement are still prompted to change their passwords.

### Encryption

* **Encryption of data storage on a device:**
  This setting applies to all drives on a device.
  * Not configured _(default)_
  * Require - Use Require to encrypt data storage on your devices.

  **Note**
  The Encryption of data storage on a device setting generically checks for the presence of encryption on the device, more specifically at the OS drive level. Currently, Intune supports only the encryption check with BitLocker. For a more robust encryption setting, consider using Require BitLocker, which leverages Windows Device Health Attestation to validate Bitlocker status at the TPM level.

### Device Security

* **Firewall:**
  * Not configured _(default)_ - Intune doesn't control the Microsoft Defender Firewall, nor change existing settings.
  * Require - Turn on the Microsoft Defender Firewall, and prevent users from turning it off.

  **Note**
  If the device immediately syncs after a reboot, or immediately syncs waking from sleep, then this setting may report as an Error. This scenario might not affect the overall device compliance status. To re-evaluate the compliance status, manually sync the device.

* **Trusted Platform Module (TPM):**
  * Not configured _(default)_ - Intune doesn't check the device for a TPM chip version.
  * Require - Intune checks the TPM chip version for compliance. The device is compliant if the TPM chip version is greater than 0 (zero). The device isn't compliant if there isn't a TPM version on the device.

* **Antivirus:**
  * Not configured _(default)_ - Intune doesn't check for any antivirus solutions installed on the device.
  * Require - Check compliance using antivirus solutions that are registered with Windows Security Center, such as Symantec and Microsoft Defender.

* **Antispyware:**
  * Not configured _(default)_ - Intune doesn't check for any antispyware solutions installed on the device.
  * Require - Check compliance using antispyware solutions that are registered with Windows Security Center, such as Symantec and Microsoft Defender.

### Defender
The following compliance settings are supported with Windows 10 Desktop.

* **Microsoft Defender Antimalware:**
  * Not configured _(default)_ - Intune doesn't control the service, nor change existing settings.
  * Require - Turn on the Microsoft Defender anti-malware service, and prevent users from turning it off.

* **Microsoft Defender Antimalware minimum version:**
  Enter the minimum allowed version of Microsoft Defender anti-malware service. For example, enter 4.11.0.0. When left blank, any version of the Microsoft Defender anti-malware service can be used.

  By _(default)_, no version is configured.

* **Microsoft Defender Antimalware security intelligence up-to-date:**
  Controls the Windows Security virus and threat protection updates on the devices.
  * Not configured _(default)_ - Intune doesn't enforce any requirements.
  * Require - Force the Microsoft Defender security intelligence be up-to-date.

* **Real-time protection:**
  * Not configured (_(default)_) - Intune doesn't control this feature, nor change existing settings.
  * Require - Turn on real-time protection, which scans for malware, spyware, and other unwanted software.

### Microsoft Defender for Endpoint
#### Microsoft Defender for Endpoint rules
For additional information on Microsoft Defender for Endpoint integration in conditional access scenarios, see Configure Conditional Access in Microsoft Defender for Endpoint.

* **Require the device to be at or under the machine risk score:**
  Use this setting to take the risk assessment from your defense threat services as a condition for compliance. Choose the maximum allowed threat level:
  * Not configured (_(default)_)
  * Clear -This option is the most secure, as the device can't have any threats. If the device is detected as having any level of threats, it's evaluated as non-compliant.
  * Low - The device is evaluated as compliant if only low-level threats are present. Anything higher puts the device in a non-compliant status.
  * Medium - The device is evaluated as compliant if existing threats on the device are low or medium level. If the device is detected to have high-level threats, it's determined to be non-compliant.
  * High - This option is the least secure, and allows all threat levels. It may be useful if you're using this solution only for reporting purposes.

### Windows Holographic for Business
Windows Holographic for Business uses the Windows 10 and later platform. Windows Holographic for Business supports the following setting:

**System Security > Encryption > Encryption of data storage on device.**
To verify device encryption on the Microsoft HoloLens, see Verify device encryption.

### Surface Hub
Surface Hub uses the Windows 10 and later platform. Surface Hubs are supported for both compliance and Conditional Access. To enable these features on Surface Hubs, we recommend you enable Windows 10 automatic enrollment in Intune (requires Azure Active Directory (Azure AD)), and target the Surface Hub devices as device groups. Surface Hubs are required to be Azure AD joined for compliance and Conditional Access to work.

For guidance, see set up enrollment for Windows devices.

Special consideration for Surface Hubs running Windows 10 Team OS:
Surface Hubs that run Windows 10 Team OS do not support the Microsoft Defender for Endpoint and Password compliance policies at this time. Therefore, for Surface Hubs that run Windows 10 Team OS set the following two settings to their _(default)_ of _Not configured_:
* In the category Password, set Require a password to unlock mobile devices to the _(default)_ of Not configured.
* In the category Microsoft Defender for Endpoint, set Require the device to be at or under the machine risk score to the _(default)_ of Not configured.

Schema for microsoft.intune.devicecompliancepolicywindows10

Display name of the Windows 10 device compliance policy.

DisplayName

Description of the Windows 10 device compliance policy.

Description

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

PasswordRequired of the Windows 10 device compliance policy.

PasswordRequired

PasswordBlockSimple of the Windows 10 device compliance policy.

PasswordBlockSimple

PasswordRequiredToUnlockFromIdle of the Windows 10 device compliance policy.

PasswordRequiredToUnlockFromIdle

PasswordMinutesOfInactivityBeforeLock of the Windows 10 device compliance policy.

PasswordMinutesOfInactivityBeforeLock

PasswordExpirationDays of the Windows 10 device compliance policy.

PasswordExpirationDays

PasswordMinimumLength of the Windows 10 device compliance policy.

PasswordMinimumLength

PasswordMinimumCharacterSetCount of the Windows 10 device compliance policy.

PasswordMinimumCharacterSetCount

PasswordRequiredType of the Windows 10 device compliance policy.

PasswordRequiredType

PasswordPreviousPasswordBlockCount of the Windows 10 device compliance policy.

PasswordPreviousPasswordBlockCount

RequireHealthyDeviceReport of the Windows 10 device compliance policy.

RequireHealthyDeviceReport

OsMinimumVersion of the Windows 10 device compliance policy.

OsMinimumVersion

OsMaximumVersion of the Windows 10 device compliance policy.

OsMaximumVersion

MobileOsMinimumVersion of the Windows 10 device compliance policy.

MobileOsMinimumVersion

MobileOsMaximumVersion of the Windows 10 device compliance policy.

MobileOsMaximumVersion

EarlyLaunchAntiMalwareDriverEnabled of the Windows 10 device compliance policy.

EarlyLaunchAntiMalwareDriverEnabled

BitLockerEnabled of the Windows 10 device compliance policy.

BitLockerEnabled

SecureBootEnabled of the Windows 10 device compliance policy.

SecureBootEnabled

CodeIntegrityEnabled of the Windows 10 device compliance policy.

CodeIntegrityEnabled

StorageRequireEncryption of the Windows 10 device compliance policy.

StorageRequireEncryption

ActiveFirewallRequired of the Windows 10 device compliance policy.

ActiveFirewallRequired

DefenderEnabled of the Windows 10 device compliance policy.

DefenderEnabled

DefenderVersion of the Windows 10 device compliance policy.

DefenderVersion

SignatureOutOfDate of the Windows 10 device compliance policy.

SignatureOutOfDate

RTPEnabled of the Windows 10 device compliance policy.

RTPEnabled

AntivirusRequired of the Windows 10 device compliance policy.

AntivirusRequired

AntiSpywareRequired of the Windows 10 device compliance policy.

AntiSpywareRequired

DeviceThreatProtectionEnabled of the Windows 10 device compliance policy.

DeviceThreatProtectionEnabled

DeviceThreatProtectionRequiredSecurityLevel of the Windows 10 device compliance policy.

DeviceThreatProtectionRequiredSecurityLevel

ConfigurationManagerComplianceRequired of the Windows 10 device compliance policy.

ConfigurationManagerComplianceRequired

TpmRequired of the Windows 10 device compliance policy.

TpmRequired

DeviceCompliancePolicyScript of the Windows 10 device compliance policy.

DeviceCompliancePolicyScript

ValidOperatingSystemBuildRanges of the Windows 10 device compliance policy.

ValidOperatingSystemBuildRanges

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Administrative Template Policy for Windows10

Schema for microsoft.intune.deviceconfigurationadministrativetemplatepolicywindows10

User provided description for the resource object.

Description

User provided name for the resource object.

DisplayName

unknown custom builtIn mixed unknownFutureValue

Type of definitions configured for this policy. Possible values are: unknown, custom, builtIn, mixed, unknownFutureValue.

PolicyConfigurationIngestionType

The unique identifier for an entity. Read-only.

Id

Schema for MSFT_IntuneGroupPolicyDefinitionValue

Specifies how the value should be configured. This can be either as a Policy or as a Preference. Possible values are: policy, preference.

ConfigurationType

Enables or disables the associated group policy definition.

Enabled

Id

The associated group policy definition with the value. Read-Only.

Definition

The localized full category path for the policy.

CategoryPath

Identifies the type of groups the policy can be applied to. Possible values are: user, machine.

ClassType

The localized policy name.

DisplayName

The localized explanation or help text associated with the policy. The default value is empty.

ExplainText

The category id of the parent category

GroupPolicyCategoryId

Signifies whether or not there are related definitions to this definition

HasRelatedDefinitions

Minimum required CSP version for device configuration in this definition

MinDeviceCspVersion

Minimum required CSP version for user configuration in this definition

MinUserCspVersion

Specifies the type of group policy. Possible values are: admxBacked, admxIngested.

PolicyType

Localized string used to specify what operating system or application version is affected by the policy.

SupportedOn

Id

Schema for MSFT_IntuneGroupPolicyDefinitionValuePresentationValue

A value for the associated presentation.

BooleanValue

DecimalValue

StringValue

Intune Device Configuration Administrative Template Policy for Windows10

Schema for MSFT_IntuneGroupPolicyDefinitionValuePresentationValueKeyValuePair

Value for this key-value pair.

Value

Name for this key-value pair.

Name

A list of pairs for the associated presentation.

KeyValuePairValues

StringValues

Id

The unique identifier for presentation definition. Read-only.

PresentationDefinitionId

The label of the presentation definition. Read-only.

PresentationDefinitionLabel

odataType

The associated group policy presentation values with the definition value.

PresentationValues

The list of enabled or disabled group policy definition values for the configuration.

DefinitionValues

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Custom Policy for Windows10

Schema for microsoft.intune.deviceconfigurationcustompolicywindows10

Admin provided name of the device configuration.

DisplayName

Schema for MSFT_MicrosoftGraphOmaSetting

Description.

Description

Display Name.

DisplayName

Indicates whether the value field is encrypted. This property is read-only.

IsEncrypted

OMA.

OmaUri

ReferenceId for looking up secret for decryption. This property is read-only.

SecretReferenceValueId

File name associated with the Value property (.cer)

FileName

Value. (Base64 encoded string)

Value

By setting to true, the CSP (configuration service provider) specified in the OMA-URI will perform a get, instead of set

IsReadOnly

The type of the entity.

odataType

OMA settings. This collection can contain a maximum of 1000 elements.

OmaSettings

Admin provided description of the Device Configuration.

Description

Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.

SupportsScopeTags

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Defender For Endpoint Onboarding Policy for Windows10

Schema for microsoft.intune.deviceconfigurationdefenderforendpointonboardingpolicywindows10

Auto populate onboarding blob programmatically from Advanced Threat protection service

AdvancedThreatProtectionAutoPopulateOnboardingBlob

Windows Defender AdvancedThreatProtection Offboarding Blob.

AdvancedThreatProtectionOffboardingBlob

Name of the file from which AdvancedThreatProtectionOffboardingBlob was obtained.

AdvancedThreatProtectionOffboardingFilename

Windows Defender AdvancedThreatProtection Onboarding Blob.

AdvancedThreatProtectionOnboardingBlob

Name of the file from which AdvancedThreatProtectionOnboardingBlob was obtained.

AdvancedThreatProtectionOnboardingFilename

Windows Defender AdvancedThreatProtection 'Allow Sample Sharing' Rule

AllowSampleSharing

Expedite Windows Defender Advanced Threat Protection telemetry reporting frequency.

EnableExpeditedTelemetryReporting

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Delivery Optimization Policy for Windows10

Schema for microsoft.intune.deviceconfigurationdeliveryoptimizationpolicywindows10

Specifies number of seconds to delay an HTTP source in a background download that is allowed to use peer-to-peer. Valid values 0 to 4294967295

BackgroundDownloadFromHttpDelayInSeconds

Specifies foreground and background bandwidth usage using percentages, absolutes, or hours.

BandwidthMode

Specifies the maximum download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. Valid values 0 to 4294967295

MaximumDownloadBandwidthInKilobytesPerSecond

Specifies the maximum upload bandwidth in KiloBytes/second that a device will use across all concurrent upload activity using Delivery Optimization (0-4000000). Valid values 0 to 4000000 The default value is 0, which permits unlimited possible bandwidth (optimized for minimal usage of upload bandwidth). Valid values 0 to 4000000

MaximumUploadBandwidthInKilobytesPerSecond

Background download percentage hours.

BandwidthBackgroundPercentageHours

Specifies the beginning of business hours using a 24-hour clock (0-23). Valid values 0 to 23

BandwidthBeginBusinessHours

Specifies the end of business hours using a 24-hour clock (0-23). Valid values 0 to 23

BandwidthEndBusinessHours

Specifies the percentage of bandwidth to limit during business hours (0-100). Valid values 0 to 100

BandwidthPercentageDuringBusinessHours

Specifies the percentage of bandwidth to limit outsidse business hours (0-100). Valid values 0 to 100

BandwidthPercentageOutsideBusinessHours

Foreground download percentage hours.

BandwidthForegroundPercentageHours

BandwidthBeginBusinessHours

BandwidthEndBusinessHours

BandwidthPercentageDuringBusinessHours

BandwidthPercentageOutsideBusinessHours

Specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth (0-100). Valid values 0 to 100

MaximumBackgroundBandwidthPercentage

Specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth (0-100). Valid values 0 to 100 The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. Valid values 0 to 100

MaximumForegroundBandwidthPercentage

The type of the entity.

odataType

Specifies number of seconds to delay a fall back from cache servers to an HTTP source for a background download. Valid values 0 to 2592000.

CacheServerBackgroundDownloadFallbackToHttpDelayInSeconds

Specifies number of seconds to delay a fall back from cache servers to an HTTP source for a foreground download. Valid values 0 to 2592000.

CacheServerForegroundDownloadFallbackToHttpDelayInSeconds

Specifies cache servers host names.

CacheServerHostNames

userDefined httpOnly httpWithPeeringNat httpWithPeeringPrivateGroup httpWithInternetPeering simpleDownload bypassMode

Specifies the download method that delivery optimization can use to manage network bandwidth consumption for large content distribution scenarios. Possible values are: userDefined, httpOnly, httpWithPeeringNat, httpWithPeeringPrivateGroup, httpWithInternetPeering, simpleDownload, bypassMode.

DeliveryOptimizationMode

Specifies number of seconds to delay an HTTP source in a foreground download that is allowed to use peer-to-peer (0-86400). Valid values 0 to 86400 Specifying 0 sets Delivery Optimization to manage this setting using the cloud service. Valid values 0 to 86400

ForegroundDownloadFromHttpDelayInSeconds

Specifies to restrict peer selection to a specific source. The options set in this policy only apply to Delivery Optimization mode Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. For option 3 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID.

GroupIdSource

Specifies an arbitrary group ID that the device belongs to

GroupIdCustom

notConfigured adSite authenticatedDomainSid dhcpUserOption dnsSuffix

Set this policy to restrict peer selection to a specific source. Possible values are: notConfigured, adSite, authenticatedDomainSid, dhcpUserOption, dnsSuffix.

GroupIdSourceOption

The type of the entity.

odataType

Specifies the maximum time in days that each file is held in the Delivery Optimization cache after downloading successfully (0-3650). Valid values 0 to 3650

MaximumCacheAgeInDays

Specifies the maximum cache size that Delivery Optimization either as a percentage or in GB.

MaximumCacheSize

Specifies the maximum size in GB of Delivery Optimization cache. Valid values 0 to 4294967295

MaximumCacheSizeInGigabytes

Specifies the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). Valid values 1 to 100

MaximumCacheSizePercentage

The type of the entity.

odataType

Specifies the minimum battery percentage to allow the device to upload data (0-100). Valid values 0 to 100 The default value is 0. The value 0 (zero) means 'not limited' and the cloud service default value will be used. Valid values 0 to 100

MinimumBatteryPercentageAllowedToUpload

Specifies the minimum disk size in GB to use Peer Caching (1-100000). Valid values 1 to 100000 Recommended values: 64 GB to 256 GB. Valid values 1 to 100000

MinimumDiskSizeAllowedToPeerInGigabytes

Specifies the minimum content file size in MB enabled to use Peer Caching (1-100000). Valid values 1 to 100000 Recommended values: 1 MB to 100,000 MB. Valid values 1 to 100000

MinimumFileSizeToCacheInMegabytes

Specifies the minimum RAM size in GB to use Peer Caching (1-100000). Valid values 1 to 100000

MinimumRamAllowedToPeerInGigabytes

Specifies the drive that Delivery Optimization should use for its cache.

ModifyCacheLocation

Specifies to restrict peer selection via selected option.

RestrictPeerSelectionBy

Specifies whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network.

VpnPeerCaching

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.

SupportsScopeTags

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Domain Join Policy for Windows10

Schema for microsoft.intune.deviceconfigurationdomainjoinpolicywindows10

Active Directory domain name to join.

ActiveDirectoryDomainName

Fixed prefix to be used for computer name.

ComputerNameStaticPrefix

Dynamically generated characters used as suffix for computer name. Valid values 3 to 14

ComputerNameSuffixRandomCharCount

Organizational unit (OU) where the computer account will be created. If this parameter is NULL, the well known computer object container will be used as published in the domain.

OrganizationalUnit

Description

DisplayName

SupportsScopeTags

Id

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments

Ensure

Intune Device Configuration Email Profile Policy for Windows10

Schema for microsoft.intune.deviceconfigurationemailprofilepolicywindows10

Account name.

AccountName

userDefined oneDay threeDays oneWeek twoWeeks oneMonth unlimited

Duration of email to sync. Possible values are: userDefined, oneDay, threeDays, oneWeek, twoWeeks, oneMonth, unlimited.

DurationOfEmailToSync

Email attribute that is picked from AAD and injected into this profile before installing on the device. Possible values are: userPrincipalName, primarySmtpAddress.

EmailAddressSource

userDefined asMessagesArrive manual fifteenMinutes thirtyMinutes sixtyMinutes basedOnMyUsage

Email sync schedule. Possible values are: userDefined, asMessagesArrive, manual, fifteenMinutes, thirtyMinutes, sixtyMinutes, basedOnMyUsage.

EmailSyncSchedule

Exchange location that (URL) that the native mail app connects to.

HostName

Indicates whether or not to use SSL.

RequireSsl

Whether or not to sync the calendar.

SyncCalendar

Whether or not to sync contacts.

SyncContacts

Whether or not to sync tasks.

SyncTasks

Custom domain name value used while generating an email profile before installing on the device.

CustomDomainName

UserDomainname attribute that is picked from AAD and injected into this profile before installing on the device. Possible values are: fullDomainName, netBiosDomainName.

UserDomainNameSource

Name of the AAD field, that will be used to retrieve UserName for email profile. Possible values are: userPrincipalName, primarySmtpAddress, samAccountName.

UsernameAADSource

Username attribute that is picked from AAD and injected into this profile before installing on the device. Possible values are: userPrincipalName, primarySmtpAddress.

UsernameSource

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Endpoint Protection Policy for Windows10

Schema for microsoft.intune.deviceconfigurationendpointprotectionpolicywindows10

Gets or sets whether applications inside Microsoft Defender Application Guard can access the devices camera and microphone.

ApplicationGuardAllowCameraMicrophoneRedirection

Allow users to download files from Edge in the application guard container and save them on the host file system

ApplicationGuardAllowFileSaveOnHost

Allow persisting user generated data inside the App Guard Container (favorites, cookies, web passwords, etc.)

ApplicationGuardAllowPersistence

Allow printing to Local Printers from Container

ApplicationGuardAllowPrintToLocalPrinters

Allow printing to Network Printers from Container

ApplicationGuardAllowPrintToNetworkPrinters

Allow printing to PDF from Container

ApplicationGuardAllowPrintToPDF

Allow printing to XPS from Container

ApplicationGuardAllowPrintToXPS

Allow application guard to use virtual GPU

ApplicationGuardAllowVirtualGPU

notConfigured blockBoth blockHostToContainer blockContainerToHost blockNone

Block clipboard to share data from Host to Container, or from Container to Host, or both ways, or neither ways. Possible values are: notConfigured, blockBoth, blockHostToContainer, blockContainerToHost, blockNone.

ApplicationGuardBlockClipboardSharing

notConfigured blockImageAndTextFile blockImageFile blockNone blockTextFile

Block clipboard to transfer image file, text file or neither of them. Possible values are: notConfigured, blockImageAndTextFile, blockImageFile, blockNone, blockTextFile.

ApplicationGuardBlockFileTransfer

Block enterprise sites to load non-enterprise content, such as third party plug-ins

ApplicationGuardBlockNonEnterpriseContent

Allows certain device level Root Certificates to be shared with the Microsoft Defender Application Guard container.

ApplicationGuardCertificateThumbprints

Enable Windows Defender Application Guard

ApplicationGuardEnabled

notConfigured enabledForEdge enabledForOffice enabledForEdgeAndOffice

Enable Windows Defender Application Guard for newer Windows builds. Possible values are: notConfigured, enabledForEdge, enabledForOffice, enabledForEdgeAndOffice.

ApplicationGuardEnabledOptions

Force auditing will persist Windows logs and events to meet security/compliance criteria (sample events are user login-logoff, use of privilege rights, software installation, system changes, etc.)

ApplicationGuardForceAuditing

Enables the Admin to choose what types of app to allow on devices. Possible values are: notConfigured, enforceComponentsAndStoreApps, auditComponentsAndStoreApps, enforceComponentsStoreAppsAndSmartlocker, auditComponentsStoreAppsAndSmartlocker.

AppLockerApplicationControl

Allows the admin to allow standard users to enable encryption during Azure AD Join.

BitLockerAllowStandardUserEncryption

Allows the Admin to disable the warning prompt for other disk encryption on the user machines.

BitLockerDisableWarningForOtherDiskEncryption

Allows the admin to require encryption to be turned on using BitLocker. This policy is valid only for a mobile SKU.

BitLockerEnableStorageCardEncryptionOnMobile

Allows the admin to require encryption to be turned on using BitLocker.

BitLockerEncryptDevice

BitLocker Fixed Drive Policy.

BitLockerFixedDrivePolicy

Select the encryption method for fixed drives. Possible values are: aesCbc128, aesCbc256, xtsAes128, xtsAes256.

EncryptionMethod

This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker.

RecoveryOptions

Indicates whether to block certificate-based data recovery agent.

BlockDataRecoveryAgent

Indicates whether or not to enable BitLocker until recovery information is stored in AD DS.

EnableBitLockerAfterRecoveryInformationToStore

Indicates whether or not to allow BitLocker recovery information to store in AD DS.

EnableRecoveryInformationSaveToStore

Indicates whether or not to allow showing recovery options in BitLocker Setup Wizard for fixed or system disk.

HideRecoveryOptions

Configure what pieces of BitLocker recovery information are stored to AD DS. Possible values are: passwordAndKey, passwordOnly.

RecoveryInformationToStore

Indicates whether users are allowed or required to generate a 256-bit recovery key for fixed or system disk. Possible values are: blocked, required, allowed, notConfigured.

RecoveryKeyUsage

Indicates whether users are allowed or required to generate a 48-digit recovery password for fixed or system disk. Possible values are: blocked, required, allowed, notConfigured.

RecoveryPasswordUsage

This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer.

RequireEncryptionForWriteAccess

notConfigured disabled enabledForAzureAd enabledForAzureAdAndHybrid

This setting initiates a client-driven recovery password rotation after an OS drive recovery (either by using bootmgr or WinRE). Possible values are: notConfigured, disabled, enabledForAzureAd, enabledForAzureAdAndHybrid.

BitLockerRecoveryPasswordRotation

BitLocker Removable Drive Policy.

BitLockerRemovableDrivePolicy

This policy setting determines whether BitLocker protection is required for removable data drives to be writable on a computer.

BlockCrossOrganizationWriteAccess

Select the encryption method for removable  drives. Possible values are: aesCbc128, aesCbc256, xtsAes128, xtsAes256.

EncryptionMethod

Indicates whether to block write access to devices configured in another organization.  If requireEncryptionForWriteAccess is false, this value does not affect.

RequireEncryptionForWriteAccess

BitLocker System Drive Policy.

BitLockerSystemDrivePolicy

Select the encryption method for operating system drives. Possible values are: aesCbc128, aesCbc256, xtsAes128, xtsAes256.

EncryptionMethod

Indicates the minimum length of startup pin. Valid values 4 to 20

MinimumPinLength

Enable pre-boot recovery message and Url. If requireStartupAuthentication is false, this value does not affect.

PrebootRecoveryEnableMessageAndUrl

Defines a custom recovery message.

PrebootRecoveryMessage

Defines a custom recovery URL.

PrebootRecoveryUrl

Allows to recover BitLocker encrypted operating system drives in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker.

RecoveryOptions

BlockDataRecoveryAgent

EnableRecoveryInformationSaveToStore

HideRecoveryOptions

RecoveryInformationToStore

RecoveryKeyUsage

RecoveryPasswordUsage

Indicates whether to allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive).

StartupAuthenticationBlockWithoutTpmChip

Require additional authentication at startup.

StartupAuthenticationRequired

Indicates if TPM startup key is allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.

StartupAuthenticationTpmKeyUsage

Indicates if TPM startup pin key and key are allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.

StartupAuthenticationTpmPinAndKeyUsage

Indicates if TPM startup pin is allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.

StartupAuthenticationTpmPinUsage

Indicates if TPM startup is allowed/required/disallowed. Possible values are: blocked, required, allowed, notConfigured.

StartupAuthenticationTpmUsage

List of folder paths to be added to the list of protected folders

DefenderAdditionalGuardedFolders

userDefined enable auditMode warn notConfigured

Value indicating the behavior of Adobe Reader from creating child processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderAdobeReaderLaunchChildProcess

Value indicating use of advanced protection against ransomeware. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderAdvancedRansomewareProtectionType

Allows or disallows Windows Defender Behavior Monitoring functionality.

DefenderAllowBehaviorMonitoring

To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.

DefenderAllowCloudProtection

Allows or disallows user access to the Windows Defender UI. If disallowed, all Windows Defender notifications will also be suppressed.

DefenderAllowEndUserAccess

Allows or disallows Windows Defender Intrusion Prevention functionality.

DefenderAllowIntrusionPreventionSystem

Allows or disallows Windows Defender On Access Protection functionality.

DefenderAllowOnAccessProtection

Allows or disallows Windows Defender Realtime Monitoring functionality.

DefenderAllowRealTimeMonitoring

Allows or disallows scanning of archives.

DefenderAllowScanArchiveFiles

Allows or disallows Windows Defender IOAVP Protection functionality.

DefenderAllowScanDownloads

Allows or disallows a scanning of network files.

DefenderAllowScanNetworkFiles

Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned.

DefenderAllowScanRemovableDrivesDuringFullScan

Allows or disallows Windows Defender Script Scanning functionality.

DefenderAllowScanScriptsLoadedInInternetExplorer

List of exe files and folders to be excluded from attack surface reduction rules

DefenderAttackSurfaceReductionExcludedPaths

DefenderBlockEndUserAccess

userDefined block auditMode warn disable

Value indicating the behavior ofBlock persistence through WMI event subscription. Possible values are: userDefined, block, auditMode, warn, disable.

DefenderBlockPersistenceThroughWmiType

This policy setting allows you to manage whether a check for new virus and spyware definitions will occur before running a scan.

DefenderCheckForSignaturesBeforeRunningScan

notConfigured high highPlus zeroTolerance

Added in Windows 10, version 1709. This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. This feature requires the 'Join Microsoft MAPS' setting enabled in order to function. Possible values are: notConfigured, high, highPlus, zeroTolerance.

DefenderCloudBlockLevel

Added in Windows 10, version 1709. This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. This feature depends on three other MAPS settings the must all be enabled- 'Configure the 'Block at First Sight' feature 'Join Microsoft MAPS' 'Send file samples when further analysis is required'. Valid values 0 to 50

DefenderCloudExtendedTimeoutInSeconds

Time period (in days) that quarantine items will be stored on the system. Valid values 0 to 90

DefenderDaysBeforeDeletingQuarantinedMalware

Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take.

DefenderDetectedMalwareActions

deviceDefault clean quarantine remove allow userDefined block

Indicates a Defender action to take for high severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.

HighSeverity

Indicates a Defender action to take for low severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.

LowSeverity

Indicates a Defender action to take for moderate severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.

ModerateSeverity

Indicates a Defender action to take for severe severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.

SevereSeverity

Allows or disallows Windows Defender Behavior Monitoring functionality.

DefenderDisableBehaviorMonitoring

This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time.

DefenderDisableCatchupFullScan

This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time.

DefenderDisableCatchupQuickScan

To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions.

DefenderDisableCloudProtection

Allows or disallows Windows Defender Intrusion Prevention functionality.

DefenderDisableIntrusionPreventionSystem

Allows or disallows Windows Defender On Access Protection functionality.

DefenderDisableOnAccessProtection

Allows or disallows Windows Defender Realtime Monitoring functionality.

DefenderDisableRealTimeMonitoring

Allows or disallows scanning of archives.

DefenderDisableScanArchiveFiles

Allows or disallows Windows Defender IOAVP Protection functionality.

DefenderDisableScanDownloads

Allows or disallows a scanning of network files.

DefenderDisableScanNetworkFiles

Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned.

DefenderDisableScanRemovableDrivesDuringFullScan

Allows or disallows Windows Defender Script Scanning functionality.

DefenderDisableScanScriptsLoadedInInternetExplorer

Value indicating if execution of executable content (exe, dll, ps, js, vbs, etc) should be dropped from email (webmail/mail-client). Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderEmailContentExecution

Value indicating if execution of executable content (exe, dll, ps, js, vbs, etc) should be dropped from email (webmail/mail-client). Possible values are: userDefined, block, auditMode, warn, disable.

DefenderEmailContentExecutionType

This policy setting allows you to enable or disable low CPU priority for scheduled scans.

DefenderEnableLowCpuPriority

Allows or disallows scanning of email.

DefenderEnableScanIncomingMail

Allows or disallows a full scan of mapped network drives.

DefenderEnableScanMappedNetworkDrivesDuringFullScan

Xml content containing information regarding exploit protection details.

DefenderExploitProtectionXml

Name of the file from which DefenderExploitProtectionXml was obtained.

DefenderExploitProtectionXmlFileName

File extensions to exclude from scans and real time protection.

DefenderFileExtensionsToExclude

Files and folder to exclude from scans and real time protection.

DefenderFilesAndFoldersToExclude

List of paths to exe that are allowed to access protected folders

DefenderGuardedFoldersAllowedAppPaths

userDefined enable auditMode blockDiskModification auditDiskModification

Value indicating the behavior of protected folders. Possible values are: userDefined, enable, auditMode, blockDiskModification, auditDiskModification.

DefenderGuardMyFoldersType

Value indicating the behavior of NetworkProtection. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderNetworkProtectionType

Value indicating the behavior of Office applications/macros creating or launching executable content. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderOfficeAppsExecutableContentCreationOrLaunch

Value indicating the behavior of Office applications/macros creating or launching executable content. Possible values are: userDefined, block, auditMode, warn, disable.

DefenderOfficeAppsExecutableContentCreationOrLaunchType

Value indicating the behavior of Office application launching child processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderOfficeAppsLaunchChildProcess

Value indicating the behavior of Office application launching child processes. Possible values are: userDefined, block, auditMode, warn, disable.

DefenderOfficeAppsLaunchChildProcessType

Value indicating the behavior of Office applications injecting into other processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderOfficeAppsOtherProcessInjection

Value indicating the behavior ofOffice applications injecting into other processes. Possible values are: userDefined, block, auditMode, warn, disable.

DefenderOfficeAppsOtherProcessInjectionType

Value indicating the behavior of Office communication applications, including Microsoft Outlook, from creating child processes. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderOfficeCommunicationAppsLaunchChildProcess

Value indicating the behavior of Win32 imports from Macro code in Office. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

Value indicating the behavior of Win32 imports from Macro code in Office. Possible values are: userDefined, block, auditMode, warn, disable.

Added in Windows 10, version 1607. Specifies the level of detection for potentially unwanted applications (PUAs). Windows Defender alerts you when potentially unwanted software is being downloaded or attempts to install itself on your computer. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderPotentiallyUnwantedAppAction

Value indicating if credential stealing from the Windows local security authority subsystem is permitted. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderPreventCredentialStealingType

Value indicating response to process creations originating from PSExec and WMI commands. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderProcessCreation

Value indicating response to process creations originating from PSExec and WMI commands. Possible values are: userDefined, block, auditMode, warn, disable.

DefenderProcessCreationType

Processes to exclude from scans and real time protection.

DefenderProcessesToExclude

Controls which sets of files should be monitored. Possible values are: monitorAllFiles, monitorIncomingFilesOnly, monitorOutgoingFilesOnly.

DefenderScanDirection

Represents the average CPU load factor for the Windows Defender scan (in percent). The default value is 50. Valid values 0 to 100

DefenderScanMaxCpuPercentage

Selects whether to perform a quick scan or full scan. Possible values are: userDefined, disabled, quick, full.

DefenderScanType

Selects the time of day that the Windows Defender quick scan should run. For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM. The default value is 120

DefenderScheduledQuickScanTime

userDefined everyday sunday monday tuesday wednesday thursday friday saturday noScheduledScan

Selects the day that the Windows Defender scan should run. Possible values are: userDefined, everyday, sunday, monday, tuesday, wednesday, thursday, friday, saturday, noScheduledScan.

DefenderScheduledScanDay

Selects the time of day that the Windows Defender scan should run.

DefenderScheduledScanTime

Value indicating the behavior of js/vbs executing payload downloaded from Internet. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderScriptDownloadedPayloadExecution

Value indicating the behavior of js/vbs executing payload downloaded from Internet. Possible values are: userDefined, block, auditMode, warn, disable.

DefenderScriptDownloadedPayloadExecutionType

Value indicating the behavior of obfuscated js/vbs/ps/macro code. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderScriptObfuscatedMacroCode

Value indicating the behavior of obfuscated js/vbs/ps/macro code. Possible values are: userDefined, block, auditMode, warn, disable.

DefenderScriptObfuscatedMacroCodeType

Indicates whether or not to block user from overriding Exploit Protection settings.

DefenderSecurityCenterBlockExploitProtectionOverride

Used to disable the display of the account protection area.

DefenderSecurityCenterDisableAccountUI

Used to disable the display of the app and browser protection area.

DefenderSecurityCenterDisableAppBrowserUI

Used to disable the display of the Clear TPM button.

DefenderSecurityCenterDisableClearTpmUI

Used to disable the display of the family options area.

DefenderSecurityCenterDisableFamilyUI

Used to disable the display of the hardware protection area.

DefenderSecurityCenterDisableHardwareUI

Used to disable the display of the device performance and health area.

DefenderSecurityCenterDisableHealthUI

Used to disable the display of the firewall and network protection area.

DefenderSecurityCenterDisableNetworkUI

Used to disable the display of the notification area control. The user needs to either sign out and sign in or reboot the computer for this setting to take effect.

DefenderSecurityCenterDisableNotificationAreaUI

Used to disable the display of the ransomware protection area.

DefenderSecurityCenterDisableRansomwareUI

Used to disable the display of the secure boot area under Device security.

DefenderSecurityCenterDisableSecureBootUI

Used to disable the display of the security process troubleshooting under Device security.

DefenderSecurityCenterDisableTroubleshootingUI

Used to disable the display of the virus and threat protection area.

DefenderSecurityCenterDisableVirusUI

Used to disable the display of update TPM Firmware when a vulnerable firmware is detected.

DefenderSecurityCenterDisableVulnerableTpmFirmwareUpdateUI

The email address that is displayed to users.

DefenderSecurityCenterHelpEmail

The phone number or Skype ID that is displayed to users.

DefenderSecurityCenterHelpPhone

The help portal URL this is displayed to users.

DefenderSecurityCenterHelpURL

notConfigured displayInAppAndInNotifications displayOnlyInApp displayOnlyInNotifications

Configure where to display IT contact information to end users. Possible values are: notConfigured, displayInAppAndInNotifications, displayOnlyInApp, displayOnlyInNotifications.

DefenderSecurityCenterITContactDisplay

Notifications to show from the displayed areas of app. Possible values are: notConfigured, blockNoncriticalNotifications, blockAllNotifications.

DefenderSecurityCenterNotificationsFromApp

The company name that is displayed to the users.

DefenderSecurityCenterOrganizationDisplayName

Specifies the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. Valid values 0 to 24

DefenderSignatureUpdateIntervalInHours

sendSafeSamplesAutomatically alwaysPrompt neverSend sendAllSamplesAutomatically

Checks for the user consent level in Windows Defender to send data. Possible values are: sendSafeSamplesAutomatically, alwaysPrompt, neverSend, sendAllSamplesAutomatically.

DefenderSubmitSamplesConsentType

Value indicating response to executables that don't meet a prevalence, age, or trusted list criteria. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderUntrustedExecutable

Value indicating response to executables that don't meet a prevalence, age, or trusted list criteria. Possible values are: userDefined, block, auditMode, warn, disable.

DefenderUntrustedExecutableType

Value indicating response to untrusted and unsigned processes that run from USB. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderUntrustedUSBProcess

Value indicating response to untrusted and unsigned processes that run from USB. Possible values are: userDefined, block, auditMode, warn, disable.

DefenderUntrustedUSBProcessType

This property will be deprecated in May 2019 and will be replaced with property DeviceGuardSecureBootWithDMA. Specifies whether Platform Security Level is enabled at next reboot.

DeviceGuardEnableSecureBootWithDMA

Turns On Virtualization Based Security(VBS).

DeviceGuardEnableVirtualizationBasedSecurity

Allows the IT admin to configure the launch of System Guard. Possible values are: notConfigured, enabled, disabled.

DeviceGuardLaunchSystemGuard

notConfigured enableWithUEFILock enableWithoutUEFILock disable

Turn on Credential Guard when Platform Security Level with Secure Boot and Virtualization Based Security are both enabled. Possible values are: notConfigured, enableWithUEFILock, enableWithoutUEFILock, disable.

DeviceGuardLocalSystemAuthorityCredentialGuardSettings

Specifies whether Platform Security Level is enabled at next reboot. Possible values are: notConfigured, withoutDMA, withDMA.

DeviceGuardSecureBootWithDMA

This policy is intended to provide additional security against external DMA capable devices. It allows for more control over the enumeration of external DMA capable devices incompatible with DMA Remapping/device memory isolation and sandboxing. This policy only takes effect when Kernel DMA Protection is supported and enabled by the system firmware. Kernel DMA Protection is a platform feature that cannot be controlled via policy or by end user. It has to be supported by the system at the time of manufacturing. To check if the system supports Kernel DMA Protection, please check the Kernel DMA Protection field in the Summary page of MSINFO32.exe. Possible values are: deviceDefault, blockAll, allowAll.

DmaGuardDeviceEnumerationPolicy

Blocks stateful FTP connections to the device

FirewallBlockStatefulFTP

Specify how the certificate revocation list is to be enforced. Possible values are: deviceDefault, none, attempt, require.

FirewallCertificateRevocationListCheckMethod

Configures the idle timeout for security associations, in seconds, from 300 to 3600 inclusive. This is the period after which security associations will expire and be deleted. Valid values 300 to 3600

FirewallIdleTimeoutForSecurityAssociationInSeconds

Configures IPSec exemptions to allow both IPv4 and IPv6 DHCP traffic

FirewallIPSecExemptionsAllowDHCP

Configures IPSec exemptions to allow ICMP

FirewallIPSecExemptionsAllowICMP

Configures IPSec exemptions to allow neighbor discovery IPv6 ICMP type-codes

FirewallIPSecExemptionsAllowNeighborDiscovery

Configures IPSec exemptions to allow router discovery IPv6 ICMP type-codes

FirewallIPSecExemptionsAllowRouterDiscovery

Configures IPSec exemptions to no exemptions

FirewallIPSecExemptionsNone

If an authentication set is not fully supported by a keying module, direct the module to ignore only unsupported authentication suites rather than the entire set

FirewallMergeKeyingModuleSettings

deviceDefault disabled queueInbound queueOutbound queueBoth

Configures how packet queueing should be applied in the tunnel gateway scenario. Possible values are: deviceDefault, disabled, queueInbound, queueOutbound, queueBoth.

FirewallPacketQueueingMethod

Select the preshared key encoding to be used. Possible values are: deviceDefault, none, utF8.

FirewallPreSharedKeyEncodingMethod

Configures the firewall profile settings for domain networks

FirewallProfileDomain

Configures the firewall to merge authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.

AuthorizedApplicationRulesFromGroupPolicyMerged

Configures the firewall to prevent merging authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.

AuthorizedApplicationRulesFromGroupPolicyNotMerged

Configures the firewall to merge connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.

ConnectionSecurityRulesFromGroupPolicyMerged

Configures the firewall to prevent merging connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.

ConnectionSecurityRulesFromGroupPolicyNotMerged

Configures the host device to allow or block the firewall and advanced security enforcement for the network profile. Possible values are: notConfigured, blocked, allowed.

FirewallEnabled

Configures the firewall to merge global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.

GlobalPortRulesFromGroupPolicyMerged

Configures the firewall to prevent merging global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.

GlobalPortRulesFromGroupPolicyNotMerged

Configures the firewall to block all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.

InboundConnectionsBlocked

Configures the firewall to allow all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.

InboundConnectionsRequired

Prevents the firewall from displaying notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.

InboundNotificationsBlocked

Allows the firewall to display notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.

InboundNotificationsRequired

Configures the firewall to block all incoming traffic regardless of other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.

IncomingTrafficBlocked

Configures the firewall to allow incoming traffic pursuant to other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.

IncomingTrafficRequired

Configures the firewall to block all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.

OutboundConnectionsBlocked

Configures the firewall to allow all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.

OutboundConnectionsRequired

Configures the firewall to merge Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.

PolicyRulesFromGroupPolicyMerged

Configures the firewall to prevent merging Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.

PolicyRulesFromGroupPolicyNotMerged

Configures the firewall to allow the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.

SecuredPacketExemptionAllowed

Configures the firewall to block the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.

SecuredPacketExemptionBlocked

Prevent the server from operating in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.

StealthModeBlocked

Allow the server to operate in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.

StealthModeRequired

Configures the firewall to block unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.

UnicastResponsesToMulticastBroadcastsBlocked

Configures the firewall to allow unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.

UnicastResponsesToMulticastBroadcastsRequired

Configures the firewall profile settings for private networks

FirewallProfilePrivate

Configures the firewall to merge authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.

Configures the firewall to prevent merging authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.

Configures the firewall to merge connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.

Configures the firewall to prevent merging connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.

Configures the host device to allow or block the firewall and advanced security enforcement for the network profile. Possible values are: notConfigured, blocked, allowed.

FirewallEnabled

Configures the firewall to merge global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.

GlobalPortRulesFromGroupPolicyMerged

Configures the firewall to prevent merging global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.

GlobalPortRulesFromGroupPolicyNotMerged

Configures the firewall to block all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.

InboundConnectionsBlocked

Configures the firewall to allow all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.

InboundConnectionsRequired

Prevents the firewall from displaying notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.

InboundNotificationsBlocked

Allows the firewall to display notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.

InboundNotificationsRequired

Configures the firewall to block all incoming traffic regardless of other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.

IncomingTrafficBlocked

Configures the firewall to allow incoming traffic pursuant to other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.

IncomingTrafficRequired

Configures the firewall to block all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.

OutboundConnectionsBlocked

Configures the firewall to allow all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.

OutboundConnectionsRequired

Configures the firewall to merge Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.

PolicyRulesFromGroupPolicyMerged

Configures the firewall to prevent merging Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.

PolicyRulesFromGroupPolicyNotMerged

Configures the firewall to allow the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.

SecuredPacketExemptionAllowed

Configures the firewall to block the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.

SecuredPacketExemptionBlocked

Prevent the server from operating in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.

StealthModeBlocked

Allow the server to operate in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.

StealthModeRequired

Configures the firewall to block unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.

Configures the firewall to allow unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.

Configures the firewall profile settings for public networks

FirewallProfilePublic

Configures the firewall to merge authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.

Configures the firewall to prevent merging authorized application rules from group policy with those from local store instead of ignoring the local store rules. When AuthorizedApplicationRulesFromGroupPolicyNotMerged and AuthorizedApplicationRulesFromGroupPolicyMerged are both true, AuthorizedApplicationRulesFromGroupPolicyMerged takes priority.

Configures the firewall to merge connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.

Configures the firewall to prevent merging connection security rules from group policy with those from local store instead of ignoring the local store rules. When ConnectionSecurityRulesFromGroupPolicyNotMerged and ConnectionSecurityRulesFromGroupPolicyMerged are both true, ConnectionSecurityRulesFromGroupPolicyMerged takes priority.

Configures the host device to allow or block the firewall and advanced security enforcement for the network profile. Possible values are: notConfigured, blocked, allowed.

FirewallEnabled

Configures the firewall to merge global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.

GlobalPortRulesFromGroupPolicyMerged

Configures the firewall to prevent merging global port rules from group policy with those from local store instead of ignoring the local store rules. When GlobalPortRulesFromGroupPolicyNotMerged and GlobalPortRulesFromGroupPolicyMerged are both true, GlobalPortRulesFromGroupPolicyMerged takes priority.

GlobalPortRulesFromGroupPolicyNotMerged

Configures the firewall to block all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.

InboundConnectionsBlocked

Configures the firewall to allow all incoming connections by default. When InboundConnectionsRequired and InboundConnectionsBlocked are both true, InboundConnectionsBlocked takes priority.

InboundConnectionsRequired

Prevents the firewall from displaying notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.

InboundNotificationsBlocked

Allows the firewall to display notifications when an application is blocked from listening on a port. When InboundNotificationsRequired and InboundNotificationsBlocked are both true, InboundNotificationsBlocked takes priority.

InboundNotificationsRequired

Configures the firewall to block all incoming traffic regardless of other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.

IncomingTrafficBlocked

Configures the firewall to allow incoming traffic pursuant to other policy settings. When IncomingTrafficRequired and IncomingTrafficBlocked are both true, IncomingTrafficBlocked takes priority.

IncomingTrafficRequired

Configures the firewall to block all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.

OutboundConnectionsBlocked

Configures the firewall to allow all outgoing connections by default. When OutboundConnectionsRequired and OutboundConnectionsBlocked are both true, OutboundConnectionsBlocked takes priority. This setting will get applied to Windows releases version 1809 and above.

OutboundConnectionsRequired

Configures the firewall to merge Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.

PolicyRulesFromGroupPolicyMerged

Configures the firewall to prevent merging Firewall Rule policies from group policy with those from local store instead of ignoring the local store rules. When PolicyRulesFromGroupPolicyNotMerged and PolicyRulesFromGroupPolicyMerged are both true, PolicyRulesFromGroupPolicyMerged takes priority.

PolicyRulesFromGroupPolicyNotMerged

Configures the firewall to allow the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.

SecuredPacketExemptionAllowed

Configures the firewall to block the host computer to respond to unsolicited network traffic of that traffic is secured by IPSec even when stealthModeBlocked is set to true. When SecuredPacketExemptionBlocked and SecuredPacketExemptionAllowed are both true, SecuredPacketExemptionAllowed takes priority.

SecuredPacketExemptionBlocked

Prevent the server from operating in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.

StealthModeBlocked

Allow the server to operate in stealth mode. When StealthModeRequired and StealthModeBlocked are both true, StealthModeBlocked takes priority.

StealthModeRequired

Configures the firewall to block unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.

Configures the firewall to allow unicast responses to multicast broadcast traffic. When UnicastResponsesToMulticastBroadcastsRequired and UnicastResponsesToMulticastBroadcastsBlocked are both true, UnicastResponsesToMulticastBroadcastsBlocked takes priority.

Intune Device Configuration Endpoint Protection Policy for Windows10

Schema for MSFT_MicrosoftGraphWindowsFirewallRule

The action the rule enforces. If not specified, the default is Allowed. Possible values are: notConfigured, blocked, allowed.

Action

The description of the rule.

Description

The display name of the rule. Does not need to be unique.

DisplayName

Indicates whether edge traversal is enabled or disabled for this rule. The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address. New rules have the EdgeTraversal property disabled by default. Possible values are: notConfigured, blocked, allowed.

EdgeTraversal

The full file path of an app that's affected by the firewall rule.

FilePath

The interface types of the rule. Possible values are: notConfigured, remoteAccess, wireless, lan.

InterfaceTypes

List of local addresses covered by the rule. Default is any address. Valid tokens include:'' indicates any local address. If present, this must be the only token included.A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask nor a network prefix is specified, the subnet mask defaults to 255.255.255.255.A valid IPv6 address.An IPv4 address range in the format of 'start address - end address' with no spaces included.An IPv6 address range in the format of 'start address - end address' with no spaces included.

LocalAddressRanges

List of local port ranges. For example, '100-120', '200', '300-320'. If not specified, the default is All.

LocalPortRanges

Specifies the list of authorized local users for the app container. This is a string in Security Descriptor Definition Language (SDDL) format.

LocalUserAuthorizations

The package family name of a Microsoft Store application that's affected by the firewall rule.

PackageFamilyName

Specifies the profiles to which the rule belongs. If not specified, the default is All. Possible values are: notConfigured, domain, private, public.

ProfileTypes

0-255 number representing the IP protocol (TCP = 6, UDP = 17). If not specified, the default is All. Valid values 0 to 255

Protocol

List of tokens specifying the remote addresses covered by the rule. Tokens are case insensitive. Default is any address. Valid tokens include:'' indicates any remote address. If present, this must be the only token included.'Defaultgateway''DHCP''DNS''WINS''Intranet' (supported on Windows versions 1809+)'RmtIntranet' (supported on Windows versions 1809+)'Internet' (supported on Windows versions 1809+)'Ply2Renders' (supported on Windows versions 1809+)'LocalSubnet' indicates any local address on the local subnet.A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask nor a network prefix is specified, the subnet mask defaults to 255.255.255.255.A valid IPv6 address.An IPv4 address range in the format of 'start address - end address' with no spaces included.An IPv6 address range in the format of 'start address - end address' with no spaces included.

RemoteAddressRanges

List of remote port ranges. For example, '100-120', '200', '300-320'. If not specified, the default is All.

RemotePortRanges

The name used in cases when a service, not an application, is sending or receiving traffic.

ServiceName

The traffic direction that the rule is enabled for. If not specified, the default is Out. Possible values are: notConfigured, out, in.

TrafficDirection

Configures the firewall rule settings. This collection can contain a maximum of 150 elements.

FirewallRules

This security setting determines which challenge/response authentication protocol is used for network logons. Possible values are: lmAndNltm, lmNtlmAndNtlmV2, lmAndNtlmOnly, lmAndNtlmV2, lmNtlmV2AndNotLm, lmNtlmV2AndNotLmOrNtm.

LanManagerAuthenticationLevel

If enabled,the SMB client will allow insecure guest logons. If not configured, the SMB client will reject insecure guest logons.

LanManagerWorkstationDisableInsecureGuestLogons

Define a different account name to be associated with the security identifier (SID) for the account 'Administrator'.

LocalSecurityOptionsAdministratorAccountName

notConfigured elevateWithoutPrompting promptForCredentialsOnTheSecureDesktop promptForConsentOnTheSecureDesktop promptForCredentials promptForConsent promptForConsentForNonWindowsBinaries

Define the behavior of the elevation prompt for admins in Admin Approval Mode. Possible values are: notConfigured, elevateWithoutPrompting, promptForCredentialsOnTheSecureDesktop, promptForConsentOnTheSecureDesktop, promptForCredentials, promptForConsent, promptForConsentForNonWindowsBinaries.

LocalSecurityOptionsAdministratorElevationPromptBehavior

This security setting determines whether to allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares.

LocalSecurityOptionsAllowAnonymousEnumerationOfSAMAccountsAndShares

Block PKU2U authentication requests to this device to use online identities.

Edit the default Security Descriptor Definition Language string to allow or deny users and groups to make remote calls to the SAM.

LocalSecurityOptionsAllowRemoteCallsToSecurityAccountsManager

UI helper boolean for LocalSecurityOptionsAllowRemoteCallsToSecurityAccountsManager entity

LocalSecurityOptionsAllowRemoteCallsToSecurityAccountsManagerHelperBool

This security setting determines whether a computer can be shut down without having to log on to Windows.

LocalSecurityOptionsAllowSystemToBeShutDownWithoutHavingToLogOn

Allow UIAccess apps to prompt for elevation without using the secure desktop.

LocalSecurityOptionsAllowUIAccessApplicationElevation

Allow UIAccess apps to prompt for elevation without using the secure desktop.Default is enabled

LocalSecurityOptionsAllowUIAccessApplicationsForSecureLocations

Prevent a portable computer from being undocked without having to log in.

LocalSecurityOptionsAllowUndockWithoutHavingToLogon

Prevent users from adding new Microsoft accounts to this computer.

LocalSecurityOptionsBlockMicrosoftAccounts

Enable Local accounts that are not password protected to log on from locations other than the physical device.Default is enabled

LocalSecurityOptionsBlockRemoteLogonWithBlankPassword

Enabling this settings allows only interactively logged on user to access CD-ROM media.

LocalSecurityOptionsBlockRemoteOpticalDriveAccess

Restrict installing printer drivers as part of connecting to a shared printer to admins only.

LocalSecurityOptionsBlockUsersInstallingPrinterDrivers

This security setting determines whether the virtual memory pagefile is cleared when the system is shut down.

LocalSecurityOptionsClearVirtualMemoryPageFile

This security setting determines whether packet signing is required by the SMB client component.

LocalSecurityOptionsClientDigitallySignCommunicationsAlways

If this security setting is enabled, the Server Message Block (SMB) redirector is allowed to send plaintext passwords to non-Microsoft SMB servers that do not support password encryption during authentication.

LocalSecurityOptionsClientSendUnencryptedPasswordToThirdPartySMBServers

App installations requiring elevated privileges will prompt for admin credentials.Default is enabled

LocalSecurityOptionsDetectApplicationInstallationsAndPromptForElevation

Determines whether the Local Administrator account is enabled or disabled.

LocalSecurityOptionsDisableAdministratorAccount

This security setting determines whether the SMB client attempts to negotiate SMB packet signing.

LocalSecurityOptionsDisableClientDigitallySignCommunicationsIfServerAgrees

Determines if the Guest account is enabled or disabled.

LocalSecurityOptionsDisableGuestAccount

This security setting determines whether packet signing is required by the SMB server component.

LocalSecurityOptionsDisableServerDigitallySignCommunicationsAlways

This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it.

LocalSecurityOptionsDisableServerDigitallySignCommunicationsIfClientAgrees

This security setting determines what additional permissions will be granted for anonymous connections to the computer.

LocalSecurityOptionsDoNotAllowAnonymousEnumerationOfSAMAccounts

Require CTRL+ALT+DEL to be pressed before a user can log on.

LocalSecurityOptionsDoNotRequireCtrlAltDel

This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. Its not stored by default.

LocalSecurityOptionsDoNotStoreLANManagerHashValueOnNextPasswordChange

notConfigured administrators administratorsAndPowerUsers administratorsAndInteractiveUsers

Define who is allowed to format and eject removable NTFS media. Possible values are: notConfigured, administrators, administratorsAndPowerUsers, administratorsAndInteractiveUsers.

LocalSecurityOptionsFormatAndEjectOfRemovableMediaAllowedUser

Define a different account name to be associated with the security identifier (SID) for the account 'Guest'.

LocalSecurityOptionsGuestAccountName

Do not display the username of the last person who signed in on this device.

LocalSecurityOptionsHideLastSignedInUser

Do not display the username of the person signing in to this device after credentials are entered and before the devices desktop is shown.

LocalSecurityOptionsHideUsernameAtSignIn

Configure the user information that is displayed when the session is locked. If not configured, user display name, domain and username are shown. Possible values are: notConfigured, administrators, administratorsAndPowerUsers, administratorsAndInteractiveUsers.

LocalSecurityOptionsInformationDisplayedOnLockScreen

notConfigured userDisplayNameDomainUser userDisplayNameOnly doNotDisplayUser

Configure the user information that is displayed when the session is locked. If not configured, user display name, domain and username are shown. Possible values are: notConfigured, userDisplayNameDomainUser, userDisplayNameOnly, doNotDisplayUser.

LocalSecurityOptionsInformationShownOnLockScreen

Set message text for users attempting to log in.

LocalSecurityOptionsLogOnMessageText

Set message title for users attempting to log in.

LocalSecurityOptionsLogOnMessageTitle

Define maximum minutes of inactivity on the interactive desktops login screen until the screen saver runs. Valid values 0 to 9999

LocalSecurityOptionsMachineInactivityLimit

LocalSecurityOptionsMachineInactivityLimitInMinutes

This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. Possible values are: none, requireNtmlV2SessionSecurity, require128BitEncryption, ntlmV2And128BitEncryption.

LocalSecurityOptionsMinimumSessionSecurityForNtlmSspBasedClients

This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. Possible values are: none, requireNtmlV2SessionSecurity, require128BitEncryption, ntlmV2And128BitEncryption.

LocalSecurityOptionsMinimumSessionSecurityForNtlmSspBasedServers

Enforce PKI certification path validation for a given executable file before it is permitted to run.

LocalSecurityOptionsOnlyElevateSignedExecutables

By default, this security setting restricts anonymous access to shares and pipes to the settings for named pipes that can be accessed anonymously and Shares that can be accessed anonymously

LocalSecurityOptionsRestrictAnonymousAccessToNamedPipesAndShares

noAction lockWorkstation forceLogoff disconnectRemoteDesktopSession

This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. Possible values are: noAction, lockWorkstation, forceLogoff, disconnectRemoteDesktopSession.

LocalSecurityOptionsSmartCardRemovalBehavior

notConfigured automaticallyDenyElevationRequests promptForCredentialsOnTheSecureDesktop promptForCredentials

Define the behavior of the elevation prompt for standard users. Possible values are: notConfigured, automaticallyDenyElevationRequests, promptForCredentialsOnTheSecureDesktop, promptForCredentials.

LocalSecurityOptionsStandardUserElevationPromptBehavior

Enable all elevation requests to go to the interactive user's desktop rather than the secure desktop. Prompt behavior policy settings for admins and standard users are used.

LocalSecurityOptionsSwitchToSecureDesktopWhenPromptingForElevation

Defines whether the built-in admin account uses Admin Approval Mode or runs all apps with full admin privileges.Default is enabled

LocalSecurityOptionsUseAdminApprovalMode

Define whether Admin Approval Mode and all UAC policy settings are enabled, default is enabled

LocalSecurityOptionsUseAdminApprovalModeForAdministrators

Virtualize file and registry write failures to per user locations

LocalSecurityOptionsVirtualizeFileAndRegistryWriteFailuresToPerUserLocations

Allows IT Admins to control whether users can can ignore SmartScreen warnings and run malicious files.

SmartScreenBlockOverrideForFiles

Allows IT Admins to configure SmartScreen for Windows.

SmartScreenEnableInShell

This user right is used by Credential Manager during Backup/Restore. Users' saved credentials might be compromised if this privilege is given to other entities. Only states NotConfigured and Allowed are supported

UserRightsAccessCredentialManagerAsTrustedCaller

Intune Device Configuration Endpoint Protection Policy for Windows10

Schema for MSFT_MicrosoftGraphDeviceManagementUserRightsLocalUserOrGroup

Admins description of this local user or group.

Description

The name of this local user or group.

Name

The security identifier of this local user or group (e.g. S-1-5-32-544).

SecurityIdentifier

Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.

LocalUsersOrGroups

Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.

State

This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Only states NotConfigured and Allowed are supported

UserRightsActAsPartOfTheOperatingSystem

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users and groups are allowed to connect to the computer over the network. State Allowed is supported.

UserRightsAllowAccessFromNetwork

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Only states NotConfigured and Allowed are supported

UserRightsBackupData

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users and groups are block from connecting to the computer over the network. State Block is supported.

UserRightsBlockAccessFromNetwork

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users and groups can change the time and date on the internal clock of the computer. Only states NotConfigured and Allowed are supported

UserRightsChangeSystemTime

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This security setting determines whether users can create global objects that are available to all sessions. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. Only states NotConfigured and Allowed are supported

UserRightsCreateGlobalObjects

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users and groups can call an internal API to create and change the size of a page file. Only states NotConfigured and Allowed are supported

UserRightsCreatePageFile

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which accounts can be used by processes to create a directory object using the object manager. Only states NotConfigured and Allowed are supported

UserRightsCreatePermanentSharedObjects

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines if the user can create a symbolic link from the computer to which they are logged on. Only states NotConfigured and Allowed are supported

UserRightsCreateSymbolicLinks

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users/groups can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal API to create an access token. Only states NotConfigured and Allowed are supported

UserRightsCreateToken

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users can attach a debugger to any process or to the kernel. Only states NotConfigured and Allowed are supported

UserRightsDebugPrograms

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users can set the Trusted for Delegation setting on a user or computer object. Only states NotConfigured and Allowed are supported.

UserRightsDelegation

Intune Device Configuration Endpoint Protection Policy for Windows10

Admins description of this local user or group.

Description

The name of this local user or group.

Name

The security identifier of this local user or group (e.g. S-1-5-32-544).

SecurityIdentifier

Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.

LocalUsersOrGroups

Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.

State

This user right determines which users cannot log on to the computer. States NotConfigured, Blocked are supported

UserRightsDenyLocalLogOn

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access.  Only states NotConfigured and Allowed are supported.

UserRightsGenerateSecurityAudits

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Only states NotConfigured and Allowed are supported.

UserRightsImpersonateClient

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. Only states NotConfigured and Allowed are supported.

UserRightsIncreaseSchedulingPriority

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. Only states NotConfigured and Allowed are supported.

UserRightsLoadUnloadDrivers

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users can log on to the computer. States NotConfigured, Allowed are supported

UserRightsLocalLogOn

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Only states NotConfigured and Allowed are supported.

UserRightsLockMemory

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. Only states NotConfigured and Allowed are supported.

UserRightsManageAuditingAndSecurityLogs

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users and groups can run maintenance tasks on a volume, such as remote defragmentation. Only states NotConfigured and Allowed are supported.

UserRightsManageVolumes

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines who can modify firmware environment values. Only states NotConfigured and Allowed are supported.

UserRightsModifyFirmwareEnvironment

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Only states NotConfigured and Allowed are supported.

UserRightsModifyObjectLabels

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users can use performance monitoring tools to monitor the performance of system processes. Only states NotConfigured and Allowed are supported.

UserRightsProfileSingleProcess

Intune Device Configuration Endpoint Protection Policy for Windows10

Admins description of this local user or group.

Description

The name of this local user or group.

Name

The security identifier of this local user or group (e.g. S-1-5-32-544).

SecurityIdentifier

Representing a collection of local users or groups which will be set on device if the state of this setting is Allowed. This collection can contain a maximum of 500 elements.

LocalUsersOrGroups

Representing the current state of this user rights setting. Possible values are: notConfigured, blocked, allowed.

State

This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client. Only states NotConfigured and Blocked are supported

UserRightsRemoteDesktopServicesLogOn

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service. Only states NotConfigured and Allowed are supported.

UserRightsRemoteShutdown

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Only states NotConfigured and Allowed are supported.

UserRightsRestoreData

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. Only states NotConfigured and Allowed are supported.

UserRightsTakeOwnership

Description

The name of this local user or group.

Name

SecurityIdentifier

LocalUsersOrGroups

State

Configure windows defender TamperProtection settings. Possible values are: notConfigured, enable, disable.

WindowsDefenderTamperProtection

This setting determines whether the Accessory management service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.

XboxServicesAccessoryManagementServiceStartupMode

This setting determines whether xbox game save is enabled (1) or disabled (0).

XboxServicesEnableXboxGameSaveTask

This setting determines whether Live Auth Manager service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.

XboxServicesLiveAuthManagerServiceStartupMode

This setting determines whether Live Game save service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.

XboxServicesLiveGameSaveServiceStartupMode

This setting determines whether Networking service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. Possible values are: manual, automatic, disabled.

XboxServicesLiveNetworkingServiceStartupMode

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.

SupportsScopeTags

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Firmware Interface Policy for Windows10

Schema for microsoft.intune.deviceconfigurationfirmwareinterfacepolicywindows10

Defines whether a user is allowed to enable Bluetooth. Possible values are: notConfigured, enabled, disabled.

Bluetooth

Defines whether a user is allowed to boot from built-in network adapters. Possible values are: notConfigured, enabled, disabled.

BootFromBuiltInNetworkAdapters

Defines whether a user is allowed to boot from external media. Possible values are: notConfigured, enabled, disabled.

BootFromExternalMedia

Defines whether built-in cameras are enabled. Possible values are: notConfigured, enabled, disabled.

Cameras

Defines the permission level granted to users to change UEFI settings. Possible values are: notConfiguredOnly, none.

ChangeUefiSettingsPermission

Defines whether a user is allowed to enable Front Camera. Possible values are: notConfigured, enabled, disabled.

FrontCamera

Defines whether a user is allowed to enable Infrared camera. Possible values are: notConfigured, enabled, disabled.

InfraredCamera

Defines whether a user is allowed to enable Microphone. Possible values are: notConfigured, enabled, disabled.

Microphone

Defines whether built-in microphones or speakers are enabled. Possible values are: notConfigured, enabled, disabled.

MicrophonesAndSpeakers

Defines whether a user is allowed to enable Near Field Communication. Possible values are: notConfigured, enabled, disabled.

NearFieldCommunication

Defines whether built-in radios e.g. WIFI, NFC, Bluetooth, are enabled. Possible values are: notConfigured, enabled, disabled.

Radios

Defines whether a user is allowed to enable rear camera. Possible values are: notConfigured, enabled, disabled.

RearCamera

Defines whether a user is allowed to enable SD Card Port. Possible values are: notConfigured, enabled, disabled.

SdCard

Defines whether a user is allowed to enable Simultaneous MultiThreading. Possible values are: notConfigured, enabled, disabled.

SimultaneousMultiThreading

Defines whether a user is allowed to enable USB Type A Port. Possible values are: notConfigured, enabled, disabled.

UsbTypeAPort

Defines whether CPU and IO virtualization is enabled. Possible values are: notConfigured, enabled, disabled.

VirtualizationOfCpuAndIO

Defines whether a user is allowed to enable Wake on LAN. Possible values are: notConfigured, enabled, disabled.

WakeOnLAN

Defines whether a user is allowed to enable Wake On Power. Possible values are: notConfigured, enabled, disabled.

WakeOnPower

Defines whether a user is allowed to enable WiFi. Possible values are: notConfigured, enabled, disabled.

WiFi

Defines whether a user is allowed to enable Windows Platform Binary Table. Possible values are: notConfigured, enabled, disabled.

WindowsPlatformBinaryTable

Defines whether a user is allowed to enable Wireless Wide Area Network. Possible values are: notConfigured, enabled, disabled.

WirelessWideAreaNetwork

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.

SupportsScopeTags

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Health Monitoring Configuration Policy for Windows10

Schema for microsoft.intune.deviceconfigurationhealthmonitoringconfigurationpolicywindows10

Enables device health monitoring on the device. Possible values are: notConfigured, enabled, disabled.

AllowDeviceHealthMonitoring

Specifies custom set of events collected from the device where health monitoring is enabled

ConfigDeviceHealthMonitoringCustomScope

undefined healthMonitoring bootPerformance windowsUpdates privilegeManagement

Specifies set of events collected from the device where health monitoring is enabled. Possible values are: undefined, healthMonitoring, bootPerformance, windowsUpdates, privilegeManagement.

ConfigDeviceHealthMonitoringScope

Description

DisplayName

SupportsScopeTags

Id

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments

Ensure

Intune Device Configuration Identity Protection Policy for Windows10

Schema for microsoft.intune.deviceconfigurationidentityprotectionpolicywindows10

Boolean value used to enable enhanced anti-spoofing for facial feature recognition on Windows Hello face authentication.

EnhancedAntiSpoofingForFacialFeaturesEnabled

Integer value specifies the period (in days) that a PIN can be used before the system requires the user to change it. Valid values are 0 to 730 inclusive. Valid values 0 to 730

PinExpirationInDays

This value configures the use of lowercase characters in the Windows Hello for Business PIN. Possible values are: blocked, required, allowed, notConfigured.

PinLowercaseCharactersUsage

Integer value that sets the maximum number of characters allowed for the work PIN. Valid values are 4 to 127 inclusive and greater than or equal to the value set for the minimum PIN. Valid values 4 to 127

PinMaximumLength

Integer value that sets the minimum number of characters required for the Windows Hello for Business PIN. Valid values are 4 to 127 inclusive and less than or equal to the value set for the maximum PIN. Valid values 4 to 127

PinMinimumLength

Controls the ability to prevent users from using past PINs. This must be set between 0 and 50, inclusive, and the current PIN of the user is included in that count. If set to 0, previous PINs are not stored. PIN history is not preserved through a PIN reset. Valid values 0 to 50

PinPreviousBlockCount

Boolean value that enables a user to change their PIN by using the Windows Hello for Business PIN recovery service.

PinRecoveryEnabled

Controls the ability to use special characters in the Windows Hello for Business PIN. Possible values are: blocked, required, allowed, notConfigured.

PinSpecialCharactersUsage

This value configures the use of uppercase characters in the Windows Hello for Business PIN. Possible values are: blocked, required, allowed, notConfigured.

PinUppercaseCharactersUsage

Controls whether to require a Trusted Platform Module (TPM) for provisioning Windows Hello for Business. A TPM provides an additional security benefit in that data stored on it cannot be used on other devices. If set to False, all devices can provision Windows Hello for Business even if there is not a usable TPM.

SecurityDeviceRequired

Controls the use of biometric gestures, such as face and fingerprint, as an alternative to the Windows Hello for Business PIN.  If set to False, biometric gestures are not allowed. Users must still configure a PIN as a backup in case of failures.

UnlockWithBiometricsEnabled

Boolean value that enables Windows Hello for Business to use certificates to authenticate on-premise resources.

UseCertificatesForOnPremisesAuthEnabled

Boolean value used to enable the Windows Hello security key as a logon credential.

UseSecurityKeyForSignin

Boolean value that blocks Windows Hello for Business as a method for signing into Windows.

WindowsHelloForBusinessBlocked

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.

SupportsScopeTags

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Imported Pfx Certificate Policy for Windows10

Schema for microsoft.intune.deviceconfigurationimportedpfxcertificatepolicywindows10

unassigned smimeEncryption smimeSigning vpn wifi

Intended Purpose of the Certificate Profile - which could be Unassigned, SmimeEncryption, SmimeSigning etc. Possible values are: unassigned, smimeEncryption, smimeSigning, vpn, wifi.

IntendedPurpose

Scale for the Certificate Validity Period. Possible values are: days, months, years.

CertificateValidityPeriodScale

Value for the Certificate Validity Period

CertificateValidityPeriodValue

useTpmKspOtherwiseUseSoftwareKsp useTpmKspOtherwiseFail usePassportForWorkKspOtherwiseFail useSoftwareKsp

Key Storage Provider (KSP). Possible values are: useTpmKspOtherwiseUseSoftwareKsp, useTpmKspOtherwiseFail, usePassportForWorkKspOtherwiseFail, useSoftwareKsp.

KeyStorageProvider

Certificate renewal threshold percentage. Valid values 1 to 99

RenewalThresholdPercentage

none emailAddress userPrincipalName customAzureADAttribute domainNameService universalResourceIdentifier

Certificate Subject Alternative Name Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.

SubjectAlternativeNameType

commonName commonNameIncludingEmail commonNameAsEmail custom commonNameAsIMEI commonNameAsSerialNumber commonNameAsAadDeviceId commonNameAsIntuneDeviceId commonNameAsDurableDeviceId

Certificate Subject Name Format. Possible values are: commonName, commonNameIncludingEmail, commonNameAsEmail, custom, commonNameAsIMEI, commonNameAsSerialNumber, commonNameAsAadDeviceId, commonNameAsIntuneDeviceId, commonNameAsDurableDeviceId.

SubjectNameFormat

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Kiosk Policy for Windows10

Schema for microsoft.intune.deviceconfigurationkioskpolicywindows10

Enable public browsing kiosk mode for the Microsoft Edge browser. The Default is false.

EdgeKioskEnablePublicBrowsing

Specify URLs that the kiosk browser is allowed to navigate to

KioskBrowserBlockedUrlExceptions

Specify URLs that the kiosk browsers should not navigate to

KioskBrowserBlockedURLs

Specify the default URL the browser should navigate to on launch.

KioskBrowserDefaultUrl

Enable the kiosk browser's end session button. By default, the end session button is disabled.

KioskBrowserEnableEndSessionButton

Enable the kiosk browser's home button. By default, the home button is disabled.

KioskBrowserEnableHomeButton

Enable the kiosk browser's navigation buttons(forward/back). By default, the navigation buttons are disabled.

KioskBrowserEnableNavigationButtons

Specify the number of minutes the session is idle until the kiosk browser restarts in a fresh state.  Valid values are 1-1440. Valid values 1 to 1440

KioskBrowserRestartOnIdleTimeInMinutes

Schema for MSFT_MicrosoftGraphWindowsKioskProfile

The App configuration that will be used for this kiosk configuration.

AppConfiguration

This setting allows access to Downloads folder in file explorer.

AllowAccessToDownloadsFolder

Schema for MSFT_MicrosoftGraphWindowsKioskAppBase

The app type. Possible values are: unknown, store, desktop, aumId.

AppType

Allow the app to be auto-launched in multi-app kiosk mode

AutoLaunch

Represents the friendly name of an app

Name

The app tile size for the start layout. Possible values are: hidden, small, medium, wide, large.

StartLayoutTileSize

Define the DesktopApplicationID of the app

DesktopApplicationId

Define the DesktopApplicationLinkPath of the app

DesktopApplicationLinkPath

Define the path of a desktop app

Path

This references an Intune App that will be target to the same assignments as Kiosk configuration

AppId

This is the only Application User Model ID (AUMID) that will be available to launch use while in Kiosk Mode

AppUserModelId

This references an contained App from an Intune App

ContainedAppId

This is the classicapppath to be used by v4 Win32 app while in Kiosk Mode

ClassicAppPath

Edge kiosk (url) for Edge kiosk mode

EdgeKiosk

Edge kiosk idle timeout in minutes for Edge kiosk mode. Valid values 0 to 1440

EdgeKioskIdleTimeoutMinutes

Edge kiosk type for Edge kiosk mode. Possible values are: publicBrowsing, fullScreen.

EdgeKioskType

Edge first run flag for Edge kiosk mode

EdgeNoFirstRun

The type of the entity.

odataType

These are the only Windows Store Apps that will be available to launch from the Start menu. This collection can contain a maximum of 128 elements.

Apps

This setting indicates that desktop apps are allowed. Default to true.

DisallowDesktopApps

This setting allows the admin to specify whether the Task Bar is shown or not.

ShowTaskBar

Allows admins to override the default Start layout and prevents the user from changing it.The layout is modified by specifying an XML file based on a layout modification schema. XML needs to be in Binary format.

StartMenuLayoutXml

UwpApp

AppId

AppUserModelId

ContainedAppId

AppType

AutoLaunch

Represents the friendly name of an app

Name

StartLayoutTileSize

DesktopApplicationId

DesktopApplicationLinkPath

Define the path of a desktop app

Path

ClassicAppPath

Edge kiosk (url) for Edge kiosk mode

EdgeKiosk

EdgeKioskIdleTimeoutMinutes

EdgeKioskType

Edge first run flag for Edge kiosk mode

EdgeNoFirstRun

The type of the entity.

odataType

This is the win32 app that will be available to launch use while in Kiosk Mode

Win32App

ClassicAppPath

Edge kiosk (url) for Edge kiosk mode

EdgeKiosk

EdgeKioskIdleTimeoutMinutes

EdgeKioskType

Edge first run flag for Edge kiosk mode

EdgeNoFirstRun

AppType

AutoLaunch

Represents the friendly name of an app

Name

StartLayoutTileSize

DesktopApplicationId

DesktopApplicationLinkPath

Define the path of a desktop app

Path

AppId

AppUserModelId

ContainedAppId

The type of the entity.

odataType

The type of the entity.

odataType

Key of the entity.

ProfileId

This is a friendly nameused to identify a group of applications, the layout of these apps on the start menu and the users to whom this kiosk configuration is assigned.

ProfileName

Intune Device Configuration Kiosk Policy for Windows10

Schema for MSFT_MicrosoftGraphWindowsKioskUser

The name of the AD group that will be locked to this kiosk configuration

GroupName

The display name of the AzureAD group that will be locked to this kiosk configuration

DisplayName

The ID of the AzureAD group that will be locked to this kiosk configuration

GroupId

The ID of the AzureAD user that will be locked to this kiosk configuration

UserId

The user accounts that will be locked to this kiosk configuration

UserPrincipalName

The local user that will be locked to this kiosk configuration

UserName

The type of the entity.

odataType

The user accounts that will be locked to this kiosk configuration. This collection can contain a maximum of 100 elements.

UserAccountsConfiguration

This policy setting allows to define a list of Kiosk profiles for a Kiosk configuration. This collection can contain a maximum of 3 elements.

KioskProfiles

force update schedule for Kiosk devices.

WindowsKioskForceUpdateSchedule

Day of month. Valid values 1 to 31

DayofMonth

sunday monday tuesday wednesday thursday friday saturday

Day of week. Possible values are: sunday, monday, tuesday, wednesday, thursday, friday, saturday.

DayofWeek

Recurrence schedule. Possible values are: none, daily, weekly, monthly.

Recurrence

If true, runs the task immediately if StartDateTime is in the past, else, runs at the next recurrence.

RunImmediatelyIfAfterStartDateTime

The start time for the force restart.

StartDateTime

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Network Boundary Policy for Windows10

Schema for microsoft.intune.deviceconfigurationnetworkboundarypolicywindows10

Windows Network Isolation Policy

WindowsNetworkIsolationPolicy

Schema for MSFT_MicrosoftGraphProxiedDomain1

The IP address or FQDN

IpAddressOrFQDN

Proxy IP or FQDN

Proxy

Contains a list of enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the EnterpriseInternalProxyServers policy. This collection can contain a maximum of 500 elements.

EnterpriseCloudResources

This is the comma-separated list of internal proxy servers. For example, '157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59'. These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the EnterpriseCloudResources policy to force traffic to the matched cloud resources through these proxies.

EnterpriseInternalProxyServers

Schema for MSFT_MicrosoftGraphIpRange1

IPv4 address in CIDR notation. Not nullable.

CidrAddress

Lower address.

LowerAddress

Upper address.

UpperAddress

The type of the entity.

odataType

Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to. This collection can contain a maximum of 500 elements.

EnterpriseIPRanges

Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. Default is false.

EnterpriseIPRangesAreAuthoritative

This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected. These locations will be considered a safe destination for enterprise data to be shared to.

EnterpriseNetworkDomainNames

This is a list of proxy servers. Any server not on this list is considered non-enterprise.

EnterpriseProxyServers

Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. Default is false

EnterpriseProxyServersAreAuthoritative

List of domain names that can used for work or personal resource.

NeutralDomainResources

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.

SupportsScopeTags

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Pkcs Certificate Policy for Windows10

Schema for microsoft.intune.deviceconfigurationpkcscertificatepolicywindows10

Target store certificate. Possible values are: user, machine.

CertificateStore

PKCS Certificate Template Name

CertificateTemplateName

PKCS Certification Authority

CertificationAuthority

PKCS Certification Authority Name

CertificationAuthorityName

Schema for MSFT_MicrosoftGraphCustomSubjectAlternativeName

Custom SAN Name

Name

Custom SAN Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.

SanType

Custom Subject Alternative Name Settings. This collection can contain a maximum of 500 elements.

CustomSubjectAlternativeNames

Schema for MSFT_MicrosoftGraphExtendedKeyUsage

Extended Key Usage Name

Name

Extended Key Usage Object Identifier

ObjectIdentifier

Extended Key Usage (EKU) settings. This collection can contain a maximum of 500 elements.

ExtendedKeyUsages

Custom String that defines the AAD Attribute.

SubjectAlternativeNameFormatString

Custom format to use with SubjectNameFormat = Custom. Example: CN=EmailAddress}},E=EmailAddress}},OU=Enterprise Users,O=Contoso Corporation,L=Redmond,ST=WA,C=US

SubjectNameFormatString

Scale for the Certificate Validity Period. Possible values are: days, months, years.

CertificateValidityPeriodScale

Value for the Certificate Validity Period

CertificateValidityPeriodValue

Key Storage Provider (KSP). Possible values are: useTpmKspOtherwiseUseSoftwareKsp, useTpmKspOtherwiseFail, usePassportForWorkKspOtherwiseFail, useSoftwareKsp.

KeyStorageProvider

Certificate renewal threshold percentage. Valid values 1 to 99

RenewalThresholdPercentage

Certificate Subject Alternative Name Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.

SubjectAlternativeNameType

Certificate Subject Name Format. Possible values are: commonName, commonNameIncludingEmail, commonNameAsEmail, custom, commonNameAsIMEI, commonNameAsSerialNumber, commonNameAsAadDeviceId, commonNameAsIntuneDeviceId, commonNameAsDurableDeviceId.

SubjectNameFormat

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.

Schema for microsoft.intune.deviceconfigurationpolicyandroiddeviceadministrator

Id of the Intune policy.

Id

Display name of the Intune policy.

DisplayName

Description of the Intune policy.

Description

Block clipboard sharing between apps (Samsung KNOX Standard 4.0+).

AppsBlockClipboardSharing

Block copy and paste functionality.

AppsBlockCopyPaste

Block YouTube (Samsung KNOX Standard 4.0+).

AppsBlockYouTube

Schema for MSFT_MicrosoftGraphapplistitem

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

Specify the apps that will be hidden on the device. Users cannot discover or run these apps.

AppsHideList

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

Specify the apps that users can install. Users will not be able to install apps that are not on the list.

AppsInstallAllowList

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

Specify the apps that users cannot run on their device.

AppsLaunchBlockList

Block Bluetooth (Samsung KNOX Standard 4.0+).

BluetoothBlocked

Block use of camera

CameraBlocked

Block data roaming over the cellular network (Samsung KNOX Standard 4.0+).

CellularBlockDataRoaming

Block SMS/MMS messaging functionality (Samsung KNOX Standard 4.0+).

CellularBlockMessaging

Block voice roaming over the cellular network (Samsung KNOX Standard 4.0+).

CellularBlockVoiceRoaming

Block Wi-Fi tethering (Samsung KNOX Standard 4.0+).

CellularBlockWiFiTethering

Device compliance can be viewed in the Restricted Apps Compliance report.

CompliantAppListType

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

Enter the Google Play Store URL of the app you want. For example, to specify the Microsoft Remote Desktop app for Android, enter https://play.google.com/store/apps/details?id=com.microsoft.rdc.android. To find the URL of an app, use a search engine to locate the store page. For example, to find the Remote Desktop app, you could search Microsoft Remote Desktop Play Store.

CompliantAppsList

Block user from changing date and time on device (Samsung KNOX).

DateAndTimeBlockChanges

Allow multiple users to log into the Company Portal using their AAD credentials (Samsung KNOX Standard 4.0+).

DeviceSharingAllowed

Block submitting diagnostic data from device.

DiagnosticDataBlockSubmission

Block factory reset on device.

FactoryResetBlocked

Block Google account auto sync functionality on device.

GoogleAccountBlockAutoSync

Block Google Play store (Samsung KNOX Standard 4.0+).

GooglePlayStoreBlocked

This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

Kiosk mode apps

KioskModeApps

Kiosk mode block sleep button

KioskModeBlockSleepButton

Kiosk mode block volume buttons

KioskModeBlockVolumeButtons

Location services blocked

LocationServicesBlocked

Block Near Field Communication (NFC) technology (Samsung KNOX Standard 4.0+).

NfcBlocked

Block using fingerprint to unlock device.

PasswordBlockFingerprintUnlock

Block Smart Lock or other trust agents from adjusting lock screen settings (Samsung KNOX Standard 5.0+).

PasswordBlockTrustAgents

Number of days until device password must be changed. (1-365)

PasswordExpirationDays

Minimum number of digits or characters in password. (4-16)

PasswordMinimumLength

Maximum minutes of inactivity until screen locks. Ignored by device if new time is longer than what's currently set on device. If set to Immediately, devices will use the minimum possible value per device.

PasswordMinutesOfInactivityBeforeScreenTimeout

Number of new passwords that must be used until an old one can be reused.

PasswordPreviousPasswordBlockCount

Require password to access device.

PasswordRequired

deviceDefault alphabetic alphanumeric alphanumericWithSymbols lowSecurityBiometric numeric numericComplex any

Specify the type of password required.

PasswordRequiredType

Number of consecutive times an incorrect password can be entered before device is wiped of all data.

PasswordSignInFailureCountBeforeFactoryReset

Block user from powering off device. If this setting is disabled the setting 'Number of sign-in failures before wiping device' does not function.

PowerOffBlocked

Define the password complexity.

RequiredPasswordComplexity

Block capturing contents of screen as an image.

ScreenCaptureBlocked

Security require verify apps

SecurityRequireVerifyApps

Block sync with Google backup.

StorageBlockGoogleBackup

Block removable storage usage (Samsung KNOX Standard 4.0+).

StorageBlockRemovableStorage

Require encryption on device. Not all devices support encryption.

StorageRequireDeviceEncryption

Storage cards must be encrypted. Not all devices support storage card encryption. For more information, see the device and mobile operating system documentation.

StorageRequireRemovableStorageEncryption

Block voice assistant (Samsung KNOX Standard 4.0+).

VoiceAssistantBlocked

Block voice dialing (Samsung KNOX Standard 4.0+).

VoiceDialingBlocked

Block autofill.

WebBrowserBlockAutofill

Block web browser on device.

WebBrowserBlocked

Block JavaScript in the browser.

WebBrowserBlockJavaScript

Block pop-ups in web browser.

WebBrowserBlockPopups

browserDefault blockAlways allowCurrentWebSite allowFromWebsitesVisited allowAlways

Allow or block browser cookies

WebBrowserCookieSettings

Block Wi-Fi (Samsung KNOX Standard 4.0+).

WiFiBlocked

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures an Intune Device Configuration Policy Android Device Owner.

Schema for microsoft.intune.deviceconfigurationpolicyandroiddeviceowner

The Id of the policy.

Id

The display name of the policy.

DisplayName

The description of the policy.

Description

Block modification of accounts. Only supported on Dedicated devices.

AccountsBlockModification

When allowed, users can enable the 'unknown sources' setting to install apps from sources other than the Google Play Store.

AppsAllowInstallFromUnknownSources

notConfigured userChoice never wiFiOnly always

Devices check for app updates daily. The default behavior is to let device users decide. They'll be able to set their preferences in the managed Google Play app.

AppsAutoUpdatePolicy

Define the default permission policy for requests for runtime permissions.

AppsDefaultPermissionPolicy

Enable a suggestion to apps that they skip their user tutorials and any introductory hints when they first start up, if applicable.

AppsRecommendSkippingFirstUseHints

This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

A list of managed apps that will have their data cleared during a global sign-out in AAD shared device mode. This collection can contain a maximum of 500 elements.

AzureAdSharedDeviceDataClearApps

Block configuring Bluetooth.

BluetoothBlockConfiguration

Block access to work contacts from another device such as a car system when an Android device is paired via Bluetooth.

BluetoothBlockContactSharing

Block all cameras on the device

CameraBlocked

Block tethering and access to portable hotspots.

CellularBlockWiFiTethering

Blocks users from making any changes to credentials associated with certificates associated with certificates assigned to them.

CertificateCredentialConfigurationDisabled

Indicates whether or not text copied from one profile (personal or work) can be pasted in the other.

CrossProfilePoliciesAllowCopyPaste

notConfigured crossProfileDataSharingBlocked dataSharingFromWorkToPersonalBlocked crossProfileDataSharingAllowed unkownFutureValue

Indicates whether data from one profile (personal or work) can be shared with apps in the other profile.

CrossProfilePoliciesAllowDataSharing

Indicates whether or not contacts stored in work profile are shown in personal profile contact searches/incoming calls.

CrossProfilePoliciesShowWorkContactsInPersonalProfile

Block data roaming.

DataRoamingBlocked

Block user from manually setting the date and time.

DateTimeConfigurationBlocked

Represents the customized detailed help text provided to users when they attempt to modify managed settings on their device.

DetailedHelpText

The default message displayed if the user's locale doesn't match with any of the localized messages.

defaultMessage

This resource configures an Intune Device Configuration Policy Android Device Owner.

Schema for MSFT_MicrosoftGraphkeyvaluepair

Name of the message localizedMessages.

Name

Value of the message localizedMessages.

Value

The list of <locale, message> pairs. This collection can contain a maximum of 500 elements.

localizedMessages

Represents the customized lock screen message provided to users when they attempt to modify managed settings on their device.

DeviceOwnerLockScreenMessage

defaultMessage

Name of the message localizedMessages.

Name

Value of the message localizedMessages.

Value

localizedMessages

Represents the enrollment profile type.

EnrollmentProfile

Block factory resetting from settings.

FactoryResetBlocked

Email addresses of device admins for factory reset protection. When a device is factory reset, it will require that one of these admins log in with their Google account to unlock the device. If none are specified, factory reset protection is not enabled.

FactoryResetDeviceAdministratorEmails

Proxy is set up directly with host, port and excluded hosts.

GlobalProxy

The type of the global proxy.

odataType

The proxy auto-config URL.

proxyAutoConfigURL

The excluded hosts.

excludedHosts

The host name.

host

The port.

port

Blocking prevents users from adding their personal Google account to their device.

GoogleAccountsBlocked

Indicates whether a user can access the device's Settings app while in Kiosk Mode.

KioskCustomizationDeviceSettingsBlocked

Whether the power menu is shown when a user long presses the Power button of a device in Kiosk Mode.

KioskCustomizationPowerButtonActionsBlocked

Indicates whether system info and notifications are disabled in Kiosk Mode

KioskCustomizationStatusBar

Indicates whether system error dialogs for crashed or unresponsive apps are shown in Kiosk Mode.

KioskCustomizationSystemErrorWarnings

Indicates which navigation features are enabled in Kiosk Mode.

KioskCustomizationSystemNavigation

Whether or not to enable app ordering in Kiosk Mode.

KioskModeAppOrderEnabled

Schema for MSFT_MicrosoftGraphandroiddeviceownerkioskmodeapppositionitem

Item to be arranged.

item

Type of the item.

odataType

The folder identifier.

folderIdentifier

The folder name.

folderName

Schema for MSFT_MicrosoftGraphandroiddeviceownerkioskmodefolderitem

The type of the item.

odataType

The class name of the item.

className

The package of the item.

package

The label of the item.

label

The link of the item.

link

Item to be arranged.

items

The class name of the item.

className

The package of the item.

package

The label of the item.

label

The link of the item.

link

Position of the item on the grid. Valid values 0 to 9999999.

position

The ordering of items on Kiosk Mode Managed Home Screen. This collection can contain a maximum of 500 elements.

KioskModeAppPositions

This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

A list of managed apps that will be shown when the device is in Kiosk Mode. This collection can contain a maximum of 500 elements.

KioskModeApps

Whether or not to alphabetize applications within a folder in Kiosk Mode.

KioskModeAppsInFolderOrderedByName

Enable end-users to configure and pair devices over Bluetooth.

KioskModeBluetoothConfigurationEnabled

Whether or not to allow a user to easy access to the debug menu in Kiosk Mode

KioskModeDebugMenuEasyAccessEnabled

The 4-6 digit PIN will be the code an IT administrator enters on a multi-app dedicated device to pause kiosk mode.

KioskModeExitCode

Whether or not to allow a user to use the flashlight in Kiosk Mode.

KioskModeFlashlightConfigurationEnabled

notConfigured darkSquare darkCircle lightSquare lightCircle

Folder icon configuration for managed home screen in Kiosk Mode.

KioskModeFolderIcon

Number of rows for Managed Home Screen grid with app ordering enabled in Kiosk Mode. Valid values 1 to 9999999.

KioskModeGridHeight

Number of columns for Managed Home Screen grid with app ordering enabled in Kiosk Mode. Valid values 1 to 9999999.

KioskModeGridWidth

notConfigured smallest small regular large largest

Icon size configuration for managed home screen in Kiosk Mode.

KioskModeIconSize

Whether or not to lock home screen to the end user in Kiosk Mode.

KioskModeLockHomeScreen

This resource configures an Intune Device Configuration Policy Android Device Owner.

Schema for MSFT_MicrosoftGraphandroiddeviceownerkioskmodemanagedfolder

The folder identifier.

folderIdentifier

The folder name.

folderName

The type of the item.

odataType

The class name of the item.

className

The package of the item.

package

The label of the item.

label

The link of the item.

link

Item to be arranged.

items

A list of managed folders for a device in Kiosk Mode. This collection can contain a maximum of 500 elements.

KioskModeManagedFolders

Whether or not to automatically sign-out of MHS and Shared device mode applications after inactive for Managed Home Screen.

KioskModeManagedHomeScreenAutoSignout

Number of seconds to give user notice before automatically signing them out for Managed Home Screen. Valid values 0 to 9999999.

KioskModeManagedHomeScreenInactiveSignOutDelayInSeconds

Number of seconds device is inactive before automatically signing user out for Managed Home Screen. Valid values 0 to 9999999.

KioskModeManagedHomeScreenInactiveSignOutNoticeInSeconds

Complexity of PIN for sign-in session for Managed Home Screen.

KioskModeManagedHomeScreenPinComplexity

Whether or not require user to set a PIN for sign-in session for Managed Home Screen.

KioskModeManagedHomeScreenPinRequired

Whether or not required user to enter session PIN if screensaver has appeared for Managed Home Screen.

KioskModeManagedHomeScreenPinRequiredToResume

Custom URL background for sign-in screen for Managed Home Screen.

KioskModeManagedHomeScreenSignInBackground

Custom URL branding logo for sign-in screen and session pin page for Managed Home Screen.

KioskModeManagedHomeScreenSignInBrandingLogo

Whether or not show sign-in screen for Managed Home Screen.

KioskModeManagedHomeScreenSignInEnabled

Whether or not to use single app kiosk mode or multi-app kiosk mode.

KioskModeManagedSettingsEntryDisabled

Whether or not to allow a user to change the media volume in Kiosk Mode.

KioskModeMediaVolumeConfigurationEnabled

notConfigured portrait landscape autoRotate

Screen orientation configuration for managed home screen in Kiosk Mode.

KioskModeScreenOrientation

Start screen saver when the device screen times out or locks.

KioskModeScreenSaverConfigurationEnabled

Whether or not the device screen should show the screen saver if audio/video is playing in Kiosk Mode.

KioskModeScreenSaverDetectMediaDisabled

The number of seconds that the device will display the screen saver for in Kiosk Mode. Valid values 0 to 9999999

KioskModeScreenSaverDisplayTimeInSeconds

URL for an image that will be the device's screen saver in Kiosk Mode.

KioskModeScreenSaverImageUrl

The number of seconds the device needs to be inactive for before the screen saver is shown in Kiosk Mode. Valid values 1 to 9999999

KioskModeScreenSaverStartDelayInSeconds

Whether or not to display application notification badges in Kiosk Mode.

KioskModeShowAppNotificationBadge

Whether or not to allow a user to access basic device information.

KioskModeShowDeviceInfo

KioskModeUseManagedHomeScreenApp

Enable IT administrators to temporarily leave multi-app kiosk mode to make changes on the device.

KioskModeVirtualHomeButtonEnabled

Enable a soft-key button that returns users to the Managed Home Screen. Choose between a persistent, floating button or a button activated by a swipe-up gesture.

KioskModeVirtualHomeButtonType

Customize the appearance of the screen background for assigned groups.

KioskModeWallpaperUrl

The restricted set of WIFI SSIDs available for the user to configure in Kiosk Mode. This collection can contain a maximum of 500 elements.

KioskModeWifiAllowedSsids

Enable end-users to connect to different Wi-Fi networks.

KioskModeWiFiConfigurationEnabled

Block unmuting the microphone and adjusting the microphone volume.

MicrophoneForceMute

Indicates whether or not to you want configure Microsoft Launcher.

MicrosoftLauncherConfigurationEnabled

Indicates whether or not the user can modify the wallpaper to personalize their device.

MicrosoftLauncherCustomWallpaperAllowUserModification

Indicates whether or not to configure the wallpaper on the targeted devices.

MicrosoftLauncherCustomWallpaperEnabled

Indicates the URL for the image file to use as the wallpaper on the targeted devices.

MicrosoftLauncherCustomWallpaperImageUrl

Indicates whether or not the user can modify the device dock configuration on the device.

MicrosoftLauncherDockPresenceAllowUserModification

Indicates whether or not you want to configure the device dock.

MicrosoftLauncherDockPresenceConfiguration

Indicates whether or not the user can modify the launcher feed on the device.

MicrosoftLauncherFeedAllowUserModification

MicrosoftLauncherFeedEnabled

MicrosoftLauncherSearchBarPlacementConfiguration

Whether the network escape hatch is enabled. If a network connection can't be made at boot time, the escape hatch prompts the user to temporarily connect to a network in order to refresh the device policy. After applying policy, the temporary network will be forgotten and the device will continue booting. This prevents being unable to connect to a network if there is no suitable network in the last policy and the device boots into an app in lock task mode, or the user is otherwise unable to reach device settings.

NetworkEscapeHatchAllowed

Block usage of NFC to beam data from apps.

NfcBlockOutgoingBeam

Disable lock screen

PasswordBlockKeyguard

notConfigured camera notifications unredactedNotifications trustAgents fingerprint remoteInput allFeatures face iris biometrics

These features are accessible to users when the device is locked. Users will not be able to see or access disabled features.

PasswordBlockKeyguardFeatures

Number of days until device password must be changed. (1-365)

PasswordExpirationDays

Indicates the minimum length of the password required on the device. Valid values 4 to 16

PasswordMinimumLength

Indicates the minimum number of letter characters required for device password. Valid values 1 to 16

PasswordMinimumLetterCharacters

Indicates the minimum number of lower case characters required for device password. Valid values 1 to 16

PasswordMinimumLowerCaseCharacters

Indicates the minimum number of non-letter characters required for device password. Valid values 1 to 16

PasswordMinimumNonLetterCharacters

Indicates the minimum number of numeric characters required for device password. Valid values 1 to 16

PasswordMinimumNumericCharacters

Indicates the minimum number of symbol characters required for device password. Valid values 1 to 16

PasswordMinimumSymbolCharacters

Indicates the minimum number of upper case letter characters required for device password. Valid values 1 to 16

PasswordMinimumUpperCaseCharacters

Maximum time after which the device will lock. Can disable screen lock as well so that it never times out.

PasswordMinutesOfInactivityBeforeScreenTimeout

Enter the number of unique passwords required before a user can reuse an old one. (1-24)

PasswordPreviousPasswordCountToBlock

deviceDefault required numeric numericComplex alphabetic alphanumeric alphanumericWithSymbols lowSecurityBiometric customPassword

Set the password's complexity requirements. Additional password requirements will become available based on your selection.

PasswordRequiredType

Indicates the timeout period after which a device must be unlocked using a form of strong authentication.

PasswordRequireUnlock

Number of consecutive times an incorrect password can be entered before device is wiped of all data. (4-11)

PasswordSignInFailureCountBeforeFactoryReset

Indicates whether the user can install apps from unknown sources on the personal profile.

PersonalProfileAppsAllowInstallFromUnknownSources

Indicates whether to disable the use of the camera on the personal profile.

PersonalProfileCameraBlocked

This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.

Schema for MSFT_MicrosoftGraphapplistitem

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

Policy applied to applications in the personal profile. This collection can contain a maximum of 500 elements.

PersonalProfilePersonalApplications

Used together with PersonalProfilePersonalApplications to control how apps in the personal profile are allowed or blocked

PersonalProfilePlayStoreMode

Indicates whether to disable the capability to take screenshots on the personal profile.

PersonalProfileScreenCaptureBlocked

Users get access to all apps, except the ones you've required uninstall in Client Apps. If you choose 'Not configured' for this setting, users can only access the apps you've listed as available or required in Client Apps.

PlayStoreMode

Block screen capture

ScreenCaptureBlocked

Represents the security common criteria mode enabled provided to users when they attempt to modify managed settings on their device.

SecurityCommonCriteriaModeEnabled

Indicates whether or not the user is allowed to access developer settings like developer options and safe boot on the device.

SecurityDeveloperSettingsEnabled

Enable Google Play Protect to scan apps before and after they're installed. If it detects a threat, it might warn the user to remove the app from the device. Required by default.

SecurityRequireVerifyApps

Represents the customized short help text provided to users when they attempt to modify managed settings on their device.

ShortHelpText

The default message displayed if the user's locale doesn't match with any of the localized messages.

defaultMessage

This resource configures an Intune Device Configuration Policy Android Device Owner.

Schema for MSFT_MicrosoftGraphkeyvaluepair

Name of the message localizedMessages.

Name

Value of the message localizedMessages.

Value

The list of <locale, message> pairs. This collection can contain a maximum of 500 elements.

localizedMessages

Block access to the status bar, including notifications and quick settings.

StatusBarBlocked

The battery plugged in modes for which the device stays on. When using this setting, it is recommended to clear the Time to lock screen setting so that the device doesn't lock itself while it stays on.

StayOnModes

Allow USB storage.

StorageAllowUsb

Block mounting of external media.

StorageBlockExternalMedia

Block transfer of files over USB.

StorageBlockUsbFileTransfer

Schema for MSFT_MicrosoftGraphandroiddeviceownersystemupdatefreezeperiod

The day of the end date of the freeze period. Valid values 1 to 31.

endDay

The month of the end date of the freeze period. Valid values 1 to 12.

endMonth

The day of the start date of the freeze period. Valid values 1 to 31.

startDay

The month of the start date of the freeze period. Valid values 1 to 12.

startMonth

Indicates the annually repeating time periods during which system updates are postponed. This collection can contain a maximum of 500 elements.

SystemUpdateFreezePeriods

deviceDefault postpone windowed automatic

When over-the-air updates are available for this device, they will be installed based on this policy.?

SystemUpdateInstallType

End of the maintenance window in the device's time zone.?

SystemUpdateWindowEndMinutesAfterMidnight

Beginning of the maintenance window in the device's time zone.?

SystemUpdateWindowStartMinutesAfterMidnight

Disable window notifications such as toasts, incoming calls, outgoing calls, system alerts, and system errors.?

SystemWindowsBlocked

Blocks users from adding and signing in to personal accounts while on the device.

UsersBlockAdd

Block removal of users.

UsersBlockRemove

Block changes to volume.

VolumeBlockAdjustment

Enabling this forces all network traffic through the VPN tunnel. If a connection to the VPN can't be established, no network traffic will be allowed.

VpnAlwaysOnLockdownMode

Android app package name for app that will handle an always-on VPN connection.

VpnAlwaysOnPackageIdentifier

Block user creation or editing of any Wi-Fi configurations.

WifiBlockEditConfigurations

Block changes to Wi-Fi configurations created by the device owner. Users can create their own Wi-Fi configurations.

WifiBlockEditPolicyDefinedConfigurations

Indicates the number of days that a work profile password can be set before it expires and a new password will be required. Valid values 1 to 365

WorkProfilePasswordExpirationDays

Indicates the minimum length of the work profile password. Valid values 4 to 16

WorkProfilePasswordMinimumLength

Indicates the minimum number of numeric characters required for the work profile password. Valid values 1 to 16

WorkProfilePasswordMinimumLetterCharacters

Indicates the minimum number of non-letter characters required for the work profile password. Valid values 1 to 16

WorkProfilePasswordMinimumLowerCaseCharacters

Indicates the minimum number of letter characters required for the work profile password. Valid values 1 to 16

WorkProfilePasswordMinimumNonLetterCharacters

Indicates the minimum number of lower-case characters required for the work profile password. Valid values 1 to 16

WorkProfilePasswordMinimumNumericCharacters

Indicates the minimum number of upper-case letter characters required for the work profile password. Valid values 1 to 16

WorkProfilePasswordMinimumSymbolCharacters

Indicates the minimum number of symbol characters required for the work profile password. Valid values 1 to 16

WorkProfilePasswordMinimumUpperCaseCharacters

Indicates the length of the work profile password history, where the user will not be able to enter a new password that is the same as any password in the history. Valid values 0 to 24

WorkProfilePasswordPreviousPasswordCountToBlock

Indicates the minimum password quality required on the work profile password.

WorkProfilePasswordRequiredType

Indicates the timeout period after which a work profile must be unlocked using a form of strong authentication.

WorkProfilePasswordRequireUnlock

Indicates the number of times a user can enter an incorrect work profile password before the device is wiped. Valid values 4 to 11

WorkProfilePasswordSignInFailureCountBeforeFactoryReset

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures an Intune device configuration profile for an Android Open Source Project Device.

Schema for microsoft.intune.deviceconfigurationpolicyandroidopensourceproject

Id of the Intune policy.

Id

Display name of the Intune policy.

DisplayName

Description of the Intune policy.

Description

Prevent applications from unknown sources.

AppsBlockInstallFromUnknownSources

Prevent bluetooth configuration.

BluetoothBlockConfiguration

Prevents using Bluetooth on devices.

BluetoothBlocked

Prevents access to the device camera.

CameraBlocked

Prevent factory reset.

FactoryResetBlocked

Minimum number of characters required for the password.

PasswordMinimumLength

Maximum minutes of inactivity until screen locks.

PasswordMinutesOfInactivityBeforeScreenTimeout

Set password complexity.

PasswordRequiredType

Number of sign-in failures before wiping device.

PasswordSignInFailureCountBeforeFactoryReset

Prevent screen capture.

ScreenCaptureBlocked

Enable debugging features.

SecurityAllowDebuggingFeatures

Prevent external media.

StorageBlockExternalMedia

Prevent USB file transfer.

StorageBlockUsbFileTransfer

Prevent Wifi configuration edit.

WifiBlockEditConfigurations

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments

Ensure

This resource configures an Intune device configuration profile for an Android WorkProfile Device.

Schema for microsoft.intune.deviceconfigurationpolicyandroidworkprofile

Display name of the device general configuration policy for Android WorkProfile.

DisplayName

Description of the device general configuration policy for Android WorkProfile

Description

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments of the Intune Policy.

Assignments

Indicates whether or not to block face unlock.

PasswordBlockFaceUnlock

Indicates whether or not to block fingerprint unlock

PasswordBlockFingerprintUnlock

Indicates whether or not to block iris unlock.

PasswordBlockIrisUnlock

Indicates whether or not to block Smart Lock and other trust agents.

passwordBlockTrustAgents

Number of days before the password expires

PasswordExpirationDays

Minimum length of passwords

PasswordMinimumLength

Minutes of inactivity before the screen times out

Number of previous passwords to block

PasswordPreviousPasswordBlockCount

Number of sign in failures allowed before factory reset

deviceDefault lowSecurityBiometric required atLeastNumeric numericComplex atLeastAlphabetic atLeastAlphanumeric alphanumericWithSymbols

Type of password that is required

PasswordRequiredType

Indicates the required device password complexity on Android. One of: NONE, LOW, MEDIUM, HIGH.

RequiredPasswordComplexity

Indicates whether to allow installation of apps from unknown sources.

WorkProfileAllowAppInstallsFromUnknownSources

deviceDefault preventAny allowPersonalToWork noRestrictions

Type of data sharing that is allowed

WorkProfileDataSharingType

Indicates whether or not to block notifications while device locked

WorkProfileBlockNotificationsWhileDeviceLocked

Block users from adding/removing accounts in work profile

WorkProfileBlockAddingAccounts

Allow bluetooth devices to access enterprise contacts

WorkProfileBluetoothEnableContactSharing

Block screen capture in work profile

WorkProfileBlockScreenCapture

Block display work profile caller ID in personal profile

WorkProfileBlockCrossProfileCallerId

Block work profile camera

WorkProfileBlockCamera

Block work profile contacts availability in personal profile

WorkProfileBlockCrossProfileContactsSearch

Boolean that indicates if the setting disallow cross profile copy paste is enabled

WorkProfileBlockCrossProfileCopyPaste

Type of password that is required

WorkProfileDefaultAppPermissionPolicy

Indicates whether or not to block face unlock in work profile.

WorkProfilePasswordBlockFaceUnlock

Indicates whether or not to block fingerprint unlock in work profile

WorkProfilePasswordBlockFingerprintUnlock

Indicates whether or not to block iris unlock in work profile.

WorkProfilePasswordBlockIrisUnlock

Indicates whether or not to block Smart Lock and other trust agents for work profile

WorkProfilePasswordBlockTrustAgents

Number of days before the work profile password expires

WorkProfilePasswordExpirationDays

Minimum length of work profile password

WorkProfilePasswordMinimumLength

Minimum count of numeric characters required in work profile password

WorkProfilePasswordMinNumericCharacters

Minimum count of non-letter characters required in work profile password

WorkProfilePasswordMinNonLetterCharacters

Minimum count of letter characters required in work profile password

WorkProfilePasswordMinLetterCharacters

Minimum count of lower-case characters required in work profile password

WorkProfilePasswordMinLowerCaseCharacters

Minimum count of upper-case characters required in work profile password

WorkProfilePasswordMinUpperCaseCharacters

Minimum count of symbols required in work profile password

WorkProfilePasswordMinSymbolCharacters

Minutes of inactivity before the screen times out

WorkProfilePasswordMinutesOfInactivityBeforeScreenTimeout

Number of previous work profile passwords to block

WorkProfilePasswordPreviousPasswordBlockCount

Number of sign in failures allowed before work profile is removed and all corporate data deleted

WorkProfilePasswordSignInFailureCountBeforeFactoryReset

Type of work profile password that is required

WorkProfilePasswordRequiredType

Indicates the required device password complexity on Android. One of: NONE, LOW, MEDIUM, HIGH in work profile.

WorkProfileRequiredPasswordComplexity

Password is required or not for work profile

WorkProfileRequirePassword

Require the Android Verify apps feature is turned on

SecurityRequireVerifyApps

Package identifier for always-on VPN.

VpnAlwaysOnPackageIdentifier

Enable lockdown mode for always-on VPN.

VpnEnableAlwaysOnLockdownMode

Allow widgets from work profile apps.

WorkProfileAllowWidgets

Prevent app installations from unknown sources in the personal profile.

WorkProfileBlockPersonalAppInstallsFromUnknownSources

Present ensures the site collection exists, absent ensures it is removed

Ensure

This resource configures an Intune Device Configuration Policy for iOS.

Schema for microsoft.intune.deviceconfigurationpolicyios

Id of the Intune policy.

Id

Display name of the Intune policy.

DisplayName

Description of the Intune policy.

Description

Indicates whether or not to allow account modification when the device is in supervised mode.

AccountBlockModification

Activation Lock makes it harder for a lost or stolen device to be reactivated.

ActivationLockAllowWhenSupervised

Indicates whether or not to allow AirDrop when the device is in supervised mode.

AirDropBlocked

Force AirDrop to be considered an unmanaged drop target.

AirDropForceUnmanagedDropTarget

Force requiring a pairing password for outgoing AirPlay requests.

AirPlayForcePairingPasswordForOutgoingRequests

Blocks keychain storage of username and password for outgoing AirPrint request.

AirPrintBlockCredentialsStorage

Blocks AirPrint request.

AirPrintBlocked

Blocking prevents malicious AirPrint Bluetooth beacons phishing for network traffic.

AirPrintBlockiBeaconDiscovery

Forces trusted certificates for TLS printing communication

AirPrintForceTrustedTLS

Block app clips.

AppClipsBlocked

Block Apple News

AppleNewsBlocked

Block Apple PersonalizedAdsBlocked

ApplePersonalizedAdsBlocked

Indicates whether or not to allow Apple Watch pairing when the device is in supervised mode (iOS 9.0 and later).

AppleWatchBlockPairing

Force paired Apple watch to use wrist detection.

AppleWatchForceWristDetection

Block app removal.

AppRemovalBlocked

This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.

Schema for MSFT_MicrosoftGraphapplistitem

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

Apps you add to this list and assign to a device can lock the device to run only that app once launched, or lock the device while a certain action is running (for example, taking a test). Once the action is complete, or you remove the restriction, the device returns to its normal state.

AppsSingleAppModeList

Blocks automatic downloading of apps purchased on other devices. Does not affect updates to existing apps.

AppStoreBlockAutomaticDownloads

For supervised devices as of iOS 13.0.

AppStoreBlocked

Block AppStore in-app purchases.

AppStoreBlockInAppPurchases

Block App Store from Home Screen. Users may continue to use iTunes or Apple Configurator to install or update apps.

AppStoreBlockUIAppInstallation

Users must enter Apple ID password for each in-app and iTunes purchase.

AppStoreRequirePassword

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

Enter the iTunes App Store URL of the app you want. For example, to specify the Microsoft Work Folders app for iOS, enter https://itunes.apple.com/us/app/work-folders/id950878067?mt=8. To find the URL of an app, use a search engine to locate the store page. For example, to find the Work Folders app, you could search Microsoft Work Folders ITunes.

AppsVisibilityList

Set whether the list is a list of apps to hide or a list of apps to make visible.

AppsVisibilityListType

Require Touch ID or Face ID before passwords or credit card information can be auto filled in Safari and Apps. Available with iOS 12.0 and later.

AutoFillForceAuthentication

Block auto unlock.

AutoUnlockBlocked

Blocking disables the ability to remove system apps from the device.

BlockSystemAppRemoval

Block modification of Bluetooth settings. To use this setting, the device must be in supervised mode (iOS 10.0+).

BluetoothBlockModification

Indicates whether or not to block the user from accessing the camera of the device. Requires a supervised device for iOS 13 and later.

CameraBlocked

Block data roaming over the cellular network. This won't show in the device's management profile, but a block will be enforced for data roaming every time the device checks in (typically every 8 hours).

CellularBlockDataRoaming

Block global background fetch while roaming over the cellular network.

CellularBlockGlobalBackgroundFetchWhileRoaming

Block changes to app cellular data usage settings.

CellularBlockPerAppDataModification

This value is available only with certain carriers. This won't show in the device's management profile, but a block will be enforced for personal hotspot every time the device checks in (typically every 8 hours). Block modification of personal hotspot in addition to this setting to ensure personal hotspot will always be blocked.

CellularBlockPersonalHotspot

For devices running iOS 12.2 and later. Users can't turn Personal Hotspot on or off. If you block this setting and block Personal Hotspot, Personal Hotspot will be turned off.

CellularBlockPersonalHotspotModification

Indicates whether or not to allow users to change the settings of the cellular plan on a supervised device.

CellularBlockPlanModification

Block voice roaming over the cellular network.

CellularBlockVoiceRoaming

Block untrusted Transport Layer Security (TLS) certificates.

CertificatesBlockUntrustedTlsCertificates

Block remote screen observation by Classroom app. To use this setting, the device must be in supervised mode (iOS 9.3+).

ClassroomAppBlockRemoteScreenObservation

Student devices enrolled in a class via the Classroom app will automatically give permission to that course's teacher to silently observe the student's screen.

ClassroomAppForceUnpromptedScreenObservation

Students can join a class without prompting the teacher.

ClassroomForceAutomaticallyJoinClasses

Requires a student enrolled in an unmanaged course via Classroom to request permission from the teacher when attempting to leave the course. Only available in iOS 11.3+

ClassroomForceRequestPermissionToLeaveClasses

Teachers can lock an app open or lock the device without first prompting the user.

ClassroomForceUnpromptedAppAndDeviceLock

Device compliance can be viewed in the Restricted Apps Compliance report.

CompliantAppListType

This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

Enter the iTunes App Store URL of the app you want. For example, to specify the Microsoft Work Folders app for iOS, enter https://itunes.apple.com/us/app/work-folders/id950878067?mt=8. To find the URL of an app, use a search engine to locate the store page. For example, to find the Work Folders app, you could search Microsoft Work Folders ITunes.

CompliantAppsList

Indicates whether or not to block the user from installing configuration profiles and certificates interactively when the device is in supervised mode.

ConfigurationProfileBlockChanges

Users can sync and add their managed contacts (including business and corporate ones) to an unmanaged app, such as the device's built-in contacts app.

ContactsAllowManagedToUnmanagedWrite

An unmanaged app, such as the device's built-in contacts app, can access contact info in a managed app, such as Outlook.

ContactsAllowUnmanagedToManagedRead

QuickPath enables continuous input on the device keyboard. Available for iOS/iPadOS 13.0 and later.

ContinuousPathKeyboardBlocked

Forces device to Set Date & Time Automatically. The device's time zone will only be updated when the device has cellular connections or wifi with location services enabled.

DateAndTimeForceSetAutomatically

Indicates whether or not to block definition lookup when the device is in supervised mode (iOS 8.1.3 and later ).

DefinitionLookupBlocked

On iOS 12.0 and later, this blocks users from setting their own Screen Time settings, which includes device restrictions. On iOS 11.4.1 and earlier, this blocks the user from enabling restrictions in the device settings. The blocking effect is the same on any supervised iOS device.

DeviceBlockEnableRestrictions

Block the use of the erase all content and settings option on the device.

DeviceBlockEraseContentAndSettings

Indicates whether or not to allow device name modification when the device is in supervised mode (iOS 9.0 and later).

DeviceBlockNameModification

Block the device from sending diagnostic and usage telemetry data.

DiagnosticDataBlockSubmission

Block the modification of the diagnostic submission and app analytics settings in the Diagnostics and Usage pane in Settings. To use this setting, the device must be in supervised mode (iOS 9.3.2+).

DiagnosticDataBlockSubmissionModification

Indicates whether or not to block the user from viewing managed documents in unmanaged apps.

DocumentsBlockManagedDocumentsInUnmanagedApps

Indicates whether or not to block the user from viewing unmanaged documents in managed apps.

DocumentsBlockUnmanagedDocumentsInManagedApps

Emails that the user sends or receives which don't match the domains you specify here will be marked as untrusted.

EmailInDomainSuffixes

Removes the Trust Enterprise Developer button in Settings->General->Profiles & Device Management.

EnterpriseAppBlockTrust

Block the changing of enterprise app trust settings.

EnterpriseAppBlockTrustModification

Indicates whether or not to backup enterprise book.

EnterpriseBookBlockBackup

Indicates whether or not to sync enterprise book metadata.

EnterpriseBookBlockMetadataSync

Indicates whether or not to allow the addition or removal of cellular plans on the eSIM of a supervised device.

EsimBlockModification

Indicates whether or not to block the user from using FaceTime. Requires a supervised device for iOS 13 and later.

FaceTimeBlocked

Using the Server Message Block (SMB) protocol, devices can access files or other resources on a network server. Available for devices running iOS and iPadOS, versions 13.0 and later.

FilesNetworkDriveAccessBlocked

Devices with access can connect to and open files on a USB drive. Available for devices running iOS and iPadOS, versions 13.0 and later.

FilesUsbDriveAccessBlocked

A Find My app feature. Available for iOS/iPadOS 13.0 and later.

FindMyDeviceInFindMyAppBlocked

Block changes to the Find My Friends app settings.

FindMyFriendsBlocked

A Find My app feature. Used to locate family and friends from an Apple device or iCloud.com. Available for iOS/iPadOS 13.0 and later.

FindMyFriendsInFindMyAppBlocked

Indicates whether or not to block the user from using Game Center when the device is in supervised mode.

GameCenterBlocked

Block adding Game Center friends. For supervised devices as of iOS 13.0.

GamingBlockGameCenterFriends

For supervised devices as of iOS 13.0.

GamingBlockMultiplayer

Host pairing allows you to control which devices the device can pair with.

HostPairingBlocked

Indicates whether or not to block the user from using the iBooks Store when the device is in supervised mode.

IBooksStoreBlocked

User will not be able to download media from the iBook store that has been tagged as erotica.

IBooksStoreBlockErotica

Handoff lets users start work on one iOS device, and continue it on another MacOS or iOS device.

ICloudBlockActivityContinuation

Block backing up device to iCloud.

ICloudBlockBackup

Blocks iCloud from syncing documents and data.

ICloudBlockDocumentSync

Block managed apps from syncing to cloud.

ICloudBlockManagedAppsSync

Any photos not fully downloaded from iCloud Photo Library to device will be removed from local storage.

ICloudBlockPhotoLibrary

Block photo stream syncing to iCloud.

ICloudBlockPhotoStreamSync

Block shared photo streaming. Blocking can cause data loss.

ICloudBlockSharedPhotoStream

Block iCloud private relay.

ICloudPrivateRelayBlocked

Require encryption on device backup.

ICloudRequireEncryptedBackup

Block iTunes.

ITunesBlocked

Block explicit iTunes music, podcast, and news content from iTunes. For supervised devices as of 13.0.

ITunesBlockExplicitContent

Block Music service. If true, Music app reverts to classic mode and Music service is disabled.

ITunesBlockMusicService

Indicates whether or not to block the user from using iTunes Radio when the device is in supervised mode (iOS 9.3 and later).

ITunesBlockRadio

Indicates whether or not to block keyboard auto-correction when the device is in supervised mode (iOS 8.1.3 and later).

KeyboardBlockAutoCorrect

Indicates whether or not to block the user from using dictation input when the device is in supervised mode.

KeyboardBlockDictation

Indicates whether or not to block predictive keyboards when device is in supervised mode (iOS 8.1.3 and later).

KeyboardBlockPredictive

Indicates whether or not to block keyboard shortcuts when the device is in supervised mode (iOS 9.0 and later).

KeyboardBlockShortcuts

Indicates whether or not to block keyboard spell-checking when the device is in supervised mode (iOS 8.1.3 and later).

KeyboardBlockSpellCheck

Disables syncing credentials stored in the Keychain to iCloud.

KeychainBlockCloudSync

Indicates whether or not to allow assistive speak while in kiosk mode.

KioskModeAllowAssistiveSpeak

Users can turn AssistiveTouch on or off.

KioskModeAllowAssistiveTouchSettings

Kiosk mode allow auto lock

KioskModeAllowAutoLock

Users can turn invert colors on or off.

KioskModeAllowColorInversionSettings

Kiosk mode allow ringer switch

KioskModeAllowRingerSwitch

Kiosk mode allow screen rotation

KioskModeAllowScreenRotation

Kiosk mode allow sleep button

KioskModeAllowSleepButton

Kiosk mode allow touchscreen

KioskModeAllowTouchscreen

Indicates whether or not to allow the user to toggle voice control in kiosk mode.

KioskModeAllowVoiceControlModification

Users can turn VoiceOver on or off.

KioskModeAllowVoiceOverSettings

Kiosk mode allow volume buttons

KioskModeAllowVolumeButtons

Users can turn zoom on or off.

KioskModeAllowZoomSettings

URL of app for kiosk mode, e.g. https://itunes.apple.com/us/app/work-folders/id950878067?mt=8

KioskModeAppStoreUrl

notConfigured appStoreApp managedApp builtInApp

Indicates type of app in kiosk mode.

KioskModeAppType

Indicates whether or not to block the auto-lock while in Kiosk Mode.

KioskModeBlockAutoLock

Indicates whether or not to block the ringer switch while in Kiosk Mode.

KioskModeBlockRingerSwitch

Indicates whether or not to block the screen rotation while in Kiosk Mode.

KioskModeBlockScreenRotation

Indicates whether or not to block the sleep button while in Kiosk Mode.

KioskModeBlockSleepButton

Indicates whether or not to block the touchscreen while in Kiosk Mode.

KioskModeBlockTouchscreen

Indicates whether or not to block the volume buttons while in Kiosk Mode.

KioskModeBlockVolumeButtons

To see a list of bundle IDs for common built-in iOS apps, see the Intune documentation.

KioskModeBuiltInAppId

Indicates whether or not to enable the voice control while in Kiosk Mode.

KioskModeEnableVoiceControl

Add managed Intune apps from the Software Node.

KioskModeManagedAppId

Indicates whether or not to enforce assistive touch while in Kiosk Mode.

KioskModeRequireAssistiveTouch

Indicates whether or not to enforce color inversion while in Kiosk Mode.

KioskModeRequireColorInversion

Indicates whether or not to enforce mono audio while in Kiosk Mode.

KioskModeRequireMonoAudio

Indicates whether or not to enforce voice control while in Kiosk Mode.

KioskModeRequireVoiceOver

Indicates whether or not to enforce zoom while in Kiosk Mode.

KioskModeRequireZoom

Indicates whether or not to block the user from using control center on the lock screen.

LockScreenBlockControlCenter

Indicates whether or not to block the user from using the notification view on the lock screen.

LockScreenBlockNotificationView

Indicates whether or not to block the user from using passbook when the device is locked.

LockScreenBlockPassbook

Indicates whether or not to block the user from using the Today View on the lock screen.

LockScreenBlockTodayView

Indicates whether or not to enforce managed pasteboard.

ManagedPasteboardRequired

Media content rating settings for apps.

MediaContentRatingApps

Media content rating settings for Australia

MediaContentRatingAustralia

allAllowed allBlocked general parentalGuidance mature agesAbove15 agesAbove18

Movies rating selected for Australia

movieRating

allAllowed allBlocked preschoolers children general parentalGuidance mature agesAbove15 agesAbove15AdultViolence

TV rating selected for Australia

tvRating

Media content rating settings for Canada

MediaContentRatingCanada

allAllowed allBlocked general parentalGuidance agesAbove14 agesAbove18 restricted

Movies rating selected for Canada

movieRating

TV rating selected for Canada

tvRating

Media content rating settings for France

MediaContentRatingFrance

Movies rating selected for France

movieRating

TV rating selected for France

tvRating

Media content rating settings for Germany

MediaContentRatingGermany

Movies rating selected for Germany

movieRating

TV rating selected for Germany

tvRating

Media content rating settings for Ireland

MediaContentRatingIreland

Movies rating selected for Ireland

movieRating

allAllowed allBlocked general children youngAdults parentalSupervision mature

TV rating selected for Ireland

tvRating

Media content rating settings for Japan

MediaContentRatingJapan

allAllowed allBlocked general parentalGuidance agesAbove15 agesAbove18

Movies rating selected for Japan

movieRating

TV rating selected for Japan

tvRating

Media content rating settings for New Zealand

MediaContentRatingNewZealand

Movies rating selected for New Zealand

movieRating

allAllowed allBlocked general parentalGuidance adults

TV rating selected for New Zealand

tvRating

Media content rating settings for United Kingdom

MediaContentRatingUnitedKingdom

allAllowed allBlocked general universalChildren parentalGuidance agesAbove12Video agesAbove12Cinema agesAbove15 adults

Movies rating selected for UK

movieRating

TV rating selected for UK

tvRating

Media content rating settings for United States

MediaContentRatingUnitedStates

allAllowed allBlocked general parentalGuidance parentalGuidance13 restricted adults

Movies rating selected for USA

movieRating

allAllowed allBlocked childrenAll childrenAbove7 general parentalGuidance childrenAbove14 adults

TV rating selected for USA

tvRating

Indicates whether or not to block the user from using the Messages app on the supervised device.

MessagesBlocked

This resource configures an Intune Device Configuration Policy for iOS.

Schema for MSFT_MicrosoftGraphiosnetworkusagerule

If set to true, corresponding managed apps will not be allowed to use cellular data at any time.

cellularDataBlocked

If set to true, corresponding managed apps will not be allowed to use cellular data when roaming.

cellularDataBlockWhenRoaming

This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.

odatatype of the item.

odataType

Kiosk mode managed app id

appId

Define the app store URL.

appStoreUrl

Define the name of the app.

name

Define the publisher of the app.

publisher

Information about the managed apps that this rule is going to apply to.

managedApps

If you don't add any managed apps, the configured settings will apply to all managed apps by default. If you add specific managed apps, the configured settings will apply to only those apps.

NetworkUsageRules

Indicates whether or not to block the user from using nfc on the supervised device.

NfcBlocked

Indicates whether or not to allow notifications settings modification (iOS 9.3 and later).

NotificationsBlockSettingsModification

Indicates whether or not to enforce on device only dictation.

OnDeviceOnlyDictationForced

Indicates whether or not to enforce on device only translation.

OnDeviceOnlyTranslationForced

Block users from adding, changing, or removing fingerprints and faces. Face ID is available in iOS 11.0 and later.

PasscodeBlockFingerprintModification

Face ID is available on iOS 11.0 and later.

PasscodeBlockFingerprintUnlock

Block passcode from being added, changed or removed. Changes to passcode restrictions will be ignored on supervised devices after blocking passcode modification.

PasscodeBlockModification

Block simple password sequences, such as 1234 or 1111.

PasscodeBlockSimple

Number of days until device password must be changed. (1-65535)

PasscodeExpirationDays

Minimum number (0-4) of non-alphanumeric characters, such as #, %, !, etc., required in the password. The default value is 0.

PasscodeMinimumCharacterSetCount

Minimum number of digits or characters in password. (4-14)

PasscodeMinimumLength

Set to 0 to require a password immediately. There is no maximum number of minutes, and this number overrides the number currently set on the device. (This compliance check is supported for devices with OS versions iOS 8.0 and above)

PasscodeMinutesOfInactivityBeforeLock

Set to 0 to use the device's minimum possible value. This number (0-60) overrides the number currently set on the device. If set to Immediately, devices will use the minimum possible value per device.

PasscodeMinutesOfInactivityBeforeScreenTimeout

Number of new passwords that must be used until an old one can be reused. (1-24)

PasscodePreviousPasscodeBlockCount

In addition to requiring a password on all devices, this setting enforces a non-simple, 6-digit password requirement (regardless of other password settings you configure) on devices that are enrolled with Apple user enrollment.

PasscodeRequired

Type of passcode that is required.

PasscodeRequiredType

Number of consecutive times an incorrect password can be entered before device is wiped of all data. (2-11)

PasscodeSignInFailureCountBeforeWipe

Indicates whether or not to block AirDrop password sharing

PasswordBlockAirDropSharing

Indicates whether or not to block password autofill.

PasswordBlockAutoFill

Indicates whether or not to block password proximity requests.

PasswordBlockProximityRequests

Allows your users to receive software updates without connecting their devices to a computer

PkiBlockOTAUpdates

Indicates whether or not to block podcasts.

PodcastsBlocked

Disables device advertising identifier

PrivacyForceLimitAdTracking

Block user's from using their Apple devices to set up and configure other Apple devices.

ProximityBlockSetupToNewDevice

Indicates whether or not to block Safari autofill.

SafariBlockAutofill

Indicates whether or not to block Safari. For supervised devices as of iOS 13.0.

SafariBlocked

Indicates whether or not to block javascript in Safari.

SafariBlockJavaScript

Indicates whether or not to block popups on Safari.

SafariBlockPopups

browserDefault blockAlways allowCurrentWebSite allowFromWebsitesVisited allowAlways

Cookie settings for Safari.

SafariCookieSettings

Documents downloaded from the URLs you specify here will be considered managed (Safari only).

SafariManagedDomains

Users can save passwords in Safari only from URLs matching the patterns you specify here. To use this setting, the device must be in supervised mode and not configured for multiple users. (iOS 9.3+)

SafariPasswordAutoFillDomains

Indicates whether or not to require fraud warning in Safari.

SafariRequireFraudWarning

Indicates whether or not to block the user from taking Screenshots

ScreenCaptureBlocked

Indicates whether or not to block temporary sessions on shared devices.

SharedDeviceBlockTemporarySessions

Indicates whether or not to block Siri.

SiriBlocked

Indicates whether or not to block Siri when locked.

SiriBlockedWhenLocked

Block Siri from querying user-generated content from the internet.

SiriBlockUserGeneratedContent

Prevents Siri from dictating, or speaking profane language.

SiriRequireProfanityFilter

Delay the user's software update for this many days. The maximum is 90 days. (1-90)

SoftwareUpdatesEnforcedDelayInDays

Delay user visibility of Software Updates. This does not impact any scheduled updates. It represents days before software updates are visible to end users after release.

SoftwareUpdatesForceDelayed

Blocks Spotlight from returning any results from an Internet search.

SpotlightBlockInternetResults

Allow users to boot devices into recovery mode with unpaired devices. Available for devices running iOS and iPadOS versions 14.5 and later.

UnpairedExternalBootToRecoveryAllowed

Blocks USB Restricted mode. USB Restricted mode blocks USB accessories from exchanging data with a device that has been locked over an hour.

UsbRestrictedModeBlocked

Indicates whether or not to block voice dialing.

VoiceDialingBlocked

Blocks the creation of VPN configurations

VpnBlockCreation

Block wallpaper from being changed.

WallpaperBlockModification

Force the device to use only Wi-Fi networks set up through configuration profiles.

WiFiConnectOnlyToConfiguredNetworks

Require devices to use Wi-Fi networks set up via configuration profiles. Available for devices running iOS and iPadOS versions 14.5 and later.

WiFiConnectToAllowedNetworksOnlyForced

Wi-Fi can't be turned off in the Settings app or in the Control Center, even when the device is in airplane mode. Available for iOS/iPadOS 13.0 and later.

WifiPowerOnForced

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures an Intune device configuration profile for an MacOS Device.

Schema for microsoft.intune.deviceconfigurationpolicymacos

Id of the Intune policy.

Id

Display name of the Intune policy.

DisplayName

Description of the Intune policy.

Description

Configures users from adding friends to Game Center. Available for devices running macOS versions 10.13 and later.

AddingGameCenterFriendsBlocked

Configures whether or not to allow AirDrop.

AirDropBlocked

Blocks users from unlocking their Mac with Apple Watch.

AppleWatchBlockAutoUnlock

Blocks users from taking photographs and videos.

CameraBlocked

Blocks AirPlay, screen sharing to other devices, and a Classroom app feature used by teachers to view their students' screens. This setting isn't available if you've blocked screenshots.

Unprompted observation means that teachers can view screens without warning students first. This setting isn't available if you've blocked screenshots.

Students can join a class without prompting the teacher.

ClassroomForceAutomaticallyJoinClasses

Students enrolled in an unmanaged Classroom course must get teacher consent to leave the course.

Teachers can lock a student's device or app without the student's approval.

Device compliance can be viewed in the Restricted Apps Compliance report.

CompliantAppListType

Schema for MSFT_MicrosoftGraphapplistitemMacOS

Specify the odataType

odataType

The application or bundle identifier of the application

appId

The Store URL of the application

appStoreUrl

The application name

name

The publisher of the application

publisher

List of apps in the compliance (either allow list or block list, controlled by CompliantAppListType).

CompliantAppsList

Configures whether or not to allow content caching.

ContentCachingBlocked

Block look up, a feature that looks up the definition of a highlighted word.

DefinitionLookupBlocked

Emails that the user sends or receives which don't match the domains you specify here will be marked as untrusted.

EmailInDomainSuffixes

Configures the reset option on supervised devices. Available for devices running macOS versions 12.0 and later.

EraseContentAndSettingsBlocked

Configured if the Game Center icon is removed from the Home screen. Available for devices running macOS versions 10.13 and later.

GameCenterBlocked

Handoff lets users start work on one MacOS device, and continue it on another MacOS or iOS device. Available for macOS 10.15 and later.

ICloudBlockActivityContinuation

Blocks iCloud from syncing contacts.

ICloudBlockAddressBook

Blocks iCloud from syncing bookmarks.

ICloudBlockBookmarks

Blocks iCloud from syncing calendars.

ICloudBlockCalendar

Blocks iCloud from syncing documents and data.

ICloudBlockDocumentSync

Blocks iCloud from syncing mail.

ICloudBlockMail

Blocks iCloud from syncing notes.

ICloudBlockNotes

Any photos not fully downloaded from iCloud Photo Library to device will be removed from local storage.

ICloudBlockPhotoLibrary

Blocks iCloud from syncing reminders.

ICloudBlockReminders

Configures if the synchronization of cloud desktop and documents is blocked. Available for devices running macOS 10.12.4 and later.

ICloudDesktopAndDocumentsBlocked

Configures if iCloud private relay is blocked or not. Available for devices running macOS 12 and later.

ICloudPrivateRelayBlocked

Blocks files from being transferred using iTunes.

ITunesBlockFileSharing

Configures  whether or not to block files from being transferred using iTunes.

ITunesBlockMusicService

Block dictation, which is a feature that converts the user's voice to text.

KeyboardBlockDictation

Disables syncing credentials stored in the Keychain to iCloud

KeychainBlockCloudSync

Configures whether multiplayer gaming when using Game Center is blocked. Available for devices running macOS versions 10.13 and later.

MultiplayerGamingBlocked

Configures whether or not to block sharing passwords with the AirDrop passwords feature.

PasswordBlockAirDropSharing

Configures whether or not to block the AutoFill Passwords feature.

PasswordBlockAutoFill

Requires user to set a non-biometric passcode or password to unlock the device.

PasswordBlockFingerprintUnlock

Blocks user from changing the set passcode.

PasswordBlockModification

Configures whether or not to block requesting passwords from nearby devices.

PasswordBlockProximityRequests

Block simple password sequences, such as 1234 or 1111.

PasswordBlockSimple

Number of days until device password must be changed. (1-65535)

PasswordExpirationDays

Configures the number of allowed failed attempts to enter the passcode at the device's lock screen. Valid values 2 to 11

PasswordMaximumAttemptCount

Minimum number (0-4) of non-alphanumeric characters, such as #, %, !, etc., required in the password. The default value is 0.

PasswordMinimumCharacterSetCount

Minimum number of digits or characters in password (4-16).

PasswordMinimumLength

Set to 0 to require a password immediately. There is no maximum number of minutes, and this number overrides the number currently set on the device.

PasswordMinutesOfInactivityBeforeLock

Set to 0 to use the device's minimum possible value. This number (0-60 minutes) overrides the number currently set on the device.

PasswordMinutesOfInactivityBeforeScreenTimeout

Configures the number of minutes before the login is reset after the maximum number of unsuccessful login attempts is reached.

PasswordMinutesUntilFailedLoginReset

Number of new passwords that must be used until an old one can be reused. (1-24)

PasswordPreviousPasswordBlockCount

Specify the type of password required.

PasswordRequired

Specify the type of password required.

PasswordRequiredType

This resource configures an Intune device configuration profile for an MacOS Device.

Schema for MSFT_MicrosoftGraphmacosprivacyaccesscontrolitem

Allow the app or process to control the Mac via the Accessibility subsystem.

accessibility

Allow or block access to contact information managed by Contacts.

addressBook

Schema for MSFT_MicrosoftGraphmacosappleeventreceiver

Allow or block this app from receiving Apple events.

allowed

Code requirement for the app or binary that receives the Apple Event.

codeRequirement

Bundle ID of the app or file path of the process or executable that receives the Apple Event.

identifier

Use bundle ID for an app or path for a process or executable that receives the Apple Event.

identifierType

Allow or deny the app or process to send a restricted Apple event to another app or process. You will need to know the identifier, identifier type, and code requirement of the receiving app or process.

appleEventsAllowedReceivers

Block access to camera app.

blockCamera

Block the app or process from listening to events from input devices such as mouse, keyboard, and trackpad.Requires macOS 10.15 or later.

blockListenEvent

Block access to microphone.

blockMicrophone

Block app from capturing contents of system display. Requires macOS 10.15 or later.

blockScreenCapture

Allow or block access to event information managed by Calendar.

calendar

Enter the code requirement, which can be obtained with the command 'codesign -display -r -' in the Terminal app. Include everything after '=>'.

codeRequirement

The display name of the app, process, or executable.

displayName

Allow the app or process to access files managed by another app's file provider extension. Requires macOS 10.15 or later.

fileProviderPresence

The bundle ID or path of the app, process, or executable.

identifier

A bundle ID is used to identify an app. A path is used to identify a process or executable.

identifierType

Allow or block access to music and the media library.

mediaLibrary

Allow or block access to images managed by Photos.

photos

Control access to CoreGraphics APIs, which are used to send CGEvents to the system event stream.

postEvent

Allow or block access to information managed by Reminders.

reminders

Allow or block access to system speech recognition facility.

speechRecognition

Statically validates the code requirement. Use this setting if the process invalidates its dynamic code signature.

staticCodeValidation

Control access to all protected files on a device. Files might be in locations such as emails, messages, apps, and administrative settings. Apply this setting with caution.

systemPolicyAllFiles

Allow or block access to Desktop folder.

systemPolicyDesktopFolder

Allow or block access to Documents folder.

systemPolicyDocumentsFolder

Allow or block access to Downloads folder.

systemPolicyDownloadsFolder

Allow or block access to network volumes. Requires macOS 10.15 or later.

systemPolicyNetworkVolumes

Control access to removable volumes on the device, such as an external hard drive. Requires macOS 10.15 or later.

systemPolicyRemovableVolumes

Allow app or process to access files used in system administration.

systemPolicySystemAdminFiles

Configure an app's access to specific data, folders, and apps on a device. These settings apply to devices running macOS Mojave 10.14 and later.

PrivacyAccessControls

Blocks Safari from remembering what users enter in web forms.

SafariBlockAutofill

Configures whether or not to block the user from taking Screenshots.

ScreenCaptureBlocked

Specify the number of days (1-90) to delay visibility of major OS software updates. Available for devices running macOS versions 11.3 and later. Valid values 0 to 90

SoftwareUpdateMajorOSDeferredInstallDelayInDays

Specify the number of days (1-90) to delay visibility of minor OS software updates. Available for devices running macOS versions 11.3 and later. Valid values 0 to 90

SoftwareUpdateMinorOSDeferredInstallDelayInDays

Specify the number of days (1-90) to delay visibility of non-OS software updates. Available for devices running macOS versions 11.3 and later. Valid values 0 to 90

SoftwareUpdateNonOSDeferredInstallDelayInDays

Delay the user's software update for this many days. The maximum is 90 days. (1-90)

SoftwareUpdatesEnforcedDelayInDays

Blocks Spotlight from returning any results from an Internet search

SpotlightBlockInternetResults

Configures the maximum hours after which the user must enter their password to unlock the device instead of using Touch ID. Available for devices running macOS 12 and later. Valid values 0 to 2147483647

TouchIdTimeoutInHours

none delayOSUpdateVisibility delayAppUpdateVisibility unknownFutureValue delayMajorOsUpdateVisibility

Configures whether to delay OS and/or app updates for macOS.

UpdateDelayPolicy

Configures whether the wallpaper can be changed. Available for devices running macOS versions 10.13 and later.

WallpaperModificationBlocked

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Policy for Windows10

Schema for microsoft.intune.deviceconfigurationpolicywindows10

Indicates whether or not to Block the user from adding email accounts to the device that are not associated with a Microsoft account.

AccountsBlockAddingNonMicrosoftAccountEmail

Specifies if Windows apps can be activated by voice. Possible values are: notConfigured, enabled, disabled.

ActivateAppsWithVoice

Indicates whether or not to block the user from selecting an AntiTheft mode preference (Windows 10 Mobile only).

AntiTheftModeBlocked

This policy setting permits users to change installation options that typically are available only to system administrators.

AppManagementMSIAllowUserControlOverInstall

This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system.

AppManagementMSIAlwaysInstallWithElevatedPrivileges

List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are to be launched after logon.

AppManagementPackageFamilyNamesToLaunchAfterLogOn

Indicates whether apps from AppX packages signed with a trusted certificate can be side loaded. Possible values are: notConfigured, blocked, allowed.

AppsAllowTrustedAppsSideloading

Indicates whether or not to disable the launch of all apps from Windows Store that came pre-installed or were downloaded.

AppsBlockWindowsStoreOriginatedApps

Allows secondary authentication devices to work with Windows.

AuthenticationAllowSecondaryDevice

Specifies the preferred domain among available domains in the Azure AD tenant.

AuthenticationPreferredAzureADTenantDomainName

Indicates whether or not Web Credential Provider will be enabled. Possible values are: notConfigured, enabled, disabled.

AuthenticationWebSignIn

Specify a list of allowed Bluetooth services and profiles in hex formatted strings.

BluetoothAllowedServices

Whether or not to Block the user from using bluetooth advertising.

BluetoothBlockAdvertising

Whether or not to Block the user from using bluetooth discoverable mode.

BluetoothBlockDiscoverableMode

Whether or not to Block the user from using bluetooth.

BluetoothBlocked

Whether or not to block specific bundled Bluetooth peripherals to automatically pair with the host device.

BluetoothBlockPrePairing

Whether or not to block the users from using Swift Pair and other proximity based scenarios.

BluetoothBlockPromptedProximalConnections

Whether or not to Block the user from accessing the camera of the device.

CameraBlocked

Whether or not to Block the user from using data over cellular while roaming.

CellularBlockDataWhenRoaming

Whether or not to Block the user from using VPN over cellular.

CellularBlockVpn

Whether or not to Block the user from using VPN when roaming over cellular.

CellularBlockVpnWhenRoaming

Whether or not to allow the cellular data channel on the device. If not configured, the cellular data channel is allowed and the user can turn it off. Possible values are: blocked, required, allowed, notConfigured.

CellularData

Whether or not to Block the user from doing manual root certificate installation.

CertificatesBlockManualRootCertificateInstallation

Specifies the time zone to be applied to the device. This is the standard Windows name for the target time zone.

ConfigureTimeZone

Whether or not to block Connected Devices Service which enables discovery and connection to other devices, remote messaging, remote app sessions and other cross-device experiences.

ConnectedDevicesServiceBlocked

Whether or not to Block the user from using copy paste.

CopyPasteBlocked

Whether or not to Block the user from using Cortana.

CortanaBlocked

Specify whether to allow or disallow the Federal Information Processing Standard (FIPS) policy.

CryptographyAllowFipsAlgorithmPolicy

This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows.

DataProtectionBlockDirectMemoryAccess

Whether or not to block end user access to Defender.

DefenderBlockEndUserAccess

Allows or disallows Windows Defender On Access Protection functionality.

DefenderBlockOnAccessProtection

notConfigured high highPlus zeroTolerance

Specifies the level of cloud-delivered protection. Possible values are: notConfigured, high, highPlus, zeroTolerance.

DefenderCloudBlockLevel

Timeout extension for file scanning by the cloud. Valid values 0 to 50

DefenderCloudExtendedTimeout

DefenderCloudExtendedTimeoutInSeconds

Number of days before deleting quarantined malware. Valid values 0 to 90

DefenderDaysBeforeDeletingQuarantinedMalware

Gets or sets Defenders actions to take on detected Malware per threat level.

DefenderDetectedMalwareActions

deviceDefault clean quarantine remove allow userDefined block

Indicates a Defender action to take for high severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.

HighSeverity

Indicates a Defender action to take for low severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.

LowSeverity

Indicates a Defender action to take for moderate severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.

ModerateSeverity

Indicates a Defender action to take for severe severity Malware threat detected. Possible values are: deviceDefault, clean, quarantine, remove, allow, userDefined, block.

SevereSeverity

When blocked, catch-up scans for scheduled full scans will be turned off.

DefenderDisableCatchupFullScan

When blocked, catch-up scans for scheduled quick scans will be turned off.

DefenderDisableCatchupQuickScan

File extensions to exclude from scans and real time protection.

DefenderFileExtensionsToExclude

Files and folder to exclude from scans and real time protection.

DefenderFilesAndFoldersToExclude

userDefined disable monitorAllFiles monitorIncomingFilesOnly monitorOutgoingFilesOnly

Value for monitoring file activity. Possible values are: userDefined, disable, monitorAllFiles, monitorIncomingFilesOnly, monitorOutgoingFilesOnly.

DefenderMonitorFileActivity

Gets or sets Defenders action to take on Potentially Unwanted Application (PUA), which includes software with behaviors of ad-injection, software bundling, persistent solicitation for payment or subscription, etc. Defender alerts user when PUA is being downloaded or attempts to install itself. Added in Windows 10 for desktop. Possible values are: deviceDefault, block, audit.

DefenderPotentiallyUnwantedAppAction

userDefined enable auditMode warn notConfigured

Gets or sets Defenders action to take on Potentially Unwanted Application (PUA), which includes software with behaviors of ad-injection, software bundling, persistent solicitation for payment or subscription, etc. Defender alerts user when PUA is being downloaded or attempts to install itself. Added in Windows 10 for desktop. Possible values are: userDefined, enable, auditMode, warn, notConfigured.

DefenderPotentiallyUnwantedAppActionSetting

Processes to exclude from scans and real time protection.

DefenderProcessesToExclude

userDefined alwaysPrompt promptBeforeSendingPersonalData neverSendData sendAllDataWithoutPrompting

The configuration for how to prompt user for sample submission. Possible values are: userDefined, alwaysPrompt, promptBeforeSendingPersonalData, neverSendData, sendAllDataWithoutPrompting.

DefenderPromptForSampleSubmission

Indicates whether or not to require behavior monitoring.

DefenderRequireBehaviorMonitoring

Indicates whether or not to require cloud protection.

DefenderRequireCloudProtection

Indicates whether or not to require network inspection system.

DefenderRequireNetworkInspectionSystem

Indicates whether or not to require real time monitoring.

DefenderRequireRealTimeMonitoring

Indicates whether or not to scan archive files.

DefenderScanArchiveFiles

Indicates whether or not to scan downloads.

DefenderScanDownloads

Indicates whether or not to scan incoming mail messages.

DefenderScanIncomingMail

Indicates whether or not to scan mapped network drives during full scan.

DefenderScanMappedNetworkDrivesDuringFullScan

Max CPU usage percentage during scan. Valid values 0 to 100

DefenderScanMaxCpu

Indicates whether or not to scan files opened from a network folder.

DefenderScanNetworkFiles

Indicates whether or not to scan removable drives during full scan.

DefenderScanRemovableDrivesDuringFullScan

Indicates whether or not to scan scripts loaded in Internet Explorer browser.

DefenderScanScriptsLoadedInInternetExplorer

The defender system scan type. Possible values are: userDefined, disabled, quick, full.

DefenderScanType

The time to perform a daily quick scan.

DefenderScheduledQuickScanTime

The defender time for the system scan.

DefenderScheduledScanTime

When enabled, low CPU priority will be used during scheduled scans.

DefenderScheduleScanEnableLowCpuPriority

The signature update interval in hours. Specify 0 not to check. Valid values 0 to 24

DefenderSignatureUpdateIntervalInHours

sendSafeSamplesAutomatically alwaysPrompt neverSend sendAllSamplesAutomatically

Checks for the user consent level in Windows Defender to send data. Possible values are: sendSafeSamplesAutomatically, alwaysPrompt, neverSend, sendAllSamplesAutomatically.

DefenderSubmitSamplesConsentType

userDefined everyday sunday monday tuesday wednesday thursday friday saturday noScheduledScan

Defender day of the week for the system scan. Possible values are: userDefined, everyday, sunday, monday, tuesday, wednesday, thursday, friday, saturday, noScheduledScan.

DefenderSystemScanSchedule

Indicates whether or not to allow developer unlock. Possible values are: notConfigured, blocked, allowed.

DeveloperUnlockSetting

Indicates whether or not to Block the user from resetting their phone.

DeviceManagementBlockFactoryResetOnMobile

Indicates whether or not to Block the user from doing manual un-enrollment from device management.

DeviceManagementBlockManualUnenroll

Gets or sets a value allowing the device to send diagnostic and usage telemetry data, such as Watson. Possible values are: userDefined, none, basic, enhanced, full.

DiagnosticsDataSubmissionMode

List of legacy applications that have GDI DPI Scaling turned off.

DisplayAppListWithGdiDPIScalingTurnedOff

List of legacy applications that have GDI DPI Scaling turned on.

DisplayAppListWithGdiDPIScalingTurnedOn

Allow users to change Start pages on Edge. Use the EdgeHomepageUrls to specify the Start pages that the user would see by default when they open Edge.

EdgeAllowStartPagesModification

Indicates whether or not to prevent access to about flags on Edge browser.

EdgeBlockAccessToAboutFlags

Block the address bar dropdown functionality in Microsoft Edge. Disable this settings to minimize network connections from Microsoft Edge to Microsoft services.

EdgeBlockAddressBarDropdown

Indicates whether or not to block auto fill.

EdgeBlockAutofill

Block Microsoft compatibility list in Microsoft Edge. This list from Microsoft helps Edge properly display sites with known compatibility issues.

EdgeBlockCompatibilityList

Indicates whether or not to block developer tools in the Edge browser.

EdgeBlockDeveloperTools

Indicates whether or not to Block the user from using the Edge browser.

EdgeBlocked

Indicates whether or not to Block the user from making changes to Favorites.

EdgeBlockEditFavorites

Indicates whether or not to block extensions in the Edge browser.

EdgeBlockExtensions

Allow or prevent Edge from entering the full screen mode.

EdgeBlockFullScreenMode

Indicates whether or not to block InPrivate browsing on corporate networks, in the Edge browser.

EdgeBlockInPrivateBrowsing

Indicates whether or not to Block the user from using JavaScript.

EdgeBlockJavaScript

Block the collection of information by Microsoft for live tile creation when users pin a site to Start from Microsoft Edge.

EdgeBlockLiveTileDataCollection

Indicates whether or not to Block password manager.

EdgeBlockPasswordManager

Indicates whether or not to block popups.

EdgeBlockPopups

Decide whether Microsoft Edge is prelaunched at Windows startup.

EdgeBlockPrelaunch

Configure Edge to allow or block printing.

EdgeBlockPrinting

Configure Edge to allow browsing history to be saved or to never save browsing history.

EdgeBlockSavingHistory

Indicates whether or not to block the user from adding new search engine or changing the default search engine.

EdgeBlockSearchEngineCustomization

Indicates whether or not to block the user from using the search suggestions in the address bar.

EdgeBlockSearchSuggestions

Indicates whether or not to Block the user from sending the do not track header.

EdgeBlockSendingDoNotTrackHeader

Indicates whether or not to switch the intranet traffic from Edge to Internet Explorer. Note: the name of this property is misleading the property is obsolete, use EdgeSendIntranetTrafficToInternetExplorer instead.

EdgeBlockSendingIntranetTrafficToInternetExplorer

Indicates whether the user can sideload extensions.

EdgeBlockSideloadingExtensions

Configure whether Edge preloads the new tab page at Windows startup.

EdgeBlockTabPreloading

Configure to load a blank page in Edge instead of the default New tab page and prevent users from changing it.

EdgeBlockWebContentOnNewTabPage

Clear browsing data on exiting Microsoft Edge.

EdgeClearBrowsingDataOnExit

userDefined allow blockThirdParty blockAll

Indicates which cookies to block in the Edge browser. Possible values are: userDefined, allow, blockThirdParty, blockAll.

EdgeCookiePolicy

Block the Microsoft web page that opens on the first use of Microsoft Edge. This policy allows enterprises, like those enrolled in zero emissions configurations, to block this page.

EdgeDisableFirstRunPage

Indicates the enterprise mode site list location. Could be a local file, local network or http location.

EdgeEnterpriseModeSiteListLocation

Get or set a value that specifies whether to set the favorites bar to always be visible or hidden on any page. Possible values are: notConfigured, hide, show.

EdgeFavoritesBarVisibility

The location of the favorites list to provision. Could be a local file, local network or http location.

EdgeFavoritesListLocation

The first run URL for when Edge browser is opened for the first time.

EdgeFirstRunUrl

Causes the Home button to either hide, load the default Start page, load a New tab page, or a custom URL

EdgeHomeButtonConfiguration

The specific URL to load.

HomeButtonCustomURL

The type of the entity.

odataType

Enable the Home button configuration.

EdgeHomeButtonConfigurationEnabled

The list of URLs for homepages shodwn on MDM-enrolled devices on Edge browser.

EdgeHomepageUrls

notConfigured digitalSignage normalMode publicBrowsingSingleApp publicBrowsingMultiApp

Controls how the Microsoft Edge settings are restricted based on the configure kiosk mode. Possible values are: notConfigured, digitalSignage, normalMode, publicBrowsingSingleApp, publicBrowsingMultiApp.

EdgeKioskModeRestriction

Specifies the time in minutes from the last user activity before Microsoft Edge kiosk resets.  Valid values are 0-1440. The default is 5. 0 indicates no reset. Valid values 0 to 1440

EdgeKioskResetAfterIdleTimeInMinutes

Specify the page opened when new tabs are created.

EdgeNewTabPageURL

notConfigured startPage newTabPage previousPages specificPages

Specify what kind of pages are open at start. Possible values are: notConfigured, startPage, newTabPage, previousPages, specificPages.

EdgeOpensWith

Allow or prevent users from overriding certificate errors.

EdgePreventCertificateErrorOverride

Specify the list of package family names of browser extensions that are required and cannot be turned off by the user.

EdgeRequiredExtensionPackageFamilyNames

Indicates whether or not to Require the user to use the smart screen filter.

EdgeRequireSmartScreen

Allows IT admins to set a default search engine for MDM-Controlled devices. Users can override this and change their default search engine provided the AllowSearchEngineCustomization policy is not set.

EdgeSearchEngine

Allows IT admins to set a predefined default search engine for MDM-Controlled devices. Possible values are: default, bing.

EdgeSearchEngineType

Points to a https link containing the OpenSearch xml file that contains, at minimum, the short name and the URL to the search Engine.

EdgeSearchEngineOpenSearchXmlUrl

The type of the entity.

odataType

Indicates whether or not to switch the intranet traffic from Edge to Internet Explorer.

EdgeSendIntranetTrafficToInternetExplorer

notConfigured disabled enabled keepGoing

Controls the message displayed by Edge before switching to Internet Explorer. Possible values are: notConfigured, disabled, enabled, keepGoing.

EdgeShowMessageWhenOpeningInternetExplorerSites

Enable favorites sync between Internet Explorer and Microsoft Edge. Additions, deletions, modifications and order changes to favorites are shared between browsers.

EdgeSyncFavoritesWithInternetExplorer

notConfigured intranet internet intranetAndInternet

Specifies what type of telemetry data (none, intranet, internet, both) is sent to Microsoft 365 Analytics. Possible values are: notConfigured, intranet, internet, intranetAndInternet.

Allow users with administrative rights to delete all user data and settings using CTRL + Win + R at the device lock screen so that the device can be automatically re-configured and re-enrolled into management.

EnableAutomaticRedeployment

This setting allows you to specify battery charge level at which Energy Saver is turned on. While on battery, Energy Saver is automatically turned on at (and below) the specified battery charge level. Valid input range (0-100). Valid values 0 to 100

EnergySaverOnBatteryThresholdPercentage

This setting allows you to specify battery charge level at which Energy Saver is turned on. While plugged in, Energy Saver is automatically turned on at (and below) the specified battery charge level. Valid input range (0-100). Valid values 0 to 100

EnergySaverPluggedInThresholdPercentage

Endpoint for discovering cloud printers.

EnterpriseCloudPrintDiscoveryEndPoint

Maximum number of printers that should be queried from a discovery endpoint. This is a mobile only setting. Valid values 1 to 65535

EnterpriseCloudPrintDiscoveryMaxLimit

OAuth resource URI for printer discovery service as configured in Azure portal.

EnterpriseCloudPrintMopriaDiscoveryResourceIdentifier

Authentication endpoint for acquiring OAuth tokens.

EnterpriseCloudPrintOAuthAuthority

GUID of a client application authorized to retrieve OAuth tokens from the OAuth Authority.

EnterpriseCloudPrintOAuthClientIdentifier

OAuth resource URI for print service as configured in the Azure portal.

EnterpriseCloudPrintResourceIdentifier

Indicates whether or not to enable device discovery UX.

ExperienceBlockDeviceDiscovery

Indicates whether or not to allow the error dialog from displaying if no SIM card is detected.

ExperienceBlockErrorDialogWhenNoSIM

Indicates whether or not to enable task switching on the device.

ExperienceBlockTaskSwitcher

Allow or prevent the syncing of Microsoft Edge Browser settings. Option for IT admins to prevent syncing across devices, but allow user override. Possible values are: notConfigured, blockedWithUserOverride, blocked.

ExperienceDoNotSyncBrowserSettings

Controls if the user can configure search to Find My Files mode, which searches files in secondary hard drives and also outside of the user profile. Find My Files does not allow users to search files or locations to which they do not have access. Possible values are: notConfigured, enabled, disabled.

FindMyFiles

Indicates whether or not to block DVR and broadcasting.

GameDvrBlocked

Controls the user access to the ink workspace, from the desktop and from above the lock screen. Possible values are: notConfigured, enabled, disabled.

InkWorkspaceAccess

Controls the user access to the ink workspace, from the desktop and from above the lock screen. Possible values are: notConfigured, blocked, allowed.

InkWorkspaceAccessState

Specify whether to show recommended app suggestions in the ink workspace.

InkWorkspaceBlockSuggestedApps

Indicates whether or not to Block the user from using internet sharing.

InternetSharingBlocked

Indicates whether or not to Block the user from location services.

LocationServicesBlocked

This policy setting specifies whether Windows apps can be activated by voice while the system is locked. Possible values are: notConfigured, enabled, disabled.

LockScreenActivateAppsWithVoice

Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices. If this policy is set to Allow, the value set by lockScreenTimeoutInSeconds is ignored.

LockScreenAllowTimeoutConfiguration

Indicates whether or not to block action center notifications over lock screen.

LockScreenBlockActionCenterNotifications

Indicates whether or not the user can interact with Cortana using speech while the system is locked.

LockScreenBlockCortana

Indicates whether to allow toast notifications above the device lock screen.

LockScreenBlockToastNotifications

Set the duration (in seconds) from the screen locking to the screen turning off for Windows 10 Mobile devices. Supported values are 11-1800. Valid values 11 to 1800

LockScreenTimeoutInSeconds

Disables the ability to quickly switch between users that are logged on simultaneously without logging off.

LogonBlockFastUserSwitching

Indicates whether or not to block the MMS send/receive functionality on the device.

MessagingBlockMMS

Indicates whether or not to block the RCS send/receive functionality on the device.

MessagingBlockRichCommunicationServices

Indicates whether or not to block text message back up and restore and Messaging Everywhere.

MessagingBlockSync

Indicates whether or not to Block a Microsoft account.

MicrosoftAccountBlocked

Indicates whether or not to Block Microsoft account settings sync.

MicrosoftAccountBlockSettingsSync

Controls the Microsoft Account Sign-In Assistant (wlidsvc) NT service. Possible values are: notConfigured, disabled.

MicrosoftAccountSignInAssistantSettings

If set, proxy settings will be applied to all processes and accounts in the device. Otherwise, it will be applied to the user account that's enrolled into MDM.

NetworkProxyApplySettingsDeviceWide

Address to the proxy auto-config (PAC) script you want to use.

NetworkProxyAutomaticConfigurationUrl

Disable automatic detection of settings. If enabled, the system will try to find the path to a proxy auto-config (PAC) script.

NetworkProxyDisableAutoDetect

Specifies manual proxy server settings.

NetworkProxyServer

Address to the proxy server. Specify an address in the format ':'

Address

Addresses that should not use the proxy server. The system will not use the proxy server for addresses beginning with what is specified in this node.

Exceptions

Specifies whether the proxy server should be used for local (intranet) addresses.

UseForLocalAddresses

Indicates whether or not to Block the user from using near field communication.

NfcBlocked

Gets or sets a value allowing IT admins to prevent apps and features from working with files on OneDrive.

OneDriveDisableFileSync

Specify whether PINs or passwords such as '1111' or '1234' are allowed. For Windows 10 desktops, it also controls the use of picture passwords.

PasswordBlockSimple

The password expiration in days. Valid values 0 to 730

PasswordExpirationDays

This security setting determines the period of time (in days) that a password must be used before the user can change it. Valid values 0 to 998

PasswordMinimumAgeInDays

The number of character sets required in the password.

PasswordMinimumCharacterSetCount

The minimum password length. Valid values 4 to 16

PasswordMinimumLength

The minutes of inactivity before the screen times out.

PasswordMinutesOfInactivityBeforeScreenTimeout

The number of previous passwords to prevent reuse of. Valid values 0 to 50

PasswordPreviousPasswordBlockCount

Indicates whether or not to require the user to have a password.

PasswordRequired

The required password type. Possible values are: deviceDefault, alphanumeric, numeric.

PasswordRequiredType

Indicates whether or not to require a password upon resuming from an idle state.

PasswordRequireWhenResumeFromIdleState

The number of sign in failures before factory reset. Valid values 0 to 999

PasswordSignInFailureCountBeforeFactoryReset

A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Desktop Image or a file Url to a local image on the file system that needs to used as the Desktop Image.

PersonalizationDesktopImageUrl

A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image.

PersonalizationLockScreenImageUrl

notConfigured noAction sleep hibernate shutdown

This setting specifies the action that Windows takes when a user presses the Power button while on battery. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.

PowerButtonActionOnBattery

This setting specifies the action that Windows takes when a user presses the Power button while plugged in. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.

PowerButtonActionPluggedIn

This setting allows you to turn off hybrid sleep while on battery. If you set this setting to disable, a hiberfile is not generated when the system transitions to sleep (Stand By). If you set this setting to enable or do not configure this policy setting, users control this setting. Possible values are: notConfigured, enabled, disabled.

PowerHybridSleepOnBattery

This setting allows you to turn off hybrid sleep while plugged in. If you set this setting to disable, a hiberfile is not generated when the system transitions to sleep (Stand By). If you set this setting to enable or do not configure this policy setting, users control this setting. Possible values are: notConfigured, enabled, disabled.

PowerHybridSleepPluggedIn

This setting specifies the action that Windows takes when a user closes the lid on a mobile PC while on battery. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.

PowerLidCloseActionOnBattery

This setting specifies the action that Windows takes when a user closes the lid on a mobile PC while plugged in. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.

PowerLidCloseActionPluggedIn

This setting specifies the action that Windows takes when a user presses the Sleep button while on battery. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.

PowerSleepButtonActionOnBattery

This setting specifies the action that Windows takes when a user presses the Sleep button while plugged in. Possible values are: notConfigured, noAction, sleep, hibernate, shutdown.

PowerSleepButtonActionPluggedIn

Prevent user installation of additional printers from printers settings.

PrinterBlockAddition

Name (network host name) of an installed printer.

PrinterDefaultName

Automatically provision printers based on their names (network host names).

PrinterNames

Enables or disables the use of advertising ID. Added in Windows 10, version 1607. Possible values are: notConfigured, blocked, allowed.

PrivacyAdvertisingId

Indicates whether or not to allow the automatic acceptance of the pairing and privacy user consent dialog when launching apps.

PrivacyAutoAcceptPairingAndConsentPrompts

Blocks the usage of cloud based speech services for Cortana, Dictation, or Store applications.

PrivacyBlockActivityFeed

Indicates whether or not to block the usage of cloud based speech services for Cortana, Dictation, or Store applications.

PrivacyBlockInputPersonalization

Blocks the shared experiences/discovery of recently used resources in task switcher etc.

PrivacyBlockPublishUserActivities

This policy prevents the privacy experience from launching during user logon for new and upgraded users.

PrivacyDisableLaunchExperience

Indicates whether or not to Block the user from reset protection mode.

ResetProtectionModeBlocked

Specifies what filter level of safe search is required. Possible values are: userDefined, strict, moderate.

SafeSearchFilter

Indicates whether or not to Block the user from taking Screenshots.

ScreenCaptureBlocked

Specifies if search can use diacritics.

SearchBlockDiacritics

Indicates whether or not to block the web search.

SearchBlockWebResults

Specifies whether to use automatic language detection when indexing content and properties.

SearchDisableAutoLanguageDetection

Indicates whether or not to disable the search indexer backoff feature.

SearchDisableIndexerBackoff

Indicates whether or not to block indexing of WIP-protected items to prevent them from appearing in search results for Cortana or Explorer.

SearchDisableIndexingEncryptedItems

Indicates whether or not to allow users to add locations on removable drives to libraries and to be indexed.

SearchDisableIndexingRemovableDrive

Specifies if search can use location information.

SearchDisableLocation

SearchDisableUseLocation

Specifies minimum amount of hard drive space on the same drive as the index location before indexing stops.

SearchEnableAutomaticIndexSizeManangement

Indicates whether or not to block remote queries of this computers index.

SearchEnableRemoteQueries

Specify whether to allow automatic device encryption during OOBE when the device is Azure AD joined (desktop only).

SecurityBlockAzureADJoinedDevicesAutoEncryption

Indicates whether or not to block access to Accounts in Settings app.

SettingsBlockAccountsPage

Indicates whether or not to block the user from installing provisioning packages.

SettingsBlockAddProvisioningPackage

Indicates whether or not to block access to Apps in Settings app.

SettingsBlockAppsPage

Indicates whether or not to block the user from changing the language settings.

SettingsBlockChangeLanguage

Indicates whether or not to block the user from changing power and sleep settings.

SettingsBlockChangePowerSleep

Indicates whether or not to block the user from changing the region settings.

SettingsBlockChangeRegion

Indicates whether or not to block the user from changing date and time settings.

SettingsBlockChangeSystemTime

Indicates whether or not to block access to Devices in Settings app.

SettingsBlockDevicesPage

Indicates whether or not to block access to Ease of Access in Settings app.

SettingsBlockEaseOfAccessPage

Indicates whether or not to block the user from editing the device name.

SettingsBlockEditDeviceName

Indicates whether or not to block access to Gaming in Settings app.

SettingsBlockGamingPage

Indicates whether or not to block access to Network & Internet in Settings app.

SettingsBlockNetworkInternetPage

Indicates whether or not to block access to Personalization in Settings app.

SettingsBlockPersonalizationPage

Indicates whether or not to block access to Privacy in Settings app.

SettingsBlockPrivacyPage

Indicates whether or not to block the runtime configuration agent from removing provisioning packages.

SettingsBlockRemoveProvisioningPackage

Indicates whether or not to block access to Settings app.

SettingsBlockSettingsApp

Indicates whether or not to block access to System in Settings app.

SettingsBlockSystemPage

Indicates whether or not to block access to Time & Language in Settings app.

SettingsBlockTimeLanguagePage

Indicates whether or not to block access to Update & Security in Settings app.

SettingsBlockUpdateSecurityPage

Indicates whether or not to block multiple users of the same app to share data.

SharedUserAppDataAllowed

notConfigured anywhere storeOnly recommendations preferStore

Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store. Possible values are: notConfigured, anywhere, storeOnly, recommendations, preferStore.

SmartScreenAppInstallControl

Indicates whether or not users can override SmartScreen Filter warnings about potentially malicious websites.

SmartScreenBlockPromptOverride

Indicates whether or not users can override the SmartScreen Filter warnings about downloading unverified files

SmartScreenBlockPromptOverrideForFiles

This property will be deprecated in July 2019 and will be replaced by property SmartScreenAppInstallControl. Allows IT Admins to control whether users are allowed to install apps from places other than the Store.

SmartScreenEnableAppInstallControl

Indicates whether or not to block the user from unpinning apps from taskbar.

StartBlockUnpinningAppsFromTaskbar

userDefined collapse remove disableSettingsApp

Setting the value of this collapses the app list, removes the app list entirely, or disables the corresponding toggle in the Settings app. Possible values are: userDefined, collapse, remove, disableSettingsApp.

StartMenuAppListVisibility

Enabling this policy hides the change account setting from appearing in the user tile in the start menu.

StartMenuHideChangeAccountSettings

Enabling this policy hides the most used apps from appearing on the start menu and disables the corresponding toggle in the Settings app.

StartMenuHideFrequentlyUsedApps

Enabling this policy hides hibernate from appearing in the power button in the start menu.

StartMenuHideHibernate

Enabling this policy hides lock from appearing in the user tile in the start menu.

StartMenuHideLock

Enabling this policy hides the power button from appearing in the start menu.

StartMenuHidePowerButton

Enabling this policy hides recent jump lists from appearing on the start menu/taskbar and disables the corresponding toggle in the Settings app.

StartMenuHideRecentJumpLists

Enabling this policy hides recently added apps from appearing on the start menu and disables the corresponding toggle in the Settings app.

StartMenuHideRecentlyAddedApps

Enabling this policy hides 'Restart/Update and Restart' from appearing in the power button in the start menu.

StartMenuHideRestartOptions

Enabling this policy hides shut down/update and shut down from appearing in the power button in the start menu.

StartMenuHideShutDown

Enabling this policy hides sign out from appearing in the user tile in the start menu.

StartMenuHideSignOut

Enabling this policy hides sleep from appearing in the power button in the start menu.

StartMenuHideSleep

Enabling this policy hides switch account from appearing in the user tile in the start menu.

StartMenuHideSwitchAccount

Enabling this policy hides the user tile from appearing in the start menu.

StartMenuHideUserTile

This policy setting allows you to import Edge assets to be used with startMenuLayoutXml policy. Start layout can contain secondary tile from Edge app which looks for Edge local asset file. Edge local asset would not exist and cause Edge secondary tile to appear empty in this case. This policy only gets applied when startMenuLayoutXml policy is modified. The value should be a UTF-8 Base64 encoded byte array.

StartMenuLayoutEdgeAssetsXml

Allows admins to override the default Start menu layout and prevents the user from changing it. The layout is modified by specifying an XML file based on a layout modification schema. XML needs to be in a UTF8 encoded byte array format.

StartMenuLayoutXml

Allows admins to decide how the Start menu is displayed. Possible values are: userDefined, fullScreen, nonFullScreen.

StartMenuMode

Enforces the visibility (Show/Hide) of the Documents folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.

StartMenuPinnedFolderDocuments

Enforces the visibility (Show/Hide) of the Downloads folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.

StartMenuPinnedFolderDownloads

Enforces the visibility (Show/Hide) of the FileExplorer shortcut on the Start menu. Possible values are: notConfigured, hide, show.

StartMenuPinnedFolderFileExplorer

Enforces the visibility (Show/Hide) of the HomeGroup folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.

StartMenuPinnedFolderHomeGroup

Enforces the visibility (Show/Hide) of the Music folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.

StartMenuPinnedFolderMusic

Enforces the visibility (Show/Hide) of the Network folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.

StartMenuPinnedFolderNetwork

Enforces the visibility (Show/Hide) of the PersonalFolder shortcut on the Start menu. Possible values are: notConfigured, hide, show.

StartMenuPinnedFolderPersonalFolder

Enforces the visibility (Show/Hide) of the Pictures folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.

StartMenuPinnedFolderPictures

Enforces the visibility (Show/Hide) of the Settings folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.

StartMenuPinnedFolderSettings

Enforces the visibility (Show/Hide) of the Videos folder shortcut on the Start menu. Possible values are: notConfigured, hide, show.

StartMenuPinnedFolderVideos

Indicates whether or not to Block the user from using removable storage.

StorageBlockRemovableStorage

Indicating whether or not to require encryption on a mobile device.

StorageRequireMobileDeviceEncryption

Indicates whether application data is restricted to the system drive.

StorageRestrictAppDataToSystemVolume

Indicates whether the installation of applications is restricted to the system drive.

StorageRestrictAppInstallToSystemVolume

Gets or sets the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests.

SystemTelemetryProxyServer

Specify whether non-administrators can use Task Manager to end tasks.

TaskManagerBlockEndTask

Whether the device is required to connect to the network.

TenantLockdownRequireNetworkDuringOutOfBoxExperience

Indicates whether or not to uninstall a fixed list of built-in Windows apps.

UninstallBuiltInApps

Indicates whether or not to Block the user from USB connection.

UsbBlocked

Indicates whether or not to Block the user from voice recording.

VoiceRecordingBlocked

Indicates whether or not user's localhost IP address is displayed while making phone calls using the WebRTC

WebRtcBlockLocalhostIpAddress

Indicating whether or not to block automatically connecting to Wi-Fi hotspots. Has no impact if Wi-Fi is blocked.

WiFiBlockAutomaticConnectHotspots

Indicates whether or not to Block the user from using Wi-Fi.

WiFiBlocked

Indicates whether or not to Block the user from using Wi-Fi manual configuration.

WiFiBlockManualConfiguration

Specify how often devices scan for Wi-Fi networks. Supported values are 1-500, where 100 = default, and 500 = low frequency. Valid values 1 to 500

WiFiScanInterval

Windows 10 force update schedule for Apps.

Recurrence schedule. Possible values are: none, daily, weekly, monthly.

Recurrence

If true, runs the task immediately if StartDateTime is in the past, else, runs at the next recurrence.

RunImmediatelyIfAfterStartDateTime

The start time for the force restart.

StartDateTime

Allows IT admins to block experiences that are typically for consumers only, such as Start suggestions, Membership notifications, Post-OOBE app install and redirect tiles.

WindowsSpotlightBlockConsumerSpecificFeatures

Allows IT admins to turn off all Windows Spotlight features

WindowsSpotlightBlocked

Block suggestions from Microsoft that show after each OS clean install, upgrade or in an on-going basis to introduce users to what is new or changed

WindowsSpotlightBlockOnActionCenter

Block personalized content in Windows spotlight based on users device usage.

WindowsSpotlightBlockTailoredExperiences

Block third party content delivered via Windows Spotlight

WindowsSpotlightBlockThirdPartyNotifications

Block Windows Spotlight Windows welcome experience

WindowsSpotlightBlockWelcomeExperience

Allows IT admins to turn off the popup of Windows Tips.

WindowsSpotlightBlockWindowsTips

Specifies the type of Spotlight. Possible values are: notConfigured, disabled, enabled.

WindowsSpotlightConfigureOnLockScreen

Indicates whether or not to block automatic update of apps from Windows Store.

WindowsStoreBlockAutoUpdate

Indicates whether or not to Block the user from using the Windows store.

WindowsStoreBlocked

Indicates whether or not to enable Private Store Only.

WindowsStoreEnablePrivateStoreOnly

Indicates whether or not to allow other devices from discovering this PC for projection.

WirelessDisplayBlockProjectionToThisDevice

Indicates whether or not to allow user input from wireless display receiver.

WirelessDisplayBlockUserInputFromReceiver

Indicates whether or not to require a PIN for new devices to initiate pairing.

WirelessDisplayRequirePinForPairing

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.

SupportsScopeTags

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Scep Certificate Policy for Windows10

Schema for microsoft.intune.deviceconfigurationscepcertificatepolicywindows10

Target store certificate. Possible values are: user, machine.

CertificateStore

SCEP Hash Algorithm. Possible values are: sha1, sha2.

HashAlgorithm

SCEP Key Size. Possible values are: size1024, size2048, size4096.

KeySize

SCEP Key Usage. Possible values are: keyEncipherment, digitalSignature.

KeyUsage

SCEP Server Url(s).

ScepServerUrls

Custom String that defines the AAD Attribute.

SubjectAlternativeNameFormatString

Custom format to use with SubjectNameFormat = Custom. Example: CN={{UserName}},E={{EmailAddress}},OU=Enterprise Users,O=Contoso Corporation,L=Redmond,ST=WA,C=US

SubjectNameFormatString

Intune Device Configuration Pkcs Certificate Policy for Windows10

Schema for MSFT_MicrosoftGraphCustomSubjectAlternativeName

Custom SAN Name

Name

none emailAddress userPrincipalName customAzureADAttribute domainNameService universalResourceIdentifier

Custom SAN Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.

SanType

Custom Subject Alternative Name Settings. This collection can contain a maximum of 500 elements.

CustomSubjectAlternativeNames

Schema for MSFT_MicrosoftGraphExtendedKeyUsage

Extended Key Usage Name

Name

Extended Key Usage Object Identifier

ObjectIdentifier

Extended Key Usage (EKU) settings. This collection can contain a maximum of 500 elements.

ExtendedKeyUsages

Scale for the Certificate Validity Period. Possible values are: days, months, years.

CertificateValidityPeriodScale

Value for the Certificate Validity Period

CertificateValidityPeriodValue

useTpmKspOtherwiseUseSoftwareKsp useTpmKspOtherwiseFail usePassportForWorkKspOtherwiseFail useSoftwareKsp

Key Storage Provider (KSP). Possible values are: useTpmKspOtherwiseUseSoftwareKsp, useTpmKspOtherwiseFail, usePassportForWorkKspOtherwiseFail, useSoftwareKsp.

KeyStorageProvider

Certificate renewal threshold percentage. Valid values 1 to 99

RenewalThresholdPercentage

Certificate Subject Alternative Name Type. Possible values are: none, emailAddress, userPrincipalName, customAzureADAttribute, domainNameService, universalResourceIdentifier.

SubjectAlternativeNameType

commonName commonNameIncludingEmail commonNameAsEmail custom commonNameAsIMEI commonNameAsSerialNumber commonNameAsAadDeviceId commonNameAsIntuneDeviceId commonNameAsDurableDeviceId

Certificate Subject Name Format. Possible values are: commonName, commonNameIncludingEmail, commonNameAsEmail, custom, commonNameAsIMEI, commonNameAsSerialNumber, commonNameAsAadDeviceId, commonNameAsIntuneDeviceId, commonNameAsDurableDeviceId.

SubjectNameFormat

Trusted Root Certificate DisplayName

RootCertificateDisplayName

Trusted Root Certificate Id

RootCertificateId

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Secure Assessment Policy for Windows10

Schema for microsoft.intune.deviceconfigurationsecureassessmentpolicywindows10

Indicates whether or not to allow the app from printing during the test.

AllowPrinting

Indicates whether or not to allow screen capture capability during a test.

AllowScreenCapture

Indicates whether or not to allow text suggestions during the test.

AllowTextSuggestion

Specifies the application user model ID of the assessment app launched when a user signs in to a secure assessment with a local guest account. Important notice: this property must be set with localGuestAccountName in order to make the local guest account sign-in experience work properly for secure assessments.

AssessmentAppUserModelId

The account used to configure the Windows device for taking the test. The user can be a domain account (domain/user), an AAD account (usernametenant.com) or a local account (username).

ConfigurationAccount

azureADAccount domainAccount localAccount localGuestAccount

The account type used to by ConfigurationAccount. Possible values are: azureADAccount, domainAccount, localAccount, localGuestAccount.

ConfigurationAccountType

Url link to an assessment that's automatically loaded when the secure assessment browser is launched. It has to be a valid Url (https://msdn.microsoft.com/).

LaunchUri

Specifies the display text for the local guest account shown on the sign-in screen. Typically is the name of an assessment. When the user clicks the local guest account on the sign-in screen, an assessment app is launched with a specified assessment URL. Secure assessments can only be configured with local guest account sign-in on devices running Windows 10, version 1903 or later. Important notice: this property must be set with assessmentAppUserModelID in order to make the local guest account sign-in experience work properly for secure assessments.

LocalGuestAccountName

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Shared Multi Device Policy for Windows10

Schema for microsoft.intune.deviceconfigurationsharedmultidevicepolicywindows10

Specifies how accounts are managed on a shared PC. Only applies when disableAccountManager is false.

AccountManagerPolicy

Configures when accounts are deleted. Possible values are: immediate, diskSpaceThreshold, diskSpaceThresholdOrInactiveThreshold.

AccountDeletionPolicy

Sets the percentage of available disk space a PC should have before it stops deleting cached shared PC accounts. Only applies when AccountDeletionPolicy is DiskSpaceThreshold or DiskSpaceThresholdOrInactiveThreshold. Valid values 0 to 100

CacheAccountsAboveDiskFreePercentage

Specifies when the accounts will start being deleted when they have not been logged on during the specified period, given as number of days. Only applies when AccountDeletionPolicy is DiskSpaceThreshold or DiskSpaceThresholdOrInactiveThreshold.

InactiveThresholdDays

Sets the percentage of disk space remaining on a PC before cached accounts will be deleted to free disk space. Accounts that have been inactive the longest will be deleted first. Only applies when AccountDeletionPolicy is DiskSpaceThresholdOrInactiveThreshold. Valid values 0 to 100

RemoveAccountsBelowDiskFreePercentage

Indicates which type of accounts are allowed to use on a shared PC. Possible values are: notConfigured, guest, domain.

AllowedAccounts

Specifies whether local storage is allowed on a shared PC.

AllowLocalStorage

Disables the account manager for shared PC mode.

DisableAccountManager

Specifies whether the default shared PC education environment policies should be disabled. For Windows 10 RS2 and later, this policy will be applied without setting Enabled to true.

DisableEduPolicies

Specifies whether the default shared PC power policies should be disabled.

DisablePowerPolicies

Disables the requirement to sign in whenever the device wakes up from sleep mode.

DisableSignInOnResume

Enables shared PC mode and applies the shared pc policies.

Enabled

Specifies whether to auto connect new non-admin Azure AD accounts to pre-configured candidate local accounts. Possible values are: notConfigured, enabled, disabled.

FastFirstSignIn

Specifies the time in seconds that a device must sit idle before the PC goes to sleep. Setting this value to 0 prevents the sleep timeout from occurring.

IdleTimeBeforeSleepInSeconds

Specifies the display text for the account shown on the sign-in screen which launches the app specified by SetKioskAppUserModelId. Only applies when KioskAppUserModelId is set.

KioskAppDisplayName

Specifies the application user model ID of the app to use with assigned access.

KioskAppUserModelId

Specifies whether local storage is allowed on a shared PC. Possible values are: notConfigured, enabled, disabled.

LocalStorage

Specifies the daily start time of maintenance hour.

MaintenanceStartTime

Disables the account manager for shared PC mode. Possible values are: notConfigured, enabled, disabled.

SetAccountManager

Specifies whether the default shared PC education environment policies should be enabled/disabled/not configured. For Windows 10 RS2 and later, this policy will be applied without setting Enabled to true. Possible values are: notConfigured, enabled, disabled.

SetEduPolicies

Specifies whether the default shared PC power policies should be enabled/disabled. Possible values are: notConfigured, enabled, disabled.

SetPowerPolicies

Specifies the requirement to sign in whenever the device wakes up from sleep mode. Possible values are: notConfigured, enabled, disabled.

SignInOnResume

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Trusted Certificate Policy for Windows10

Schema for microsoft.intune.deviceconfigurationtrustedcertificatepolicywindows10

File name to display in UI.

CertFileName

Destination store location for the Trusted Root Certificate. Possible values are: computerCertStoreRoot, computerCertStoreIntermediate, userCertStoreIntermediate.

DestinationStore

Trusted Root Certificate

TrustedRootCertificate

Description

DisplayName

Id

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments

Ensure

Intune Device Configuration Vpn Policy for Windows10

Schema for microsoft.intune.deviceconfigurationvpnpolicywindows10

Schema for MSFT_MicrosoftGraphWindows10AssociatedApps

Application type. Possible values are: desktop, universal.

AppType

Identifier.

Identifier

Associated Apps. This collection can contain a maximum of 10000 elements.

AssociatedApps

certificate usernameAndPassword customEapXml derivedCredential

Authentication method. Possible values are: certificate, usernameAndPassword, customEapXml, derivedCredential.

AuthenticationMethod

pulseSecure f5EdgeClient dellSonicWallMobileConnect checkPointCapsuleVpn automatic ikEv2 l2tp pptp citrix paloAltoGlobalProtect ciscoAnyConnect unknownFutureValue microsoftTunnel

Connection type. Possible values are: pulseSecure, f5EdgeClient, dellSonicWallMobileConnect, checkPointCapsuleVpn, automatic, ikEv2, l2tp, pptp, citrix, paloAltoGlobalProtect, ciscoAnyConnect, unknownFutureValue, microsoftTunnel.

ConnectionType

Cryptography Suite security settings for IKEv2 VPN in Windows10 and above

CryptographySuite

Authentication Transform Constants. Possible values are: md5_96, sha1_96, sha_256_128, aes128Gcm, aes192Gcm, aes256Gcm.

AuthenticationTransformConstants

Cipher Transform Constants. Possible values are: aes256, des, tripleDes, aes128, aes128Gcm, aes256Gcm, aes192, aes192Gcm, chaCha20Poly1305.

CipherTransformConstants

Diffie Hellman Group. Possible values are: group1, group2, group14, ecp256, ecp384, group24.

DhGroup

Encryption Method. Possible values are: aes256, des, tripleDes, aes128, aes128Gcm, aes256Gcm, aes192, aes192Gcm, chaCha20Poly1305.

EncryptionMethod

Integrity Check Method. Possible values are: sha2_256, sha1_96, sha1_160, sha2_384, sha2_512, md5.

IntegrityCheckMethod

Perfect Forward Secrecy Group. Possible values are: pfs1, pfs2, pfs2048, ecp256, ecp384, pfsMM, pfs24.

PfsGroup

Schema for MSFT_MicrosoftGraphVpnDnsRule

Automatically connect to the VPN when the device connects to this domain: Default False.

AutoTrigger

Name.

Name

Keep this rule active even when the VPN is not connected: Default False

Persistent

Proxy Server Uri.

ProxyServerUri

Servers.

Servers

DNS rules. This collection can contain a maximum of 1000 elements.

DnsRules

Specify DNS suffixes to add to the DNS search list to properly route short names.

DnsSuffixes

Extensible Authentication Protocol (EAP) XML. (UTF8 encoded byte array)

EapXml

Enable Always On mode.

EnableAlwaysOn

Enable conditional access.

EnableConditionalAccess

Enable device tunnel.

EnableDeviceTunnel

Enable IP address registration with internal DNS.

EnableDnsRegistration

Enable single sign-on (SSO) with alternate certificate.

EnableSingleSignOnWithAlternateCertificate

Enable split tunneling.

EnableSplitTunneling

ID of the Microsoft Tunnel site associated with the VPN profile.

MicrosoftTunnelSiteId

Only associated Apps can use connection (per-app VPN).

OnlyAssociatedAppsCanUseConnection

Profile target type. Possible values are: user, device, autoPilotDevice.

ProfileTarget

Proxy Server.

ProxyServer

Bypass proxy server for local address.

BypassProxyServerForLocalAddress

Address.

Address

Proxy's automatic configuration script url.

AutomaticConfigurationScriptUrl

Port. Valid values 0 to 65535

Port

Automatically detect proxy settings.

AutomaticallyDetectProxySettings

The type of the entity.

odataType

Remember user credentials.

RememberUserCredentials

Intune Device Configuration Vpn Policy for Windows10

Schema for MSFT_MicrosoftGraphVpnRoute

Destination prefix (IPv4/v6 address).

DestinationPrefix

Prefix size. (1-32). Valid values 1 to 32

PrefixSize

Routes (optional for third-party providers). This collection can contain a maximum of 1000 elements.

Routes

Single sign-on Extended Key Usage (EKU).

SingleSignOnEku

Extended Key Usage Name

Name

Extended Key Usage Object Identifier

ObjectIdentifier

Single sign-on issuer hash.

SingleSignOnIssuerHash

Schema for MSFT_MicrosoftGraphVpnTrafficRule

App identifier, if this traffic rule is triggered by an app.

AppId

App type, if this traffic rule is triggered by an app. Possible values are: none, desktop, universal.

AppType

Claims associated with this traffic rule.

Claims

Schema for MSFT_MicrosoftGraphIPv4Range

Lower address.

LowerAddress

Upper address.

UpperAddress

IPv4 address in CIDR notation. Not nullable.

CidrAddress

The type of the entity.

odataType

Local address range. This collection can contain a maximum of 500 elements.

LocalAddressRanges

Schema for MSFT_MicrosoftGraphNumberRange

Lower number.

LowerNumber

Upper number.

UpperNumber

Local port range can be set only when protocol is either TCP or UDP (6 or 17). This collection can contain a maximum of 500 elements.

LocalPortRanges

Name.

Name

Protocols (0-255). Valid values 0 to 255

Protocols

Schema for MSFT_MicrosoftGraphIPv4Range

Lower address.

LowerAddress

Upper address.

UpperAddress

CidrAddress

The type of the entity.

odataType

Remote address range. This collection can contain a maximum of 500 elements.

RemoteAddressRanges

Lower number.

LowerNumber

Upper number.

UpperNumber

Remote port range can be set only when protocol is either TCP or UDP (6 or 17). This collection can contain a maximum of 500 elements.

RemotePortRanges

When app triggered, indicates whether to enable split tunneling along this route. Possible values are: none, splitTunnel, forceTunnel.

RoutingPolicyType

Specify whether the rule applies to inbound traffic or outbound traffic. Possible values are: outbound, inbound, unknownFutureValue.

VpnTrafficDirection

Traffic rules. This collection can contain a maximum of 1000 elements.

TrafficRules

Trusted Network Domains

TrustedNetworkDomains

Windows Information Protection (WIP) domain to associate with this connection.

WindowsInformationProtectionDomain

Connection name displayed to the user.

ConnectionName

Custom XML commands that configures the VPN connection. (UTF8 encoded byte array)

CustomXml

Intune Device Configuration Vpn Policy for Windows10

Schema for MSFT_MicrosoftGraphVpnServer

Address (IP address, FQDN or URL)

Address

Description.

Description

Default server.

IsDefaultServer

List of VPN Servers on the network. Make sure end users can access these network locations. This collection can contain a maximum of 500 elements.

ServerCollection

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Windows Team Policy for Windows10

Schema for microsoft.intune.deviceconfigurationwindowsteampolicywindows10

Indicates whether or not to Block Azure Operational Insights.

AzureOperationalInsightsBlockTelemetry

The Azure Operational Insights workspace id.

AzureOperationalInsightsWorkspaceId

The Azure Operational Insights Workspace key.

AzureOperationalInsightsWorkspaceKey

Specifies whether to automatically launch the Connect app whenever a projection is initiated.

ConnectAppBlockAutoLaunch

Indicates whether or not to Block setting a maintenance window for device updates.

MaintenanceWindowBlocked

Maintenance window duration for device updates. Valid values 0 to 5

MaintenanceWindowDurationInHours

Maintenance window start time for device updates.

MaintenanceWindowStartTime

Indicates whether or not to Block wireless projection.

MiracastBlocked

userDefined one two three four five six seven eight nine ten eleven thirtySix forty fortyFour fortyEight oneHundredFortyNine oneHundredFiftyThree oneHundredFiftySeven oneHundredSixtyOne oneHundredSixtyFive

The channel. Possible values are: userDefined, one, two, three, four, five, six, seven, eight, nine, ten, eleven, thirtySix, forty, fortyFour, fortyEight, oneHundredFortyNine, oneHundredFiftyThree, oneHundredFiftySeven, oneHundredSixtyOne, oneHundredSixtyFive.

MiracastChannel

Indicates whether or not to require a pin for wireless projection.

MiracastRequirePin

Specifies whether to disable the 'My meetings and files' feature in the Start menu, which shows the signed-in user's meetings and files from Office 365.

SettingsBlockMyMeetingsAndFiles

Specifies whether to allow the ability to resume a session when the session times out.

SettingsBlockSessionResume

Specifies whether to disable auto-populating of the sign-in dialog with invitees from scheduled meetings.

SettingsBlockSigninSuggestions

Specifies the default volume value for a new session. Permitted values are 0-100. The default is 45. Valid values 0 to 100

SettingsDefaultVolume

Specifies the number of minutes until the Hub screen turns off.

SettingsScreenTimeoutInMinutes

Specifies the number of minutes until the session times out.

SettingsSessionTimeoutInMinutes

Specifies the number of minutes until the Hub enters sleep mode.

SettingsSleepTimeoutInMinutes

The welcome screen background image URL. The URL must use the HTTPS protocol and return a PNG image.

WelcomeScreenBackgroundImageUrl

Indicates whether or not to Block the welcome screen from waking up automatically when someone enters the room.

WelcomeScreenBlockAutomaticWakeUp

The welcome screen meeting information shown. Possible values are: userDefined, showOrganizerAndTimeOnly, showOrganizerAndTimeAndSubject.

WelcomeScreenMeetingInformation

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

Indicates whether or not the underlying Device Configuration supports the assignment of scope tags. Assigning to the ScopeTags property is not allowed when this value is false and entities will not be visible to scoped users. This occurs for Legacy policies created in Silverlight and can be resolved by deleting and recreating the policy in the Azure Portal. This property is read-only.

SupportsScopeTags

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Configuration Wired Network Policy for Windows10

Schema for microsoft.intune.deviceconfigurationwirednetworkpolicywindows10

Specify the duration for which automatic authentication attempts will be blocked from occurring after a failed authentication attempt.

AuthenticationBlockPeriodInMinutes

certificate usernameAndPassword derivedCredential unknownFutureValue

Specify the authentication method. Possible values are: certificate, usernameAndPassword, derivedCredential. Possible values are: certificate, usernameAndPassword, derivedCredential, unknownFutureValue.

AuthenticationMethod

Specify the number of seconds for the client to wait after an authentication attempt before failing. Valid range 1-3600.

AuthenticationPeriodInSeconds

Specify the number of seconds between a failed authentication and the next authentication attempt. Valid range 1-3600.

AuthenticationRetryDelayPeriodInSeconds

none user machine machineOrUser guest unknownFutureValue

Specify whether to authenticate the user, the device, either, or to use guest authentication (none). If you're using certificate authentication, make sure the certificate type matches the authentication type. Possible values are: none, user, machine, machineOrUser, guest. Possible values are: none, user, machine, machineOrUser, guest, unknownFutureValue.

AuthenticationType

When TRUE, caches user credentials on the device so that users don't need to keep entering them each time they connect. When FALSE, do not cache credentials. Default value is FALSE.

CacheCredentials

When TRUE, prevents the user from being prompted to authorize new servers for trusted certification authorities when EAP type is selected as PEAP. When FALSE, does not prevent the user from being prompted. Default value is FALSE.

DisableUserPromptForServerValidation

Specify the number of seconds to wait before sending an EAPOL (Extensible Authentication Protocol over LAN) Start message. Valid range 1-3600.

EapolStartPeriodInSeconds

eapTls leap eapSim eapTtls peap eapFast teap

Extensible Authentication Protocol (EAP). Indicates the type of EAP protocol set on the Wi-Fi endpoint (router). Possible values are: eapTls, leap, eapSim, eapTtls, peap, eapFast, teap. Possible values are: eapTls, leap, eapSim, eapTtls, peap, eapFast, teap.

EapType

When TRUE, the automatic configuration service for wired networks requires the use of 802.1X for port authentication. When FALSE, 802.1X is not required. Default value is FALSE.

Enforce8021X

When TRUE, forces FIPS compliance. When FALSE, does not enable FIPS compliance. Default value is FALSE.

ForceFIPSCompliance

Specify inner authentication protocol for EAP TTLS. Possible values are: unencryptedPassword, challengeHandshakeAuthenticationProtocol, microsoftChap, microsoftChapVersionTwo. Possible values are: unencryptedPassword, challengeHandshakeAuthenticationProtocol, microsoftChap, microsoftChapVersionTwo.

InnerAuthenticationProtocolForEAPTTLS

Specify the maximum authentication failures allowed for a set of credentials. Valid range 1-100.

MaximumAuthenticationFailures

Specify the maximum number of EAPOL (Extensible Authentication Protocol over LAN) Start messages to be sent before returning failure. Valid range 1-100.

MaximumEAPOLStartMessages

Specify the string to replace usernames for privacy when using EAP TTLS or PEAP.

OuterIdentityPrivacyTemporaryValue

When TRUE, enables verification of server's identity by validating the certificate when EAP type is selected as PEAP. When FALSE, the certificate is not validated. Default value is TRUE.

PerformServerValidation

When TRUE, enables cryptographic binding when EAP type is selected as PEAP. When FALSE, does not enable cryptogrpahic binding. Default value is TRUE.

RequireCryptographicBinding

Specify the secondary authentication method. Possible values are: certificate, usernameAndPassword, derivedCredential. Possible values are: certificate, usernameAndPassword, derivedCredential, unknownFutureValue.

SecondaryAuthenticationMethod

Specify trusted server certificate names.

TrustedServerCertificateNames

Specify root certificates for server validation. This collection can contain a maximum of 500 elements.

RootCertificatesForServerValidationIds

Specify root certificate display names for server validation. This collection can contain a maximum of 500 elements.

RootCertificatesForServerValidationDisplayNames

Specify identity certificate for client authentication.

IdentityCertificateForClientAuthenticationId

Specify identity certificate display name for client authentication.

IdentityCertificateForClientAuthenticationDisplayName

Specify root certificate for client validation

SecondaryIdentityCertificateForClientAuthenticationId

Specify root certificate display name for client validation

SecondaryIdentityCertificateForClientAuthenticationDisplayName

Specify root certificate for client validation.

RootCertificateForClientValidationId

Specify root certificate display name for client validation.

RootCertificateForClientValidationDisplayName

Specify secondary root certificate for client validation.

SecondaryRootCertificateForClientValidationId

Specify secondary root certificate display name for client validation.

SecondaryRootCertificateForClientValidationDisplayName

Admin provided description of the Device Configuration.

Description

Admin provided name of the device configuration.

DisplayName

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures the Intune device enrollment limit restrictions.

Schema for microsoft.intune.deviceenrollmentlimitrestriction

Display name of the device enrollment limit restriction.

DisplayName

Description of the device enrollment limit restriction.

Description

Specifies the maximum number of devices a user can enroll

Limit

Present ensures the restriction exists, absent ensures it is removed.

Ensure

This resource configures the Intune device platform enrollment restrictions.

**Be aware**: To deploy a Android platform restriction policy, two individual configurations must exist:

* The first one contains the key for `AndroidRestriction`
* The second one contains the key for `AndroidForWorkRestriction`

Schema for microsoft.intune.deviceenrollmentplatformrestriction

Identity of the device enrollment platform restriction.

Identity

Display name of the device enrollment platform restriction.

DisplayName

Description of the device enrollment platform restriction.

Description

Android for work restrictions based on platform, platform operating system version, and device ownership.

AndroidForWorkRestriction

Block the platform from enrolling.

PlatformBlocked

Block personally owned devices from enrolling.

PersonalDeviceEnrollmentBlocked

Min OS version supported.

OsMinimumVersion

Max OS version supported.

OsMaximumVersion

Collection of blocked Manufacturers.

BlockedManufacturers

Collection of blocked Skus.

BlockedSkus

Android restrictions based on platform, platform operating system version, and device ownership.

AndroidRestriction

Block the platform from enrolling.

PlatformBlocked

PersonalDeviceEnrollmentBlocked

Min OS version supported.

OsMinimumVersion

Max OS version supported.

OsMaximumVersion

Collection of blocked Manufacturers.

BlockedManufacturers

Collection of blocked Skus.

BlockedSkus

Ios restrictions based on platform, platform operating system version, and device ownership.

IosRestriction

Block the platform from enrolling.

PlatformBlocked

PersonalDeviceEnrollmentBlocked

Min OS version supported.

OsMinimumVersion

Max OS version supported.

OsMaximumVersion

Collection of blocked Manufacturers.

BlockedManufacturers

Collection of blocked Skus.

BlockedSkus

Mac restrictions based on platform, platform operating system version, and device ownership.

MacOSRestriction

Block the platform from enrolling.

PlatformBlocked

PersonalDeviceEnrollmentBlocked

Min OS version supported.

OsMinimumVersion

Max OS version supported.

OsMaximumVersion

Collection of blocked Manufacturers.

BlockedManufacturers

Collection of blocked Skus.

BlockedSkus

MacRestriction

Block the platform from enrolling.

PlatformBlocked

PersonalDeviceEnrollmentBlocked

Min OS version supported.

OsMinimumVersion

Max OS version supported.

OsMaximumVersion

Collection of blocked Manufacturers.

BlockedManufacturers

Collection of blocked Skus.

BlockedSkus

Windows Home Sku restrictions based on platform, platform operating system version, and device ownership.

WindowsHomeSkuRestriction

Block the platform from enrolling.

PlatformBlocked

PersonalDeviceEnrollmentBlocked

Min OS version supported.

OsMinimumVersion

Max OS version supported.

OsMaximumVersion

Collection of blocked Manufacturers.

BlockedManufacturers

Collection of blocked Skus.

BlockedSkus

Windows mobile restrictions based on platform, platform operating system version, and device ownership.

WindowsMobileRestriction

Block the platform from enrolling.

PlatformBlocked

PersonalDeviceEnrollmentBlocked

Min OS version supported.

OsMinimumVersion

Max OS version supported.

OsMaximumVersion

Collection of blocked Manufacturers.

BlockedManufacturers

Collection of blocked Skus.

BlockedSkus

Windows restrictions based on platform, platform operating system version, and device ownership.

WindowsRestriction

Block the platform from enrolling.

PlatformBlocked

PersonalDeviceEnrollmentBlocked

Min OS version supported.

OsMinimumVersion

Max OS version supported.

OsMaximumVersion

Collection of blocked Manufacturers.

BlockedManufacturers

Collection of blocked Skus.

BlockedSkus

Support for Enrollment Configuration Type

DeviceEnrollmentConfigurationType

Priority is used when a user exists in multiple groups that are assigned enrollment configuration. Users are subject only to the configuration with the lowest priority value.

Priority

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Device Enrollment Status Page Configuration for Windows10

Schema for microsoft.intune.deviceenrollmentstatuspagewindows10

The display name of the device enrollment configuration

DisplayName

The unique identifier for an entity. Read-only.

Id

The description of the device enrollment configuration

Description

Allow or block device reset on installation failure

AllowDeviceResetOnInstallFailure

Allow the user to continue using the device on installation failure

AllowDeviceUseOnInstallFailure

Allow or block log collection on installation failure

AllowLogCollectionOnInstallFailure

Install all required apps as non blocking apps during white glove

AllowNonBlockingAppInstallation

Allow the user to retry the setup on installation failure

BlockDeviceSetupRetryByUser

Set custom error message to show upon installation failure

CustomErrorMessage

Only show installation progress for first user post enrollment

DisableUserStatusTrackingAfterFirstUser

Set installation progress timeout in minutes

InstallProgressTimeoutInMinutes

Allows quality updates installation during OOBE

InstallQualityUpdates

Ids of selected applications to track the installation status. When this parameter is used, SelectedMobileAppNames is ignored

SelectedMobileAppIds

Names of selected applications to track the installation status. This parameter is ignored when SelectedMobileAppIds is also specified

SelectedMobileAppNames

Show or hide installation progress to user

ShowInstallationProgress

Only show installation progress for Autopilot enrollment scenarios

TrackInstallProgressForAutopilotOnly

Priority is used when a user exists in multiple groups that are assigned enrollment configuration. Users are subject only to the configuration with the lowest priority value.

Priority

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures an Intune Endpoint Detection and Response Policy for Windows 10.

Schema for microsoft.intune.endpointdetectionandresponsepolicywindows10

Identity of the endpoint detection and response policy for Windows 10.

Identity

Display name of the endpoint detection and response policy for Windows 10.

DisplayName

Description of the endpoint detection and response policy for Windows 10.

Description

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments of the endpoint detection and response policy for Windows 10.

Assignments

Return or set Windows Defender Advanced Threat Protection Sample Sharing configuration parameter: 0 - none, 1 - All

SampleSharing

Microsoft Defender for Endpoint endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats.

ConfigurationType

Set Windows Defender Advanced Threat Protection Onboarding blob and initiate onboarding to Windows Defender Advanced Threat Protection

ConfigurationBlob

Present ensures the policy exists, absent ensures it is removed

Ensure

This resource configures an Intune Endpoint Protection Exploit Protection policy for a Windows 10 Device.
Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML.
For more information Exploit Protection, see
- Enable Exploit Protection on Devices and Import: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-exploit-protection,
- Export, and deploy Exploit Protection configurations: https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml

Schema for microsoft.intune.exploitprotectionpolicywindows10settingcatalog

Identity of the endpoint protection policy.

Identity

Display name of the endpoint protection policy.

DisplayName

Description of the endpoint protection.

Description

Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML.

ExploitProtectionSettings

Prevent users from making changes to the exploit protection settings area in the Windows Defender Security Center.values 0:disable, 1:enable

DisallowExploitProtectionOverride

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the endpoint protection.

Assignments

Ensure

Intune Policy Sets

Schema for microsoft.intune.policysets

Description of the PolicySet.

Description

DisplayName of the PolicySet.

DisplayName

Tags of the guided deployment

GuidedDeploymentTags

RoleScopeTags of the PolicySet

RoleScopeTags

The unique identifier for an entity. Read-only.

Id

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Represents the assignment to the Intune policy.

Assignments

Intune Policy Sets

Schema for MSFT_DeviceManagementConfigurationPolicyItems

The type of policy the item represents.

dataType

The group Id of the policy the item represents.

payloadId

The collection display name of the policy the item represents

displayName

The type of policy the item represents.

itemType

Tags of the guided deployment

guidedDeploymentTags

Items

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures an Intune Role Assignment.

Schema for microsoft.intune.roleassignment

Id

Description of the Role Assignment.

Description

The display or friendly name of the role Assignment.

DisplayName

List of ids of role scope member security groups. These are IDs from Azure Active Directory. Ignored if ScopeType is not 'ResourceScope'

ResourceScopes

List of DisplayName of role scope member security groups. These are Displayname from Azure Active Directory. Ignored if ScopeType is not 'ResourceScope'

ResourceScopesDisplayNames

Specifies the type of scope for a Role Assignment. Default type 'ResourceScope' allows assignment of ResourceScopes. Possible values are: resourceScope, allDevices, allLicensedUsers, allDevicesAndLicensedUsers.

ScopeType

The list of ids of role member security groups. These are IDs from Azure Active Directory.

Members

The list of Displaynames of role member security groups. These are Displaynamnes from Azure Active Directory.

MembersDisplayNames

The Role Definition Id.

RoleDefinition

The Role Definition Displayname.

RoleDefinitionDisplayName

Present ensures the Role exists, absent ensures it is removed.

Ensure

This resource configures an Intune Role Definition.

Schema for microsoft.intune.roledefinition

Id

Description of the Role definition.

Description

Display Name of the Role definition.

DisplayName

Type of Role. Set to True if it is built-in, or set to False if it is a custom role definition.

IsBuiltIn

List of allowed resource actions

allowedResourceActions

List of not allowed resource actions

notAllowedResourceActions

Id of the Scope Tags to assign

roleScopeTagIds

Ensure

This resource configures a Intune Endpoint Protection Attack Surface Reduction rules policy for a Windows 10 Device.
This resource returns ASR rules created using settings catalog settings.

Schema for microsoft.intune.settingcatalogasrrulespolicywindows10

Identity of the endpoint protection attack surface protection rules policy for Windows 10.

Identity

Display name of the endpoint protection attack surface protection rules policy for Windows 10.

DisplayName

Description of the endpoint protection attack surface protection rules policy for Windows 10.

Description

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Assignments of the endpoint protection.

Assignments

Exclude files and paths from attack surface reduction rules

AttackSurfaceReductionOnlyExclusions

This rule prevents an application from writing a vulnerable signed driver to disk.

BlockAbuseOfExploitedVulnerableSignedDrivers

ASR Only Per Rule Exclusions

BlockAbuseOfExploitedVulnerableSignedDrivers_ASROnlyPerRuleExclusions

This rule prevents attacks by blocking Adobe Reader from creating processes.

BlockAdobeReaderFromCreatingChildProcesses

ASR Only Per Rule Exclusions

BlockAdobeReaderFromCreatingChildProcesses_ASROnlyPerRuleExclusions

This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access.

BlockAllOfficeApplicationsFromCreatingChildProcesses

ASR Only Per Rule Exclusions (off: Off, block: Block, audit: Audit, warn: Warn)

BlockAllOfficeApplicationsFromCreatingChildProcesses_ASROnlyPerRuleExclusions

This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS).

BlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem

ASR Only Per Rule Exclusions

BlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem_ASROnlyPerRuleExclusions

This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers.

BlockExecutableContentFromEmailClientAndWebmail

ASR Only Per Rule Exclusions

BlockExecutableContentFromEmailClientAndWebmail_ASROnlyPerRuleExclusions

This rule blocks executable files that don't meet a prevalence, age, or trusted list criteria, such as .exe, .dll, or .scr, from launching.

BlockExecutableFilesRunningUnlessTheyMeetPrevalenceAgeTrustedListCriterion

ASR Only Per Rule Exclusions

BlockExecutableFilesRunningUnlessTheyMeetPrevalenceAgeTrustedListCriterion_ASROnlyPerRuleExclusions

This rule detects suspicious properties within an obfuscated script.

BlockExecutionOfPotentiallyObfuscatedScripts

ASR Only Per Rule Exclusions

BlockExecutionOfPotentiallyObfuscatedScripts_ASROnlyPerRuleExclusions

This rule prevents scripts from launching potentially malicious downloaded content.

BlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent

ASR Only Per Rule Exclusions

BlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent_ASROnlyPerRuleExclusions

This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.

BlockOfficeApplicationsFromCreatingExecutableContent

ASR Only Per Rule Exclusions

BlockOfficeApplicationsFromCreatingExecutableContent_ASROnlyPerRuleExclusions

This rule blocks code injection attempts from Office apps into other processes.

BlockOfficeApplicationsFromInjectingCodeIntoOtherProcesses

ASR Only Per Rule Exclusions

BlockOfficeApplicationsFromInjectingCodeIntoOtherProcesses_ASROnlyPerRuleExclusions

This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.

BlockOfficeCommunicationAppFromCreatingChildProcesses

ASR Only Per Rule Exclusions

BlockOfficeCommunicationAppFromCreatingChildProcesses_ASROnlyPerRuleExclusions

This rule prevents malware from abusing WMI to attain persistence on a device.

BlockPersistenceThroughWMIEventSubscription

This rule blocks processes created through PsExec and WMI from running.

BlockProcessCreationsFromPSExecAndWMICommands

ASR Only Per Rule Exclusions

BlockProcessCreationsFromPSExecAndWMICommands_ASROnlyPerRuleExclusions

This rule prevents the execution of commands to restart machines in Safe Mode.

BlockRebootingMachineInSafeMode

ASR Only Per Rule Exclusions

BlockRebootingMachineInSafeMode_ASROnlyPerRuleExclusions

With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards.

BlockUntrustedUnsignedProcessesThatRunFromUSB

ASR Only Per Rule Exclusions

BlockUntrustedUnsignedProcessesThatRunFromUSB_ASROnlyPerRuleExclusions

This rule blocks the use of executable files that are identified as copies of Windows system tools. These files are either duplicates or impostors of the original system tools.

BlockUseOfCopiedOrImpersonatedSystemTools

ASR Only Per Rule Exclusions

BlockUseOfCopiedOrImpersonatedSystemTools_ASROnlyPerRuleExclusions

This rule blocks webshell creation for servers.

BlockWebShellCreationForServers

ASR Only Per Rule Exclusions

BlockWebshellCreationForServers_ASROnlyPerRuleExclusions

This rule prevents VBA macros from calling Win32 APIs.

ASR Only Per Rule Exclusions

This rule provides an extra layer of protection against ransomware.

UseAdvancedProtectionAgainstRansomware

ASR Only Per Rule Exclusions

UseAdvancedProtectionAgainstRansomware_ASROnlyPerRuleExclusions

List of additional folders that need to be protected

ControlledFolderAccessProtectedFolders

List of apps that have access to protected folders.

ControlledFolderAccessAllowedApplications

This rule enables Controlled folder access which protects your data by checking apps against a list of known, trusted apps.values 0:disable, 1:enable, 2:audit

EnableControlledFolderAccess

Present ensures the policy exists, absent ensures it is removed

Ensure

This resource configures an Intune Wifi Configuration Policy Android Device Administrator Device.

Schema for microsoft.intune.wificonfigurationpolicyandroiddeviceadministrator

Id of the Intune Policy.

Id

Display name of the Intune Policy.

DisplayName

Description of the Intune Policy.

Description

Connect automatically.

ConnectAutomatically

Connect when network name is hidden.

ConnectWhenNetworkNameIsHidden

Network name.

NetworkName

SSID.

Ssid

Wi-Fi security type.

WiFiSecurityType

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures an Intune Wifi Configuration Policy Android Enterprise Device Owner Device.

Schema for microsoft.intune.wificonfigurationpolicyandroidenterprisedeviceowner

Id of the Intune policy

Id

Disaply name of the Intune policy

DisplayName

Description of the Intune policy

Description

If the network is in range, automatically connect.

ConnectAutomatically

Don't show this Wi-Fi network on an end-user's device in the list of available networks. The SSID will not be broadcasted.

ConnectWhenNetworkNameIsHidden

Network name.

NetworkName

Pre shared key.

PreSharedKey

Pre shared key is set.

PreSharedKeyIsSet

URL of the automatic proxy.

ProxyAutomaticConfigurationUrl

Exclusion list of the proxy.

ProxyExclusionList

Address of the proxy.

ProxyManualAddress

Port of the proxy.

ProxyManualPort

Proxy setting type.

ProxySettings

Service Set Identifier. The name of the Wi-Fi connection.

Ssid

Type of Wi-Fi profile.

WiFiSecurityType

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments

Ensure

This resource configures an Intune Wifi Configuration Policy Android Enterprise Work Profile Device.

Schema for microsoft.intune.wificonfigurationpolicyandroidenterpriseworkprofile

Id of the Intune policy.

Id

Display name of the Intune policy.

DisplayName

Description of the Intune policy.

Description

Connect automatically.

ConnectAutomatically

Connect when network name is hidden.

ConnectWhenNetworkNameIsHidden

Network name.

NetworkName

SSID.

Ssid

Wi-Fi security.

WiFiSecurityType

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments

Ensure

This resource configures an Intune Wifi Configuration Policy Android For Work Device.

Schema for microsoft.intune.wificonfigurationpolicyandroidforwork

Id of the Intune policy.

Id

Display name of the Intune policy.

DisplayName

Description of the Intune policy.

Description

Connect automatically

ConnectAutomatically

Connect when network name is hidden

ConnectWhenNetworkNameIsHidden

Network name

NetworkName

SSID

Ssid

Wi-Fi security

WiFiSecurityType

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments

Ensure

This resource configures an Intune Wifi Configuration Policy Android Open Source Project Device.

Schema for microsoft.intune.wificonfigurationpolicyandroidopensourceproject

Id of the Intune policy.

Id

Display name of the Intune policy.

DisplayName

Description of the Intune policy.

Description

Connect automatically to the network.

ConnectAutomatically

Define if the network should be connected if hidden.

ConnectWhenNetworkNameIsHidden

Define the network name.

NetworkName

Define the pre-shared key.

PreSharedKey

Define if the pre-shared key is set.

PreSharedKeyIsSet

Define the SSID.

Ssid

Define the Wifi security type.

WiFiSecurityType

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments

Ensure

This resource configures an Intune Wifi Configuration Policy for iOS Device.

Schema for microsoft.intune.wificonfigurationpolicyios

Id of the Intune policy.

Id

Display name of the Intune policy.

DisplayName

Description of the Intune policy.

Description

Connect automatically

ConnectAutomatically

Connect when network name is hidden

ConnectWhenNetworkNameIsHidden

Disable the MAC address randomization.

DisableMacAddressRandomization

Network name

NetworkName

Pre shared key

PreSharedKey

Proxy automatic configuration url

ProxyAutomaticConfigurationUrl

Proxy manual address

ProxyManualAddress

Proxy manual port

ProxyManualPort

Proxy settings

ProxySettings

SSID

Ssid

open wpaPersonal wpaEnterprise wep wpa2Personal wpa2Enterprise

Wi-Fi security

WiFiSecurityType

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures an Intune Wifi Configuration Policy for MacOS Device.

Schema for microsoft.intune.wificonfigurationpolicymacos

Id of the Intune policy.

Id

Display name of the Intune policy.

DisplayName

Description of the Intune policy.

Description

Connect automatically

ConnectAutomatically

Connect when network name is hidden

ConnectWhenNetworkNameIsHidden

Network name

NetworkName

Pre shared key

PreSharedKey

Proxy automatic configuration url

ProxyAutomaticConfigurationUrl

Proxy manual address

ProxyManualAddress

Proxy manual port

ProxyManualPort

Proxy settings

ProxySettings

SSID

Ssid

Wi-Fi security

WiFiSecurityType

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments

Ensure

This resource configures an Intune Wifi Configuration Policy for Windows10 Device.

Schema for microsoft.intune.wificonfigurationpolicywindows10

Id of the Intune policy.

Id

Display name of the Intune policy.

DisplayName

Description of the Intune policy.

Description

Connect automatically

ConnectAutomatically

Connect to preferred network

ConnectToPreferredNetwork

Connect when network name is hidden

ConnectWhenNetworkNameIsHidden

Force FIPS compliance

ForceFIPSCompliance

Metered connection limit

MeteredConnectionLimit

Network name

NetworkName

Pre shared key

PreSharedKey

Proxy automatic configuration url

ProxyAutomaticConfigurationUrl

Proxy manual address

ProxyManualAddress

Proxy manual port

ProxyManualPort

Proxy setting

ProxySetting

SSID

Ssid

Wi-Fi security

WifiSecurityType

The type of the target assignment.

dataType

groupId

groupDisplayName

collectionId

Assignments

Ensure

Intune Windows Autopilot Deployment Profile Azure AD Hybrid Joined

Schema for microsoft.intune.windowsautopilotdeploymentprofileazureadhybridjoined

The Autopilot Hybrid Azure AD join flow will continue even if it does not establish domain controller connectivity during OOBE.

HybridAzureADJoinSkipConnectivityCheck

Description of the profile

Description

The template used to name the AutoPilot Device. This can be a custom text and can also contain either the serial number of the device, or a randomly generated number. The total length of the text generated by the template can be no more than 15 characters.

DeviceNameTemplate

windowsPc surfaceHub2 holoLens surfaceHub2S virtualMachine unknownFutureValue

The AutoPilot device type that this profile is applicable to. Possible values are: windowsPc, surfaceHub2.

DeviceType

Name of the profile

DisplayName

Enable Autopilot White Glove for the profile.

EnableWhiteGlove

Enrollment status screen setting

EnrollmentStatusScreenSettings

Allow or block user to use device before profile and app installation complete

AllowDeviceUseBeforeProfileAndAppInstallComplete

Allow the user to continue using the device on installation failure

AllowDeviceUseOnInstallFailure

Allow or block log collection on installation failure

AllowLogCollectionOnInstallFailure

Allow the user to retry the setup on installation failure

BlockDeviceSetupRetryByUser

Set custom error message to show upon installation failure

CustomErrorMessage

Show or hide installation progress to user

HideInstallationProgress

Set installation progress timeout in minutes

InstallProgressTimeoutInMinutes

HardwareHash Extraction for the profile

ExtractHardwareHash

Language configured on the device

Language

AzureAD management app ID used during client device-based enrollment discovery

ManagementServiceAppId

Out of box experience setting

OutOfBoxExperienceSettings

AAD join authentication type. Possible values are: singleUser, shared.

DeviceUsageType

If set to true, then the user can't start over with different account, on company sign-in

HideEscapeLink

Show or hide EULA to user

HideEULA

Show or hide privacy settings to user

HidePrivacySettings

If set, then skip the keyboard selection page if Language and Region are set

SkipKeyboardSelectionPage

Type of user. Possible values are: administrator, standard.

UserType

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Windows Autopilot Deployment Profile Azure AD Joined

Schema for microsoft.intune.windowsautopilotdeploymentprofileazureadjoined

Description of the profile

Description

The template used to name the AutoPilot Device. This can be a custom text and can also contain either the serial number of the device, or a randomly generated number. The total length of the text generated by the template can be no more than 15 characters.

DeviceNameTemplate

The AutoPilot device type that this profile is applicable to. Possible values are: windowsPc, surfaceHub2.

DeviceType

Name of the profile

DisplayName

Enable Autopilot White Glove for the profile.

EnableWhiteGlove

Enrollment status screen setting

EnrollmentStatusScreenSettings

Allow or block user to use device before profile and app installation complete

Allow the user to continue using the device on installation failure

AllowDeviceUseOnInstallFailure

Allow or block log collection on installation failure

AllowLogCollectionOnInstallFailure

Allow the user to retry the setup on installation failure

BlockDeviceSetupRetryByUser

Set custom error message to show upon installation failure

CustomErrorMessage

Show or hide installation progress to user

HideInstallationProgress

Set installation progress timeout in minutes

InstallProgressTimeoutInMinutes

HardwareHash Extraction for the profile

ExtractHardwareHash

Language configured on the device

Language

AzureAD management app ID used during client device-based enrollment discovery

ManagementServiceAppId

Out of box experience setting

OutOfBoxExperienceSettings

AAD join authentication type. Possible values are: singleUser, shared.

DeviceUsageType

If set to true, then the user can't start over with different account, on company sign-in

HideEscapeLink

Show or hide EULA to user

HideEULA

Show or hide privacy settings to user

HidePrivacySettings

If set, then skip the keyboard selection page if Language and Region are set

SkipKeyboardSelectionPage

Type of user. Possible values are: administrator, standard.

UserType

The unique identifier for an entity. Read-only.

Id

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Windows Information Protection Policy for Windows10 Mdm Enrolled

Schema for microsoft.intune.windowsinformationprotectionpolicywindows10mdmenrolled

Id

Policy display name.

DisplayName

Specifies whether to allow Azure RMS encryption for WIP

AzureRightsManagementServicesAllowed

Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent(DRA) certificate for encrypting file system(EFS)

DataRecoveryCertificate

Data recovery Certificate

Certificate

Data recovery Certificate description

Description

Data recovery Certificate expiration datetime

ExpirationDateTime

Data recovery Certificate subject name

SubjectName

noProtection encryptAndAuditOnly encryptAuditAndPrompt encryptAuditAndBlock

WIP enforcement level.See the Enum definition for supported values. Possible values are: noProtection, encryptAndAuditOnly, encryptAuditAndPrompt, encryptAuditAndBlock.

EnforcementLevel

Primary enterprise domain

EnterpriseDomain

Schema for MSFT_MicrosoftGraphWindowsInformationProtectionResourceCollection

Display name

DisplayName

Collection of resources

Resources

This is the comma-separated list of internal proxy servers. For example, '157.54.14.28, 157.54.11.118, 10.202.14.167, 157.53.14.163, 157.69.210.59'. These proxies have been configured by the admin to connect to specific resources on the Internet. They are considered to be enterprise network locations. The proxies are only leveraged in configuring the EnterpriseProxiedDomains policy to force traffic to the matched domains through these proxies

EnterpriseInternalProxyServers

Schema for MSFT_MicrosoftGraphWindowsInformationProtectionIPRangeCollection

Display name

DisplayName

Schema for MSFT_MicrosoftGraphIpRange

IPv4 address in CIDR notation. Not nullable.

CidrAddress

Lower address.

LowerAddress

Upper address.

UpperAddress

The type of the entity.

odataType

Collection of ip ranges

Ranges

Sets the enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. These locations will be considered a safe destination for enterprise data to be shared to

EnterpriseIPRanges

Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. Default is false

EnterpriseIPRangesAreAuthoritative

Display name

DisplayName

Collection of resources

Resources

This is the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected These locations will be considered a safe destination for enterprise data to be shared to

EnterpriseNetworkDomainNames

Display name

DisplayName

Collection of resources

Resources

List of enterprise domains to be protected

EnterpriseProtectedDomainNames

Schema for MSFT_MicrosoftGraphWindowsInformationProtectionProxiedDomainCollection

Display name

DisplayName

Schema for MSFT_MicrosoftGraphProxiedDomain

The IP address or FQDN

IpAddressOrFQDN

Proxy IP or FQDN

Proxy

Collection of proxied domains

ProxiedDomains

Contains a list of Enterprise resource domains hosted in the cloud that need to be protected. Connections to these resources are considered enterprise data. If a proxy is paired with a cloud resource, traffic to the cloud resource will be routed through the enterprise network via the denoted proxy server (on Port 80). A proxy server used for this purpose must also be configured using the EnterpriseInternalProxyServers policy

EnterpriseProxiedDomains

Display name

DisplayName

Collection of resources

Resources

This is a list of proxy servers. Any server not on this list is considered non-enterprise

EnterpriseProxyServers

Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. Default is false

EnterpriseProxyServersAreAuthoritative

Schema for MSFT_MicrosoftGraphWindowsInformationProtectionApp

If true, app is denied protection or exemption.

Denied

The app's description.

Description

App display name.

DisplayName

The product name.

ProductName

The publisher name

PublisherName

The binary name.

BinaryName

The high binary version.

BinaryVersionHigh

The lower binary version.

BinaryVersionLow

The type of the entity.

odataType

Exempt applications can also access enterprise data, but the data handled by those applications are not protected. This is because some critical enterprise applications may have compatibility problems with encrypted data.

ExemptApps

Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles in the Start menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the WIP icon in the title bar of a WIP-protected app

IconsVisible

This switch is for the Windows Search Indexer, to allow or disallow indexing of items

IndexingEncryptedStoresOrItemsBlocked

Intune Windows Information Protection Policy for Windows10 Mdm Enrolled

Display name

DisplayName

Collection of resources

Resources

List of domain names that can used for work or personal resource

NeutralDomainResources

Denied

The app's description.

Description

App display name.

DisplayName

The product name.

ProductName

The publisher name

PublisherName

The binary name.

BinaryName

The high binary version.

BinaryVersionHigh

The lower binary version.

BinaryVersionLow

The type of the entity.

odataType

Protected applications can access enterprise data and the data handled by those applications are protected with encryption

ProtectedApps

Specifies whether the protection under lock feature (also known as encrypt under pin) should be configured

ProtectionUnderLockConfigRequired

This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 1 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after unenrollment. If the keys are not revoked, there will be no revoked file cleanup subsequently.

RevokeOnUnenrollDisabled

TemplateID GUID to use for RMS encryption. The RMS template allows the IT admin to configure the details about who has access to RMS-protected file and how long they have access

RightsManagementServicesTemplateId

Display name

DisplayName

Collection of resources

Resources

Specifies a list of file extensions, so that files with these extensions are encrypted when copying from an SMB share within the corporate boundary

SmbAutoEncryptedFileExtensions

The policy's description.

Description

Schema for MSFT_IntuneWindowsInformationProtectionPolicyWindows10MdmEnrolledPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

deviceAndAppManagementAssignmentFilterType

The Id of the filter for the target assignment.

deviceAndAppManagementAssignmentFilterId

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Windows Update For Business Feature Update Profile for Windows10

## RolloutSettings

The RolloutSettings for this resource have the following constraints and notes:

* When creating a policy:
    * If only a start date is specified, then the start date must be at least today.
        * If the desired state date is before the current date, it will be adjusted to the current date.
    * If a start and end date is specified, the start date must be the current date + 2 days, and
      the end date must be at least one day after the start date.
        * If the start date is before the current date + 2 days, it will be adjusted to this date.
* When updating a policy:
    * If only a start date is specified, then the start date must either be the date from the current
      configuration or the current date (or later).
        * If the desired state date is before the current date, it will be adjusted to the current date.
    * If a start and end date is specified, the start date must be the current date + 2 days, and
      the end date must be at least one day after the start date.
        * If the start date is before the current date + 2 days, it will be adjusted to this date.
* When testing a policy:
    * If the policy is missing and the start and end date are before the current date, it will return true.
    * If the start date is different but before the current start date or time, it will return true.

Schema for microsoft.intune.windowsupdateforbusinessfeatureupdateprofilewindows10

The unique identifier for an entity. Read-only.

Id

The display name of the profile.

DisplayName

The description of the profile which is specified by the user.

Description

The feature update version that will be deployed to the devices targeted by this profile. The version could be any supported version for example 1709, 1803 or 1809 and so on.

FeatureUpdateVersion

If true, the Windows 11 update will become optional

InstallFeatureUpdatesOptional

If true, the latest Microsoft Windows 10 update will be installed on devices ineligible for Microsoft Windows 11. Cannot be changed after creation of the policy.

The windows update rollout settings, including offer start date time, offer end date time, and days between each set of offers. For 'as soon as possible' installation, set this setting to $null or do not configure it.

RolloutSettings

The feature update's ending  of release date and time to be set, update, and displayed for a feature Update profile for example: 2020-06-09T10:00:00Z.

OfferEndDateTimeInUTC

The number of day(s) between each set of offers to be set, updated, and displayed for a feature update profile, for example: if OfferStartDateTimeInUTC is 2020-06-09T10:00:00Z, and OfferIntervalInDays is 1, then the next two sets of offers will be made consecutively on 2020-06-10T10:00:00Z (next day at the same specified time) and 2020-06-11T10:00:00Z (next next day at the same specified time) with 1 day in between each set of offers.

OfferIntervalInDays

The feature update's starting date and time to be set, update, and displayed for a feature Update profile for example: 2020-06-09T10:00:00Z.

OfferStartDateTimeInUTC

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

Schema for MSFT_DeviceManagementConfigurationPolicyAssignments

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

Intune Windows Update For Business Ring Update Profile for Windows 10

Schema for microsoft.intune.windowsupdateforbusinessringupdateprofilewindows10

The unique identifier for an entity. Read-only.

Id

Admin provided name of the device configuration.

DisplayName

When TRUE, allows eligible Windows 10 devices to upgrade to Windows 11. When FALSE, implies the device stays on the existing operating system. Returned by default. Query parameters are not supported.

The Automatic Update Mode. Possible values are: UserDefined, NotifyDownload, AutoInstallAtMaintenanceTime, AutoInstallAndRebootAtMaintenanceTime, AutoInstallAndRebootAtScheduledTime, AutoInstallAndRebootWithoutEndUserControl, WindowsDefault. UserDefined is the default value, no intent. Returned by default. Query parameters are not supported. Possible values are: userDefined, notifyDownload, autoInstallAtMaintenanceTime, autoInstallAndRebootAtMaintenanceTime, autoInstallAndRebootAtScheduledTime, autoInstallAndRebootWithoutEndUserControl, windowsDefault.

AutomaticUpdateMode

notConfigured automatic user unknownFutureValue

Specify the method by which the auto-restart required notification is dismissed. Possible values are: NotConfigured, Automatic, User. Returned by default. Query parameters are not supported. Possible values are: notConfigured, automatic, user, unknownFutureValue.

AutoRestartNotificationDismissal

userDefined all businessReadyOnly windowsInsiderBuildFast windowsInsiderBuildSlow windowsInsiderBuildRelease

Determines which branch devices will receive their updates from. Possible values are: UserDefined, All, BusinessReadyOnly, WindowsInsiderBuildFast, WindowsInsiderBuildSlow, WindowsInsiderBuildRelease. Returned by default. Query parameters are not supported. Possible values are: userDefined, all, businessReadyOnly, windowsInsiderBuildFast, windowsInsiderBuildSlow, windowsInsiderBuildRelease.

BusinessReadyUpdatesOnly

Number of days before feature updates are installed automatically with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.

DeadlineForFeatureUpdatesInDays

Number of days before quality updates are installed automatically with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.

DeadlineForQualityUpdatesInDays

Number of days after deadline until restarts occur automatically with valid range from 0 to 7 days. Returned by default. Query parameters are not supported.

DeadlineGracePeriodInDays

userDefined httpOnly httpWithPeeringNat httpWithPeeringPrivateGroup httpWithInternetPeering simpleDownload bypassMode

The Delivery Optimization Mode. Possible values are: UserDefined, HttpOnly, HttpWithPeeringNat, HttpWithPeeringPrivateGroup, HttpWithInternetPeering, SimpleDownload, BypassMode. UserDefined allows the user to set. Returned by default. Query parameters are not supported. Possible values are: userDefined, httpOnly, httpWithPeeringNat, httpWithPeeringPrivateGroup, httpWithInternetPeering, simpleDownload, bypassMode.

DeliveryOptimizationMode

When TRUE, excludes Windows update Drivers. When FALSE, does not exclude Windows update Drivers. Returned by default. Query parameters are not supported.

DriversExcluded

Deadline in days before automatically scheduling and executing a pending restart outside of active hours, with valid range from 2 to 30 days. Returned by default. Query parameters are not supported.

EngagedRestartDeadlineInDays

Number of days a user can snooze Engaged Restart reminder notifications with valid range from 1 to 3 days. Returned by default. Query parameters are not supported.

EngagedRestartSnoozeScheduleInDays

Number of days before transitioning from Auto Restarts scheduled outside of active hours to Engaged Restart, which requires the user to schedule, with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.

EngagedRestartTransitionScheduleInDays

Defer Feature Updates by these many days with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.

FeatureUpdatesDeferralPeriodInDays

When TRUE, assigned devices are paused from receiving feature updates for up to 35 days from the time you pause the ring. When FALSE, does not pause Feature Updates. Returned by default. Query parameters are not supported.s

FeatureUpdatesPaused

The Feature Updates Pause Expiry datetime. This value is 35 days from the time admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported.

FeatureUpdatesPauseExpiryDateTime

The Feature Updates Pause start date. This value is the time when the admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported. This property is read-only.

FeatureUpdatesPauseStartDate

The Feature Updates Rollback Start datetime.This value is the time when the admin rolled back the Feature update for the ring.Returned by default.Query parameters are not supported.

FeatureUpdatesRollbackStartDateTime

The number of days after a Feature Update for which a rollback is valid with valid range from 2 to 60 days. Returned by default. Query parameters are not supported.

FeatureUpdatesRollbackWindowInDays

The Installation Schedule. Possible values are: ActiveHoursStart, ActiveHoursEnd, ScheduledInstallDay, ScheduledInstallTime. Returned by default. Query parameters are not supported.

InstallationSchedule

Active Hours End

ActiveHoursEnd

Active Hours Start

ActiveHoursStart

userDefined everyday sunday monday tuesday wednesday thursday friday saturday noScheduledScan

Scheduled Install Day in week. Possible values are: userDefined, everyday, sunday, monday, tuesday, wednesday, thursday, friday, saturday, noScheduledScan.

ScheduledInstallDay

Scheduled Install Time during day

ScheduledInstallTime

The type of the entity.

odataType

When TRUE, allows Microsoft Update Service. When FALSE, does not allow Microsoft Update Service. Returned by default. Query parameters are not supported.

MicrosoftUpdateServiceAllowed

When TRUE the device should wait until deadline for rebooting outside of active hours. When FALSE the device should not wait until deadline for rebooting outside of active hours. Returned by default. Query parameters are not supported.

PostponeRebootUntilAfterDeadline

userDefined settingsOnly settingsAndExperimentations notAllowed

The Pre-Release Features. Possible values are: UserDefined, SettingsOnly, SettingsAndExperimentations, NotAllowed. UserDefined is the default value, no intent. Returned by default. Query parameters are not supported. Possible values are: userDefined, settingsOnly, settingsAndExperimentations, notAllowed.

PrereleaseFeatures

Defer Quality Updates by these many days with valid range from 0 to 30 days. Returned by default. Query parameters are not supported.

QualityUpdatesDeferralPeriodInDays

When TRUE, assigned devices are paused from receiving quality updates for up to 35 days from the time you pause the ring. When FALSE, does not pause Quality Updates. Returned by default. Query parameters are not supported.

QualityUpdatesPaused

The Quality Updates Pause Expiry datetime. This value is 35 days from the time admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported.

QualityUpdatesPauseExpiryDateTime

The Quality Updates Pause start date. This value is the time when the admin paused or extended the pause for the ring. Returned by default. Query parameters are not supported. This property is read-only.

QualityUpdatesPauseStartDate

The Quality Updates Rollback Start datetime. This value is the time when the admin rolled back the Quality update for the ring. Returned by default. Query parameters are not supported.

QualityUpdatesRollbackStartDateTime

Specify the period for auto-restart imminent warning notifications. Supported values: 15, 30 or 60 (minutes). Returned by default. Query parameters are not supported.

ScheduleImminentRestartWarningInMinutes

Specify the period for auto-restart warning reminder notifications. Supported values: 2, 4, 8, 12 or 24 (hours). Returned by default. Query parameters are not supported.

ScheduleRestartWarningInHours

When TRUE, skips all checks before restart: Battery level = 40%, User presence, Display Needed, Presentation mode, Full screen mode, phone call state, game mode etc. When FALSE, does not skip all checks before restart. Returned by default. Query parameters are not supported.

SkipChecksBeforeRestart

notConfigured defaultNotifications restartWarningsOnly disableAllNotifications unknownFutureValue

Specifies what Windows Update notifications users see. Possible values are: NotConfigured, DefaultNotifications, RestartWarningsOnly, DisableAllNotifications. Returned by default. Query parameters are not supported. Possible values are: notConfigured, defaultNotifications, restartWarningsOnly, disableAllNotifications, unknownFutureValue.

UpdateNotificationLevel

userDefined firstWeek secondWeek thirdWeek fourthWeek everyWeek unknownFutureValue

Schedule the update installation on the weeks of the month. Possible values are: UserDefined, FirstWeek, SecondWeek, ThirdWeek, FourthWeek, EveryWeek. Returned by default. Query parameters are not supported. Possible values are: userDefined, firstWeek, secondWeek, thirdWeek, fourthWeek, everyWeek, unknownFutureValue.

UpdateWeeks

Specifies whether to enable end user's access to pause software updates. Possible values are: NotConfigured, Enabled, Disabled. Returned by default. Query parameters are not supported. Possible values are: notConfigured, enabled, disabled.

UserPauseAccess

Specifies whether to disable user's access to scan Windows Update. Possible values are: NotConfigured, Enabled, Disabled. Returned by default. Query parameters are not supported. Possible values are: notConfigured, enabled, disabled.

UserWindowsUpdateScanAccess

Admin provided description of the Device Configuration.

Description

This resource configures an Intune Endpoint Protection Antivirus policy for a Windows 10 Device.
This policy setting enables the management of Microsoft Defender Antivirus for Windows 10 using the settings catalog.

The type of the target assignment.

dataType

The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.

The Id of the filter for the target assignment.

The group Id that is the target of the assignment.

groupId

The group Display Name that is the target of the assignment.

groupDisplayName

The collection Id that is the target of the assignment.(ConfigMgr)

collectionId

Represents the assignment to the Intune policy.

Assignments

Present ensures the policy exists, absent ensures it is removed.

Ensure

This resource configures an Audit ConfigurationPolicy
in Security and Compliance Center.

Schema for microsoft.securityandcompliance.auditconfigurationpolicy

Workload associated with the policy.

Workload

Specify if this policy should exist or not.

Ensure

This resource configures a Auto Sensitivity label policy in Security and Compliance.

Schema for microsoft.securityandcompliance.autosensitivitylabelpolicy

The Name parameter specifies the unique name for the sensitivity label. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.

Name

Specify if this label policy should exist or not.

Ensure

The Comment parameter specifies an optional comment.

Comment

The ApplySensitivityLabel parameter specifies the label to use for the auto label policy.

ApplySensitivityLabel

The ExchangeSender parameter specifies which senders to include in the policy.

ExchangeSender

The ExchangeSenderException parameter specifies which senders to exclude in the policy.

ExchangeSenderException

The ExchangeSenderMemberOf parameter specifies the distribution groups, mail-enabled security groups, or dynamic distribution groups to include in the auto-labeling policy.

ExchangeSenderMemberOf

he ExchangeSenderMemberOf parameter specifies the distribution groups, mail-enabled security groups, or dynamic distribution groups to exclude from the auto-labeling policy.

ExchangeSenderMemberOfException

ExchangeLocation

This AddExchangeLocation parameter specifies new Exchange locations to be added to the policy without affecting the existing ones.

AddExchangeLocation

The RemoveExchangeLocation parameter removes locations on Exchange from the policy.

RemoveExchangeLocation

Enable Disable TestWithNotifications TestWithoutNotifications

The Mode parameter specifies the action and notification level of the auto-labeling policy.

Mode

The OneDriveLocation parameter specifies the OneDrive for Business sites to include. You identify the site by its URL value, or you can use the value.

OneDriveLocation

The AddOneDriveLocation parameter specifies the OneDrive for Business sites to add to the list of included sites when you aren't using the value All for the OneDriveLocation parameter.

AddOneDriveLocation

The RemoveOneDriveLocation parameter specifies the OneDrive for Business sites to remove from the list of included sites when you aren't using the value All for the OneDriveLocation parameter.

RemoveOneDriveLocation

This parameter specifies the OneDrive for Business sites to exclude when you use the value All for the OneDriveLocation parameter.

AddOneDriveLocationException

This RemoveOneDriveLocationException parameter specifies the OneDrive for Business sites to remove from the list of excluded sites when you use the value All for the OneDriveLocation parameter.

RemoveOneDriveLocationException

The AddOneDriveLocationException parameter specifies the OneDrive for Business sites to add to the list of excluded sites when you use the value All for the OneDriveLocation parameter.

OneDriveLocationException

The Priority parameter specifies the priority of the policy. The highest priority policy will take action over lower priority policies if two policies are applicable for a file.

Priority

The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.

SharePointLocation

This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter.

SharePointLocationException

The AddSharePointLocation parameter specifies the SharePoint Online sites to add to the list of included sites when you aren't using the value All for the SharePointLocation parameter.

AddSharePointLocationException

The RemoveSharePointLocationException parameter specifies the SharePoint Online sites to remove from the list of excluded sites when you use the value All for the SharePointLocation parameter.

RemoveSharePointLocationException

AddSharePointLocation

The RemoveSharePointLocation parameter specifies the SharePoint Online sites to remove from the list of included sites when you aren't using the value All for the SharePointLocation parameter.

RemoveSharePointLocation

This resource configures a Auto Sensitivity Label
Rule in Security and Compliance Center.

Schema for microsoft.securityandcompliance.autosensitivitylabelrule

Name of the Rule.

Name

Name of the associated Policy.

Policy

The AccessScope parameter specifies a condition for the auto-labeling policy rule that's based on the access scope of the content. The rule is applied to content that matches the specified access scope. Valid values are: InOrganization, NotInOrganization, None

AccessScope

The AnyOfRecipientAddressContainsWords parameter specifies a condition for the auto-labeling policy rule that looks for words or phrases in recipient email addresses. You can specify multiple words or phrases separated by commas.

AnyOfRecipientAddressContainsWords

The AnyOfRecipientAddressMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in recipient email addresses by using regular expressions.

AnyOfRecipientAddressMatchesPatterns

The Comment parameter specifies an optional comment.

Comment

The ContentContainsSensitiveInformation parameter specifies a condition for the rule that's based on a sensitive information type match in content. The rule is applied to content that contains the specified sensitive information type.

ContentContainsSensitiveInformation

Schema for MSFT_SCDLPSensitiveInformation

Name of the Sensitive Information Content

name

Id of the Sensitive Information Content

id

Maximum Confidence level value for the Sensitive Information

maxconfidence

Minimum Confidence level value for the Sensitive Information

minconfidence

Type of Classifier value for the Sensitive Information

classifiertype

Minimum Count value for the Sensitive Information

mincount

Maximum Count value for the Sensitive Information

maxcount

Sensitive Information Content Types

SensitiveInformation

Schema for MSFT_SCDLPContainsSensitiveInformationGroup

name

Id of the Sensitive Information Content

id

maxconfidence

minconfidence

classifiertype

mincount

maxcount

Sensitive Information Content Types

SensitiveInformation

Schema for MSFT_SCDLPLabel

Name of the Sensitive Label

name

Id of the Sensitive Information label

id

Type of the Sensitive Information label

type

Sensitive Information Labels

Labels

Name of the group

Name

Operator

Operator

Groups of sensitive information types.

Groups

Operator

Operator

The ContentExtensionMatchesWords parameter specifies a condition for the auto-labeling policy rule that looks for words in file name extensions. You can specify multiple words separated by commas.

ContentExtensionMatchesWords

The Disabled parameter specifies whether the auto-labeling policy rule is enabled or disabled.

Disabled

The DocumentIsPasswordProtected parameter specifies a condition for the auto-labeling policy rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files.

DocumentIsPasswordProtected

The DocumentIsUnsupported parameter specifies a condition for the auto-labeling policy rule that looks for files that can't be scanned.

DocumentIsUnsupported

The ExceptIfAccessScopeAccessScope parameter specifies an exception for the auto-labeling policy rule that's based on the access scope of the content. The rule isn't applied to content that matches the specified access scope. Valid values are: InOrganization, NotInOrganization, None

ExceptIfAccessScope

The ExceptIfAnyOfRecipientAddressContainsWords parameter specifies an exception for the auto-labeling policy rule that looks for words or phrases in recipient email addresses. You can specify multiple words separated by commas.

ExceptIfAnyOfRecipientAddressContainsWords

The ExceptIfAnyOfRecipientAddressMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in recipient email addresses by using regular expressions.

ExceptIfAnyOfRecipientAddressMatchesPatterns

The ExceptIfContentContainsSensitiveInformation parameter specifies an exception for the auto-labeling policy rule that's based on a sensitive information type match in content. The rule isn't applied to content that contains the specified sensitive information type.

ExceptIfContentContainsSensitiveInformation

This resource configures a Auto Sensitivity Label
Rule in Security and Compliance Center.

name

Id of the Sensitive Information Content

id

maxconfidence

minconfidence

classifiertype

mincount

maxcount

Sensitive Information Content Types

SensitiveInformation

name

Id of the Sensitive Information Content

id

maxconfidence

minconfidence

classifiertype

mincount

maxcount

Sensitive Information Content Types

SensitiveInformation

Schema for MSFT_SCDLPLabel

Name of the Sensitive Label

name

Id of the Sensitive Information label

id

Type of the Sensitive Information label

type

Sensitive Information Labels

Labels

Name of the group

Name

Operator

Operator

Groups of sensitive information types.

Groups

Operator

Operator

The ExceptIfContentExtensionMatchesWords parameter specifies an exception for the auto-labeling policy rule that looks for words in file name extensions. You can specify multiple words separated by commas.

ExceptIfContentExtensionMatchesWords

The ExceptIfDocumentIsPasswordProtected parameter specifies an exception for the auto-labeling policy rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files.

ExceptIfDocumentIsPasswordProtected

The ExceptIfDocumentIsUnsupported parameter specifies an exception for the auto-labeling policy rule that looks for files that can't be scanned.

ExceptIfDocumentIsUnsupported

The ExceptIfFrom parameter specifies an exception for the auto-labeling policy rule that looks for messages from specific senders. You can use any value that uniquely identifies the sender.

ExceptIfFrom

The ExceptIfFromAddressContainsWords parameter specifies an exception for the auto-labeling policy rule that looks for words or phrases in the sender's email address. You can specify multiple words or phrases separated by commas.

ExceptIfFromAddressContainsWords

The ExceptIfFromAddressMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in the sender's email address by using regular expressions.

ExceptIfFromAddressMatchesPatterns

The ExceptIfFromMemberOf parameter specifies an exception for the auto-labeling policy rule that looks for messages sent by group members. You identify the group members by their email addresses. You can enter multiple values separated by commas.

ExceptIfFromMemberOf

The HeaderMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in a header field by using regular expressions.

ExceptIfHeaderMatchesPatterns

The ExceptIfProcessingLimitExceeded parameter specifies an exception for the auto-labeling policy rule that looks for files where scanning couldn't complete.

ExceptIfProcessingLimitExceeded

The ExceptIfRecipientDomainIs parameter specifies an exception for the auto-labeling policy rule that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

ExceptIfRecipientDomainIs

The ExceptIfSenderDomainIs parameter specifies an exception for the auto-labeling policy rule that looks for messages from senders with email address in the specified domains. You can specify multiple values separated by commas.

ExceptIfSenderDomainIs

The ExceptIfSenderIpRanges parameter specifies an exception for the auto-labeling policy rule that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.

ExceptIfSenderIPRanges

The ExceptIfSentTo parameter specifies an exception for the auto-labeling policy rule that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

ExceptIfSentTo

The ExceptIfSentToMemberOf parameter specifies an exception for the auto-labeling policy rule that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You identify the groups by email address. You can specify multiple values separated by commas.

ExceptIfSentToMemberOf

The ExceptIfSubjectMatchesPatterns parameter specifies an exception for the auto-labeling policy rule that looks for text patterns in the Subject field of messages by using regular expressions.

ExceptIfSubjectMatchesPatterns

The FromAddressContainsWords parameter specifies a condition for the auto-labeling policy rule that looks for words or phrases in the sender's email address. You can specify multiple words or phrases separated by commas.

FromAddressContainsWords

The FromAddressMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in the sender's email address by using regular expressions.

FromAddressMatchesPatterns

The HeaderMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in a header field by using regular expressions.

HeaderMatchesPatterns

Name of the header pattern

Name

Regular expressions for the pattern

Values

The ProcessingLimitExceeded parameter specifies a condition for the auto-labeling policy rule that looks for files where scanning couldn't complete. You can use this condition to create rules that work together to identify and process messages where the content couldn't be fully scanned.

ProcessingLimitExceeded

The RecipientDomainIs parameter specifies a condition for the auto-labeling policy rule that looks for recipients with email address in the specified domains. You can specify multiple domains separated by commas.

RecipientDomainIs

The ReportSeverityLevel parameter specifies the severity level of the incident report for content detections based on the rule. Valid values are: None, Low, Medium, High

ReportSeverityLevel

The RuleErrorAction parameter specifies what to do if an error is encountered during the evaluation of the rule. Valid values are: Ignore, RetryThenBlock, *blank*

RuleErrorAction

The SenderDomainIs parameter specifies a condition for the auto-labeling policy rule that looks for messages from senders with email address in the specified domains.

SenderDomainIs

The SenderIpRanges parameter specifies a condition for the auto-sensitivity policy rule that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.

SenderIPRanges

The SentTo parameter specifies a condition for the auto-sensitivity policy rule that looks for recipients in messages. You can use any value that uniquely identifies the recipient.

SentTo

The SentToMemberOf parameter specifies a condition for the auto-labeling policy rule that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups. You identify the groups by email address.

SentToMemberOf

The SubjectMatchesPatterns parameter specifies a condition for the auto-labeling policy rule that looks for text patterns in the Subject field of messages by using regular expressions.

SubjectMatchesPatterns

Workload the rule is associated with. Value can be: Exchange, SharePoint, OneDriveForBusiness

Workload

Specify if this rule should exist or not.

Ensure

This resource configures a eDiscovery Case Policy
in Security and Compliance Center.

Schema for microsoft.securityandcompliance.caseholdpolicy

The Name parameter specifies the unique name of the case hold policy.

Name

The Case parameter specifies the eDiscovery case that you want to associate with the case hold policy.

Case

The Comment parameter specifies an optional comment.

Comment

The Enabled parameter specifies whether the policy is enabled or disabled.

Enabled

The ExchangeLocation parameter specifies the mailboxes to include in the policy.

ExchangeLocation

The PublicFolderLocation parameter specifies that you want to include all public folders in the case hold policy. You use the value All for this parameter.

PublicFolderLocation

The SharePointLocation parameter specifies the SharePoint Online and OneDrive for Business sites to include. You identify a site by its URL value.

SharePointLocation

Specify if this policy should exist or not.

Ensure

This resource configures an eDiscovery Case Hold Rule
in Security and Compliance.

Schema for microsoft.securityandcompliance.caseholdrule

The Name parameter specifies a unique name for the case hold rule.

Name

The Policy parameter specifies the case hold policy that contains the rule. You can use any value that uniquely identifies the policy.

Policy

Comment

The ContentMatchQuery parameter specifies a content search filter. Use this parameter to create a query-based hold so only the content that matches the specified search query is placed on hold. This parameter uses a text search string or a query that's formatted by using the Keyword Query Language (KQL).

ContentMatchQuery

The Disabled parameter specifies whether the case hold rule is enabled or disabled.

Disabled

Present ensures the rule exists, absent ensures it is removed

Ensure

This resource configures an eDiscovery Case in Security and Compliance.

Schema for microsoft.securityandcompliance.compliancecase

The Name parameter specifies the unique name of the compliance case.

Name

The description of the case.

Description

Specify if this case should exist or not.

Ensure

Status for the case. Can either be 'Active' or 'Closed'

Status

This resource configures an Compliance Search (eDiscovery) in Security and Compliance.

Schema for microsoft.securityandcompliance.compliancesearch

The Name parameter specifies the unique name of the complaiance tag.

Name

Compliance Case (eDiscovery) that this Search is associated with

Case

The AllowNotFoundExchangeLocationsEnabled parameter specifies whether to include mailboxes other than regular user mailboxes in the compliance search.

AllowNotFoundExchangeLocationsEnabled

The ContentMatchQuery parameter specifies a content search filter. This parameter uses a text search string or a query that's formatted by using the Keyword Query Language (KQL).

ContentMatchQuery

The Description parameter specifies an optional description for the compliance search. If the value contains spaces, enclose the value in quotation marks.

Description

The ExchangeLocation parameter specifies the mailboxes to include.

ExchangeLocation

This parameter specifies the mailboxes to exclude when you use the value All for the ExchangeLocation parameter.

ExchangeLocationExclusion

The HoldNames parameter specifies that the content locations that have been placed on hold in the specified eDiscovery case will be searched. You use the value All for this parameter. You also need to specify the name of an eDiscovery case by using the Case parameter.

HoldNames

The IncludeUserAppContent parameter specifies that you want to search the cloud-based storage location for users who don't have a regular Office 365 user account in your organization. These types of users include users without an Exchange Online license who use Office applications, Office 365 guest users, and on-premises users whose identity is synchronized with your Office 365 organization.

IncludeUserAppContent

The Language parameter specifies the language for the compliance search. Valid input for this parameter is a supported culture code value from the Microsoft .NET Framework CultureInfo class. For example, da-DK for Danish or ja-JP for Japanese.

Language

The PublicFolderLocation parameter specifies that you want to include all public folders in the search. You use the value All for this parameter.

PublicFolderLocation

The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.

SharePointLocation

This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.

SharePointLocationExclusion

Specify if this search should exist or not.

Ensure

This resource configures a Compliance Search Action in Security and Compliance.

Schema for microsoft.securityandcompliance.compliancesearchaction

The Action parameter specifies what type of action to define. Accepted values are Export, Retention and Purge.

Action

The SearchName parameter specifies the name of the existing content search to associate with the content search action. You can specify multiple content searches separated by commas.

SearchName

The FileTypeExclusionsForUnindexedItems specifies the file types to exclude because they can't be indexed. You can specify multiple values separated by commas.

FileTypeExclusionsForUnindexedItems

The EnableDedupe parameter eliminates duplication of messages when you export content search results.

EnableDedupe

The IncludeCredential switch specifies whether to include the credential in the results.

IncludeCredential

The IncludeSharePointDocumentVersions parameter specifies whether to export previous versions of the document when you use the Export switch.

IncludeSharePointDocumentVersions

The PurgeType parameter specifies how to remove items when the action is Purge.

PurgeType

The RetryOnError switch specifies whether to retry the action on any items that failed without re-running the entire action all over again.

RetryOnError

The ActionScope parameter specifies the items to include when the action is Export.

ActionScope

Specify if this action should exist or not.

Ensure

This resource configures a Compliance Tag in Security and Compliance.

Schema for microsoft.securityandcompliance.compliancetag

The Name parameter specifies the unique name of the complaiance tag.

Name

Specify if this rule should exist or not.

Ensure

The Comment parameter specifies an optional comment.

Comment

The EventType parameter specifies the retention rule that's associated with the label.

EventType

The IsRecordLabel parameter specifies whether the label is a record label.

IsRecordLabel

The Notes parameter specifies an optional note. If you specify a value that contains spaces, enclose the value in quotation marks, for example: 'This is a user note'

Notes

Regulatory description

Regulatory

The FilePlanProperty parameter specifies the file plan properties to include in the label.

FilePlanProperty

File plan department. Can get list by running Get-FilePlanPropertyDepartment.

FilePlanPropertyDepartment

File plan Authority. Can get list by running Get-FilePlanPropertyAuthority.

FilePlanPropertyAuthority

File plan category. Can get a list by running Get-FilePlanPropertyCategory.

FilePlanPropertyCategory

File plan citation. Can get a list by running Get-FilePlanPropertyCitation.

FilePlanPropertyCitation

File plan reference id. Can get a list by running Get-FilePlanPropertyReferenceId.

FilePlanPropertyReferenceId

File plan subcategory. Can get a list by running Get-FilePlanPropertySubCategory.

FilePlanPropertySubCategory

The ReviewerEmail parameter specifies the email address of a reviewer for Delete and KeepAndDelete retention actions. You can specify multiple email addresses separated by commas.

ReviewerEmail

The RetentionDuration parameter specifies the hold duration for the retention rule. Valid values are: An integer - The hold duration in days, Unlimited - The content is held indefinitely.

RetentionDuration

The RetentionAction parameter specifies the action for the label. Valid values are: Delete, Keep or KeepAndDelete.

RetentionAction

CreationAgeInDays EventAgeInDays ModificationAgeInDays TaggedAgeInDays

The RetentionType parameter specifies whether the retention duration is calculated from the content creation date, tagged date, or last modification date. Valid values are: CreationAgeInDays, EventAgeInDays,ModificationAgeInDays, or TaggedAgeInDays.

RetentionType

This resource configures a Device Conditional Access Policy in Security and Compliance.

Schema for microsoft.securityandcompliance.deviceconditionalaccesspolicy

The name of the Device Conditional Access Policy.

Name

Specify if this policy should exist or not.

Ensure

The Comment parameter specifies an optional comment.

Comment

The Enabled parameter specifies whether the policy is enabled.

Enabled

This resource configures a Device Configuration Policy in Security and Compliance.

Schema for microsoft.securityandcompliance.deviceconfigurationpolicy

The name of the Device Configuration Policy.

Name

Ensure

Comment

Enabled

This resource configures a Data Loss Prevention Compliance
Policy in Security and Compliance Center.

Schema for microsoft.securityandcompliance.dlpcompliancepolicy

The Name parameter specifies the unique name of the DLP policy. If the value contains spaces, enclose the value in quotation marks.

Name

Comment

The EndpointDLPLocation parameter specifies the user accounts to include in the DLP policy for Endpoint DLP when they are logged on to an onboarded device. You identify the account by name or email address. You can use the value All to include all user accounts.

EndpointDlpLocation

The EndpointDlpLocationException parameter specifies the user accounts to exclude from Endpoint DLP when you use the value All for the EndpointDlpLocation parameter. You identify the account by name or email address.

EndpointDlpLocationException

The OnPremisesScannerDlpLocation parameter specifies the on-premises file shares and SharePoint document libraries and folders to include in the DLP policy. You can use the value All to include all on-premises file shares and SharePoint document libraries and folders.

OnPremisesScannerDlpLocation

The OnPremisesScannerDlpLocationException parameter specifies the on-premises file shares and SharePoint document libraries and folders to exclude from the DLP policy if you use the value All for the OnPremisesScannerDlpLocation parameter.

OnPremisesScannerDlpLocationException

The PowerBIDlpLocation parameter specifies the Power BI workspace IDs to include in the DLP policy. Only workspaces hosted in Premium Gen2 capacities are permitted. You can use the value All to include all supported workspaces.

PowerBIDlpLocation

The PowerBIDlpLocationException parameter specifies the Power BI workspace IDs to exclude from the DLP policy when you use the value All for the PowerBIDlpLocation parameter. Only workspaces hosted in Premium Gen2 capacities are permitted.

PowerBIDlpLocationException

The ThirdPartyAppDlpLocation parameter specifies the non-Microsoft cloud apps to include in the DLP policy. You can use the value All to include all connected apps.

ThirdPartyAppDlpLocation

The ThirdPartyAppDlpLocationException parameter specifies the non-Microsoft cloud apps to exclude from the DLP policy when you use the value All for the ThirdPartyAppDlpLocation parameter.

ThirdPartyAppDlpLocationException

The ExchangeLocation parameter specifies Exchange Online mailboxes to include in the DLP policy. You can only use the value All for this parameter to include all mailboxes.

ExchangeLocation

Exchange members to include.

ExchangeSenderMemberOf

Exchange members to exclude.

ExchangeSenderMemberOfException

Enable TestWithNotifications TestWithoutNotifications Disable PendingDeletion

The Mode parameter specifies the action and notification level of the DLP policy. Valid values are: Enable, TestWithNotifications, TestWithoutNotifications, Disable and PendingDeletion.

Mode

The OneDriveLocation parameter specifies the OneDrive for Business sites to include. You identify the site by its URL value, or you can use the value All to include all sites.

OneDriveLocation

This parameter specifies the OneDrive for Business sites to exclude when you use the value All for the OneDriveLocation parameter. You identify the site by its URL value.

OneDriveLocationException

Priority for the Policy.

Priority

The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.

SharePointLocation

This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.

SharePointLocationException

Teams locations to include

TeamsLocation

Teams locations to exclude.

TeamsLocationException

Specify if this policy should exist or not.

Ensure

This resource configures a Data Loss Prevention Compliance
Rule in Security and Compliance Center.

Schema for microsoft.securityandcompliance.dlpcompliancerule

Name of the Rule.

Name

Name of the associated DLP Compliance Policy.

Policy

The AccessScope parameter specifies a condition for the DLP rule that's based on the access scope of the content. The rule is applied to content that matches the specified access scope.

AccessScope

The BlockAccess parameter specifies an action for the DLP rule that blocks access to the source item when the conditions of the rule are met. $true: Blocks further access to the source item that matched the rule. The owner, author, and site owner can still access the item. $false: Allows access to the source item that matched the rule. This is the default value.

BlockAccess

The BlockAccessScope parameter specifies the scope of the block access action.

BlockAccessScope

The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks.

Comment

The AdvancedRule parameter uses complex rule syntax that supports multiple AND, OR, and NOT operators and nested groups

AdvancedRule

The ContentContainsSensitiveInformation parameter specifies a condition for the rule that's based on a sensitive information type match in content. The rule is applied to content that contains the specified sensitive information type.

ContentContainsSensitiveInformation

This resource configures a Auto Sensitivity Label
Rule in Security and Compliance Center.

Name of the Sensitive Information Content

name

Id of the Sensitive Information Content

id

Maximum Confidence level value for the Sensitive Information

maxconfidence

Minimum Confidence level value for the Sensitive Information

minconfidence

Type of Classifier value for the Sensitive Information

classifiertype

Minimum Count value for the Sensitive Information

mincount

Maximum Count value for the Sensitive Information

maxcount

Sensitive Information Content Types

SensitiveInformation

name

Id of the Sensitive Information Content

id

maxconfidence

minconfidence

classifiertype

mincount

maxcount

Sensitive Information Content Types

SensitiveInformation

Schema for MSFT_SCDLPLabel

Name of the Sensitive Label

name

Id of the Sensitive Information label

id

Type of the Sensitive Information label

type

Sensitive Information Labels

Labels

Name of the group

Name

Operator

Operator

Groups of sensitive information types.

Groups

Operator

Operator

The ExceptIfContentContainsSensitiveInformation parameter specifies an exception for the rule that's based on a sensitive information type match in content. The rule isn't applied to content that contains the specified sensitive information type.

name

Id of the Sensitive Information Content

id

maxconfidence

minconfidence

classifiertype

mincount

maxcount

Sensitive Information Content Types

SensitiveInformation

name

Id of the Sensitive Information Content

id

maxconfidence

minconfidence

classifiertype

mincount

maxcount

Sensitive Information Content Types

SensitiveInformation

Schema for MSFT_SCDLPLabel

Name of the Sensitive Label

name

Id of the Sensitive Information label

id

Type of the Sensitive Information label

type

Sensitive Information Labels

Labels

Name of the group

Name

Operator

Operator

Groups of sensitive information types.

Groups

Operator

Operator

The ContentPropertyContainsWords parameter specifies a condition for the DLP rule that's based on a property match in content. The rule is applied to content that contains the specified property.

ContentPropertyContainsWords

The Disabled parameter specifies whether the DLP rule is disabled.

Disabled

The GenerateAlert parameter specifies an action for the DLP rule that notifies the specified users when the conditions of the rule are met.

GenerateAlert

The GenerateIncidentReport parameter specifies an action for the DLP rule that sends an incident report to the specified users when the conditions of the rule are met.

GenerateIncidentReport

All Default DetectionDetails Detections DocumentAuthor DocumentLastModifier MatchedItem OriginalContent RulesMatched Service Severity Title RetentionLabel SensitivityLabel

The IncidentReportContent parameter specifies the content to include in the report when you use the GenerateIncidentReport parameter.

IncidentReportContent

The NotifyAllowOverride parameter specifies the notification override options when the conditions of the rule are met.

NotifyAllowOverride

The NotifyEmailCustomText parameter specifies the custom text in the email notification message that's sent to recipients when the conditions of the rule are met.

NotifyEmailCustomText

The NotifyPolicyTipCustomText parameter specifies the custom text in the Policy Tip notification message that's shown to recipients when the conditions of the rule are met. The maximum length is 256 characters. HTML tags and tokens (variables) aren't supported.

NotifyPolicyTipCustomText

The NotifyUser parameter specifies an action for the DLP rule that notifies the specified users when the conditions of the rule are met.

NotifyUser

The ReportSeverityLevel parameter specifies the severity level of the incident report for content detections based on the rule.

ReportSeverityLevel

The RuleErrorAction parameter specifies what to do if an error is encountered during the evaluation of the rule.

RuleErrorAction

Specify if this rule should exist or not.

Ensure

The AnyOfRecipientAddressContainsWords parameter specifies a condition for the DLP rule that looks for words or phrases in recipient email addresses.

AnyOfRecipientAddressContainsWords

The AnyOfRecipientAddressMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in recipient email addresses by using regular expressions.

AnyOfRecipientAddressMatchesPatterns

The RemoveRMSTemplate parameter specifies an action for the DLP rule that removes Office 365 Message Encryption from messages and their attachments.

RemoveRMSTemplate

The StopPolicyProcessing parameter specifies an action that stops processing more DLP policy rules.

StopPolicyProcessing

The DocumentIsUnsupported parameter specifies a condition for the DLP rule that looks for files that can't be scanned.

DocumentIsUnsupported

The ExceptIfDocumentIsUnsupported parameter specifies an exception for the DLP rule that looks for files that can't be scanned.

ExceptIfDocumentIsUnsupported

The SenderOverride parameter specifies a condition for the rule that looks for messages where the sender chose to override a DLP policy.

HasSenderOverride

The ExceptIfHasSenderOverride parameter specifies an exception for the rule that looks for messages where the sender chose to override a DLP policy.

ExceptIfHasSenderOverride

The ProcessingLimitExceeded parameter specifies a condition for the DLP rule that looks for files where scanning couldn't complete.

ProcessingLimitExceeded

The ExceptIfProcessingLimitExceeded parameter specifies an exception for the DLP rule that looks for files where scanning couldn't complete.

ExceptIfProcessingLimitExceeded

The DocumentIsPasswordProtected parameter specifies a condition for the DLP rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files.

DocumentIsPasswordProtected

The ExceptIfDocumentIsPasswordProtected parameter specifies an exception for the DLP rule that looks for password protected files (because the contents of the file can't be inspected). Password detection only works for Office documents and .zip files.

ExceptIfDocumentIsPasswordProtected

The MessageTypeMatches parameter specifies a condition for the DLP rule that looks for types of SMIME message patterns.

MessageTypeMatches

The FromScope parameter specifies whether messages from inside or outside the organisation are in scope for the DLP rule.

FromScope

The ExceptIfFromScope parameter specifies whether messages from inside or outside the organisation are in scope for the DLP rule.

ExceptIfFromScope

The SubjectContainsWords parameter specifies a condition for the DLP rule that looks for words or phrases in the Subject field of messages. You can specify multiple words or phrases separated by commas.

SubjectContainsWords

The SubjectMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in the Subject field of messages by using regular expressions.

SubjectMatchesPatterns

The SubjectOrBodyContainsWords parameter specifies a condition for the rule that looks for words in the Subject field or body of messages.

SubjectOrBodyContainsWords

The SubjectOrBodyMatchesPatterns parameter specifies a condition for the rule that looks for text patterns in the Subject field or body of messages.

SubjectOrBodyMatchesPatterns

The ContentCharacterSetContainsWords parameter specifies a condition for the rule that looks for character set names in messages. You can specify multiple values separated by commas.

ContentCharacterSetContainsWords

The DocumentNameMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in the name of message attachments by using regular expressions.

DocumentNameMatchesPatterns

The DocumentNameMatchesWords parameter specifies a condition for the DLP rule that looks for words or phrases in the name of message attachments.

DocumentNameMatchesWords

he ExceptIfAnyOfRecipientAddressContainsWords parameter specifies an exception for the DLP rule that looks for words or phrases in recipient email addresses.

The ExceptIfAnyOfRecipientAddressMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in recipient email addresses by using regular expressions.

The ExceptIfContentCharacterSetContainsWords parameter specifies an exception for the rule that looks for character set names in messages.

ExceptIfContentCharacterSetContainsWords

The ExceptIfContentPropertyContainsWords parameter specifies an exception for the DLP rule that's based on a property match in content.

ExceptIfContentPropertyContainsWords

The ExceptIfDocumentNameMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in the name of message attachments by using regular expressions.

ExceptIfDocumentNameMatchesPatterns

The ExceptIfDocumentNameMatchesWords parameter specifies an exception for the DLP rule that looks for words or phrases in the name of message attachments.

ExceptIfDocumentNameMatchesWords

The ExceptIfFromAddressContainsWords parameter specifies an exception for the DLP rule that looks for words or phrases in the sender's email address.

ExceptIfFromAddressContainsWords

The ExceptIfFromAddressMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in the sender's email address by using regular expressions.

ExceptIfFromAddressMatchesPatterns

The FromAddressContainsWords parameter specifies a condition for the DLP rule that looks for words or phrases in the sender's email address.

FromAddressContainsWords

The FromAddressMatchesPatterns parameter specifies a condition for the DLP rule that looks for text patterns in the sender's email address by using regular expressions.

FromAddressMatchesPatterns

The ExceptIfMessageTypeMatches parameter specifies an exception for the rule that looks for messages of the specified type.

ExceptIfMessageTypeMatches

The RecipientDomainIs parameter specifies a condition for the DLP rule that looks for recipients with email addresses in the specified domains.

RecipientDomainIs

The ExceptIfRecipientDomainIs parameter specifies an exception for the DLP rule that looks for recipients with email addresses in the specified domains.

ExceptIfRecipientDomainIs

The ExceptIfSenderDomainIs parameter specifies an exception for the DLP rule that looks for messages from senders with email address in the specified domains.

ExceptIfSenderDomainIs

The ExceptIfSenderIpRanges parameter specifies an exception for the DLP rule that looks for senders whose IP addresses matches the specified value, or fall within the specified ranges.

ExceptIfSenderIPRanges

The ExceptIfSentTo parameter specifies an exception for the DLP rule that looks for recipients in messages. You identify the recipients by email address.

ExceptIfSentTo

The ExceptIfSubjectContainsWords parameter specifies an exception for the DLP rule that looks for words or phrases in the Subject field of messages.

ExceptIfSubjectContainsWords

The ExceptIfSubjectMatchesPatterns parameter specifies an exception for the DLP rule that looks for text patterns in the Subject field of messages by using regular expressions.

ExceptIfSubjectMatchesPatterns

The ExceptIfSubjectOrBodyContainsWords parameter specifies an exception for the rule that looks for words in the Subject field or body of messages.

ExceptIfSubjectOrBodyContainsWords

The ExceptIfSubjectOrBodyMatchesPatterns parameter specifies an exception for the rule that looks for text patterns in the Subject field or body of messages.

ExceptIfSubjectOrBodyMatchesPatterns

The DocumentContainsWords parameter specifies a condition for the DLP rule that looks for words in message attachments. Only supported attachment types are checked.

DocumentContainsWords

The SentToMemberOf parameter specifies a condition for the DLP rule that looks for messages sent to members of distribution groups, dynamic distribution groups, or mail-enabled security groups.

SentToMemberOf

The ContentIsNotLabeled parameter specifies if the content is labeled. A True or False condition.

ContentIsNotLabeled

The SetHeader The SetHeader parameter specifies an action for the DLP rule that adds or modifies a header field and value in the message header. You can specify multiple header name and value pairs separated by commas

SetHeader

The ContentExtensionMatchesWords parameter specifies a condition for the DLP rule that looks for words in file name extensions. You can specify multiple words separated by commas.

ContentExtensionMatchesWords

The ExceptIfContentExtensionMatchesWords parameter specifies an exception for the DLP rule that looks for words in file name extensions. You can specify multiple words separated by commas.

ExceptIfContentExtensionMatchesWords

This resource configures an authority entry for Security and
Compliance File Plans.

Schema for microsoft.securityandcompliance.fileplanpropertyauthority

The Name parameter specifies the unique name of the Authority.

Name

Specify if this authority should exist or not.

Ensure

This resource configures a category entry for Security and
Compliance File Plans.

Schema for microsoft.securityandcompliance.fileplanpropertycategory

The Name parameter specifies the unique name of the category.

Name

Specify if this category should exist or not.

Ensure

This resource configures a citation entry for Security and
Compliance File Plans.

Schema for microsoft.securityandcompliance.fileplanpropertycitation

The Name parameter specifies the unique name of the citation.

Name

URL of the citation.

CitationUrl

Jurisdiction of the citation.

CitationJurisdiction

Specify if this citation should exist or not.

Ensure

This resource configures a department entry for Security and
Compliance File Plans.

Schema for microsoft.securityandcompliance.fileplanpropertydepartment

The Name parameter specifies the unique name of the department.

Name

Specify if this department should exist or not.

Ensure

This resource configures a reference ID entry for Security and
Compliance File Plans.

Schema for microsoft.securityandcompliance.fileplanpropertyreferenceid

The Name parameter specifies the unique name of the reference id.

Name

Specify if this reference id should exist or not.

Ensure

This resource configures a sub-category entry for Security and
Compliance File Plans.

Schema for microsoft.securityandcompliance.fileplanpropertysubcategory

The Name parameter specifies the unique name of the sub-category.

Name

The Category parameter specifies the name of the parent category associated with the sub-category.

Category

Ensure

This resource configures a Sensitivity label policy in Security and Compliance.

Schema for microsoft.securityandcompliance.labelpolicy

The Name parameter specifies the unique name for the sensitivity label. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.

Name

Specify if this label policy should exist or not.

Ensure

The Comment parameter specifies an optional comment.

Comment

Schema for MSFT_SCLabelSetting

Advanced settings key.

Key

Advanced settings value.

Value

The AdvancedSettings parameter enables client-specific features and capabilities on the sensitivity label. The settings that you configure with this parameter only affect apps that are designed for the setting.

AdvancedSettings

The ExchangeLocation parameter specifies the mailboxes to include in the policy.

ExchangeLocation

The ExchangeLocationException parameter specifies the mailboxes to exclude when you use the value All for the ExchangeLocation parameter.

ExchangeLocationException

The ModernGroupLocation parameter specifies the Microsoft 365 Groups to include in the policy.

ModernGroupLocation

The ModernGroupLocationException parameter specifies the Microsoft 365 Groups to exclude when you're using the value All for the ModernGroupLocation parameter.

ModernGroupLocationException

The Labels parameter specifies the sensitivity labels that are associated with the policy. You can use any value that uniquely identifies the label.

Labels

The AddExchangeLocation parameter specifies the mailboxes to add in the existing policy.

AddExchangeLocation

The AddExchangeLocationException parameter specifies the mailboxes to add to exclusions when you use the value All for the ExchangeLocation parameter.

AddExchangeLocationException

The AddModernGroupLocation parameter specifies the Microsoft 365 Groups to add to include the policy.

AddModernGroupLocation

The AddModernGroupLocationException parameter specifies the Microsoft 365 Groups to add to exclusions when you're using the value All for the ModernGroupLocation parameter.

AddModernGroupLocationException

The AddLabels parameter specifies the sensitivity labels to add to the policy. You can use any value that uniquely identifies the label.

AddLabels

The RemoveExchangeLocation parameter specifies the mailboxes to remove from the policy.

RemoveExchangeLocation

The RemoveExchangeLocationException parameter specifies the mailboxes to remove when you use the value All for the ExchangeLocation parameter.

RemoveExchangeLocationException

The RemoveModernGroupLocation parameter specifies the Microsoft 365 Groups to remove from the policy.

RemoveModernGroupLocation

The RemoveModernGroupLocationException parameter specifies the Microsoft 365 Groups to remove from excluded values when you're using the value All for the ModernGroupLocation parameter.

RemoveModernGroupLocationException

The RemoveLabels parameter specifies the sensitivity labels that are removed from the policy. You can use any value that uniquely identifies the label.

RemoveLabels

This resource configures a Protection Alert
in Security and Compliance Center.

Schema for microsoft.securityandcompliance.protectionalert

Specifies the scope for aggregated alert policies

AlertBy

This parameter is reserved for internal Microsoft use

AlertFor

None SimpleAggregation AnomalousAggregation CustomAggregation

Specifies how the alert policy triggers alerts for multiple occurrences of monitored activity

AggregationType

Specifies a category for the alert policy

Category

Specifies an optional comment

Comment

Enables or disables the alert policy

Disabled

Specify if this alert should exist or not.

Ensure

The Filter parameter uses OPATH syntax to filter the results by the specified properties and values

Filter

Specifies the unique name for the alert policy

Name

Specifies the language or locale that's used for notifications. For example, da-DK for Danish

NotificationCulture

NotificationEnabled true or false

NotificationEnabled

Specifies whether to trigger an alert for a single event when the alert policy is configured for aggregated activity

NotifyUserOnFilterMatch

Specifies whether to temporarily suspend notifications for the alert policy. Until the specified date-time, no notifications are sent for detected activities.

NotifyUserSuppressionExpiryDate

Specifies the maximum number of notifications for the alert policy within the time period specified by the NotifyUserThrottleWindow parameter. Once the maximum number of notifications has been reached in the time period, no more notifications are sent for the alert.

NotifyUserThrottleThreshold

Specifies the time interval in minutes that's used by the NotifyUserThrottleThreshold parameter

NotifyUserThrottleWindow

Specifies the SMTP address of the user who receives notification messages for the alert policy. You can specify multiple values separated by commas

NotifyUser

Specifies the activities that are monitored by the alert policy

Operation

PrivacyManagementScopedSensitiveInformationTypes

PrivacyManagementScopedSensitiveInformationTypes

PrivacyManagementScopedSensitiveInformationTypesForCounting

PrivacyManagementScopedSensitiveInformationTypesForCounting

PrivacyManagementScopedSensitiveInformationTypesThreshold

PrivacyManagementScopedSensitiveInformationTypesThreshold

specifies the severity of the detection

Severity

Activity Malware Phish Malicious MaliciousUrlClick MailFlow

Specifies the type of activities that are monitored by the alert policy

ThreatType

Specifies the number of detections that trigger the alert policy within the time period specified by the TimeWindow parameter. A valid value is an integer that's greater than or equal to 3.

Threshold

Specifies the time interval in minutes for number of detections specified by the Threshold parameter. A valid value is an integer that's greater than 60 (one hour).

TimeWindow

Volume Threshold

VolumeThreshold

This resource configures a Retention Compliance Policy in Security and Compliance.

Schema for microsoft.securityandcompliance.retentioncompliancepolicy

The Name parameter specifies the unique name of the retention policy.

Name

Specify if this policy should exist or not.

Ensure

The Comment parameter specifies an optional comment.

Comment

Location of the dynamic scope for this policy.

DynamicScopeLocation

Determines if the policy is enabled or not.

Enabled

The ExchangeLocation parameter specifies the mailboxes to include.

ExchangeLocation

This parameter specifies the mailboxes to remove from the list of excluded mailboxes when you use the value All for the ExchangeLocation parameter

ExchangeLocationException

The ModernGroupLocation parameter specifies the Office 365 groups to include in the policy.

ModernGroupLocation

The ModernGroupLocationException parameter specifies the Office 365 groups to exclude when you're using the value All for the ModernGroupLocation parameter.

ModernGroupLocationException

The OneDriveLocation parameter specifies the OneDrive for Business sites to include. You identify the site by its URL value, or you can use the value All to include all sites.

OneDriveLocation

This parameter specifies the OneDrive for Business sites to exclude when you use the value All for the OneDriveLocation parameter. You identify the site by its URL value.

OneDriveLocationException

The PublicFolderLocation parameter specifies that you want to include all public folders in the retention policy. You use the value All for this parameter.

PublicFolderLocation

The RestrictiveRetention parameter specifies whether Preservation Lock is enabled for the policy.

RestrictiveRetention

The SharePointLocation parameter specifies the SharePoint Online sites to include. You identify the site by its URL value, or you can use the value All to include all sites.

SharePointLocation

This parameter specifies the SharePoint Online sites to exclude when you use the value All for the SharePointLocation parameter. You identify the site by its URL value.

SharePointLocationException

The SkypeLocation parameter specifies the Skype for Business Online users to include in the policy.

SkypeLocation

This parameter is reserved for internal Microsoft use.

SkypeLocationException

The TeamsChannelLocation parameter specifies the Teams Channel to include in the policy.

TeamsChannelLocation

This parameter specifies the SharePoint Online sites to exclude when you use the value All for the TeamsChannelLocation parameter. You identify the site by its URL value.

TeamsChannelLocationException

The TeamsChatLocation parameter specifies the Teams Chat to include in the policy.

TeamsChatLocation

This parameter specifies the SharePoint Online sites to exclude when you use the value All for the TeamsChatLocation parameter. You identify the site by its URL value.

TeamsChatLocationException

This resource configures a Retention Compliance Rule in Security and Compliance.

Schema for microsoft.securityandcompliance.retentioncompliancerule

The Name parameter specifies the unique name of the retention rule.

Name

The Policy parameter specifies the policy to contain the rule.

Policy

Specify if this rule should exist or not.

Ensure

The Comment parameter specifies an optional comment.

Comment

The ExpirationDateOption parameter specifies whether the expiration date is calculated from the content creation date or last modification date. Valid values are: CreationAgeInDays and ModificationAgeInDays.

ExpirationDateOption

The ExcludedItemClasses parameter specifies the types of messages to exclude from the rule. You can use this parameter only to exclude items from a hold policy, which excludes the specified item class from being held. Using this parameter won't exclude items from deletion policies. Typically, you use this parameter to exclude voicemail messages, IM conversations, and other Skype for Business Online content from being held by a hold policy.

ExcludedItemClasses

The ContentMatchQuery parameter specifies a content search filter.

ContentMatchQuery

The RetentionComplianceAction parameter specifies the retention action for the rule. Valid values are: Delete, Keep and KeepAndDelete.

RetentionComplianceAction

The RetentionDuration parameter specifies the hold duration for the retention rule. Valid values are: An integer - The hold duration in days, Unlimited - The content is held indefinitely.

RetentionDuration

The RetentionDurationDisplayHint parameter specifies the units that are used to display the retention duration in the Security and Compliance Center. Valid values are: Days, Months or Years.

RetentionDurationDisplayHint

This resource configures a Retention Event Type in Security and Compliance.

Schema for microsoft.securityandcompliance.retentioneventtype

The Name parameter specifies the unique name of the retention event type.

Name

Ensure

Comment

This resource configures a Security Filter in Security and Compliance.

Schema for microsoft.securityandcompliance.securityfilter

The FilterName parameter specifies the name of the compliance security filter that you want to view. If the value contains spaces, enclose the value in quotation marks (\").

FilterName

The Action parameter filters the results by the type of search action that a filter is applied to.

Action

The User parameter filters the results by the user who gets a filter applied to their searches. Acceptable values are : The alias or email address of a user, All or The name of a role group

Users

The Description parameter specifies a description for the compliance security filter. The maximum length is 256 characters. If the value contains spaces, enclose the value in quotation marks (\").

Description

The Filters parameter specifies the search criteria for the compliance security filter. The filters are applied to the users specified by the Users parameter. You can create three different types of filters: Mailbox filter, Mailbox content filter or Site and site content filter

Filters

The Region parameter specifies the satellite location for multi-geo tenants to conduct eDiscovery searches in.

Region

Specify if this label policy should exist or not.

Ensure

This resource configures Sensitivity labels in Security and Compliance.

Schema for microsoft.securityandcompliance.sensitivitylabel

The Name parameter specifies the unique name for the sensitivity label. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks.

Name

Specify if this rule should exist or not.

Ensure

The Comment parameter specifies an optional comment.

Comment

This resource configures a Sensitivity label policy in Security and Compliance.

Schema for MSFT_SCLabelSetting

Advanced settings key.

Key

Advanced settings value.

Value

The AdvancedSettings parameter enables client-specific features and capabilities on the sensitivity label. The settings that you configure with this parameter only affect apps that are designed for the setting.

AdvancedSettings

The DisplayName parameter specifies the display name for the sensitivity label. The display name appears in the Microsoft Office and is used by Outlook users to select the appropriate sensitivity label before they send a message.

DisplayName

Schema for MSFT_SCLabelLocaleSettings

Name of the Local key.

localeKey

Schema for MSFT_SCLabelSetting

Advanced settings key.

Key

Advanced settings value.

Value

The locale settings display names.

LabelSettings

The LocaleSettings parameter specifies one or more localized label name or label Tooltips in different languages. Regions include all region codes supported in Office Client applications.

LocaleSettings

The ParentId parameter specifies the parent label that you want this label to be under (a sublabel). You can use any value that uniquely identifies the parent sensitivity label for example name.

ParentId

The Priority parameter specifies a priority value for the sensitivity label that determines the order of label processing. A lower integer value indicates a higher priority.

Priority

The ToolTip parameter specifies the default tooltip and sensitivity label description that's seen by users. It the value contains spaces, enclose the value in quotation marks.

Tooltip

The ApplyContentMarkingFooterAlignment parameter specifies the footer alignment.

ApplyContentMarkingFooterAlignment

The ApplyContentMarkingFooterEnabled parameter specifies whether to enable or disable the sensitivity label.

ApplyContentMarkingFooterEnabled

The ApplyContentMarkingFooterFontColor parameter specifies the color of the footer text. This parameter accepts a hexadecimal color code value in the format #xxxxxx. The default value is #000000.

ApplyContentMarkingFooterFontColor

The ApplyContentMarkingFooterFontSize parameter specifies the font size (in points) of the footer text.

ApplyContentMarkingFooterFontSize

The ApplyContentMarkingFooterMargin parameter specifies the size (in points) of the footer margin.

ApplyContentMarkingFooterMargin

The ApplyContentMarkingFooterText parameter specifies the footer text. If the value contains spaces, enclose the value in quotation marks.

ApplyContentMarkingFooterText

The ApplyContentMarkingHeaderAlignment parameter specifies the header alignment.

ApplyContentMarkingHeaderAlignment

The ApplyContentMarkingHeaderEnabled parameter enables or disables the Apply Content Marking Header action for the label.

ApplyContentMarkingHeaderEnabled

The ApplyContentMarkingHeaderFontColor parameter specifies the color of the header text. This parameter accepts a hexadecimal color code value in the format #xxxxxx. The default value is #000000.

ApplyContentMarkingHeaderFontColor

The ApplyContentMarkingHeaderFontSize parameter specifies the font size (in points) of the header text.

ApplyContentMarkingHeaderFontSize

The ApplyContentMarkingHeaderMargin parameter specifies the size (in points) of the header margin.

ApplyContentMarkingHeaderMargin

The ApplyContentMarkingHeaderText parameter specifies the header text. If the value contains spaces, enclose the value in quotation marks.

ApplyContentMarkingHeaderText

The ApplyWaterMarkingEnabled parameter enables or disables the Apply Watermarking Header action for the label.

ApplyWaterMarkingEnabled

The ApplyWaterMarkingFontColor parameter specifies the color of the watermark text. This parameter accepts a hexadecimal color code value in the format #xxxxxx.

ApplyWaterMarkingFontColor

The ApplyWaterMarkingFontSize parameter specifies the font size (in points) of the watermark text.

ApplyWaterMarkingFontSize

The ApplyWaterMarkingAlignment parameter specifies the watermark alignment.

ApplyWaterMarkingLayout

The ApplyWaterMarkingText parameter specifies the watermark text. If the value contains spaces, enclose the value in quotation marks.

ApplyWaterMarkingText

File Email Site UnifiedGroup PurviewAssets Teamwork SchematizedData

The ContentType parameter specifies where the sensitivity label can be applied.

ContentType

The EncryptionContentExpiredOnDateInDaysOrNever parameter specifies when the encrypted content expires. Valid values are integer or never.

EncryptionContentExpiredOnDateInDaysOrNever

The EncryptionDoNotForward parameter specifies whether the Do Not Forward template is applied.

EncryptionDoNotForward

The EncryptionEncryptOnly parameter specifies whether the encrypt-only template is applied.

EncryptionEncryptOnly

The EncryptionEnabled parameter specifies whether encryption in enabled.

EncryptionEnabled

The EncryptionOfflineAccessDays parameter specifies the number of days that offline access is allowed.

EncryptionOfflineAccessDays

The EncryptionPromptUser parameter specifies whether to set the label with user defined permission in Word, Excel, and PowerPoint.

EncryptionPromptUser

The EncryptionProtectionType parameter specifies the protection type for encryption.

EncryptionProtectionType

The EncryptionRightsDefinitions parameter specifies the rights users have when accessing protected. This parameter uses the syntax Identity1:Rights1,Rights2;Identity2:Rights3,Rights4. For example, john@contoso.com:VIEW,EDIT;microsoft.com:VIEW.

EncryptionRightsDefinitions

The EncryptionRightsUrl parameter specifies the URL for hold your own key (HYOK) protection.

EncryptionRightsUrl

The SiteAndGroupProtectionAllowAccessToGuestUsers parameter enables or disables access to guest users.

SiteAndGroupProtectionAllowAccessToGuestUsers

The SiteAndGroupProtectionAllowEmailFromGuestUsers parameter enables or disables email from guest users.

SiteAndGroupProtectionAllowEmailFromGuestUsers

The SiteAndGroupProtectionAllowFullAccess parameter enables or disables full access.

SiteAndGroupProtectionAllowFullAccess

The SiteAndGroupProtectionAllowLimitedAccess parameter enables or disables limited access.

SiteAndGroupProtectionAllowLimitedAccess

The SiteAndGroupProtectionBlockAccess parameter blocks access.

SiteAndGroupProtectionBlockAccess

The SiteAndGroupProtectionEnabled parameter enables or disables the Site and Group Protection action for the labels.

SiteAndGroupProtectionEnabled

The SiteAndGroupProtectionPrivacy parameter specifies the privacy level for the label.

SiteAndGroupProtectionPrivacy

ExternalUserAndGuestSharing ExternalUserSharingOnly ExistingExternalUserSharingOnly Disabled

The SiteAndGroupExternalSharingControlType parameter specifies the external user sharing setting for the label.

SiteAndGroupExternalSharingControlType

This resource configures a Supervision Policy in Security and Compliance.

Schema for microsoft.securityandcompliance.supervisoryreviewpolicy

The Name parameter specifies the unique name for the supervisory review policy. The name can't exceed 64 characters. If the value contains spaces, enclose the value in quotation marks.

Name

The Comment parameter specifies an optional comment. If you specify a value that contains spaces, enclose the value in quotation marks.

Comment

The Reviewers parameter specifies the SMTP addresses of the reviewers for the supervisory review policy. You can specify multiple email addresses separated by commas.

Reviewers

Specify if this rule should exist or not.

Ensure

This resource configures a Supervision Review Rule in Security and Compliance.

Schema for microsoft.securityandcompliance.supervisoryreviewrule

Name

The Policy parameter specifies the supervisory review policy that's assigned to the rule. You can use any value that uniquely identifies the policy.

Policy

The Condition parameter specifies the conditions and exceptions for the rule.

Condition

The SamplingRate parameter specifies the percentage of communications for review. If you want reviewers to review all detected items, use the value 100.

SamplingRate

Ensure

configurationMonitor Schema

Schema for entity configurationMonitor

openComplexDictionaryType Schema

Schema for entity openComplexDictionaryType

configurationBaseline Schema

Schema for entity configurationBaseline

baselineParameter Schema

Schema for entity baselineParameter

string integer boolean unknownFutureValue

Provide a JSON object that satisfies the schema "configurationMonitor Schema". Here are the required top‑level fields: none (all optional). Return only the valid JSON object.