+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response. That URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same resource collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same resource collection. |

+If successful, this method returns `200 OK` response code and an [administrativeUnit](../resources/administrativeunit.md) collection object in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned, there are additional pages of data to be retrieved in the session. The **administrativeUnit** continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned, there is no more data about the existing state of the resource to be returned. Persist and use the `@odata.deltaLink` URL to learn about changes to the resource in the future.

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same resource collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same resource collection. |

+- If a `@odata.nextLink` URL is returned, there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned, there is no more data about the existing state of the resource to be returned. Persist and use the `@odata.deltaLink` URL to learn about changes to the resource in the future.

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same baseTask collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same baseTask collection. |

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same **baseTaskList** collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same **baseTaskList** collection. |

+The following is an example of the request. `@odata.nextLink` in the response can be used to get the next page of messages.

+- A `@odata.nextLink` (that contains a URL with a **delta** function call and a `skipToken`), or

+- A `@odata.deltaLink` (that contains a URL with a **delta** function call and `deltaToken`).

+State tokens are completely opaque to the client. To proceed with a round of change tracking, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL returned from the last GET request to the next delta function call for that same calendar view. A `@odata.deltaLink` returned in a response signifies that the current round of change tracking is complete. You can save and use the `@odata.deltaLink` URL when you begin the to retrieve additional changes (messages changed or posted after acquiring `@odata.deltaLink`).

+Tracking changes in channel messages incurs a round of one or more **delta** function calls. If you use any query parameter (other than `$deltatoken` and `$skiptoken`), you must specify it in the initial **delta** request. Microsoft Graph automatically encodes any specified parameters into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already includes the encoded parameters.

+| `$deltatoken` | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next iteration of change tracking for that collection.|

+| `$skiptoken` | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating that there are further changes to be tracked. |

+If successful, this method returns a `200 OK` response code and a collection of [chatMessage](../resources/chatmessage.md) objects in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+The response includes two messages and a `@odata.nextLink` response header with a `skipToken`. The `@odata.nextLink` URL indicates there are more messages in the channel to get.

+The second request specifies the `@odata.nextLink` URL returned from the previous response. Notice that it no longer has to specify the same top parameters as in the initial request, as the `skipToken` in the `@odata.nextLink` URL encodes and includes them.

+The third request continues to use the latest `@odata.nextLink` returned from the last sync request.

+The third response returns the only remaining messages in the channel and a `@odata.deltaLink` response header with a `deltaToken` which indicates that all messages in the channel have been read. Save and use the `@odata.deltaLink` URL to query for any new messages starting from this point onwards.

+Using the `@odata.deltaLink` from the last request in the last round, you will be able to get only those messages that have changed (by being added, or updated) in that channel since then. Your request will look like the following, assuming you prefer to keep the same maximum page size in the response:

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response. You only need to specify any desired query parameters once upfront.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same contact collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same contact collection. |

+into the token portion (`skiptoken` or `$deltatoken`) of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same contact folder collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same contact folder collection. |

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same resource collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same resource collection. |

+- If a `@odata.nextLink` URL is returned, there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned, there is no more data about the existing state of the resource to be returned. Persist and use the `@odata.deltaLink` URL to learn about changes to the resource in the future.

+This method supports the `$select` and `$filter` [OData Query Parameters](/graph/query-parameters) to help customize the response. You can only filter by the OData type of the objects returned, for example, `/domains/{domainId}/domainNameReferences/microsoft.graph.group` and `/domains/{domainId}/domainNameReferences/microsoft.graph.user`.

+The query URL returned in a `@odata.nextLink` or `@odata.deltaLink` of a successful response includes a state token. For any subsequent **delta** function call, use the query URL in a `@odata.nextLink` or `@odata.deltaLink` preceding it.

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response. You only need to specify any desired query parameters once upfront.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same calendar view, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that calendar view.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same calendar view. |

+Tracking changes in groups incurs a round of one or more **delta** function calls. If you use any query parameter (other than `$deltatoken` and `$skiptoken`), you must specify it in the initial **delta** request. Microsoft Graph automatically encodes any specified parameters into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already includes the encoded, desired parameters.

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same group collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection. |

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same group collection. |

+| Prefer | return=minimal <br><br>Specifying this header with a request that uses a `@odata.deltaLink` would return only the object properties that have changed since the last round. Optional. |

+If successful, this method returns `200 OK` response code and [group](../resources/group.md) collection object in the response body. The response also includes a state token which is either a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned:

+ - This indicates there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned:

+ - This indicates there is no more data about the existing state of the resource to be returned. Save and use the `@odata.deltaLink` URL to learn about changes to the resource in the next round.

+ - You have a choice to specify the `Prefer:return=minimal` header, to include in the response values for only the properties that have changed since the time the `@odata.deltaLink` was issued.

+By default, requests using a `@odata.deltaLink` or `@odata.nextLink` return the same properties as selected in the initial delta query in the following ways:

+> **Note:** The header can be added to a `@odata.deltaLink` request at any point in time in the delta cycle. The header only affects the set of properties included in the response and it does not affect how the delta query is executed. See the [third example](#request-3) below.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that all 3 properties are included in the response and it is not known which ones have changed since the `@odata.deltaLink` was obtained.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that the `mailNickname` property is not included, which means it has not changed since the last delta query; `displayName` and `description` are included which means their values have changed.

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same mail folder collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same mail folder collection. |

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same message collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same message collection. |

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response. That URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same resource collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL, including this token, in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating that there are further changes to be tracked in the same resource collection. |

+If successful, this method returns a `200 OK` response code and an [oauth2permissiongrant](../resources/oauth2permissiongrant.md) collection object in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned, there are additional pages of data to be retrieved in the session. The **oauth2permissiongrant** continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned, there is no more data about the existing state of the resource to be returned. Persist and use the `@odata.deltaLink` URL to learn about changes to the resource in the future.

+Tracking changes in organizational contacts incurs a round of one or more **delta** function calls. If you use any query parameter (other than `$deltatoken` and `$skiptoken`), you must specify it in the initial **delta** request. Microsoft Graph automatically encodes any specified parameters into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response. That URL already includes the encoded parameters.

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same organization contact collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL, including this token, in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating that there are further changes to be tracked in the same organization contact collection. |

+| Prefer | return=minimal <br><br>Specifying this header with a request that uses a `@odata.deltaLink` would return only the object properties that have changed since the last round. Optional. |

+If successful, this method returns a `200 OK` response code and an [orgContact](../resources/orgcontact.md) collection object in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned:

+ - This indicates there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned:

+ - This indicates that there is no more data about the existing state of the resource to be returned. Save and use the `@odata.deltaLink` URL to learn about changes to the resource in the next round.

+ - You have a choice to specify the `Prefer:return=minimal` header, to include in the response values for only the properties that have changed since the time the `@odata.deltaLink` was issued.

+By default, requests using a `@odata.deltaLink` or `@odata.nextLink` return the same properties as selected in the initial delta query in the following ways:

+> **Note:** The header can be added to a `@odata.deltaLink` request at any point in time in the delta cycle. The header only affects the set of properties included in the response and it does not affect how the delta query is run. See [Example 3](#example-3-alternative-minimal-response-behavior).

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that all three properties are included in the response and it is not known which ones have changed since the `@odata.deltaLink` was obtained.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that the `mail` property is not included, which means it has not changed since the last delta query; `displayName` and `jobTitle` are included, which means their values have changed.

+If the `@odata.deltaLink` that the caller uses is malformed, this endpoint will return HTTP 400.

+If the `@odata.deltaLink` that the caller uses is too old, this endpoint will return HTTP 410.

+ Title: "List roleDefinitions"

+# List roleDefinitions

+ Title: "Create roleDefinitions"

+# Create roleDefinitions

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same resource collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same resource collection. |

+- If a `@odata.nextLink` URL is returned, there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned, there is no more data about the existing state of the resource to be returned. Persist and use the `@odata.deltaLink` URL to learn about changes to the resource in the future.

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same todoTask collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same todoTask collection. |

+To track changes in the **todoTask** resources in a **todoTaskList** since the last round of change tracking, you would make one or more **delta** function calls to get the set of incremental changes. The following example shows how to begin a next round of change tracking, using the URL in the `@odata.deltaLink` returned from the last **delta** function call of the last round, which contains a `deltaToken`. This **delta** function call limits the maximum number of **todoTask** in the response body to 2.

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same **todoTaskList** collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same **todoTaskList** collection. |

+Tracking changes in users incurs a round of one or more **delta** function calls. If you use any query parameter (other than `$deltatoken` and `$skiptoken`), you must specify it in the initial **delta** request. Microsoft Graph automatically encodes any specified parameters into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already includes the encoded, desired parameters.

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same user collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same user collection. |

+| Prefer | return=minimal <br><br>Specifying this header with a request that uses a `@odata.deltaLink` would return only the object properties that have changed since the last round. Optional. |

+If successful, this method returns `200 OK` response code and [user](../resources/user.md) collection object in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned:

+ - This indicates there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned:

+ - This indicates there is no more data about the existing state of the resource to be returned. Save and use the `@odata.deltaLink` URL to learn about changes to the resource in the next round.

+ - You have a choice to specify the `Prefer:return=minimal` header, to include in the response values for only the properties that have changed since the time the `@odata.deltaLink` was issued.

+By default, requests using a `@odata.deltaLink` or `@odata.nextLink` return the same properties as selected in the initial delta query in the following ways:

+> **Note:** The header can be added to a `@odata.deltaLink` request at any point in time in the delta cycle. The header only affects the set of properties included in the response and it does not affect how the delta query is executed. See [Example 3](#example-3-alternative-minimal-response-behavior).

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that all three properties are included in the response and it is not known which ones have changed since the `@odata.deltaLink` was obtained.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that the `mobilePhone` property is not included, which means it has not changed since the last delta query; `displayName` and `jobTitle` are included which means their values have changed.

+|supportedServices|String collection| The capabilities assigned to the domain. Can include `0`, `1` or more of following values: `Email`, `Sharepoint`, `EmailInternalRelayOnly`, `OfficeCommunicationsOnline`,`SharePointDefaultDomain`, `FullRedelegation`, `SharePointPublic`, `OrgIdAuthentication`, `Yammer`, `Intune`. The values which you can add/remove using Graph API include: `Email`, `OfficeCommunicationsOnline`, `Yammer`. Not nullable.|

+|domainNameReferences|[directoryObject](directoryobject.md) collection| The objects such as users and groups that reference the domain ID. Read-only, Nullable. Supports `$expand` and `$filter` by the OData type of objects returned. For example `/domains/{domainId}/domainNameReferences/microsoft.graph.user` and `/domains/{domainId}/domainNameReferences/microsoft.graph.group`.|

+|serviceConfigurationRecords|[domainDnsRecord](domaindnsrecord.md) collection| DNS records the customer adds to the DNS zone file of the domain before the domain can be used by Microsoft Online services. Read-only, Nullable. Supports `$expand`. |

+|verificationDnsRecords|[domainDnsRecord](domaindnsrecord.md) collection| DNS records that the customer adds to the DNS zone file of the domain before the customer can complete domain ownership verification with Azure AD. Read-only, Nullable. Supports `$expand`.|

+|federationConfiguration|[internalDomainFederation](../resources/internaldomainfederation.md)| Domain settings configured by customer when federated with Azure AD. Supports `$expand`.|

+description: "The domainDnsRecord entity is used to present DNS records."

+For each [domain](domain.md) in the tenant, you may be required to add DNS record(s) to the DNS zone file of the domain before the domain can be used by Microsoft Online Services. The **domainDnsRecord** entity is used to present such DNS records. This resource type is the base entity for the following resources:

+None.

+|recordType|String| Indicates what type of DNS record this entity represents.</br></br>The value can be one of the following: `CName`, `Mx`, `Srv`, `Txt`. |

+|supportedService|String| Microsoft Online Service or feature that has a dependency on this DNS record.</br></br>Can be one of the following values: `null`, `Email`, `Sharepoint`, `EmailInternalRelayOnly`, `OfficeCommunicationsOnline`, `SharePointDefaultDomain`, `FullRedelegation`, `SharePointPublic`, `OrgIdAuthentication`, `Yammer`, `Intune`.|

+|ttl|Int32| Value to use when configuring the time-to-live (ttl) property of the DNS record at the DNS host. Not nullable. |

+|isStateSessionEnabled|Boolean| Indicates whether validation of the state parameter when the client uses the OAuth 2.0 authorization code grant flow is enabled. This setting allows admins to specify whether they want to enable CSRF protection for their apps. |

+ "isStateSessionEnabled": true,

+ "verifiedCustomDomainPasswordCredential": {"@odata.type": "microsoft.graph.passwordCredential"}

+-->

+1. The caller initiates a delta sync query, obtaining a `@odata.nextLink` and an empty collection of changes.

+3. The caller follows the `@odata.nextLink` provided in the initial delta sync query to obtain a new `@odata.deltaLink` to any changes since previous step.

+5. The caller follows the new deltaLink to obtain the next deltaLink and changes since the current `@odata.deltaLink` was generated.

+| [Create roleDefinitions](../api/rbacapplication-post-roledefinitions.md) | [unifiedRoleDefinition](unifiedroledefinition.md) | Create a unifiedRoleDefinition object. |

+description: "Specifies a domain for a tenant. The verifiedDomains property of the organization entity is a collection of verifiedDomain objects."

+Specifies a domain for a tenant. The **verifiedDomains** property of the [organization](organization.md) entity is a collection of **verifiedDomain** objects.

+| Property | Type | Description |

+|:-|:--|:-|

+| capabilities | String | For example, `Email`, `OfficeCommunicationsOnline`. |

+| isDefault | Boolean | `true` if this is the default domain associated with the tenant; otherwise, `false`. |

+| isInitial | Boolean | `true` if this is the initial domain associated with the tenant; otherwise, `false`. |

+| name | String | The domain name; for example, `contoso.onmicrosoft.com`. |

+| type | String | For example, `Managed`. |

+ "capabilities": "String",

+ "name": "String",

+ "type": "String"

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response. That URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same resource collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating that there are further changes to be tracked in the same resource collection. |

+If successful, this method returns a `200 OK` response code and an [application](../resources/application.md) collection object in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned, there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned, there is no more data about the existing state of the resource to be returned. Persist and use the `@odata.deltaLink` URL to learn about changes to the resource in the future.

+The following is an example of the request. `@odata.nextLink` in the response can be used to get the next page of messages.

+- A `@odata.nextLink` (that contains a URL with a **delta** function call and a `skipToken`), or

+- A `@odata.deltaLink` (that contains a URL with a **delta** function call and `deltaToken`).

+State tokens are completely opaque to the client. To proceed with a round of change tracking, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL returned from the last GET request to the next delta function call for that same calendar view. A `@odata.deltaLink` returned in a response signifies that the current round of change tracking is complete. You can save and use the `@odata.deltaLink` URL when you begin the to retrieve additional changes (messages changed or posted after acquiring `@odata.deltaLink`).

+Tracking changes in channel messages incurs a round of one or more **delta** function calls. If you use any query parameter (other than `$deltatoken` and `$skiptoken`), you must specify it in the initial **delta** request. Microsoft Graph automatically encodes any specified parameters into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already includes the encoded parameters.

+| `$deltatoken` | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next iteration of change tracking for that collection.|

+| `$skiptoken` | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating that there are further changes to be tracked. |

+If successful, this method returns a `200 OK` response code and a collection of [chatMessage](../resources/chatmessage.md) objects in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+The response includes two messages and a `@odata.nextLink` response header with a `skipToken`. The `@odata.nextLink` URL indicates there are more messages in the channel to get.

+The second request specifies the `@odata.nextLink` URL returned from the previous response. Notice that it no longer has to specify the same top parameters as in the initial request, as the `skipToken` in the `@odata.nextLink` URL encodes and includes them.

+The third request continues to use the latest `@odata.nextLink` returned from the last sync request.

+The third response returns the only remaining messages in the channel and a `@odata.deltaLink` response header with a `deltaToken` which indicates that all messages in the channel have been read. Save and use the `@odata.deltaLink` URL to query for any new messages starting from this point onwards.

+Using the `@odata.deltaLink` from the last request in the last round, you will be able to get only those messages that have changed (by being added, or updated) in that channel since then. Your request will look like the following, assuming you prefer to keep the same maximum page size in the response:

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response. You only need to specify any desired query parameters once upfront.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same contact collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same contact collection. |

+into the token portion (`skiptoken` or `$deltatoken`) of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same contact folder collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same contact folder collection. |

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same resource collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same resource collection. |

+If successful, this method returns a `200 OK` response code and [directoryRole](../resources/directoryrole.md) collection object in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned, there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned, there is no more data about the existing state of the resource to be returned. Save `@odata.deltaLink` URL and apply it in the next **delta** call to learn about changes to the resource in the future.

+This method supports the `$select` and `$filter` [OData Query Parameters](/graph/query-parameters) to help customize the response. You can only filter by the OData type of the objects returned, for example, `/domains/{domainId}/domainNameReferences/microsoft.graph.group` and `/domains/{domainId}/domainNameReferences/microsoft.graph.user`.

+If successful, this function returns an `200 OK` response code and an [educationClass](../resources/educationclass.md) collection in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned, there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned, there is no more data about the existing state of the resource to be returned. Persist and use the `@odata.deltaLink` URL to learn about changes to the resource in the future.

+If successful, this function returns a `200 OK` response code and a [educationSchool](../resources/educationschool.md) collection in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned, there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned, there is no more data about the existing state of the resource to be returned. Persist and use the `@odata.deltaLink` URL to learn about changes to the resource in the future.

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response. You only need to specify any desired query parameters once upfront.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same calendar view, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that calendar view.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same calendar view. |

+Tracking changes in groups incurs a round of one or more **delta** function calls. If you use any query parameter (other than `$deltatoken` and `$skiptoken`), you must specify it in the initial **delta** request. Microsoft Graph automatically encodes any specified parameters into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already includes the encoded, desired parameters.

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same group collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection. |

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same group collection. |

+| Prefer | return=minimal <br><br>Specifying this header with a request that uses a `@odata.deltaLink` would return only the object properties that have changed since the last round. Optional. |

+If successful, this method returns `200 OK` response code and [group](../resources/group.md) collection object in the response body. The response also includes a state token which is either a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned:

+ - This indicates there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned:

+ - This indicates there is no more data about the existing state of the resource to be returned. Save and use the `@odata.deltaLink` URL to learn about changes to the resource in the next round.

+ - You have a choice to specify the `Prefer:return=minimal` header, to include in the response values for only the properties that have changed since the time the `@odata.deltaLink` was issued.

+By default, requests using a `@odata.deltaLink` or `@odata.nextLink` return the same properties as selected in the initial delta query in the following ways:

+> **Note:** The header can be added to a `@odata.deltaLink` request at any point in time in the delta cycle. The header only affects the set of properties included in the response and it does not affect how the delta query is executed. See the [third example](#request-3) below.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that all 3 properties are included in the response and it is not known which ones have changed since the `@odata.deltaLink` was obtained.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that the `mailNickname` property is not included, which means it has not changed since the last delta query; `displayName` and `description` are included which means their values have changed.

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same mail folder collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same mail folder collection. |

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same message collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same message collection. |

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response. The URL

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same resource collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL, including this token, in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating that there are further changes to be tracked in the same resource collection. |

+If successful, this method returns a `200 OK` response code and an [oauth2permissiongrant](../resources/oauth2permissiongrant.md) collection object in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned, additional pages of data can be retrieved in the session. The **oauth2permissiongrant** continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned, no more data about the resource is returned. Persist and use the `@odata.deltaLink` URL to learn about changes to the resource in the future.

+Tracking changes in organizational contacts incurs a round of one or more **delta** function calls. If you use any query parameter (other than `$deltatoken` and `$skiptoken`), you must specify it in the initial **delta** request. Microsoft Graph automatically encodes any specified parameters into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response. That URL already includes the encoded parameters.

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same organization contact collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL, including this token, in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating that there are further changes to be tracked in the same organization contact collection. |

+| Prefer | return=minimal <br><br>Specifying this header with a request that uses a `@odata.deltaLink` would return only the object properties that have changed since the last round. Optional. |

+If successful, this method returns a `200 OK` response code and ab [orgContact](../resources/orgcontact.md) collection object in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned:

+ - This indicates that there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned:

+ - This indicates that there is no more data about the existing state of the resource to be returned. Save and use the `@odata.deltaLink` URL to learn about changes to the resource in the next round.

+ - You have a choice to specify the `Prefer:return=minimal` header, to include in the response values for only the properties that have changed since the time the `@odata.deltaLink` was issued.

+By default, requests using a `@odata.deltaLink` or `@odata.nextLink` return the same properties as selected in the initial delta query in the following ways:

+> **Note:** The header can be added to a `@odata.deltaLink` request at any point in time in the delta cycle. The header only affects the set of properties included in the response and it does not affect how the delta query is run. See [Example 3](#example-3-alternative-minimal-response-behavior).

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that all three properties are included in the response and it is not known which ones have changed since the `@odata.deltaLink` was obtained.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that the `mail` property is not included, which means it has not changed since the last delta query; `displayName` and `jobTitle` are included which means their values have changed.

+### Example 2: Retrieve the role management policies that apply to the directory and expand the associated rules

+#### Request

+<!-- {

+ "blockType": "request",

+ "name": "list_unifiedrolemanagementpolicy_expand_rules"

+}

+-->

+```msgraph-interactive

+GET https://graph.microsoft.com/v1.0/policies/roleManagementPolicies?$filter=scopeId eq '/' and scopeType eq 'Directory'&$expand=rules

+```

+#### Response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "Collection(microsoft.graph.unifiedRoleManagementPolicy)"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#policies/roleManagementPolicies(rules())",

+ "value": [

+ {

+ "id": "Directory_cab01047-8ad9-4792-8e42-569340767f1b_70c808b5-0d35-4863-a0ba-07888e99d448",

+ "displayName": "Directory",

+ "description": "Directory",

+ "isOrganizationDefault": false,

+ "scopeId": "/",

+ "scopeType": "Directory",

+ "lastModifiedDateTime": "2022-04-20T16:12:29.553Z",

+ "lastModifiedBy": {

+ "displayName": "MOD Administrator",

+ "id": null

+ },

+ "rules@odata.context": "https://graph.microsoft.com/v1.0/$metadata#policies/roleManagementPolicies('Directory_cab01047-8ad9-4792-8e42-569340767f1b_70c808b5-0d35-4863-a0ba-07888e99d448')/rules",

+ "rules": [

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule",

+ "id": "Expiration_Admin_Eligibility",

+ "isExpirationRequired": false,

+ "maximumDuration": "P365D",

+ "target": {

+ "caller": "Admin",

+ "operations": [

+ "all"

+ ],

+ "level": "Eligibility",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule",

+ "id": "Notification_Admin_Admin_Eligibility",

+ "notificationType": "Email",

+ "recipientType": "Admin",

+ "notificationLevel": "All",

+ "isDefaultRecipientsEnabled": true,

+ "notificationRecipients": [],

+ "target": {

+ "caller": "Admin",

+ "operations": [

+ "all"

+ ],

+ "level": "Eligibility",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule",

+ "id": "Notification_Requestor_Admin_Eligibility",

+ "notificationType": "Email",

+ "recipientType": "Requestor",

+ "notificationLevel": "All",

+ "isDefaultRecipientsEnabled": true,

+ "notificationRecipients": [],

+ "target": {

+ "caller": "Admin",

+ "operations": [

+ "all"

+ ],

+ "level": "Eligibility",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule",

+ "id": "Notification_Approver_Admin_Eligibility",

+ "notificationType": "Email",

+ "recipientType": "Approver",

+ "notificationLevel": "All",

+ "isDefaultRecipientsEnabled": true,

+ "notificationRecipients": [],

+ "target": {

+ "caller": "Admin",

+ "operations": [

+ "all"

+ ],

+ "level": "Eligibility",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule",

+ "id": "Enablement_Admin_Eligibility",

+ "enabledRules": [],

+ "target": {

+ "caller": "Admin",

+ "operations": [

+ "all"

+ ],

+ "level": "Eligibility",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule",

+ "id": "Expiration_Admin_Assignment",

+ "isExpirationRequired": false,

+ "maximumDuration": "P180D",

+ "target": {

+ "caller": "Admin",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule",

+ "id": "Enablement_Admin_Assignment",

+ "enabledRules": [

+ "Justification"

+ ],

+ "target": {

+ "caller": "Admin",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule",

+ "id": "Notification_Admin_Admin_Assignment",

+ "notificationType": "Email",

+ "recipientType": "Admin",

+ "notificationLevel": "All",

+ "isDefaultRecipientsEnabled": true,

+ "notificationRecipients": [],

+ "target": {

+ "caller": "Admin",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule",

+ "id": "Notification_Requestor_Admin_Assignment",

+ "notificationType": "Email",

+ "recipientType": "Requestor",

+ "notificationLevel": "All",

+ "isDefaultRecipientsEnabled": true,

+ "notificationRecipients": [],

+ "target": {

+ "caller": "Admin",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule",

+ "id": "Notification_Approver_Admin_Assignment",

+ "notificationType": "Email",

+ "recipientType": "Approver",

+ "notificationLevel": "All",

+ "isDefaultRecipientsEnabled": true,

+ "notificationRecipients": [],

+ "target": {

+ "caller": "Admin",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule",

+ "id": "Expiration_EndUser_Assignment",

+ "isExpirationRequired": true,

+ "maximumDuration": "PT8H",

+ "target": {

+ "caller": "EndUser",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule",

+ "id": "Enablement_EndUser_Assignment",

+ "enabledRules": [

+ "MultiFactorAuthentication",

+ "Justification"

+ ],

+ "target": {

+ "caller": "EndUser",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule",

+ "id": "Approval_EndUser_Assignment",

+ "target": {

+ "caller": "EndUser",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ },

+ "setting": {

+ "isApprovalRequired": false,

+ "isApprovalRequiredForExtension": false,

+ "isRequestorJustificationRequired": true,

+ "approvalMode": "SingleStage",

+ "approvalStages": [

+ {

+ "approvalStageTimeOutInDays": 1,

+ "isApproverJustificationRequired": true,

+ "escalationTimeInMinutes": 0,

+ "isEscalationEnabled": false,

+ "primaryApprovers": [],

+ "escalationApprovers": []

+ }

+ ]

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule",

+ "id": "AuthenticationContext_EndUser_Assignment",

+ "isEnabled": false,

+ "claimValue": null,

+ "target": {

+ "caller": "EndUser",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule",

+ "id": "Notification_Admin_EndUser_Assignment",

+ "notificationType": "Email",

+ "recipientType": "Admin",

+ "notificationLevel": "All",

+ "isDefaultRecipientsEnabled": true,

+ "notificationRecipients": [],

+ "target": {

+ "caller": "EndUser",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule",

+ "id": "Notification_Requestor_EndUser_Assignment",

+ "notificationType": "Email",

+ "recipientType": "Requestor",

+ "notificationLevel": "All",

+ "isDefaultRecipientsEnabled": true,

+ "notificationRecipients": [],

+ "target": {

+ "caller": "EndUser",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ },

+ {

+ "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule",

+ "id": "Notification_Approver_EndUser_Assignment",

+ "notificationType": "Email",

+ "recipientType": "Approver",

+ "notificationLevel": "All",

+ "isDefaultRecipientsEnabled": true,

+ "notificationRecipients": [],

+ "target": {

+ "caller": "EndUser",

+ "operations": [

+ "all"

+ ],

+ "level": "Assignment",

+ "inheritableSettings": [],

+ "enforcedSettings": []

+ }

+ }

+ ]

+ }

+ ]

+}

+```

+description: "Get the details of all role management policy assignments including the policies and rules associated with the Azure AD roles."

+Get the details of all role management policy assignments including the policies and rules associated with the Azure AD roles.

+ Title: "List roleDefinitions"

+# List roleDefinitions

+ Title: "Create roleDefinitions"

+# Create roleDefinitions

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same resource collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same resource collection. |

+- If a `@odata.nextLink` URL is returned, there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned, there is no more data about the existing state of the resource to be returned. Persist and use the `@odata.deltaLink` URL to learn about changes to the resource in the future.

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same todoTask collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same todoTask collection. |

+To track changes in the **todoTask** resources in a **todoTaskList** since the last round of change tracking, you would make one or more **delta** function calls to get the set of incremental changes. The following example shows how to begin a next round of change tracking, using the URL in the `@odata.deltaLink` returned from the last **delta** function call of the last round, which contains a `deltaToken`. This **delta** function call limits the maximum number of **todoTask** in the response body to 2.

+into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, simply copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same **todoTaskList** collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same **todoTaskList** collection. |

+description: "Get the details of a role management policy assignment including the policy and rules associated with the Azure AD role."

+Get the details of a role management policy assignment including the policy and rules associated with the Azure AD role.

+Tracking changes in users incurs a round of one or more **delta** function calls. If you use any query parameter (other than `$deltatoken` and `$skiptoken`), you must specify it in the initial **delta** request. Microsoft Graph automatically encodes any specified parameters into the token portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.

+In subsequent requests, copy and apply the `@odata.nextLink` or `@odata.deltaLink` URL from the previous response, as that URL already includes the encoded, desired parameters.

+| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same user collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|

+| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating there are further changes to be tracked in the same user collection. |

+| Prefer | return=minimal <br><br>Specifying this header with a request that uses a `@odata.deltaLink` would return only the object properties that have changed since the last round. Optional. |

+If successful, this method returns `200 OK` response code and [user](../resources/user.md) collection object in the response body. The response also includes a `@odata.nextLink` URL or a `@odata.deltaLink` URL.

+- If a `@odata.nextLink` URL is returned:

+ - This indicates there are additional pages of data to be retrieved in the session. The application continues making requests using the `@odata.nextLink` URL until a `@odata.deltaLink` URL is included in the response.

+- If a `@odata.deltaLink` URL is returned:

+ - This indicates there is no more data about the existing state of the resource to be returned. Save and use the `@odata.deltaLink` URL to learn about changes to the resource in the next round.

+ - You have a choice to specify the `Prefer:return=minimal` header, to include in the response values for only the properties that have changed since the time the `@odata.deltaLink` was issued.

+By default, requests using a `@odata.deltaLink` or `@odata.nextLink` return the same properties as selected in the initial delta query in the following ways:

+> **Note:** The header can be added to a `@odata.deltaLink` request at any point in time in the delta cycle. The header only affects the set of properties included in the response and it does not affect how the delta query is executed. See [Example 3](#example-3-alternative-minimal-response-behavior).

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that all three properties are included in the response and it is not known which ones have changed since the `@odata.deltaLink` was obtained.

+The following is an example of the response when using `@odata.deltaLink` obtained from the query initialization. Note that the `mobilePhone` property is not included, which means it has not changed since the last delta query; `displayName` and `jobTitle` are included which means their values have changed.

+|supportedServices|String collection| The capabilities assigned to the domain. Can include `0`, `1` or more of following values: `Email`, `Sharepoint`, `EmailInternalRelayOnly`, `OfficeCommunicationsOnline`, `SharePointDefaultDomain`, `FullRedelegation`, `SharePointPublic`, `OrgIdAuthentication`, `Yammer`, `Intune`. The values which you can add/remove using Graph API include: `Email`, `OfficeCommunicationsOnline`, `Yammer`. Not nullable.|

+|domainNameReferences|[directoryObject](directoryobject.md) collection| The objects such as users and groups that reference the domain ID. Read-only, Nullable. Supports `$expand` and `$filter` by the OData type of objects returned. For example `/domains/{domainId}/domainNameReferences/microsoft.graph.user` and `/domains/{domainId}/domainNameReferences/microsoft.graph.group`.|

+|serviceConfigurationRecords|[domainDnsRecord](domaindnsrecord.md) collection| DNS records the customer adds to the DNS zone file of the domain before the domain can be used by Microsoft Online services. Read-only, Nullable. Supports `$expand`. |

+|verificationDnsRecords|[domainDnsRecord](domaindnsrecord.md) collection| DNS records that the customer adds to the DNS zone file of the domain before the customer can complete domain ownership verification with Azure AD. Read-only, Nullable. Supports `$expand`.|

+description: "The domainDnsRecord entity is used to present DNS records."

+For each [domain](domain.md) in the tenant, you may be required to add DNS record(s) to the DNS zone file of the domain before the domain can be used by Microsoft Online Services. These DNS records are represented

+The **domainDnsRecord** resource type is used to present such DNS records as exposed through the **serviceConfigurationRecords** and **verificationDnsRecords**. This resource type is the base entity for the following resources:

+None.

+|isOptional|Boolean| If `false`, this record must be configured by the customer at the DNS host for Microsoft Online Services to operate correctly with the domain. |

+|recordType|String| Indicates what type of DNS record this entity represents.</br></br>The value can be one of the following: `CName`, `Mx`, `Srv`, `Txt`. |

+|supportedService|String| Microsoft Online Service or feature that has a dependency on this DNS record.</br></br>Can be one of the following values: `null`, `Email`, `Sharepoint`, `EmailInternalRelayOnly`, `OfficeCommunicationsOnline`, `SharePointDefaultDomain`, `FullRedelegation`, `SharePointPublic`, `OrgIdAuthentication`, `Yammer`, `Intune`.|

+|ttl|Int32| Value to use when configuring the time-to-live (ttl) property of the DNS record at the DNS host. Not nullable. |

+Each Azure AD role defines settings or rules. Such settings include whether multifactor authentication (MFA), justification, or approval is required to activate an eligible role. Or whether you can create permanent assignments or eligibilities for principals to the role. These role-specific settings will determine the settings you can apply while creating or managing role assignments and eligibilities through PIM. In Microsoft Graph, these role settings are managed through the [unifiedRoleManagementPolicy](unifiedrolemanagementpolicy.md) and the [unifiedRoleManagementPolicyAssignment](unifiedrolemanagementpolicyassignment.md) resource types and their related methods.

+The following table lists scenarios for using PIM to manage Azure AD role settings or rules and the APIs to call:

+|Scenarios |API |

+|||

+|Retrieve role management policies and associated rules or settings | [List unifiedRoleManagementPolicies](../api/policyroot-list-rolemanagementpolicies.md) |

+|Retrieve a role management policy and it's associated rules or settings | [Get unifiedRoleManagementPolicy](../api/unifiedrolemanagementpolicy-get.md) |

+|Retrieve the rules or settings defined for role management policy | [List rules](../api/unifiedrolemanagementpolicy-list-rules.md) |

+|Retrieve a rule or settings defined for a role management policy | [Get unifiedRoleManagementPolicyRule](../api/unifiedrolemanagementpolicyrule-get.md) |

+|Update a rule or setting defined for a role management policy|[Update unifiedRoleManagementPolicyRule](../api/unifiedrolemanagementpolicyrule-get.md)|

+|Get the details of all role management policy assignments including the policies and rules or settings associated with the Azure AD roles | [List unifiedRoleManagementPolicyAssignments](../api/policyroot-list-rolemanagementpolicyassignments.md) |

+|Get the details of a role management policy assignment including the policy and rules or settings associated with the Azure AD role | [Get unifiedRoleManagementPolicyAssignment](../api/unifiedrolemanagementpolicyassignment-get.md) |

+| [Create roleDefinitions](../api/rbacapplication-post-roledefinitions.md) | [unifiedRoleDefinition](unifiedroledefinition.md) | Create a unifiedRoleDefinition object. |

+|[Update unifiedRoleManagementPolicyRule](../api/unifiedrolemanagementpolicyrule-get.md)|[unifiedRoleManagementPolicyRule](../resources/unifiedrolemanagementpolicyrule.md)|Update a rule defined for a role management policy.|

+|[List unifiedRoleManagementPolicyAssignments](../api/policyroot-list-rolemanagementpolicyassignments.md)|[unifiedRoleManagementPolicyAssignment](../resources/unifiedrolemanagementpolicyassignment.md) collection|Get the details of all role management policy assignments including the policies and rules associated with the Azure AD role.|

+|target|[unifiedRoleManagementPolicyRuleTarget](../resources/unifiedrolemanagementpolicyruletarget.md)| Defines details of scope that's targeted by role management policy rule. The details can include the principal type, the role assignment type, and actions affecting a role. Supports `$filter` (`eq`, `ne`).|

+|targetObjects|[directoryObject](../resources/directoryobject.md) collection| **Not implemented.** The collection of users, groups, and service principals that are in scope of the policy. If not specified, all objects are in scope of the policy.|

+description: "Specifies a domain for a tenant. The verifiedDomains property of the organization entity is a collection of verifiedDomain objects."

+Specifies a domain for a tenant. The **verifiedDomains** property of the [organization](organization.md) entity is a collection of **verifiedDomain** objects.

+| Property | Type | Description |

+|:-|:--|:-|

+| capabilities | String | For example, `Email`, `OfficeCommunicationsOnline`. |

+| isDefault | Boolean | `true` if this is the default domain associated with the tenant; otherwise, `false`. |

+| isInitial | Boolean | `true` if this is the initial domain associated with the tenant; otherwise, `false`. |

+| name | String | The domain name; for example, `contoso.onmicrosoft.com`. |

+| type | String | For example, `Managed`. |

+ "capabilities": "String",

+ "name": "String",

+ "type": "String"