+```

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+### Example 5: Create an access review on a group with insights about user-to-group affiliation and user sign in for recommendations

+>

+> Do not share application client IDs (**appId**) in API documentation or code samples.

+### Example 2: Create a Microsoft Teams live event with a user token

+### Example 3: Create an online meeting that requires a passcode

+### Example 4: Create an online meeting that does not require a passcode

+| appRoles | [appRole](../resources/approle.md) collection | The collection of roles defined for the application. These roles can be assigned to users, groups, or service principals. Not nullable. |

+POST https://graph.microsoft.com/beta/me/messages/AAMkAGUwNjQ4ZjIxLTQ3Y2YtNDViMi1iZjc4LTMA=/attachments/createUploadSession

+ Title: "Get simulationAutomation"

+description: "Get an attack simulation automation for a tenant."

+ms.localizationpriority: medium

+# Get simulationAutomation

+Namespace: microsoft.graph

+Get an attack simulation automation for a tenant.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+| Permission type | Permissions (from least to most privileged) |

+|:|:--|

+| Delegated (work or school account) | AttackSimulation.Read.All |

+| Delegated (personal Microsoft account) | Not supported. |

+| Application | AttackSimulation.Read.All |

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /security/attackSimulation/simulationAutomations/{simulationAutomationId}

+```

+## Optional query parameters

+This method supports the `$count`, `$filter`, `$orderby`, `$skip`, `$top`, and `$select` [OData query parameters](/graph/query-parameters) to help customize the response. You can use the `$filter` and `$orderby` query parameters on the **displayName** and **status** properties.

+If the result set spans multiple pages, the response body contains an `@odata.nextLink` that you can use to page through the result set.

+The following are examples of their use:

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /security/attackSimulation/simulationAutomations/{simulationAutomationId}?$count=true

+GET /security/attackSimulation/simulationAutomations/{simulationAutomationId}?$filter={property} eq '{property-value}'

+GET /security/attackSimulation/simulationAutomations/{simulationAutomationId}?$filter={property} eq '{property-value}'&$top=5

+GET /security/attackSimulation/simulationAutomations/{simulationAutomationId}?$orderby={property}

+GET /security/attackSimulation/simulationAutomations/{simulationAutomationId}?$skip={skipCount}

+GET /security/attackSimulation/simulationAutomations/{simulationAutomationId}?$top=1

+GET /security/attackSimulation/simulationAutomations/{simulationAutomationId}?$select={property}

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and a [simulationAutomation](../resources/simulationautomation.md) object in the response body.

+## Examples

+### Request

+The following is an example of a request.

+# [HTTP](#tab/http)

+<!-- {

+ "blockType": "request",

+ "name": "get_simulationautomation"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/security/attackSimulation/simulationAutomations/fbad62b0-b32d-b6ac-9f48-d84bbea08f96

+```

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [PHP](#tab/php)

+### Response

+The following is an example of the response.

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.simulationAutomation"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.type": "#microsoft.graph.simulationAutomation",

+ "id": "fbad62b0-b32d-b6ac-9f48-d84bbea08f96",

+ "displayName": "Reed Flores",

+ "description": "Sample Simulation Automation Description",

+ "status": "running",

+ "createdDateTime": "2022-01-01T01:01:01.01Z",

+ "createdBy": {

+ "id": "99af58b9-ef1a-412b-a581-cb42fe8c8e21",

+ "displayName": "Reed Flores",

+ "email": "reed@contoso.com"

+ },

+ "lastModifiedDateTime": "2022-01-01T01:01:01.01Z",

+ "lastModifiedBy": {

+ "id": "99af58b9-ef1a-412b-a581-cb42fe8c8e21",

+ "displayName": "Reed Flores",

+ "email": "reed@contoso.com"

+ },

+ "lastRunDateTime": "2022-01-01T01:01:01.01Z",

+ "nextRunDateTime": "2022-01-01T01:01:01.01Z"

+}

+```

+ Title: "Get simulation"

+description: "Get an attack simulation campaign for a tenant."

+ms.localizationpriority: medium

+# Get simulation

+Namespace: microsoft.graph

+Get an attack simulation campaign for a tenant.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+| Permission type | Permissions (from least to most privileged) |

+|:|:--|

+| Delegated (work or school account) | AttackSimulation.Read.All |

+| Delegated (personal Microsoft account) | Not supported. |

+| Application | AttackSimulation.Read.All |

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /security/attackSimulation/simulations/{simulationId}

+```

+## Optional query parameters

+This method supports the `$count`, `$filter`, `$orderby`, `$skipToken`, `$top`, and `$select` [OData query parameters](/graph/query-parameters) to help customize the response. You can use the `$filter` and `$orderby` query parameters on the **attackTechnique**, **attackType**, **completionDateTime**, **displayName**, **isAutomated**, **launchDateTime**, and **status** properties.

+If the result set spans multiple pages, the response body contains an `@odata.nextLink` that you can use to page through the result set.

+The following are examples of their use:

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /security/attackSimulation/simulations/{simulationId}?$count=true

+GET /security/attackSimulation/simulations/{simulationId}?$filter={property} eq '{property-value}'

+GET /security/attackSimulation/simulations/{simulationId}?$filter={property} eq '{property-value}'&$top=5

+GET /security/attackSimulation/simulations/{simulationId}?$orderby={property}

+GET /security/attackSimulation/simulations/{simulationId}?$skipToken={skipToken}

+GET /security/attackSimulation/simulations/{simulationId}?$top=1

+GET /security/attackSimulation/simulations/{simulationId}?$select={property}

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and a [simulation](../resources/simulation.md) object in the response body.

+## Examples

+### Request

+The following is an example of a request.

+# [HTTP](#tab/http)

+<!-- {

+ "blockType": "request",

+ "name": "get_simulation"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/security/attackSimulation/simulations/f1b13829-3829-f1b1-2938-b1f12938b1a

+```

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [PHP](#tab/php)

+### Response

+The following is an example of the response.

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.simulation"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "id": "f1b13829-3829-f1b1-2938-b1f12938b1f1",

+ "displayName": "Sample Simulation",

+ "description": "Sample Simulation Description",

+ "attackType": "social",

+ "attackTechnique": "credentialHarvesting",

+ "status": "scheduled",

+ "createdDateTime": "2021-01-01T01:01:01.01Z",

+ "createdBy": {

+ "id": "99af58b9-ef1a-412b-a581-cb42fe8c8e21",

+ "displayName": "Reed Flores",

+ "email": "reed@contoso.com"

+ },

+ "lastModifiedDateTime": "2021-01-01T01:01:01.01Z",

+ "lastModifiedBy": {

+ "id": "99af58b9-ef1a-412b-a581-cb42fe8c8e21",

+ "displayName": "Reed Flores",

+ "email": "reed@contoso.com"

+ },

+ "launchDateTime": "2021-01-01T02:01:01.01Z",

+ "completionDateTime": "2021-01-07T01:01:01.01Z",

+ "isAutomated": false,

+ "automationId": "f1b13829-3829-f1b1-2938-b1f12938b1ab",

+ "payloadDeliveryPlatform": "email"

+}

+```

+The following is an example of a request.

+This method supports the `$count`, `$filter`, `$orderby`, `$skipToken`, `$top`, and `$select` [OData query parameters](/graph/query-parameters) to help customize the response. You can use the `$filter` and `$orderby` query parameters on the **attackTechnique**, **attackType**, **completionDateTime**, **displayName**, **isAutomated**, **launchDateTime**, and **status** properties.

+If the result set spans multiple pages, the response body contains an `@odata.nextLink` that you can use to page through the result set.

+GET /security/attackSimulation/simulations?$skipToken={skipToken}

+ "displayName": "Reed Flores",

+ "email": "reed@contoso.com"

+ "displayName": "Reed Flores",

+ "email": "reed@contoso.com"

+ Title: "Get authenticationCombinationConfiguration"

+description: "Read the properties and relationships of an authenticationCombinationConfiguration object."

+ms.localizationpriority: medium

+# Get authenticationCombinationConfiguration

+Namespace: microsoft.graph

+Read the properties and relationships of an [authenticationCombinationConfiguration](../resources/authenticationcombinationconfiguration.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /identity/conditionalAccess/authenticationStrengths/policies/{authenticationStrengthPolicyId}/combinationConfigurations/{authenticationCombinationConfigurationId}

+```

+## Optional query parameters

+This method does not support OData query parameters.

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and an [authenticationCombinationConfiguration](../resources/authenticationcombinationconfiguration.md) object in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "get_authenticationcombinationconfiguration"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrengths/policies/0e371351-6419-4c8a-8047-61eef0212ffb/combinationConfigurations/133b68c4-503b-4e87-839a-6c286a27381b

+```

+### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.authenticationCombinationConfiguration"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.type" : "#microsoft.graph.fido2CombinationConfiguration",

+ "id": "133b68c4-503b-4e87-839a-6c286a27381b",

+ "allowedAAGUIDs": [

+ "dcf6eadd-31fd-49e5-b84e-44035a5e6295",

+ "e0d9c83d-f035-45b2-8d98-345903f91e29"

+ ],

+ "appliesToCombinations": ["fido2"]

+}

+```

+ Title: "Update authenticationCombinationConfiguration"

+description: "Update the properties of an authenticationCombinationConfiguration object."

+ms.localizationpriority: medium

+# Update authenticationCombinationConfiguration

+Namespace: microsoft.graph

+Update the properties of an [authenticationCombinationConfiguration](../resources/authenticationcombinationconfiguration.md) object. In use, only [fido2combinationConfigurations](../resources/fido2combinationconfiguration.md) may be updated as they are the only type of [authenticationCombinationConfiguration](../resources/authenticationcombinationconfiguration.md) that may be created.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+PATCH /identity/conditionalAccess/authenticationStrengths/policies/{authenticationStrengthPolicyId}/combinationConfigurations/{authenticationCombinationConfigurationId}

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+|Content-Type|application/json. Required.|

+## Request body

+|Property|Type|Description|

+|:|:|:|

+|appliesToCombinations|authenticationMethodModes collection|The combinations to which this configuration applies. The only possible value for fido2combinationConfigurations is `fido2`. Required.|

+## Response

+If successful, this method returns a `204 NO CONTENT` response code.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "update_authenticationcombinationconfiguration"

+}

+-->

+``` http

+PATCH https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrengths/policies/0e371351-6419-4c8a-8047-61eef0212ffb/combinationConfigurations/4643f174-fe85-42b8-8b84-516775750a30

+Content-Type: application/json

+Content-length: 130

+{

+ "appliesToCombinations": ["fido2"]

+}

+```

+### Response

+The following is an example of the response

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+}

+-->

+``` http

+HTTP/1.1 204 No Content

+```

+This method does not support OData query parameters.

+ Title: "Get authenticationMethodModeDetail"

+description: "Read the properties and relationships of an authenticationMethodModeDetail object."

+ms.localizationpriority: medium

+# Get authenticationMethodModeDetail

+Namespace: microsoft.graph

+Read the properties and relationships of an [authenticationMethodModeDetail](../resources/authenticationmethodmodedetail.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /identity/conditionalAccess/authenticationStrengths/authenticationMethodModes/{authenticationMethodModeDetailId}

+```

+## Optional query parameters

+This method does not support OData query parameters.

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and an [authenticationMethodModeDetail](../resources/authenticationmethodmodedetail.md) object in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "get_authenticationmethodmodedetail"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrengths/authenticationMethodModes/windowsHelloForBusiness

+```

+### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.authenticationMethodModeDetail"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "value": {

+ "@odata.type": "#microsoft.graph.authenticationMethodModeDetail",

+ "id": "windowsHelloForBusiness",

+ "displayName": "Windows Hello for Business",

+ "authenticationMethod": "windowsHelloForBusiness"

+ }

+}

+```

+ Title: "Delete authenticationCombinationConfiguration"

+description: "Delete an authenticationCombinationConfiguration for a custom authenticationStrengthPolicy object."

+ms.localizationpriority: medium

+# Delete authenticationCombinationConfiguration

+Namespace: microsoft.graph

+Delete an [authenticationCombinationConfiguration](../resources/authenticationcombinationconfiguration.md) for a custom [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+DELETE /identity/conditionalAccess/authenticationStrengths/policies/{authenticationStrengthPolicyId}/combinationConfigurations/{authenticationCombinationConfigurationId}/$ref

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `204 No Content` response code.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "delete_authenticationcombinationconfiguration"

+}

+-->

+``` http

+DELETE https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrengths/policies/0e371351-6419-4c8a-8047-61eef0212ffb/combinationConfigurations/6cbbcfd0-5054-4a59-a10e-2d21fe09305d

+```

+### Response

+The following is an example of the response

+<!-- {

+ "blockType": "response",

+ "truncated": true

+}

+-->

+``` http

+HTTP/1.1 204 No Content

+```

+ Title: "authenticationStrengthPolicy: findByMethodMode"

+description: "Get authentication strength policies that include the specified authentication method modes."

+ms.localizationpriority: medium

+# authenticationStrengthPolicy: findByMethodMode

+Namespace: microsoft.graph

+Get a list of the [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) objects and their properties filtered to only include policies that include the authentication method mode specified in the request.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /policies/authenticationStrengthPolicies/findByMethodMode(authenticationMethodModes=["authenticationMethodMode"])

+```

+## Function parameters

+In the request URL, provide the following query parameters with values.

+The following table shows the parameters that must be used with this function.

+|Parameter|Type|Description|

+|:|:|:|

+|authenticationMethodModes|authenticationMethodModes collection|The authentication method modes to search for in existing authentication strength policies.|

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this function returns a `200 OK` response code and a [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) collection in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "authenticationstrengthpolicythis.findbymethodmode"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/policies/authenticationStrengthPolicies/findByMethodMode(authenticationMethodModes=["sms"])

+```

+### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "Collection(microsoft.graph.authenticationStrengthPolicy)"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "value": [

+ {

+ "@odata.type" : "authenticationStrengthPolicy",

+ "id": "00000000-0000-0000-0000-000000000002",

+ "createdDateTime": "2022-09-30T10:59:01Z",

+ "modifiedDateTime": "2022-09-30T10:59:01Z",

+ "displayName": "Multi-factor authentication (MFA)",

+ "description": "Combinations of methods that satisfy strong authentication, such as a password + SMS",

+ "policyType": "builtIn",

+ "requirementsSatisfied": "mfa",

+ "allowedCombinations": [

+ "windowsHelloForBusiness",

+ "fido2",

+ "x509CertificateMultiFactor",

+ "deviceBasedPush",

+ "temporaryAccessPassOneTime",

+ "temporaryAccessPassMultiUse",

+ "password, microsoftAuthenticatorPush",

+ "password, softwareOath",

+ "password, hardwareOath",

+ "password, sms",

+ "password, voice",

+ "federatedMultiFactor",

+ "federatedSingleFactor, microsoftAuthenticatorPush",

+ "federatedSingleFactor, softwareOath",

+ "federatedSingleFactor, hardwareOath",

+ "federatedSingleFactor, sms",

+ "federatedSingleFactor, voice"

+ ],

+ "combinationConfigurations": []

+ }

+ ]

+}

+```

+ Title: "Get authenticationStrengthPolicy"

+description: "Read the properties and relationships of an authenticationStrengthPolicy object."

+ms.localizationpriority: medium

+# Get authenticationStrengthPolicy

+Namespace: microsoft.graph

+Read the properties and relationships of an [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /policies/authenticationStrengthPolicies/{authenticationStrengthPolicyId}

+```

+## Optional query parameters

+This method does not support OData query parameters.

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and an [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) object in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "get_authenticationstrengthpolicy"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/policies/authenticationStrengthPolicies/00000000-0000-0000-0000-000000000004

+```

+### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.authenticationStrengthPolicy"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.type" : "#microsoft.graph.authenticationStrengthPolicy",

+ "id": "00000000-0000-0000-0000-000000000004",

+ "createdDateTime": "2017-10-30T10:59:01Z",

+ "modifiedDateTime": "2017-10-30T10:59:01Z",

+ "displayName": "Phishing resistant MFA",

+ "description": "Phishing-resistant, Passwordless methods for the strongest authentication, such as a FIDO2 security key",

+ "policyType": "builtIn",

+ "requirementsSatisfied": "mfa",

+ "allowedCombinations": [

+ "windowsHelloForBusiness",

+ "fido2",

+ "x509CertificateMultiFactor"

+ ],

+ "combinationConfigurations": []

+}

+```

+ Title: "List combinationConfigurations"

+description: "Get the authenticationCombinationConfiguration objects for an authentication strength policy."

+ms.localizationpriority: medium

+# List combinationConfigurations

+Namespace: microsoft.graph

+Get the [authenticationCombinationConfiguration](../resources/authenticationcombinationconfiguration.md) objects for an [authentication strength policy](../resources/authenticationstrengthpolicy.md). authenticationCombinationConfiguration represents requirements placed on specific authentication method combinations that require specified variants of those authentication methods to be used when authenticating. Currently, only [fido2combinationConfigurations](../resources/fido2combinationconfiguration.md) objects are supported.

+authenticationCombinationConfiguration objects are supported only for custom authentication strengths.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /identity/conditionalAccess/authenticationStrengths/policies/{authenticationStrengthPolicyId}/combinationConfigurations

+```

+## Optional query parameters

+This method does not support OData query parameters.

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and a collection of [authenticationCombinationConfiguration](../resources/authenticationcombinationconfiguration.md) objects in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "list_authenticationcombinationconfiguration"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrengths/policies/0e371351-6419-4c8a-8047-61eef0212ffb/combinationConfigurations

+```

+### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "Collection(microsoft.graph.authenticationCombinationConfiguration)"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "value": [

+ {

+ "@odata.type" : "#microsoft.graph.fido2CombinationConfiguration",

+ "id": "133b68c4-503b-4e87-839a-6c286a27381b",

+ "allowedAAGUIDs": [

+ "dcf6eadd-31fd-49e5-b84e-44035a5e6295",

+ "e0d9c83d-f035-45b2-8d98-345903f91e29"

+ ],

+ "appliesToCombinations": ["fido2"]

+ }

+ ]

+}

+```

+ Title: "Create authenticationCombinationConfiguration"

+description: "Create a new authenticationCombinationConfiguration object. In use, only fido2combinationConfigurations may be created, and these may only be created for custom authentication strength policies."

+ms.localizationpriority: medium

+# Create combinationConfiguration

+Namespace: microsoft.graph

+Create a new authenticationCombinationConfiguration object. In use, only [fido2combinationConfigurations](../resources/fido2combinationconfiguration.md) may be created, and these may only be created for custom authentication strength policies.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+POST /identity/conditionalAccess/authenticationStrengths/policies/{authenticationStrengthPolicyId}/combinationConfigurations

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+|Content-Type|application/json. Required.|

+## Request body

+In the request body, supply a JSON representation of the [authenticationCombinationConfiguration](../resources/authenticationcombinationconfiguration.md) object.

+You can specify the following properties when creating an **authenticationCombinationConfiguration**. Additionally, you must supply the @odata.type and required properties of the derived type of [authenticationCombinationConfiguration](../resources/authenticationcombinationconfiguration.md) that you're creating. For example, `"@odata.type" : "#microsoft.graph.fido2CombinationConfiguration"`.

+|Property|Type|Description|

+|:|:|:|

+|appliesToCombinations|authenticationMethodModes collection|The combinations to which this configuration applies. The only possible value for fido2combinationConfigurations is `fido2`. Required.|

+## Response

+If successful, this method returns a `201 Created` response code and a [fido2CombinationConfiguration](../resources/fido2CombinationConfiguration.md) object in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "create_authenticationcombinationconfiguration_from_"

+}

+-->

+``` http

+POST https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrengths/policies/8313edec-d6af-483f-87b8-ec7cccfd2ab4/combinationConfigurations

+Content-Type: application/json

+Content-length: 130

+{

+ "@odata.type" : "#microsoft.graph.fido2CombinationConfiguration",

+ "allowedAAGUIDs": [

+ "486c3b50-889c-480a-abc5-c04ef7c873e0",

+ "c042882f-a621-40c8-94d3-9cde3a826fed",

+ "ec454c08-4c77-4012-9d48-45f7f0fccdfb"

+ ],

+ "appliesToCombinations": ["fido2"]

+}

+```

+### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.authenticationCombinationConfiguration"

+}

+-->

+``` http

+HTTP/1.1 201 Created

+Content-Type: application/json

+{

+ "@odata.type" : "#microsoft.graph.fido2CombinationConfiguration",

+ "id": "96cb1a17-e45e-4b4f-8b4b-4a9490d63d66",

+ "allowedAAGUIDs": [

+ "486c3b50-889c-480a-abc5-c04ef7c873e0",

+ "c042882f-a621-40c8-94d3-9cde3a826fed",

+ "ec454c08-4c77-4012-9d48-45f7f0fccdfb"

+ ],

+ "appliesToCombinations": ["fido2"]

+}

+```

+ Title: "Update authenticationStrengthPolicy"

+description: "Update the properties of an authenticationStrengthPolicy object."

+ms.localizationpriority: medium

+# Update authenticationStrengthPolicy

+Namespace: microsoft.graph

+Update the properties of an [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) object. You cannot update the allowed auth method combinations using this request. To do so, use the [Update allowed combinations](authenticationstrengthpolicy-updateallowedcombinations.md) action.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+PATCH /policies/authenticationStrengthPolicies/{authenticationStrengthPolicyId}

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+|Content-Type|application/json. Required.|

+## Request body

+|Property|Type|Description|

+|:|:|:|

+|displayName|String|The display name of the policy to be created. Optional.|

+|description|String|The description of the policy to be created. Optional.|

+## Response

+If successful, this method returns a `204 NO CONTENT` response code.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "update_authenticationstrengthpolicy"

+}

+-->

+``` http

+PATCH https://graph.microsoft.com/beta/policies/authenticationStrengthPolicies/a34a4c89-c5bf-4c0b-927d-adc396bf1f19

+Content-Type: application/json

+Content-length: 239

+{

+ "@odata.type": "#microsoft.graph.authenticationStrengthPolicy",

+ "displayName": "FIDO2 only",

+ "description": "An auth strength allowing only FIDO2 security keys."

+}

+```

+### Response

+The following is an example of the response

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+}

+-->

+``` http

+HTTP/1.1 204 No Content

+```

+ Title: "authenticationStrengthPolicy: updateAllowedCombinations"

+description: "Update the allowedCombinations collection for a given authentication strength policy object."

+ms.localizationpriority: medium

+# authenticationStrengthPolicy: updateAllowedCombinations

+Namespace: microsoft.graph

+Update the allowedCombinations property of an [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) object. To update other properties of an authenticationStrengthPolicy object, use the [Update authenticationStrengthPolicy](authenticationstrengthpolicy-update.md) method.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+POST /policies/authenticationStrengthPolicies/{authenticationStrengthPolicyId}/updateAllowedCombinations

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+|Content-Type|application/json. Required.|

+## Request body

+In the request body, supply a JSON representation of the parameters.

+The following table shows the parameters that can be used with this action.

+|Parameter|Type|Description|

+|:|:|:|

+|allowedCombinations|authenticationMethodModes collection|The authentication method combinations allowed by this authentication strength policy. The possible values of this flagged enum are: `password`, `voice`, `hardwareOath`, `softwareOath`, `sms`, `fido2`, `windowsHelloForBusiness`, `microsoftAuthenticatorPush`, `deviceBasedPush`, `temporaryAccessPassOneTime`, `temporaryAccessPassMultiUse`, `email`, `x509CertificateSingleFactor`, `x509CertificateMultiFactor`, `federatedSingleFactor`, `federatedMultiFactor`, `unknownFutureValue`. For the list of allowed combinations, call the [List authenticationMethodModes](../api/authenticationstrengthroot-list-authenticationmethodmodes.md) API. Required.|

+## Response

+If successful, this action returns a `200 OK` response code and a [updateAllowedCombinationsResult](../resources/updateallowedcombinationsresult.md) in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "authenticationstrengthpolicythis.updateallowedcombinations"

+}

+-->

+``` http

+POST https://graph.microsoft.com/beta/policies/authenticationStrengthPolicies/33c5d2c0-884e-4b5d-a5b8-5395082b092c/updateAllowedCombinations

+Content-Type: application/json

+Content-length: 51

+{

+ "allowedCombinations": [

+ "password, voice"

+ ]

+}

+```

+### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.updateAllowedCombinationsResult"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.type" : "#microsoft.graph.updateAllowedCombinationsResult",

+ "previousCombinations": [

+ "fido2",

+ "password, voice"

+ ],

+ "currentCombinations": [

+ "password, voice"

+ ],

+ "conditionalAccessReferences": [

+ "53a3968a-ae2c-4b82-a313-091d10c52bfa"

+ ],

+ "additionalInformation": "You have lowered the security of the My Custom Strength authentication strength by adding a lower security combination. This Authentication Strength is referenced by one or more Conditional Access policies. Review conditionalAccessReferences to understand which Conditional Access policies were impacted by this change. To reverse your changes back, use updateAllowedCombinations action with the previousCombinations values."

+}

+```

+ Title: "authenticationStrengthPolicy: usage"

+description: "The`usage function allows the caller to see which Conditional Access policies reference a specified authentication strength policy"

+ms.localizationpriority: medium

+# authenticationStrengthPolicy: usage

+Namespace: microsoft.graph

+The `usage` function allows the caller to see which Conditional Access policies reference a specified authentication strength policy. The policies are returned in two collections, one containing Conditional Access policies that require an MFA claim and the other containing Conditional Access policies that do not require such a claim. Policies in the former category are restricted in what kinds of changes may be made to them to prevent undermining the MFA requirement of those policies.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /policies/authenticationStrengthPolicies/{authenticationStrengthPolicyId}/usage

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this function returns a `200 OK` response code and an [authenticationStrengthUsage](../resources/authenticationstrengthusage.md) complex type in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "authenticationstrengthpolicythis.usage"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/policies/authenticationStrengthPolicies/{authenticationStrengthPolicyId}/usage

+```

+### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.authenticationStrengthUsage"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "mfa": [{

+ "displayName": "Conditional Access Policy 1",

+ "id": "a26dbede-a6c0-4156-92e1-6c86dd7bc561",

+ "grantControls": {

+ "authenticationStrength": {"id": "00000000-0000-0000-0000-000000000003"},

+ "controls": ["MfaAndChangePassword"]

+ }

+ }],

+ "none": [{

+ "displayName": "Conditional Access Policy 2",

+ "id": "5d7d5a7f-dd35-412b-a18d-5411d8eafe8f",

+ "grantControls": {

+ "authenticationStrength": {"id": "00000000-0000-0000-0000-000000000003"},

+ "controls": ["RequireCompliantDevice"]

+ }

+ }]

+}

+```

+ Title: "Delete authenticationStrengthPolicy"

+description: "Delete a custom authenticationStrengthPolicy object."

+ms.localizationpriority: medium

+# Delete authenticationStrengthPolicy

+Namespace: microsoft.graph

+Delete a custom [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+DELETE /policies/authenticationStrengthPolicies/{authenticationStrengthPolicyId}/$ref

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `204 No Content` response code.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "delete_authenticationstrengthpolicy"

+}

+-->

+``` http

+DELETE https://graph.microsoft.com/beta/policies/authenticationStrengthPolicies/6e7d7469-07c5-4bb2-a801-5eaef8fb7c1e/$ref

+```

+### Response

+The following is an example of the response

+<!-- {

+ "blockType": "response",

+ "truncated": true

+}

+-->

+``` http

+HTTP/1.1 204 No Content

+```

+ Title: "List authenticationMethodModes"

+description: "Get a list of all supported authentication methods, or all supported authentication method combinations."

+ms.localizationpriority: medium

+# List authenticationMethodModes

+Namespace: microsoft.graph

+Get a list of all supported authentication methods, or all supported authentication method combinations as a list of **authenticationMethodModes** objects and their properties.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+Retrieve the collection of **authenticationMethodModes** objects and their descriptions.

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /identity/conditionalAccess/authenticationStrengths/authenticationMethodModes

+```

+Retrieve the flat collection of authenticationCombinations objects, representing all the allowed combinations (allowedCombinations) in an authenticationStrengthPolicy object.

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /identity/conditionalAccess/authenticationStrengths/authenticationCombinations

+```

+## Optional query parameters

+This method does not support OData query parameters.

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and a collection of [authenticationMethodModeDetail](../resources/authenticationmethodmodedetail.md) objects in the response body.

+## Examples

+### Example 1: Retrieve authenticationMethodModes objects and their descriptions

+#### Request

+The following is an example of a request to retrieve the collection of **authenticationMethodModes** objects and their descriptions.

+.

+<!-- {

+ "blockType": "request",

+ "name": "list_authenticationmethodmodedetail"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrengths/authenticationMethodModes

+```

+#### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "Collection(microsoft.graph.authenticationMethodModeDetail)"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#authenticationMethodModeDetail",

+ "value": [

+ {

+ "id" : "password",

+ "displayName" : "Password",

+ "authenticationMethod" : "password"

+ },

+ {

+ "id" : "voice",

+ "displayName" : "Voice",

+ "authenticationMethod" : "voice"

+ },

+ {

+ "id" : "softwareOath",

+ "displayName" : "Software OATH tokens",

+ "authenticationMethod" : "softwareOath"

+ },

+ {

+ "id" : "sms",

+ "displayName" : "SMS",

+ "authenticationMethod" : "sms"

+ },

+ {

+ "id" : "fido2",

+ "displayName" : "FIDO2 Security Key",

+ "authenticationMethod" : "fido2"

+ },

+ {

+ "id" : "windowsHelloForBusiness",

+ "displayName" : "Windows Hello for Business",

+ "authenticationMethod" : "windowsHelloForBusiness"

+ },

+ {

+ "id" : "microsoftAuthenticatorPush",

+ "displayName" : "Microsoft Authenticator (push notification)",

+ "authenticationMethod" : "microsoftAuthenticator"

+ },

+ {

+ "id" : "deviceBasedPush",

+ "displayName" : "Microsoft Authenticator (Passwordless)",

+ "authenticationMethod" : "microsoftAuthenticator"

+ },

+ {

+ "id" : "temporaryAccessPassOneTime",

+ "displayName" : "Temporary Access Pass (one-time use)",

+ "authenticationMethod" : "temporaryAccessPass"

+ },

+ {

+ "id" : "temporaryAccessPassMultiUse",

+ "displayName" : "Temporary Access Pass (multi-use)",

+ "authenticationMethod" : "temporaryAccessPass"

+ },

+ {

+ "id" : "email",

+ "displayName" : "Email one-time passcode",

+ "authenticationMethod" : "email"

+ },

+ {

+ "id" : "x509CertificateSingleFactor",

+ "displayName" : "Certificate-based authentication (single-factor)",

+ "authenticationMethod" : "x509Certificate"

+ },

+ {

+ "id" : "federatedMultiFactor",

+ "displayName" : "Federation (multi-factor)",

+ "authenticationMethod" : "federation"

+ },

+ {

+ "id" : "federatedSingleFactor",

+ "displayName" : "Federation (single-factor)",

+ "authenticationMethod" : "federation"

+ },

+ {

+ "id": "x509CertificateMultiFactor",

+ "displayName" : "Certificate-based authentication (multi-factor)",

+ "authenticationMethod" : "x509Certificate"

+ }

+ ]

+}

+```

+### Example 2: Retrieve the allowed authentication combinations

+#### Request

+The following is an example of a request to retrieve the flat collection of authenticationCombinations objects, representing all the possible allowed combinations (allowedCombinations) that may be used in an authenticationStrengthPolicy object.

+<!-- {

+ "blockType": "request",

+ "name": "list_authenticationcombinations"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrengths/authenticationCombinations

+```

+#### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "isCollection": true,

+ "@odata.type": "Collection(microsoft.graph.authenticationMethodModes)"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/authenticationStrengths/authenticationCombinations",

+ "value": [

+ "windowsHelloForBusiness",

+ "fido2",

+ "x509CertificateMultiFactor",

+ "deviceBasedPush",

+ "temporaryAccessPassOneTime",

+ "temporaryAccessPassMultiUse",

+ "password,microsoftAuthenticatorPush",

+ "password,softwareOath",

+ "password,hardwareOath",

+ "password,sms",

+ "password,voice",

+ "federatedMultiFactor",

+ "microsoftAuthenticatorPush,federatedSingleFactor",

+ "softwareOath,federatedSingleFactor",

+ "hardwareOath,federatedSingleFactor",

+ "sms,federatedSingleFactor",

+ "voice,federatedSingleFactor",

+ "x509CertificateSingleFactor",

+ "sms",

+ "password",

+ "federatedSingleFactor",

+ "email"

+ ]

+}

+```

+<!-- {

+ "type": "#page.annotation",

+ "section": "documentation",

+ "suppressions": [

+ "Error: list_authenticationcombinations:

+ Unable to locate a definition for resource type: microsoft.graph.authenticationMethodModes"

+ ]

+} -->

+ Title: "List authenticationStrengthPolicies"

+description: "Get a list of the authenticationStrengthPolicy objects and their properties."

+ms.localizationpriority: medium

+# List authenticationStrengthPolicies

+Namespace: microsoft.graph

+Get a list of the [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) objects and their properties. This API returns both built-in and custom policies.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.Read.All, Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /policies/authenticationStrengthPolicies

+```

+## Optional query parameters

+This method supports the `filter` OData query parameter on the `policyType` and `policyName` properties to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and a collection of [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) objects in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "list_authenticationstrengthpolicy"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/policies/authenticationStrengthPolicies

+```

+### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "Collection(microsoft.graph.authenticationStrengthPolicy)"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "value": [

+ {

+ "@odata.type" : "authenticationStrengthPolicy",

+ "id": "7d718ef4-5493-4313-a52c-7401b7df3a9c",

+ "createdDateTime": "2022-09-30T10:59:01Z",

+ "modifiedDateTime": "2022-09-30T10:59:01Z",

+ "displayName": "Contoso authentication level",

+ "description": "The only authentication level allowed to access our secret apps",

+ "policyType": "custom",

+ "requirementsSatisfied": "mfa",

+ "allowedCombinations": [

+ "x509CertificateSingleFactor, fido2",

+ "fido2"

+ ],

+ "combinationConfigurations": [

+ {

+ "@odata.type" : "fido2CombinationConfiguration",

+ "id": "675ff4e1-7c6d-4a7f-9803-ad084d1b45b3",

+ "allowedAAGUIDs": [

+ "2ac80ddb-17bd-4575-b41c-0dc37ae3290d"

+ ],

+ "appliesToCombinations": ["fido2"]

+ }

+ ]

+ },

+ {

+ "@odata.type" : "authenticationStrengthPolicy",

+ "id": "00000000-0000-0000-0000-000000000002",

+ "createdDateTime": "2022-09-30T10:59:01Z",

+ "modifiedDateTime": "2022-09-30T10:59:01Z",

+ "displayName": "Multi-factor authentication",

+ "description": "Combinations of methods that satisfy strong authentication, such as a password + SMS",

+ "policyType": "builtIn",

+ "requirementsSatisfied": "mfa",

+ "allowedCombinations": [

+ "windowsHelloForBusiness",

+ "fido2",

+ "x509CertificateMultiFactor",

+ "deviceBasedPush",

+ "temporaryAccessPassOneTime",

+ "temporaryAccessPassMultiUse",

+ "password, microsoftAuthenticatorPush",

+ "password, softwareOath",

+ "password, hardwareOath",

+ "password, sms",

+ "password, voice",

+ "federatedMultiFactor",

+ "federatedSingleFactor, microsoftAuthenticatorPush",

+ "federatedSingleFactor, softwareOath",

+ "federatedSingleFactor, hardwareOath",

+ "federatedSingleFactor, sms",

+ "federatedSingleFactor, voice"

+ ],

+ "combinationConfigurations": []

+ },

+ {

+ "@odata.type" : "authenticationStrengthPolicy",

+ "id": "00000000-0000-0000-0000-000000000003",

+ "createdDateTime": "2022-09-30T10:59:01Z",

+ "modifiedDateTime": "2022-09-30T10:59:01Z",

+ "displayName": "Passwordless MFA",

+ "description": "Passwordless methods that satisfy strong authentication, such as Passwordless sign-in with the Microsoft Authenticator",

+ "policyType": "builtIn",

+ "requirementsSatisfied": "mfa",

+ "allowedCombinations": [

+ "windowsHelloForBusiness",

+ "fido2",

+ "x509CertificateMultiFactor",

+ "deviceBasedPush"

+ ],

+ "combinationConfigurations": []

+ },

+ {

+ "@odata.type" : "authenticationStrengthPolicy",

+ "id": "00000000-0000-0000-0000-000000000004",

+ "createdDateTime": "2022-09-30T10:59:01Z",

+ "modifiedDateTime": "2022-09-30T10:59:01Z",

+ "displayName": "Phishing resistant MFA",

+ "description": "Phishing-resistant, Passwordless methods for the strongest authentication, such as a FIDO2 security key",

+ "policyType": "builtIn",

+ "requirementsSatisfied": "mfa",

+ "allowedCombinations": [

+ "windowsHelloForBusiness",

+ "fido2",

+ "x509CertificateMultiFactor"

+ ],

+ "combinationConfigurations": []

+ }

+ ]

+}

+```

+ Title: "Create authenticationStrengthPolicy"

+description: "Create a new custom authenticationStrengthPolicy object."

+ms.localizationpriority: medium

+# Create authenticationStrengthPolicy

+Namespace: microsoft.graph

+Create a new custom [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|Policy.ReadWrite.ConditionalAccess, Policy.ReadWrite.AuthenticationMethod|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+POST /policies/authenticationStrengthPolicies

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+|Content-Type|application/json. Required.|

+## Request body

+In the request body, supply a JSON representation of the [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) object.

+You can specify the following properties when creating an **authenticationStrengthPolicy**.

+|Property|Type|Description|

+|:|:|:|

+|displayName|String|The display name of the policy to be created. Required.|

+|description|String|The description of the policy to be created. Optional.|

+|allowedCombinations|authenticationMethodModes collection|The authentication method combinations allowed by this authentication strength policy. The possible values of this flagged enum are: `password`, `voice`, `hardwareOath`, `softwareOath`, `sms`, `fido2`, `windowsHelloForBusiness`, `microsoftAuthenticatorPush`, `deviceBasedPush`, `temporaryAccessPassOneTime`, `temporaryAccessPassMultiUse`, `email`, `x509CertificateSingleFactor`, `x509CertificateMultiFactor`, `federatedSingleFactor`, `federatedMultiFactor`, `unknownFutureValue`. For the list of allowed combinations, call the [List authenticationMethodModes](../api/authenticationstrengthroot-list-authenticationmethodmodes.md) API. Required.|

+## Response

+If successful, this method returns a `201 Created` response code and an [authenticationStrengthPolicy](../resources/authenticationstrengthpolicy.md) object in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "create_authenticationstrengthpolicy_from_"

+}

+-->

+``` http

+POST https://graph.microsoft.com/beta/policies/authenticationStrengthPolicies

+Content-Type: application/json

+Content-length: 239

+{

+ "@odata.type" : "#microsoft.graph.authenticationStrengthPolicy",

+ "displayName": "Contoso authentication level",

+ "description": "The only authentication level allowed to access our secret apps",

+ "allowedCombinations": [

+ "password, hardwareOath",

+ "password, sms"

+ ]

+}

+```

+### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.authenticationStrengthPolicy"

+}

+-->

+``` http

+HTTP/1.1 201 Created

+Content-Type: application/json

+{

+ "@odata.type" : "authenticationStrengthPolicy",

+ "id": "dd055c42-4218-4281-8631-f090e171f5cd",

+ "createdDateTime": "2022-09-30T10:59:01Z",

+ "modifiedDateTime": "2022-09-30T10:59:01Z",

+ "displayName": "Contoso authentication level",

+ "description": "The only authentication level allowed to access our secret apps",

+ "policyType": "custom",

+ "requirementsSatisfied": "mfa",

+ "allowedCombinations": [

+ "password, hardwareOath",

+ "password, sms"

+ ],

+ "combinationConfigurations": []

+}

+```

+ "name": "get_callTranscript",

+ "sampleKeys": ["ba321e0d-79ee-478d-8e28-85a19507f456", "MSo1N2Y5ZGFjYy03MWJmLTQ3NDMtYjQxMy01M2EdFGkdRWHJlQ", "MSMjMCMjNzU3ODc2ZDYtOTcwMi00MDhkLWFkNDItOTE2ZDNmZjkwZGY4"]

+ "name": "get_callTranscript_content",

+ "sampleKeys": ["ba321e0d-79ee-478d-8e28-85a19507f456", "MSo1N2Y5ZGFjYy03MWJmLTQ3NDMtYjQxMy01M2EdFGkdRWHJlQ", "MSMjMCMjNzU3ODc2ZDYtOTcwMi00MDhkLWFkNDItOTE2ZDNmZjkwZGY4"]

+ "name": "get_callTranscript_content_format",

+ "sampleKeys": ["ba321e0d-79ee-478d-8e28-85a19507f456", "MSo1N2Y5ZGFjYy03MWJmLTQ3NDMtYjQxMy01M2EdFGkdRWHJlQ", "MSMjMCMjNzU3ODc2ZDYtOTcwMi00MDhkLWFkNDItOTE2ZDNmZjkwZGY4"]

+ "name": "get_callTranscript_content_Accept",

+ "sampleKeys": ["ba321e0d-79ee-478d-8e28-85a19507f456", "MSo1N2Y5ZGFjYy03MWJmLTQ3NDMtYjQxMy01M2EdFGkdRWHJlQ", "MSMjMCMjNzU3ODc2ZDYtOTcwMi00MDhkLWFkNDItOTE2ZDNmZjkwZGY4"]

+ "name": "get_callTranscript_content_format_precedence",

+ "sampleKeys": ["ba321e0d-79ee-478d-8e28-85a19507f456", "MSo1N2Y5ZGFjYy03MWJmLTQ3NDMtYjQxMy01M2EdFGkdRWHJlQ", "MSMjMCMjNzU3ODc2ZDYtOTcwMi00MDhkLWFkNDItOTE2ZDNmZjkwZGY4"]

+| Delegated (work or school account) | ChannelMessage.Send, Group.ReadWrite.All** |

+| Application | Teamwork.Migrate.All, ChannelMessage.ReadWrite.All |

+> **Note**: Permissions marked with ** are supported only for backward compatibility. We recommend that you update your solutions to use an alternative permission listed in the previous table and avoid using these permissions going forward.

+

+DELETE /chats/{chat-id}/pinnedMessages/{pinnedChatMessageId}

+### Example 5: Get the chat along with the preview of the last message sent in the chat

+#### Request

+The following is an example of the request.

+<!-- {

+ "blockType": "request",

+ "name": "get_meeting_chat",

+ "sampleKeys": ["19:meeting_ZDZlYTYxOWUtYzdlMi00ZmMxLWIxMTAtN2YzODZlZjAxYzI4@thread.v2"]

+}-->

+```http

+GET https://graph.microsoft.com/beta/chats/19:ebe3857aa388434bab0cad9d2e09f4de@thread.v2?$expand=lastMessagePreview

+```

+#### Response

+The following example shows the response.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.chat"

+} -->

+```http

+HTTP/1.1 200 OK

+Content-type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#chats(lastMessagePreview())/$entity",

+ "id": "19:ebe3857aa388434bab0cad9d2e09f4de@thread.v2",

+ "topic": "Demo Group Chat",

+ "createdDateTime": "2021-04-08T16:00:53.563Z",

+ "lastUpdatedDateTime": "2022-09-08T23:11:54.246Z",

+ "chatType": "group",

+ "webUrl": "https://teams.microsoft.com/l/chat/19%3Aebe3857aa388434bab0cad9d2e09f4de%40thread.v2/0?tenantId=2432b57b-0abd-43db-aa7b-16eadd115d34",

+ "tenantId": "2432b57b-0abd-43db-aa7b-16eadd115d34",

+ "onlineMeetingInfo": null,

+ "viewpoint": {

+ "isHidden": true,

+ "lastMessageReadDateTime": "2022-09-08T23:11:54.353Z"

+ },

+ "lastMessagePreview@odata.context": "https://graph.microsoft.com/beta/$metadata#chats('19%3Aebe3857aa388434bab0cad9d2e09f4de%40thread.v2')/lastMessagePreview/$entity",

+ "lastMessagePreview": {

+ "id": "1662678714353",

+ "createdDateTime": "2022-09-08T23:11:54.353Z",

+ "isDeleted": false,

+ "messageType": "systemEventMessage",

+ "from": null,

+ "body": {

+ "contentType": "html",

+ "content": "<systemEventMessage/>"

+ },

+ "eventDetail": {

+ "@odata.type": "#microsoft.graph.membersAddedEventMessageDetail",

+ "visibleHistoryStartDateTime": "0001-01-01T00:00:00Z",

+ "members": [

+ {

+ "id": "ee9f3754-62e1-4034-ad10-97940ef7f709",

+ "displayName": null,

+ "userIdentityType": "aadUser"

+ }

+ ],

+ "initiator": {

+ "application": null,

+ "device": null,

+ "user": {

+ "id": "bfb5bb25-3a8d-487d-9828-7875ced51a30",

+ "displayName": null,

+ "userIdentityType": "aadUser"

+ }

+ }

+ }

+ }

+}

+```

+ "id" : "d864e79f-a516-4d0f-9fee-0eeb4d61fdc2",

+ "tenantId": "2a690434-97d9-4eed-83a6-f5f13600199a"

+ }

+ Title: "List pinnedChatMessages in a chat"

+# List pinnedChatMessages in a chat

+#### Request

+#### Response

+#### Request

+#### Response

+ "id" : "d864e79f-a516-4d0f-9fee-0eeb4d61fdc2",

+ "tenantId": "2a690434-97d9-4eed-83a6-f5f13600199a"

+ }

+ "id" : "d864e79f-a516-4d0f-9fee-0eeb4d61fdc2",

+ "tenantId": "2a690434-97d9-4eed-83a6-f5f13600199a"

+In the request body, supply the ID of a chat message to pin.

+|Delegated (personal Microsoft account)|Not supported.|

+The following example shows how you can send an activity feed notification for a new task created in a chat. For more details, see [sending Teams activity notifications](/graph/teams-send-activityfeednotifications).

+The following example shows the request.

+The following example shows the response.

+The following example shows the request.

+The following example shows the response.

+The following example shows the request.

+The following example shows the response.

+The following example shows the request.

+The following example shows the response.

+The following example shows how you can send an activity feed notification to all chat members. This example is similar to previous examples. However, in this case, the `recipient` is a [chatMembersNotificationRecipient](../resources/chatmembersnotificationrecipient.md). Note that the `chatId` specified in the `recipient` must match the `chatId` specified in the request URL.

+The following example shows the request.

+The following example shows the response.

+ "id" : "d864e79f-a516-4d0f-9fee-0eeb4d61fdc2",

+ "tenantId": "2a690434-97d9-4eed-83a6-f5f13600199a"

+ }

+| Application | Teamwork.Migrate.All, ChannelMessage.ReadWrite.All |

+| Application | Teamwork.Migrate.All, ChannelMessage.ReadWrite.All |

+ Title: "chatMessage: setReaction"

+description: "Set a reaction to a single message or message reply in a channel or a chat."

+ms.localizationpriority: medium

+# chatMessage: SetReaction

+Namespace: microsoft.graph

+Set a reaction to a single [message](../resources/chatmessage.md) or a [message reply](../resources/chatmessage.md) in a [channel](../resources/channel.md) or a [chat](../resources/chat.md).

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+### Permissions for channel

+| Permission type | Permissions (from least to most privileged) |

+|:|:--|

+|Delegated (work or school account)| ChannelMessage.Send, |

+|Delegated (personal Microsoft account)| Not supported. |

+|Application| Not supported. |

+### Permissions for chat

+| Permission type | Permissions (from least to most privileged) |

+|:|:--|

+|Delegated (work or school account)| Chat.ReadWrite, ChatMessage.Send |

+|Delegated (personal Microsoft account)| Not supported. |

+|Application| Not supported. |

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+POST /users/{userId}/chats/{chatsId}/messages/{chatMessageId}/setReaction

+POST /teams/{teamsId}/channels/{channelId}/messages/{chatMessageId}/setReaction

+POST /teams/{teamId}/channels/{channelId}/messages/{messageId}/replies/{replyId}/setReaction

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+In the request body, supply the **reactionType** as unicode.

+## Response

+If successful, this action returns a `204 No Content` response code.

+## Examples

+### Example 1: Set a reaction to a chat message

+#### Request

+```http

+POST https://graph.microsoft.com/beta/chats/chatId/messages/messageId/setReaction

+{

+ "reactionType": "💘"

+}

+```

+#### Response

+<!-- {

+ "blockType": "response"

+} -->

+``` http

+HTTP/1.1 204 No Content

+```

+### Example 2: Set a reaction to a message in a channel

+#### Request

+```http

+POST https://graph.microsoft.com/beta/teams/teamsid/channels/channelId/messages/messageId/setReaction

+{

+ "reactionType": "💘"

+}

+```

+#### Response

+<!-- {

+ "blockType": "response"

+} -->

+``` http

+HTTP/1.1 204 No Content

+```

+### Example 3: Set a reaction to a reply message

+#### Request

+```http

+POST https://graph.microsoft.com/beta/teams/teamsid/channels/channelId/messages/messageId/replies/replyId/setReaction

+{

+ "reactionType": "💘"

+}

+```

+#### Response

+<!-- {

+ "blockType": "response"

+} -->

+``` http

+HTTP/1.1 204 No Content

+```

+ Title: "chatMessage: unsetReaction"

+description: "Unset areaction to a single message or message reply in a channel or a chat."

+ms.localizationpriority: medium

+# chatMessage: unsetReaction

+Namespace: microsoft.graph

+Unset a reaction to a single [message](../resources/chatmessage.md) or a [message reply](../resources/chatmessage.md) in a [channel](../resources/channel.md) or a [chat](../resources/chat.md).

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+### Permissions for channel

+| Permission type | Permissions (from least to most privileged) |

+|:|:--|

+|Delegated (work or school account)| ChannelMessage.Send, |

+|Delegated (personal Microsoft account)| Not supported. |

+|Application| Not supported. |

+### Permissions for chat

+| Permission type | Permissions (from least to most privileged) |

+|:|:--|

+|Delegated (work or school account)| Chat.ReadWrite, ChatMessage.Send |

+|Delegated (personal Microsoft account)| Not supported. |

+|Application| Not supported. |

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+POST /users/{userId}/chats/{chatsId}/messages/{chatMessageId}/unsetReaction

+POST /teams/{teamsId}/channels/{channelId}/messages/{chatMessageId}/unsetReaction

+POST /teams/{teamId}/channels/{channelId}/messages/{messageId}/replies/{replyId}/unsetReaction

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+In the request body, supply the **reactionType** as unicode.

+## Response

+If successful, this action returns a `204 No Content` response code.

+## Examples

+### Example 1: Unset a reaction to a chat message

+#### Request

+```http

+POST https://graph.microsoft.com/beta/chats/chatId/messages/messageId/unsetReaction

+{

+ "reactionType": "💘"

+}

+```

+#### Response

+<!-- {

+ "blockType": "response"

+} -->

+```http

+HTTP/1.1 204 No Content

+```

+### Example 2: Unset a reaction to a message in a channel

+#### Request

+```http

+POST https://graph.microsoft.com/beta/teams/teamsid/channels/channelId/messages/messageId/unsetReaction

+{

+ "reactionType": "💘"

+}

+```

+#### Response

+<!-- {

+ "blockType": "response"

+} -->

+``` http

+HTTP/1.1 204 No Content

+```

+### Example 3: Unset a reaction to a message reply

+#### Request

+```http

+POST https://graph.microsoft.com/beta/teams/teamsid/channels/channelId/messages/messageId/replies/replyId/unsetReaction

+{

+ "reactionType": "💘"

+}

+```

+#### Response

+<!-- {

+ "blockType": "response"

+} -->

+```http

+HTTP/1.1 204 No Content

+```

+### Permissions for channel

+| Permission type | Permissions (from least to most privileged) |

+|:|:--|

+| Delegated (work or school account) | ChannelMessage.ReadWrite, Group.ReadWrite.All** |

+| Delegated (personal Microsoft account) | Not supported. |

+| Application | ChannelMessage.UpdatePolicyViolation.All, ChannelMessage.ReadWrite.All, Group.ReadWrite.All** |

+> **Note**: Permissions marked with ** are supported only for backward compatibility. We recommend that you update your solutions to use an alternative permission listed in the previous table and avoid using these permissions going forward.

+### Permissions for chat

+| Permission type | Permissions (from least to most privileged) |

+|:|:--|

+| Delegated (work or school account) | Chat.ReadWrite |

+| Delegated (personal Microsoft account) | Not supported. |

+| Application | Chat.UpdatePolicyViolation.All, Chat.ReadWrite.All |

+# [PowerShell](#tab/powershell)

+|localAdminEnabled|Boolean|To turn on the local admin option, change this setting to `true`.ΓÇ» |

+|selfServiceEnabled|Boolean|To turn on the self-service option, change this setting to `true`.ΓÇ»|

+|lastModifiedDateTime|DateTimeOffset|The last date and time the setting was modified. The Timestamp type represents the date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 isΓÇ»`2014-01-01T00:00:00Z`.ΓÇ»|

+The following is an example of a request.

+The following is an example of the response.

+ ],

+ "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#policies/conditionalAccessPolicies('6b5e999b-0ba8-4186-a106-e0296c1c4358')/grantControls/authenticationStrength/$entity",

+ "authenticationStrength": null

+ "termsOfUse": [],

+ "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#policies/conditionalAccessPolicies('ad8d2b4a-8d30-413f-88b8-144c6c8d98d9')/grantControls/authenticationStrength/$entity",

+ "authenticationStrength": null

+ Title: "List conditionalAccessTemplates"

+description: "Get a list of the conditionalAccessTemplate objects and their properties."

+ms.localizationpriority: medium

+# List conditionalAccessTemplates

+Namespace: microsoft.graph

+Get a list of the [conditionalAccessTemplate](../resources/conditionalaccesstemplate.md) objects and their properties.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type | Permissions (from least to most privileged) |

+|:--|:-|

+|Delegated (work or school account) | Policy.Read.All |

+|Delegated (personal Microsoft account) | Not supported. |

+|Application | Policy.Read.All |

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /identity/conditionalAccess/templates

+```

+## Optional query parameters

+This method supports the `$filter` and `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+## Request headers

+| Name |Description|

+|:-|:-|

+| Authorization | Bearer {token} |

+| Accept-Language | Language. Optional. |

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and a collection of [conditionalAccessTemplate](../resources/conditionalaccesstemplate.md) objects in the response body.

+## Examples

+### Example 1: List all conditional access policy templates

+#### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "list_conditionalaccesstemplate"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identity/conditionalAccess/templates

+```

+#### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "Collection(microsoft.graph.conditionalAccessTemplate)"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/templates",

+ "value": [

+ {

+ "name": "Require multifactor authentication for admins",

+ "description": "Require multifactor authentication for privileged administrative accounts to reduce risk of compromise. This policy will target the same roles as Security Default.",

+ "id": "c7503427-338e-4c5e-902d-abe252abfb43",

+ "scenarios": "secureFoundation,zeroTrust,protectAdmins",

+ "details": {

+ "sessionControls": null,

+ "conditions": {

+ "userRiskLevels": [],

+ "signInRiskLevels": [],

+ "clientAppTypes": [

+ "all"

+ ],

+ "servicePrincipalRiskLevels": [],

+ "platforms": null,

+ "locations": null,

+ "signInRiskDetections": null,

+ "times": null,

+ "deviceStates": null,

+ "devices": null,

+ "clientApplications": null,

+ "applications": {

+ "includeApplications": [

+ "All"

+ ],

+ "excludeApplications": [],

+ "includeUserActions": [],

+ "includeAuthenticationContextClassReferences": [],

+ "applicationFilter": null,

+ "networkAccess": null

+ },

+ "users": {

+ "includeUsers": [],

+ "excludeUsers": [

+ "Current administrator will be excluded"

+ ],

+ "includeGroups": [],

+ "excludeGroups": [],

+ "includeRoles": [

+ "62e90394-69f5-4237-9190-012177145e10",

+ "194ae4cb-b126-40b2-bd5b-6091b380977d"

+ ],

+ "excludeRoles": [],

+ "includeGuestsOrExternalUsers": null,

+ "excludeGuestsOrExternalUsers": null

+ }

+ },

+ "grantControls": {

+ "operator": "OR",

+ "builtInControls": [

+ "mfa"

+ ],

+ "customAuthenticationFactors": [],

+ "termsOfUse": [],

+ "authenticationStrength": null

+ }

+ }

+ }

+ ]

+}

+```

+### Example 2: List name, description, id, scenarios of templates whose scenarios contain "zeroTrust"

+#### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "list_conditionalaccesstemplate_select"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identity/conditionalAccess/templates?$select=name,description,id,scenarios&$filter=scenarios has 'secureFoundation'

+```

+#### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "Collection(microsoft.graph.conditionalAccessTemplate)"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/templates(name,description,id,scenarios)",

+ "value": [

+ {

+ "name": "Require multifactor authentication for admins",

+ "description": "Require multifactor authentication for privileged administrative accounts to reduce risk of compromise. This policy will target the same roles as Security Default.",

+ "id": "c7503427-338e-4c5e-902d-abe252abfb43",

+ "scenarios": "secureFoundation,zeroTrust,protectAdmins"

+ },

+ {

+ "name": "Securing security info registration",

+ "description": "Secure when and how users register for Azure AD multifactor authentication and self-service password.",

+ "id": "b8bda7f8-6584-4446-bce9-d871480e53fa",

+ "scenarios": "secureFoundation,zeroTrust,remoteWork"

+ },

+ {

+ "name": "Block legacy authentication",

+ "description": "Block legacy authentication endpoints that can be used to bypass multifactor authentication.",

+ "id": "0b2282f9-2862-4178-88b5-d79340b36cb8",

+ "scenarios": "secureFoundation,zeroTrust,remoteWork,protectAdmins"

+ },

+ {

+ "name": "Require multifactor authentication for all users",

+ "description": "Require multifactor authentication for all user accounts to reduce risk of compromise.",

+ "id": "a3d0a415-b068-4326-9251-f9cdf9feeb64",

+ "scenarios": "secureFoundation,zeroTrust,remoteWork"

+ }

+ ]

+}

+```

+ Title: "Get template"

+description: "Retrieve the properties and relationships of a conditionalAccessTemplate object."

+ms.localizationpriority: medium

+# Get conditionalAccessTemplate

+Namespace: microsoft.graph

+Read the properties and relationships of a [conditionalAccessTemplate](../resources/conditionalaccesstemplate.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type | Permissions (from least to most privileged) |

+|:--|:-|

+|Delegated (work or school account) | Policy.Read.All |

+|Delegated (personal Microsoft account) | Not supported. |

+|Application | Policy.Read.All |

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /identity/conditionalAccess/templates/{id}

+```

+## Optional query parameters

+This method supports the `$select` OData query parameter to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+## Request headers

+| Name |Description|

+|:-|:-|

+| Authorization | Bearer {token} |

+| Accept-Language | Language. Optional. |

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and a [conditionalAccessTemplate](../resources/conditionalaccesstemplate.md) object in the response body.

+## Examples

+### Example 1: Get the properties a template by ID

+#### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "get_conditionalaccesstemplate"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identity/conditionalAccess/templates/c7503427-338e-4c5e-902d-abe252abfb43

+```

+#### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.conditionalAccessTemplate"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/templates/$entity",

+ "name": "Require multifactor authentication for admins",

+ "description": "Require multifactor authentication for privileged administrative accounts to reduce risk of compromise. This policy will target the same roles as Security Default.",

+ "id": "c7503427-338e-4c5e-902d-abe252abfb43",

+ "scenarios": "secureFoundation,zeroTrust,protectAdmins",

+ "details": {

+ "sessionControls": null,

+ "conditions": {

+ "userRiskLevels": [],

+ "signInRiskLevels": [],

+ "clientAppTypes": [

+ "all"

+ ],

+ "servicePrincipalRiskLevels": [],

+ "platforms": null,

+ "locations": null,

+ "signInRiskDetections": null,

+ "times": null,

+ "deviceStates": null,

+ "devices": null,

+ "clientApplications": null,

+ "applications": {

+ "includeApplications": [

+ "All"

+ ],

+ "excludeApplications": [],

+ "includeUserActions": [],

+ "includeAuthenticationContextClassReferences": [],

+ "applicationFilter": null,

+ "networkAccess": null

+ },

+ "users": {

+ "includeUsers": [],

+ "excludeUsers": [

+ "Current administrator will be excluded"

+ ],

+ "includeGroups": [],

+ "excludeGroups": [],

+ "includeRoles": [

+ "62e90394-69f5-4237-9190-012177145e10",

+ "194ae4cb-b126-40b2-bd5b-6091b380977d"

+ ],

+ "excludeRoles": [],

+ "includeGuestsOrExternalUsers": null,

+ "excludeGuestsOrExternalUsers": null

+ }

+ },

+ "grantControls": {

+ "operator": "OR",

+ "builtInControls": [

+ "mfa"

+ ],

+ "customAuthenticationFactors": [],

+ "termsOfUse": [],

+ "authenticationStrength": null

+ }

+ }

+}

+```

+### Example 2: Select details of a template

+#### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "get_conditionalaccesstemplate_select"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identity/conditionalAccess/templates/c7503427-338e-4c5e-902d-abe252abfb43?$select=details

+```

+#### Response

+The following is an example of the response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.conditionalAccessTemplate"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/templates(details)/$entity",

+ "details": {

+ "sessionControls": null,

+ "conditions": {

+ "userRiskLevels": [],

+ "signInRiskLevels": [],

+ "clientAppTypes": [

+ "all"

+ ],

+ "servicePrincipalRiskLevels": [],

+ "platforms": null,

+ "locations": null,

+ "signInRiskDetections": null,

+ "times": null,

+ "deviceStates": null,

+ "devices": null,

+ "clientApplications": null,

+ "applications": {

+ "includeApplications": [

+ "All"

+ ],

+ "excludeApplications": [],

+ "includeUserActions": [],

+ "includeAuthenticationContextClassReferences": [],

+ "applicationFilter": null,

+ "networkAccess": null

+ },

+ "users": {

+ "includeUsers": [],

+ "excludeUsers": [

+ "Current administrator will be excluded"

+ ],

+ "includeGroups": [],

+ "excludeGroups": [],

+ "includeRoles": [

+ "62e90394-69f5-4237-9190-012177145e10",

+ "194ae4cb-b126-40b2-bd5b-6091b380977d"

+ ],

+ "excludeRoles": [],

+ "includeGuestsOrExternalUsers": null,

+ "excludeGuestsOrExternalUsers": null

+ }

+ },

+ "grantControls": {

+ "operator": "OR",

+ "builtInControls": [

+ "mfa"

+ ],

+ "customAuthenticationFactors": [],

+ "termsOfUse": [],

+ "authenticationStrength": null

+ }

+ }

+}

+```

+When items are added or updated for this resource, they are specially indexed for use with the `$count` and `$search` query parameters. There can be a slight delay between when an item is added or updated and when it is available in the index.

+ Title: "Get alertRecord"

+description: "Read the properties and relationships of an alertRecord object."

+ms.localizationpriority: medium

+# Get alertRecord

+Namespace: microsoft.graph.deviceManagement

+Read the properties and relationships of an [alertRecord](../resources/devicemanagement-alertrecord.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|CloudPC.Read.All, CloudPC.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|CloudPC.Read.All, CloudPC.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /deviceManagement/monitoring/alertRecords/{alertRecordId}

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and an [microsoft.graph.deviceManagement.alertRecord](../resources/devicemanagement-alertrecord.md) object in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "get_alertrecord"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/deviceManagement/monitoring/alertRecords/6c46a7ba-e78a-45e5-a81c-179ab8fd3e8e

+```

+### Response

+The following is an example of the response.

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.deviceManagement.alertRecord"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/monitoring/alertRecords/$entity",

+ "id": "6c46a7ba-e78a-45e5-a81c-179ab8fd3e8e",

+ "displayName": "Upload failure for Device Images",

+ "status": "active",

+ "severity": "warning",

+ "alertRuleId": "30070507-6514-443b-8fa5-06979cedacdf",

+ "alertRuleTemplate": "cloudPcImageUploadScenario",

+ "detectedDateTime": "2022-03-30T11:55:00.1147865Z",

+ "resolvedDateTime": null,

+ "lastUpdatedDateTime": "2022-03-31T01:10:20.9648579Z",

+ "alertImpact": {

+ "value": 2,

+ "aggregationType": "count"

+ }

+}

+```

+ Title: "alertRecord: getPortalNotifications"

+description: "Get a list of all portal notifications that one or more users can access."

+ms.localizationpriority: medium

+# alertRecord: getPortalNotifications

+Namespace: microsoft.graph.deviceManagement

+Get a list of all portal notifications that one or more users can access.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|CloudPC.Read.All, CloudPC.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|CloudPC.Read.All, CloudPC.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /deviceManagement/monitoring/alertRecords/getPortalNotifications

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this function returns a `200 OK` response code and a collection of [microsoft.graph.deviceManagement.portalNotification](../resources/devicemanagement-portalnotification.md) objects in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "alertrecordthis.getportalnotifications"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/deviceManagement/monitoring/alertRecords/getPortalNotifications

+```

+### Response

+The following is an example of the response.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.deviceManagement.portalNotification",

+ "isCollection": true

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#Collection(microsoft.graph.deviceManagement.portalNotification)",

+ "value": [

+ {

+ "id": "6575ceea-1d1c-48f1-b6af-01b98fbde246",

+ "alertRuleId": "30070507-6514-443b-8fa5-06979cedacdf",

+ "alertRecordId": "6c46a7ba-e78a-45e5-a81c-179ab8fd3e8e",

+ "alertRuleName": "Upload failure for Device Images",

+ "alertRuleTemplate": "cloudPcImageUploadScenario",

+ "isPortalNotificationSent": true,

+ "severity": "warning",

+ "alertImpact": {

+ "value": 2,

+ "aggregationType": "count"

+ }

+ },

+ {

+ "id": "f2c9ef57-44b8-4783-87e6-e4131a9c1008",

+ "alertRuleId": "215c55cc-b1c9-4d36-a870-be5778101714",

+ "alertRecordId": "44336915-dfcb-479b-a4d6-54bd66fa1ad6",

+ "alertRuleName": "Azure network connection failure impacting Cloud PCs",

+ "alertRuleTemplate": "cloudPcOnPremiseNetworkConnectionCheckScenario",

+ "isPortalNotificationSent": true,

+ "severity": "warning",

+ "alertImpact": {

+ "value": 100,

+ "aggregationType": "count"

+ }

+ }

+ ]

+}

+```

+ Title: "List alertRecords"

+description: "Get a list of the alertRecord objects and their properties."

+ms.localizationpriority: medium

+# List alertRecords

+Namespace: microsoft.graph.deviceManagement

+Get a list of the [alertRecord](../resources/devicemanagement-alertrecord.md) objects and their properties.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|CloudPC.Read.All, CloudPC.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|CloudPC.Read.All, CloudPC.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /deviceManagement/monitoring/alertRecords

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.deviceManagement.alertRecord](../resources/devicemanagement-alertrecord.md) objects in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "list_alertrecord"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/deviceManagement/monitoring/alertRecords

+```

+### Response

+The following is an example of the response.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.deviceManagement.alertRecord",

+ "isCollection": true

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/monitoring/alertRecords",

+ "value": [

+ {

+ "id": "6c46a7ba-e78a-45e5-a81c-179ab8fd3e8e",

+ "displayName": "Upload failure for Device Images",

+ "status": "active",

+ "severity": "warning",

+ "alertRuleId": "30070507-6514-443b-8fa5-06979cedacdf",

+ "alertRuleTemplate": "cloudPcImageUploadScenario",

+ "detectedDateTime": "2022-03-30T11:55:00.1147865Z",

+ "resolvedDateTime": null,

+ "lastUpdatedDateTime": "2022-03-31T01:10:20.9648579Z",

+ "alertImpact": {

+ "value": 2,

+ "aggregationType": "count"

+ }

+ },

+ {

+ "id": "44336915-dfcb-479b-a4d6-54bd66fa1ad6",

+ "displayName": "Azure network connection failure impacting Cloud PCs",

+ "status": "resolved",

+ "severity": "warning",

+ "alertRuleId": "215c55cc-b1c9-4d36-a870-be5778101714",

+ "alertRuleTemplate": "cloudPcOnPremiseNetworkConnectionCheckScenario",

+ "detectedDateTime": "2022-03-29T08:00:30.1313929Z",

+ "resolvedDateTime": "2022-03-30T08:24:35.7020041Z",

+ "lastUpdatedDateTime": "2022-03-30T08:24:35.7020041Z",

+ "alertImpact": {

+ "value": 100,

+ "aggregationType": "count"

+ }

+ }

+ ]

+}

+```

+ Title: "alertRecord: setPortalNotificationAsSent"

+description: "Set a single portal notification status to published."

+ms.localizationpriority: medium

+# alertRecord: setPortalNotificationAsSent

+Namespace: microsoft.graph.deviceManagement

+Set a single portal notification status to published by modifying the **isPortalNotificationSent** property to `true` for the user specified in the request.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|CloudPC.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|CloudPC.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+POST /deviceManagement/monitoring/alertRecords/{alertRecordId}/setPortalNotificationAsSent

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this action returns a `204 No Content` response code.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "alertrecordthis.setportalnotificationassent"

+}

+-->

+``` http

+POST https://graph.microsoft.com/beta/deviceManagement/monitoring/alertRecords/6c46a7ba-e78a-45e5-a81c-179ab8fd3e8e/setPortalNotificationAsSent

+```

+### Response

+The following is an example of the response.

+<!-- {

+ "blockType": "response",

+ "truncated": true

+}

+-->

+``` http

+HTTP/1.1 204 No Content

+```

+ Title: "Get alertRule"

+description: "Read the properties and relationships of an alertRule object."

+ms.localizationpriority: medium

+# Get alertRule

+Namespace: microsoft.graph.deviceManagement

+Read the properties and relationships of an [alertRule](../resources/devicemanagement-alertrule.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|CloudPC.Read.All, CloudPC.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|CloudPC.Read.All, CloudPC.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /deviceManagement/monitoring/alertRules/{alertRuleId}

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and an [microsoft.graph.deviceManagement.alertRule](../resources/devicemanagement-alertrule.md) object in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "get_alertrule"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/deviceManagement/monitoring/alertRules/30070507-6514-443b-8fa5-06979cedacdf

+```

+### Response

+The following is an example of the response.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.deviceManagement.alertRule"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/monitoring/alertRules/$entity",

+ "id": "30070507-6514-443b-8fa5-06979cedacdf",

+ "displayName": "Upload failure for Device Images",

+ "severity": "warning",

+ "isSystemRule": true,

+ "description": "Device Image Uploads have failed and can delay the provisioning of new Cloud PCs.",

+ "enabled": true,

+ "alertRuleTemplate": "cloudPcImageUploadScenario",

+ "threshold": {

+ "aggregation": "count",

+ "operator": "greaterOrEqual",

+ "target": 2

+ },

+ "notificationChannels": [

+ {

+ "notificationChannelType": "portal",

+ "receivers": [

+ ""

+ ],

+ "notificationReceivers": []

+ },

+ {

+ "notificationChannelType": "email",

+ "receivers": [

+ "serena.davis@contoso.com"

+ ],

+ "notificationReceivers": [

+ {

+ "locale": "en-us",

+ "contactInformation": "serena.davis@contoso.com"

+ }

+ ]

+ }

+ ]

+}

+```

+ Title: "List alertRules"

+description: "Get a list of the alertRule objects and their properties."

+ms.localizationpriority: medium

+# List alertRules

+Namespace: microsoft.graph.deviceManagement

+Get a list of the [alertRule](../resources/devicemanagement-alertrule.md) objects and their properties.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|CloudPC.Read.All, CloudPC.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|CloudPC.Read.All, CloudPC.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /deviceManagement/monitoring/alertRules

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.deviceManagement.alertRule](../resources/devicemanagement-alertrule.md) objects in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "list_alertrule"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/deviceManagement/monitoring/alertRules

+```

+### Response

+The following is an example of the response.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.deviceManagement.alertRule",

+ "isCollection": true

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://canary.graph.microsoft.com/testprodbeta_cpc_sh/$metadata#deviceManagement/monitoring/alertRules",

+ "value": [

+ {

+ "id": "215c55cc-b1c9-4d36-a870-be5778101714",

+ "displayName": "Azure network connection failure impacting Cloud PCs",

+ "severity": "warning",

+ "isSystemRule": true,

+ "description": "Azure network connection checks have failed and is potentially impacting existing Cloud PCs and blocking the provisioning of new Cloud PCs",

+ "enabled": true,

+ "alertRuleTemplate": "cloudPcOnPremiseNetworkConnectionCheckScenario",

+ "threshold": {

+ "aggregation": "count",

+ "operator": "greaterOrEqual",

+ "target": 90

+ },

+ "notificationChannels": [

+ {

+ "notificationChannelType": "portal",

+ "receivers": [

+ ""

+ ],

+ "notificationReceivers": []

+ },

+ {

+ "notificationChannelType": "email",

+ "receivers": [

+ "serena.davis@contoso.com"

+ ],

+ "notificationReceivers": [

+ {

+ "locale": "en-us",

+ "contactInformation": "serena.davis@contoso.com"

+ }

+ ]

+ }

+ ]

+ },

+ {

+ "id": "30070507-6514-443b-8fa5-06979cedacdf",

+ "displayName": "Upload failure for Device Images",

+ "severity": "warning",

+ "isSystemRule": true,

+ "description": "Device Image Uploads have failed and can delay the provisioning of new Cloud PCs.",

+ "enabled": true,

+ "alertRuleTemplate": "cloudPcImageUploadScenario",

+ "threshold": {

+ "aggregation": "count",

+ "operator": "greaterOrEqual",

+ "target": 2

+ },

+ "notificationChannels": [

+ {

+ "notificationChannelType": "portal",

+ "receivers": [

+ ""

+ ],

+ "notificationReceivers": []

+ },

+ {

+ "notificationChannelType": "email",

+ "receivers": [

+ "serena.davis@contoso.com"

+ ],

+ "notificationReceivers": [

+ {

+ "locale": "en-us",

+ "contactInformation": "serena.davis@contoso.com"

+ }

+ ]

+ }

+ ]

+ },

+ {

+ "id": "b43741fa-254a-445f-86cf-8def2c32571a",

+ "displayName": "Provisioning Failure impacting Cloud PCs",

+ "severity": "warning",

+ "isSystemRule": true,

+ "description": "Provisioning has failed and is delaying end users from connecting to their Cloud PCs.",

+ "enabled": true,

+ "alertRuleTemplate": "cloudPcProvisionScenario",

+ "threshold": {

+ "aggregation": "count",

+ "operator": "greaterOrEqual",

+ "target": 1

+ },

+ "notificationChannels": [

+ {

+ "notificationChannelType": "portal",

+ "receivers": [

+ ""

+ ],

+ "notificationReceivers": []

+ },

+ {

+ "notificationChannelType": "email",

+ "receivers": [

+ "serena.davis@contoso.com"

+ ],

+ "notificationReceivers": [

+ {

+ "locale": "en-us",

+ "contactInformation": "serena.davis@contoso.com"

+ }

+ ]

+ }

+ ]

+ }

+ ]

+}

+```

+ Title: "Create alertRule"

+description: "Create an alertRule object."

+ms.localizationpriority: medium

+# Create alertRule

+Namespace: microsoft.graph.deviceManagement

+Create an [alertRule](../resources/devicemanagement-alertrule.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|CloudPC.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|CloudPC.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+```http

+POST /deviceManagement/monitoring/alertRules

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+|Content-Type|application/json. Required.|

+## Request body

+|Property|Type|Description|

+|:|:|:|

+|alertRuleTemplate|alertRuleTemplate|The rule template of the alert event. The possible values are: `cloudPcProvisionScenario`, `cloudPcImageUploadScenario`, `cloudPcOnPremiseNetworkConnectionCheckScenario`, `unknownFutureValue`.|

+|description|String|The rule description.|

+|displayName|String|The display name of the rule.|

+|enabled|Boolean|The status of the rule that indicates whether the rule is enabled or disabled. If `true`, the rule is enabled; otherwise, the rule is disabled.|

+|isSystemRule|Boolean|Indicates whether the rule is a system rule. If `true`, the rule is a system rule; otherwise, the rule is a custom defined rule and can be edited. System rules are built-in and only a few properties can be edited.|

+|notificationChannels|[microsoft.graph.deviceManagement.notificationChannel](../resources/devicemanagement-notificationchannel.md) collection|The notification channels of the rule selected by the user.|

+|severity|ruleSeverityType|The severity of the rule. The possible values are: `unknown`, `informational`, `warning`, `critical`, `unknownFutureValue`.|

+|threshold|[microsoft.graph.deviceManagement.ruleThreshold](../resources/devicemanagement-rulethreshold.md)|The threshold of the rule.|

+## Response

+If successful, this method returns a `201 Created` response code and an [microsoft.graph.deviceManagement.alertRule](../resources/devicemanagement-alertrule.md) object in the response body.

+## Example

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "post_alertrule"

+}

+-->

+``` http

+POST https://graph.microsoft.com/beta/deviceManagement/monitoring/alertRules

+Content-Type: application/json

+{

+ "id": "215c55cc-b1c9-4d36-a870-be5778101714",

+ "displayName": "Azure network connection failure impacting Cloud PCs",

+ "severity": "informational",

+ "isSystemRule": true,

+ "description": "Azure network connection checks have failed and is potentially impacting existing Cloud PCs and blocking the provisioning of new Cloud PCs",

+ "enabled": true,

+ "alertRuleTemplate": "cloudPcOnPremiseNetworkConnectionCheckScenario",

+ "threshold": {

+ "aggregation": "count",

+ "operator": "greaterOrEqual",

+ "target": 90

+ },

+ "notificationChannels": [

+ {

+ "notificationChannelType": "portal",

+ "receivers": [

+ ""

+ ],

+ "notificationReceivers": []

+ },

+ {

+ "notificationChannelType": "email",

+ "receivers": [

+ "serena.davis@contoso.com"

+ ],

+ "notificationReceivers": [

+ {

+ "locale": "en-us",

+ "contactInformation": "serena.davis@contoso.com"

+ }

+ ]

+ }

+ ]

+}

+```

+### Response

+The following is an example of the response.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.deviceManagement.alertRule"

+}

+-->

+``` http

+HTTP/1.1 201 CREATED

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/monitoring/alertRules/$entity",

+ "id": "215c55cc-b1c9-4d36-a870-be5778101714",

+ "displayName": "Azure network connection failure impacting Cloud PCs",

+ "severity": "informational",

+ "isSystemRule": true,

+ "description": "Azure network connection checks have failed and is potentially impacting existing Cloud PCs and blocking the provisioning of new Cloud PCs",

+ "enabled": true,

+ "alertRuleTemplate": "cloudPcOnPremiseNetworkConnectionCheckScenario",

+ "threshold": {

+ "aggregation": "count",

+ "operator": "greaterOrEqual",

+ "target": 90

+ },

+ "notificationChannels": [

+ {

+ "notificationChannelType": "portal",

+ "receivers": [

+ ""

+ ],

+ "notificationReceivers": []

+ },

+ {

+ "notificationChannelType": "email",

+ "receivers": [

+ "serena.davis@contoso.com"

+ ],

+ "notificationReceivers": [

+ {

+ "locale": "en-us",

+ "contactInformation": "serena.davis@contoso.com"

+ }

+ ]

+ }

+ ]

+}

+```

+ Title: "Update alertRule"

+description: "Update the properties of an alertRule object."

+ms.localizationpriority: medium

+# Update alertRule

+Namespace: microsoft.graph.deviceManagement

+Update the properties of an [alertRule](../resources/devicemanagement-alertrule.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|CloudPC.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported.|

+|Application|CloudPC.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+PATCH /deviceManagement/monitoring/alertRules/{alertRuleId}

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+|Content-Type|application/json. Required.|

+## Request body

+|Property|Type|Description|

+|:|:|:|

+|enabled|Boolean|The status of the rule that indicates whether the rule is enabled or disabled. If `true`, the rule is enabled; otherwise, the rule is disabled. Optional.|

+|notificationChannels|[microsoft.graph.deviceManagement.notificationChannel](../resources/devicemanagement-notificationchannel.md) collection|The notification channels of the rule selected by the user. Optional.|

+|severity|ruleSeverityType|The severity of the rule. The possible values are: `unknown`, `informational`, `warning`, `critical`, `unknownFutureValue`. Optional.|

+|threshold|[microsoft.graph.deviceManagement.ruleThreshold](../resources/devicemanagement-rulethreshold.md)|The threshold of the rule. Optional.|

+## Response

+If successful, this method returns a `200 OK` response code and an updated [microsoft.graph.deviceManagement.alertRule](../resources/devicemanagement-alertrule.md) object in the response body.

+## Examples

+### Request

+The following is an example of a request.

+<!-- {

+ "blockType": "request",

+ "name": "update_alertrule"

+}

+-->

+``` http

+PATCH https://graph.microsoft.com/beta/deviceManagement/monitoring/alertRules/215c55cc-b1c9-4d36-a870-be5778101714

+Content-Type: application/json

+{

+ "severity": "informational",

+ "enabled": true,

+ "threshold": {

+ "aggregation": "count",

+ "operator": "greaterOrEqual",

+ "target": 90

+ },

+ "notificationChannels": [

+ {

+ "notificationChannelType": "portal",

+ "receivers": [

+ ""

+ ],

+ "notificationReceivers": []

+ },

+ {

+ "notificationChannelType": "email",

+ "receivers": [

+ "serena.davis@contoso.com"

+ ],

+ "notificationReceivers": [

+ {

+ "locale": "en-us",

+ "contactInformation": "serena.davis@contoso.com"

+ }

+ ]

+ }

+ ]

+}

+```

+### Response

+The following is an example of the response.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.deviceManagement.alertRule"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/monitoring/alertRules/$entity",

+ "id": "215c55cc-b1c9-4d36-a870-be5778101714",

+ "displayName": "Azure network connection failure impacting Cloud PCs",

+ "severity": "informational",

+ "isSystemRule": true,

+ "description": "Azure network connection checks have failed and is potentially impacting existing Cloud PCs and blocking the provisioning of new Cloud PCs",

+ "enabled": true,

+ "alertRuleTemplate": "cloudPcOnPremiseNetworkConnectionCheckScenario",

+ "threshold": {

+ "aggregation": "count",

+ "operator": "greaterOrEqual",

+ "target": 90

+ },

+ "notificationChannels": [

+ {

+ "notificationChannelType": "portal",

+ "receivers": [

+ ""

+ ],

+ "notificationReceivers": []

+ },

+ {

+ "notificationChannelType": "email",

+ "receivers": [

+ "serena.davis@contoso.com"

+ ],

+ "notificationReceivers": [

+ {

+ "locale": "en-us",

+ "contactInformation": "serena.davis@contoso.com"

+ }

+ ]

+ }

+ ]

+}

+```

+|Permission type | Permissions (from least to most privileged) |

+|:--|:|

+|Delegated (work or school account) | Files.ReadWrite.All, Sites.ReadWrite.All |

+|Delegated (personal Microsoft account) | Not supported. |

+|Application | Files.ReadWrite.All, Sites.ReadWrite.All |

+Also, Few Irm Protected sensitivity labels cannot be updated by Application and need delegated user access to validate if the user has proper rights, For these scenario the API will throw `Not Supported` response code.

+<!-- { "blockType": "request", "name": "assignSensitivityLabel", "tags": "service.graph", "sampleKeys": ["016GVDAP3RCQS5VBQHORFIVU2ZMOSBL25U"] } -->

+ "name": "driveItem_createlink"

+ "scopes": "files.readwrite service.sharepoint"

+ "scopes": "files.readwrite service.onedrive"

+> [!NOTE]

+> * The use of `Prefer: deltashowsharingchanges` header requires you to use `Prefer: deltashowremovedasdeleted` and `Prefer: deltatraversepermissiongaps`. These header values can be joined together in a single header: `Prefer: deltashowremovedasdeleted, deltatraversepermissiongaps, deltashowsharingchanges`.

+>

+> * In order to process permissions correctly your application will need to request **Sites.FullControl.All** permissions.

+For additional guidance about scanning scenarios see [Best practices for discovering files and detecting changes at scale](/onedrive/developer/rest-api/concepts/scan-guidance).

+## See also

+[Use delta query to track changes in Microsoft Graph data](/graph/delta-query-overview)

+[Best practices for discovering files and detecting changes at scale](/onedrive/developer/rest-api/concepts/scan-guidance)

+|Delegated (work or school account) | Files.Read.All, Files.ReadWrite.All, Sites.Read.All, Sites.ReadWrite.All |

+|Delegated (personal Microsoft account) | Not supported. |

+## Optional query parameters

+This method supports the `$top`,and `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+This method supports the `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+This method supports the `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+This method supports the `$top`, `$filter`, `$orderBy`, and `$select` OData query parameters to help customize the response.

+For general information, see [OData query parameters](/graph/query-parameters).

+This method supports the `$filter`,'$top', and `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+ "sampleKeys": ["955e0bd5-52c2-41ad-b7e8-5b33a18c5e78","18d17255-3278-49fb-8da7-d095b7f610c4"],

+>**Note:** The response object shown here might be shortened for readability.

+This method supports the `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+ "sampleKeys": ["72a7baec-c3e9-4213-a850-f62de0adad5f","1618dfb0-3ff2-4edf-8d5c-b8f81df00e80","517b36a6-9ca2-4e7b-9748-3af25f5cd4fd"],

+ "sampleKeys": ["72a7baec-c3e9-4213-a850-f62de0adad5f","1618dfb0-3ff2-4edf-8d5c-b8f81df00e80","3cb7968b-082f-4756-bdfb-782b4538cc0a"],

+ "sampleKeys": ["72a7baec-c3e9-4213-a850-f62de0adad5f","1618dfb0-3ff2-4edf-8d5c-b8f81df00e80","a7a2fec0-2a26-47bf-8d40-2319c0afb1f4"],

+ "sampleKeys": ["72a7baec-c3e9-4213-a850-f62de0adad5f","1618dfb0-3ff2-4edf-8d5c-b8f81df00e80","f3687fc5-908b-4006-8040-dbba9e04023c"],

+| Delegated (personal Microsoft account) | Not supported. |

+| Application | Not supported. |

+This method supports the `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+ "dueDateTime": "2022-09-16T00:00:00Z",

+ "displayName": "Reading test 09.14 Beta",

+ "@odata.type": "#microsoft.graph.educationAssignmentPointsGradeType",

+ "@odata.type": "#microsoft.graph.educationAssignmentClassRecipient"

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#education/classes('f4a941ff-9da6-4707-ba5b-0eae93cad0b4')/assignments/$entity",

+ "classId": "f4a941ff-9da6-4707-ba5b-0eae93cad0b4",

+ "displayName": "Reading test 09.14 Beta",

+ "dueDateTime": "2022-09-16T00:00:00Z",

+ "feedbackResourcesFolderUrl": null,

+ "createdDateTime": "2022-09-14T21:24:11.8578804Z",

+ "lastModifiedDateTime": "2022-09-14T21:24:11.8578831Z",

+ "webUrl": "https://teams.microsoft.com/l/entity/66aeee93-507d-479a-a3ef-8f494af43945/classroom?context=%7B%22subEntityId%22%3A%22%7B%5C%22version%5C%22%3A%5C%221.0%5C%22,%5C%22config%5C%22%3A%7B%5C%22classes%5C%22%3A%5B%7B%5C%22id%5C%22%3A%5C%22f4a941ff-9da6-4707-ba5b-0eae93cad0b4%5C%22,%5C%22displayName%5C%22%3Anull,%5C%22assignmentIds%5C%22%3A%5B%5C%22b58c972d-585a-4ed8-8e0e-9c66e5506d26%5C%22%5D,%5C%22submissionId%5C%22%3Anull%7D%5D%7D,%5C%22action%5C%22%3A%5C%22navigate%5C%22,%5C%22view%5C%22%3A%5C%22assignment-viewer%5C%22%7D%22,%22channelId%22%3Anull%7D",

+ "id": "b58c972d-585a-4ed8-8e0e-9c66e5506d26",

+| Application | EduAssignments.ReadWrite.All, EduAssignments.ReadWriteBasic.All |

+## Optional query parameters

+This method supports the `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+This method supports the `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+## Optional query parameters

+This method supports the `$top`, `$filter`, and `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+This method supports the `$top`, `$filter`, `$orderBy`, and `$select` OData query parameters to help customize the response.For general information, see [OData query parameters](/graph/query-parameters).

+This method supports the `$top`, `$filter`, `$orderBy`, and `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+|Application | Notes.ReadWrite.All, EduAssignments.ReadWrite.All |

+|Application | EduAssignments.ReadWrite.All, EduAssignments.ReadWriteBasic.All |

+|Application | Notes.ReadWrite.All, EduAssignments.ReadWrite.All |

+|Application | Notes.ReadWrite.All, EduAssignments.ReadWrite.All |

+This method supports the `$top`, `$filter`, `$orderBy`, and `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+description: "Retrieve a submitted resource. This will be available to a teacher or an application with application permissions after a student has submitted, and will be available to the student after the teacher has released the submission. Note that teachers can leave notes in some resources."

+This method supports the `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+This method supports the `$top`, `$filter`, `$orderBy`, and `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+## Optional query parameters

+This method supports the `$top`, `$filter`, `$orderBy`, and `$select` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+Create a new [accessPackageResourceRequest](../resources/accesspackageresourcerequest.md) object to request the addition of a resource to an access package catalog, update of a resource, or the removal of a resource from a catalog. A resource must be included in an access package catalog before a [role of that resource](../resources/accesspackageresourcerole.md) can be added to an access package.

+The following conditions apply for apps to delete role-assignable groups:

+This method supports the `$filter`, `$count`, `$select`, `$search`, and `$expand` [OData query parameters](/graph/query-parameters) to help customize the response. OData cast is also enabled, for example, you can cast to get just the group members that are users. You can use `$search` on the **displayName** and **description** properties. When items are added or updated for this resource, they are specially indexed for use with the `$count` and `$search` query parameters. There can be a slight delay between when an item is added or updated and when it is available in the index.

+ Title: "List group owners"

+# List group owners

+This method supports the `$filter`, `$count`, `$select`, `$search`, and `$expand` [OData query parameters](/graph/query-parameters) to help customize the response. OData cast is also enabled, for example, you can cast to get just the group owners that are users. You can use `$search` on the **displayName** and **description** properties. When items are added or updated for this resource, they are specially indexed for use with the `$count` and `$search` query parameters. There can be a slight delay between when an item is added or updated and when it is available in the index.

+For an app create a group with owners or members while it has the *Group.Create* permission, the app must have the privileges to read the object type that it wants to assign as the group owner or member. Therefore:

+# [PowerShell](#tab/powershell)

+If successful, this method returns a `200 OK` response code and a [microsoft.graph.identityGovernance.customTaskExtension](../resources/identitygovernance-customtaskextension.md) object in the response body.

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.workflow](../resources/identitygovernance-workflow.md) objects in the response body.

+# [PowerShell](#tab/powershell)

+If successful, this method returns a `200 OK` response code and a [microsoft.graph.identityGovernance.lifecycleManagementSettings](../resources/identitygovernance-lifecyclemanagementsettings.md) object in the response body.

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+This method supports the `$select` `$search`, `$orderBy`, and `$filter` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.customTaskExtension](../resources/identitygovernance-customtaskextension.md) objects in the response body.

+# [PowerShell](#tab/powershell)

+This method supports the `$select`, `$search`, `$orderBy`, and `$filter` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.workflow](../resources/identitygovernance-workflow.md) objects in the response body.

+# [PowerShell](#tab/powershell)

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.taskDefinition](../resources/identitygovernance-taskdefinition.md) objects in the response body.

+### Example 1: Retrieve all built-in task definitions

+#### Request

+# [PowerShell](#tab/powershell)

+#### Response

+### Example 2: Retrieve all built-in tasks supported for "joiner" workflows

+#### Request

+The following is an example of a request. Because the **category** can be one of `joiner`, `joiner,leaver`, or `leaver`, the request must match categories that are `joiner` or `joiner,leaver` to retrieve all tasks supported for "joiner" workflows.

+# [HTTP](#tab/http)

+<!-- {

+ "blockType": "request",

+ "name": "lifecycleworkflows_list_taskdefinition_filter_category"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/taskDefinitions?$filter=category eq 'joiner,leaver' OR category eq 'joiner'

+```

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [PHP](#tab/php)

+#### Response

+The following is an example of the response

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "Collection(microsoft.graph.identityGovernance.taskDefinition)"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/taskDefinitions",

+ "value": [

+ {

+ "category": "joiner,leaver",

+ "description": "Add user to selected groups",

+ "displayName": "Add User To Groups",

+ "id": "22085229-5809-45e8-97fd-270d28d66910",

+ "version": 1,

+ "parameters": [

+ {

+ "name": "groupID",

+ "values": [],

+ "valueType": "string"

+ }

+ ]

+ },

+ {

+ "category": "joiner,leaver",

+ "description": "Disable user account in the directory",

+ "displayName": "Disable User Account",

+ "id": "1dfdfcc7-52fa-4c2e-bf3a-e3919cc12950",

+ "version": 1,

+ "parameters": []

+ },

+ {

+ "category": "joiner,leaver",

+ "description": "Enable user account in the directory",

+ "displayName": "Enable User Account",

+ "id": "6fc52c9d-398b-4305-9763-15f42c1676fc",

+ "version": 1,

+ "parameters": []

+ },

+ {

+ "category": "joiner,leaver",

+ "description": "Remove user from membership of selected Azure AD groups",

+ "displayName": "Remove user from selected groups",

+ "id": "1953a66c-751c-45e5-8bfe-01462c70da3c",

+ "version": 1,

+ "parameters": [

+ {

+ "name": "groupID",

+ "values": [],

+ "valueType": "string"

+ }

+ ]

+ },

+ {

+ "category": "joiner",

+ "description": "Generate Temporary Access Pass and send via email to user's manager",

+ "displayName": "Generate TAP And Send Email",

+ "id": "1b555e50-7f65-41d5-b514-5894a026d10d",

+ "version": 1,

+ "parameters": [

+ {

+ "name": "tapLifetimeMinutes",

+ "values": [],

+ "valueType": "string"

+ },

+ {

+ "name": "tapIsUsableOnce",

+ "values": [

+ "true",

+ "false"

+ ],

+ "valueType": "enum"

+ }

+ ]

+ },

+ {

+ "category": "joiner",

+ "description": "Send welcome email to new hire",

+ "displayName": "Send Welcome Email",

+ "id": "70b29d51-b59a-4773-9280-8841dfd3f2ea",

+ "version": 1,

+ "parameters": []

+ },

+ {

+ "category": "joiner,leaver",

+ "description": "Add user to selected teams",

+ "displayName": "Add User To Teams",

+ "id": "e440ed8d-25a1-4618-84ce-091ed5be5594",

+ "version": 1,

+ "parameters": [

+ {

+ "name": "teamID",

+ "values": [],

+ "valueType": "string"

+ }

+ ]

+ },

+ {

+ "category": "joiner,leaver",

+ "description": "Remove user from membership of selected Teams",

+ "displayName": "Remove user from selected Teams",

+ "id": "06aa7acb-01af-4824-8899-b14e5ed788d6",

+ "version": 1,

+ "parameters": [

+ {

+ "name": "teamID",

+ "values": [],

+ "valueType": "string"

+ }

+ ]

+ },

+ {

+ "category": "joiner,leaver",

+ "description": "Run a Custom Task Extension to callout to an external system.",

+ "displayName": "Run a Custom Task Extension",

+ "id": "4262b724-8dba-4fad-afc3-43fcbb497a0e",

+ "version": 1,

+ "parameters": [

+ {

+ "name": "customTaskExtensionID",

+ "values": [],

+ "valueType": "string"

+ }

+ ]

+ }

+ ]

+}

+```

+ Title: "List workflows (in Lifecycle Workflows)"

+# List workflows (in Lifecycle Workflows)

+This method supports the `$search`, `$orderBy`, and `$filter` OData query parameters to help customize the response. `$expand` is supported by the **createdBy** and **lastModifiedBy** relationships only. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.workflow](../resources/identitygovernance-workflow.md) objects in the response body.

+### Example 1: Retrieve all workflows created in the tenant

+#### Request

+# [PowerShell](#tab/powershell)

+#### Response

+### Example 2: Retrieve only specific properties of "leaver" workflows

+#### Request

+The following is an example of a request.

+# [HTTP](#tab/http)

+<!-- {

+ "blockType": "request",

+ "name": "lifecycleworkflows_list_workflow_select"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows?$filter=category eq 'leaver'&$select=id,category,displayName,isEnabled,isSchedulingEnabled

+```

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [PHP](#tab/php)

+#### Response

+The following is an example of the response

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "Collection(microsoft.graph.identityGovernance.workflowTemplate)"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows(category,displayName,isEnabled,isSchedulingEnabled)",

+ "value": [

+ {

+ "category": "leaver",

+ "displayName": "Pre-Offboarding employees in the R&D department",

+ "id": "c0548e6c-8849-46e8-be14-8b6d2b04957e",

+ "isEnabled": true,

+ "isSchedulingEnabled": true

+ }

+ ]

+}

+```

+This method supports the `$select`, `$orderBy`, and `$filter` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.workflowTemplate](../resources/identitygovernance-workflowtemplate.md) objects in the response body.

+### Example 1: Retrieve all Lifecycle Workflows workflow templates

+#### Request

+# [PowerShell](#tab/powershell)

+#### Response

+### Example 2: Retrieve workflow templates supported for "leaver" workflows

+#### Request

+The following is an example of a request.

+# [HTTP](#tab/http)

+<!-- {

+ "blockType": "request",

+ "name": "lifecycleworkflows_list_workflowtemplate_filter_category"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflowTemplates?$filter=category eq 'leaver'

+```

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [PHP](#tab/php)

+#### Response

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "Collection(microsoft.graph.identityGovernance.workflowTemplate)"

+}

+-->

+```json

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflowTemplates",

+ "value": [

+ {

+ "category": "leaver",

+ "description": "Execute real-time termination tasks for employees on their last day of work",

+ "displayName": "Real-time employee termination",

+ "id": "145735f1-57cc-48c2-81ec-727f07a10096",

+ "executionConditions": {

+ "@odata.type": "#microsoft.graph.identityGovernance.onDemandExecutionOnly"

+ },

+ "tasks@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflowTemplates('145735f1-57cc-48c2-81ec-727f07a10096')/tasks",

+ "tasks": [

+ {

+ "category": "leaver",

+ "continueOnError": false,

+ "description": "Remove user from all Azure AD groups memberships",

+ "displayName": "Remove user from all groups",

+ "executionSequence": 1,

+ "id": "1b89bb69-a8cf-416b-a69e-4f6d8108834c",

+ "isEnabled": true,

+ "taskDefinitionId": "b3a31406-2a15-4c9a-b25b-a658fa5f07fc",

+ "arguments": []

+ },

+ {

+ "category": "leaver",

+ "continueOnError": false,

+ "description": "Remove user from all Teams memberships",

+ "displayName": "Remove user from all Teams",

+ "executionSequence": 2,

+ "id": "d3cea676-ccce-4426-825c-63c63e9a64c7",

+ "isEnabled": true,

+ "taskDefinitionId": "81f7b200-2816-4b3b-8c5d-dc556f07b024",

+ "arguments": []

+ },

+ {

+ "category": "leaver",

+ "continueOnError": false,

+ "description": "Delete user account in Azure AD",

+ "displayName": "Delete User Account",

+ "executionSequence": 3,

+ "id": "adbd4f05-99f0-4260-a155-7657623ca071",

+ "isEnabled": true,

+ "taskDefinitionId": "8d18588d-9ad3-4c0f-99d0-ec215f0e3dff",

+ "arguments": []

+ }

+ ]

+ },

+ {

+ "category": "leaver",

+ "description": "Configure pre-offboarding tasks for employees before their last day of work",

+ "displayName": "Pre-Offboarding of an employee",

+ "id": "25abd83d-3b5d-4d6f-bb9a-4ed366fd96b1",

+ "executionConditions": {

+ "@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",

+ "scope": {

+ "@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",

+ "rule": "department eq 'Marketing'"

+ },

+ "trigger": {

+ "@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger",

+ "timeBasedAttribute": "employeeLeaveDateTime",

+ "offsetInDays": -7

+ }

+ },

+ "tasks@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflowTemplates('25abd83d-3b5d-4d6f-bb9a-4ed366fd96b1')/tasks",

+ "tasks": [

+ {

+ "category": "joiner,leaver",

+ "continueOnError": false,

+ "description": "Remove user from membership of selected Azure AD groups",

+ "displayName": "Remove user from selected groups",

+ "executionSequence": 1,

+ "id": "7e9aac8a-d239-4867-be60-b3c999c50ee7",

+ "isEnabled": true,

+ "taskDefinitionId": "1953a66c-751c-45e5-8bfe-01462c70da3c",

+ "arguments": [

+ {

+ "name": "groupID",

+ "value": ""

+ }

+ ]

+ },

+ {

+ "category": "joiner,leaver",

+ "continueOnError": false,

+ "description": "Remove user from membership of selected Teams",

+ "displayName": "Remove user from selected Teams",

+ "executionSequence": 2,

+ "id": "40eab675-1aaf-432d-b17e-053d93b0fe2e",

+ "isEnabled": true,

+ "taskDefinitionId": "06aa7acb-01af-4824-8899-b14e5ed788d6",

+ "arguments": [

+ {

+ "name": "teamID",

+ "value": ""

+ }

+ ]

+ }

+ ]

+ },

+ {

+ "category": "leaver",

+ "description": "Configure offboarding tasks for employees on their last day of work",

+ "displayName": "Offboard an employee",

+ "id": "e821c59e-d28c-44d7-902f-5fed05e926f1",

+ "executionConditions": {

+ "@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",

+ "scope": {

+ "@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",

+ "rule": "department eq 'Marketing'"

+ },

+ "trigger": {

+ "@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger",

+ "timeBasedAttribute": "employeeLeaveDateTime",

+ "offsetInDays": 0

+ }

+ },

+ "tasks@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflowTemplates('e821c59e-d28c-44d7-902f-5fed05e926f1')/tasks",

+ "tasks": [

+ {

+ "category": "joiner,leaver",

+ "continueOnError": false,

+ "description": "Disable user account in the directory",

+ "displayName": "Disable User Account",

+ "executionSequence": 1,

+ "id": "8d9eab35-6c32-4b76-acbd-6a22cb07aa6a",

+ "isEnabled": true,

+ "taskDefinitionId": "1dfdfcc7-52fa-4c2e-bf3a-e3919cc12950",

+ "arguments": []

+ },

+ {

+ "category": "leaver",

+ "continueOnError": false,

+ "description": "Remove user from all Azure AD groups memberships",

+ "displayName": "Remove user from all groups",

+ "executionSequence": 2,

+ "id": "4f5d8835-5d38-4106-ac7e-ebc407749bd2",

+ "isEnabled": true,

+ "taskDefinitionId": "b3a31406-2a15-4c9a-b25b-a658fa5f07fc",

+ "arguments": []

+ },

+ {

+ "category": "leaver",

+ "continueOnError": false,

+ "description": "Remove user from all Teams memberships",

+ "displayName": "Remove user from all Teams",

+ "executionSequence": 3,

+ "id": "8087b303-e7d5-492d-ab75-31d4aa34bd73",

+ "isEnabled": true,

+ "taskDefinitionId": "81f7b200-2816-4b3b-8c5d-dc556f07b024",

+ "arguments": []

+ }

+ ]

+ },

+ {

+ "category": "leaver",

+ "description": "Configure offboarding tasks for employees after their last day of work",

+ "displayName": "Post-Offboarding of an employee",

+ "id": "50149a4a-7c2d-4fd8-8018-761f4eb915cb",

+ "executionConditions": {

+ "@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",

+ "scope": {

+ "@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",

+ "rule": "department eq 'Marketing'"

+ },

+ "trigger": {

+ "@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger",

+ "timeBasedAttribute": "employeeLeaveDateTime",

+ "offsetInDays": 7

+ }

+ },

+ "tasks@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflowTemplates('50149a4a-7c2d-4fd8-8018-761f4eb915cb')/tasks",

+ "tasks": [

+ {

+ "category": "leaver",

+ "continueOnError": false,

+ "description": "Remove all licenses assigned to the user",

+ "displayName": "Remove all licenses for user",

+ "executionSequence": 1,

+ "id": "760ab754-8249-4bce-9315-1ad06488e434",

+ "isEnabled": true,

+ "taskDefinitionId": "8fa97d28-3e52-4985-b3a9-a1126f9b8b4e",

+ "arguments": []

+ },

+ {

+ "category": "leaver",

+ "continueOnError": false,

+ "description": "Remove user from all Teams memberships",

+ "displayName": "Remove user from all Teams",

+ "executionSequence": 2,

+ "id": "17b4e37b-c50b-4e04-a11c-93479f487d1d",

+ "isEnabled": true,

+ "taskDefinitionId": "81f7b200-2816-4b3b-8c5d-dc556f07b024",

+ "arguments": []

+ },

+ {

+ "category": "leaver",

+ "continueOnError": false,

+ "description": "Delete user account in Azure AD",

+ "displayName": "Delete User Account",

+ "executionSequence": 3,

+ "id": "46849618-30e7-4b67-abf0-f8c7f0d54b95",

+ "isEnabled": true,

+ "taskDefinitionId": "8d18588d-9ad3-4c0f-99d0-ec215f0e3dff",

+ "arguments": []

+ }

+ ]

+ }

+ ]

+}

+```

+If successful, this method returns a `201 Created` response code and a [microsoft.graph.identityGovernance.customTaskExtension](../resources/identitygovernance-customtaskextension.md) object in the response body.

+# [PowerShell](#tab/powershell)

+description: "Create a new workflow object. You can create up to 50 workflows in a tenant."

+Create a new [workflow](../resources/identitygovernance-workflow.md) object. You can create up to 50 workflows in a tenant.

+|category|[microsoft.graph.identityGovernance.lifecycleWorkflowCategory](../resources/identitygovernance-workflow.md)|The category of the workflow. The possible values are: `joiner`, `leaver`, `unknownFutureValue`. Can be only one value. Required.|

+|displayName|String|A unique string that identifies the workflow. Required.|

+|executionConditions|[microsoft.graph.identityGovernance.workflowExecutionConditions](../resources/identitygovernance-workflowexecutionconditions.md)|Defines for who and when a workflow will run. Required. |

+If successful, this method returns a `201 Created` response code and a [microsoft.graph.identityGovernance.workflow](../resources/identitygovernance-workflow.md) object in the response body.

+The following is an example of a request that creates a workflow with the following configuration:

+# [PowerShell](#tab/powershell)

+If successful, this method returns a `200 OK` response code and a [microsoft.graph.identityGovernance.run](../resources/identitygovernance-run.md) object in the response body.

+# [PowerShell](#tab/powershell)

+This method supports the `$select`, `$orderBy`, `$expand`, and `$filter` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.taskProcessingResult](../resources/identitygovernance-taskprocessingresult.md) objects in the response body.

+# [PowerShell](#tab/powershell)

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.userProcessingResults](../resources/identitygovernance-userprocessingresult.md) object in the response body.

+# [PowerShell](#tab/powershell)

+If successful, this function returns a `200 OK` response code and a [microsoft.graph.identityGovernance.runSummary](../resources/identitygovernance-runsummary.md) in the response body.

+# [PowerShell](#tab/powershell)

+ "blockType": "ignored",

+ "sampleKeys": ["156ce798-1eb6-4e0a-8515-e79f54d04390", "2", "4d9d41d7-a8e1-4f2f-8c8c-a883bc02e6ee"]

+If successful, this method returns a `200 OK` response code and a [microsoft.graph.identityGovernance.task](../resources/identitygovernance-task.md) object in the response body.

+ "name": "lifecycleworkflows_get_workflowVersion_task",

+ "sampleKeys": ["156ce798-1eb6-4e0a-8515-e79f54d04390", "2", "4d9d41d7-a8e1-4f2f-8c8c-a883bc02e6ee"]

+description: "Read the details of a built-in workflow task."

+Read the details of a built-in workflow [task](../resources/identitygovernance-taskdefinition.md).

+If successful, this method returns a `200 OK` response code and a [microsoft.graph.identityGovernance.taskDefinition](../resources/identitygovernance-taskdefinition.md) object in the response body.

+# [PowerShell](#tab/powershell)

+POST https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows/4f36da05-5df8-457d-adb3-b132e7b59571/tasks/e07dcdb2-0a77-4ee3-8645-3801fbe1cf9f/taskProcessingResults/6e1ec336-8d06-4386-a377-79dbab1a2eb6/resume

+This method supports the `$select`, `$orderBy`, `$expand`, and `$filter` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.taskProcessingResult](../resources/identitygovernance-taskprocessingresult.md) objects in the response body.

+# [PowerShell](#tab/powershell)

+If successful, this method returns a `200 OK` response code and a [microsoft.graph.identityGovernance.taskReportSummary](../resources/identitygovernance-taskreportsummary.md) object in the response body.

+# [PowerShell](#tab/powershell)

+If successful, this method returns a `200 OK` response code and a [microsoft.graph.identityGovernance.userProcessingResult](../resources/identitygovernance-userprocessingresult.md) object in the response body.

+# [PowerShell](#tab/powershell)

+This method supports the `$select`, `$orderBy`, `$expand`, and `$filter` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.taskProcessingResult](../resources/identitygovernance-taskprocessingresult.md) objects in the response body.

+# [PowerShell](#tab/powershell)

+## Optional query parameters

+This method supports the `$count`, `$orderBy`, `$expand`, and `$filter` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this function returns a `200 OK` response code and a [microsoft.graph.identityGovernance.userSummary](../resources/identitygovernance-usersummary.md) in the response body.

+# [PowerShell](#tab/powershell)

+Run a [workflow](../resources/identitygovernance-workflow.md) object on-demand. You can run any workflow on-demand, including scheduled workflows. Workflows created from the "Real-time employee termination" template are run on-demand only. When you run a workflow on demand, the tasks are executed regardless of whether the user state matches the scope and trigger execution conditions.

+# [PowerShell](#tab/powershell)

+If successful, this action returns a `200 OK` response code and a [microsoft.graph.identityGovernance.workflow](../resources/identitygovernance-workflow.md) in the response body.

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+ Title: "Get workflow (in Lifecycle Workflows)"

+# Get workflow (in Lifecycle Workflows)

+This method supports the `$select` and `$expand` OData query parameters to help customize the response. The **tasks** relationship is expanded by default and `$expand` is supported by the **createdBy** and **lastModifiedBy** relationships. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a [microsoft.graph.identityGovernance.workflow](../resources/identitygovernance-workflow.md) object in the response body.

+### Example 1: Retrieve the details of a workflow

+#### Request

+# [PowerShell](#tab/powershell)

+#### Response

+### Example 2: Retrieve specific properties of a workflow

+#### Request

+```http

+GET https://graph.microsoft.com/beta/identityGovernance/lifecycleWorkflows/workflows/c0548e6c-8849-46e8-be14-8b6d2b04957e?$select=id,displayName,executionConditions,category

+```

+#### Response

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.identityGovernance.workflow"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/lifecycleWorkflows/workflows(id,displayName,executionConditions,category)/$entity",

+ "category": "leaver",

+ "displayName": "Pre-Offboarding employees in the R&D department",

+ "id": "c0548e6c-8849-46e8-be14-8b6d2b04957e",

+ "executionConditions": {

+ "@odata.type": "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions",

+ "scope": {

+ "@odata.type": "#microsoft.graph.identityGovernance.ruleBasedSubjectSet",

+ "rule": "(department eq 'R&D')"

+ },

+ "trigger": {

+ "@odata.type": "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger",

+ "timeBasedAttribute": "employeeLeaveDateTime",

+ "offsetInDays": -7

+ }

+ }

+}

+```

+This method supports the `$select`, `$orderBy`, and `$filter` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.run](../resources/identitygovernance-run.md) objects in the response body.

+# [PowerShell](#tab/powershell)

+description: "Retrieve the details of the built-in tasks in Lifecycle Workflows."

+Retrieve the details of the built-in tasks in Lifecycle Workflows.

+This method supports the `$search`, `$orderBy`, and `$filter` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.task](../resources/identitygovernance-task.md) objects in the response body.

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.taskReport](../resources/identitygovernance-taskreport.md) objects in the response body.

+# [PowerShell](#tab/powershell)

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.userProcessingResult](../resources/identitygovernance-userprocessingresult.md) objects in the response body.

+# [PowerShell](#tab/powershell)

+This method supports the `$select`, `$count`, `$search`, `$orderBy`, `$expand`, and `$filter` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.workflowVersion](../resources/identitygovernance-workflowversion.md) objects in the response body.

+# [PowerShell](#tab/powershell)

+ "isEnabled": true,

+ "isSchedulingEnabled": true,

+ "isEnabled": true,

+ "isSchedulingEnabled": false,

+ "isEnabled": true,

+ "isSchedulingEnabled": false,

+If successful, this action returns a `200 OK` response code and a [microsoft.graph.identityGovernance.workflow](../resources/identitygovernance-workflow.md) in the response body.

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+If successful, this method returns a `200 OK` response code and a [microsoft.graph.identityGovernance.workflowTemplate](../resources/identitygovernance-workflowtemplate.md) object in the response body.

+# [PowerShell](#tab/powershell)

+If successful, this method returns a `200 OK` response code and a [microsoft.graph.identityGovernance.workflowVersion](../resources/identitygovernance-workflowversion.md) object in the response body.

+ "name": "lifecycleworkflows_get_workflowversion",

+ "sampleKeys": ["156ce798-1eb6-4e0a-8515-e79f54d04390", "3"]

+# [PowerShell](#tab/powershell)

+ "isEnabled": true,

+ "isSchedulingEnabled": false,

+This method supports the `$select`, `$top`, `$count`, `$search`, `$orderBy`, `$expand`, and `$filter` OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+If successful, this method returns a `200 OK` response code and a collection of [microsoft.graph.identityGovernance.task](../resources/identitygovernance-task.md) objects in the response body.

+ "name": "lifecycleworkflows_list_workflowversion_task",

+ "sampleKeys": ["156ce798-1eb6-4e0a-8515-e79f54d04390", "2"]

+Update the privacy settings to display or return the specified type of insights in an organization. The type of settings can be contact insights, item insights, or people insights.

+To update settings for contact insights, one of the following permissions is required to call this API. To learn more, including how to choose permissions, see [permissions](/graph/permissions-reference).

+|Permission type | Permissions (from least to most privileged) |

+|:--|:|

+|Delegated (work or school account) | Organization.ReadWrite.All |

+|Delegated (personal Microsoft account) | Not supported. |

+|Application | Not supported. |

+To update settings for item insights or people insights, one of the following permissions is required to call this API. To learn more, including how to choose permissions, see [permissions](/graph/permissions-reference).

+>**Note:** Using delegated permissions for this operation to update insights for contacts, item, or people requires the signed-in user to have a global administrator role.

+To update settings for contact insights:

+<!-- { "blockType": "ignored" } -->

+```http

+PATCH /organization/{organizationId}/settings/contactInsights

+```

+### Example 1: Update settings for contact insights

+#### Request

+The following is an example of a request that shows how an admin updates **isEnabledInOrganization** to enable contact insights for the specified organization; the default for **isEnabledInOrganization** is false, disabling contact insights. The example also sets the **disabledForGroup** privacy setting to prohibit displaying user's contact insights in a particular Azure AD group.

+# [HTTP](#tab/http)

+<!-- {

+ "blockType": "request",

+ "name": "update_insightssettings_contactinsightsrequest"

+}-->

+```http

+PATCH https://graph.microsoft.com/beta/organization/{organizationId}/settings/contactInsights

+Content-type: application/json

+{

+ "isEnabledInOrganization": true,

+ "disabledForGroup": "edbfe4fb-ec70-4300-928f-dbb2ae86c981"

+}

+```

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [PHP](#tab/php)

+### Response

+The following is an example of the response.

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.insightsSettings",

+ "name": "update_insightssettings_contactinsightsrequest"

+} -->

+```http

+HTTP/1.1 200 OK

+Content-type: application/json

+{

+ "isEnabledInOrganization": true,

+ "disabledForGroup": "edbfe4fb-ec70-4300-928f-dbb2ae86c981"

+}

+```

+### Example 2: Update settings for item insights

+### Example 3: Update settings for people insights

+Content-length: 2024

+ "firmwareTargetArtifactDescription": "Firmware Target Artifact Description value",

+Content-Length: 2073

+ "firmwareTargetArtifactDescription": "Firmware Target Artifact Description value",

+Content-Length: 2194

+ "firmwareTargetArtifactDescription": "Firmware Target Artifact Description value",

+Content-Length: 2310

+ "firmwareTargetArtifactDescription": "Firmware Target Artifact Description value",

+Content-length: 2024

+ "firmwareTargetArtifactDescription": "Firmware Target Artifact Description value",

+Content-Length: 2073

+ "firmwareTargetArtifactDescription": "Firmware Target Artifact Description value",

+Content-length: 1565

+ "v12_0": true,

+ "v13_0": true

+Content-Length: 1737

+ "v12_0": true,

+ "v13_0": true

+Content-Length: 1866

+ "v12_0": true,

+ "v13_0": true

+Content-Length: 1990

+ "v12_0": true,

+ "v13_0": true

+Content-length: 1565

+ "v12_0": true,

+ "v13_0": true

+Content-Length: 1737

+ "v12_0": true,

+ "v13_0": true

+Content-length: 1762

+ "v12_0": true,

+ "v13_0": true

+Content-Length: 1934

+ "v12_0": true,

+ "v13_0": true

+Content-Length: 2079

+ "v12_0": true,

+ "v13_0": true

+Content-Length: 2219

+ "v12_0": true,

+ "v13_0": true

+Content-length: 1762

+ "v12_0": true,

+ "v13_0": true

+Content-Length: 1934

+ "v12_0": true,

+ "v13_0": true