Skip to content

Commit 8c96576

Browse files
learn-build-service-prod[bot]learn-build-service-prod[bot]
authored
Merge pull request #28784 from microsoftgraph/main
Auto Publish – main to live - 2026-05-01 00:30 UTC
2 parents 1385686 + 098de86 commit 8c96576

189 files changed

Lines changed: 6541 additions & 237 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# Visual Studio Code Settings
22
.vscode/
3+
.vscode/settings.json
34

45
# Test-Docs.ps1 related files
56
nuget.exe
@@ -10,4 +11,4 @@ apidoc.exe
1011
.DS_Store
1112

1213
# Unotes related files
13-
.unotes/
14+
.unotes/

‎api-reference/beta/api/accesspackage-post-accesspackageresourcerolescopes.md‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -409,3 +409,211 @@ Content-type: application/json
409409
"modifiedDateTime": "2019-12-11T01:35:26.4754081Z"
410410
}
411411
```
412+
413+
### Example 5: Add an Active Subscription scoped to a Resource Group Resource Role to an access package
414+
415+
#### Request
416+
417+
The following example shows a request to add an active Subscription scoped to a Resource Group Resource Role to an access package.
418+
419+
Before this request, you must have already added the access package resource `b09a0288-a83e-4ae6-8a53-bc09aeb966ea` for the Subscription `828b526f-c769-4b19-9797-734b4843b978` to the access package catalog containing this access package. The resource could have been added to the catalog by [creating an access package resource request](/graph/api/entitlementmanagement-post-accesspackageresourcerequests?view=graph-rest-beta).
420+
421+
<!-- {
422+
"blockType": "request",
423+
"name": "create_accesspackageresourcerolescope_from_accesspackage_subscription"
424+
}-->
425+
426+
```http
427+
POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/5f7f4c7d-b3f5-4988-a17b-3f09b6f5a9ee/accessPackageResourceRoleScopes
428+
Content-type: application/json
429+
430+
{
431+
"accessPackageResourceRole": {
432+
"originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978/providers/Microsoft.Authorization/roleDefinitions/76cc9ee4-d5d3-4a45-a930-26add3d73475",
433+
"displayName": "Access Review Operator Service Role",
434+
"description": "Lets you grant Access Review System app permissions to discover and revoke access as needed by the access review process.",
435+
"accessPackageResource": {
436+
"id": "b09a0288-a83e-4ae6-8a53-bc09aeb966ea",
437+
"description": "Dev",
438+
"displayName": "Dev",
439+
"resourceType": "Subscription",
440+
"originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978",
441+
"originSystem": "AzureResources"
442+
},
443+
"originSystem": "AzureResources",
444+
"type": "active"
445+
},
446+
"accessPackageResourceScope": {
447+
"id": "e1e0ec8c-472d-4ec5-a8f9-29e0bc275640",
448+
"description": "/resourceGroups/rg",
449+
"displayName": "/resourceGroups/rg",
450+
"isRootScope": false,
451+
"originSystem": "AzureResources",
452+
"originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978/resourceGroups/rg"
453+
}
454+
}
455+
```
456+
457+
#### Response
458+
459+
The following example shows the response.
460+
461+
> **Note:** The response object shown here might be shortened for readability.
462+
463+
<!-- {
464+
"blockType": "response",
465+
"truncated": true,
466+
"@odata.type": "microsoft.graph.accessPackageResourceRoleScope"
467+
} -->
468+
469+
```http
470+
HTTP/1.1 201 Created
471+
Content-type: application/json
472+
473+
{
474+
"id": "34b2d7de-e8d6-4ba8-843e-a03546feac63_e1e0ec8c-472d-4ec5-a8f9-29e0bc275640",
475+
"createdBy": "admin@example.com",
476+
"createdDateTime": "2026-02-09T22:31:55.3690356Z",
477+
"modifiedBy": "admin@example.com",
478+
"modifiedDateTime": "2026-02-09T22:31:55.3690356Z"
479+
}
480+
```
481+
482+
### Example 6: Add Eligible Management Group Resource Role to an access package
483+
484+
#### Request
485+
486+
The following example shows a request to add an eligible Management Group scoped to a Resource Role to an access package.
487+
488+
Before this request, you must have already added the access package resource `c347ca9b-a9cc-4df9-bc3c-00c8e0297692` for the Management Group `test-mgmtgroup` to the access package catalog containing this access package. The resource could have been added to the catalog by [creating an access package resource request](/graph/api/entitlementmanagement-post-accesspackageresourcerequests?view=graph-rest-beta).
489+
490+
<!-- {
491+
"blockType": "request",
492+
"name": "create_accesspackageresourcerolescope_from_accesspackage_subscription_management_group"
493+
}-->
494+
495+
```http
496+
POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/5f7f4c7d-b3f5-4988-a17b-3f09b6f5a9ee/accessPackageResourceRoleScopes
497+
Content-type: application/json
498+
499+
{
500+
"accessPackageResourceRole": {
501+
"id": "055c76c1-a466-4f1a-9279-4a2ccaa7ac3e",
502+
"originId": "/providers/Microsoft.Authorization/roleDefinitions/76cc9ee4-d5d3-4a45-a930-26add3d73475",
503+
"displayName": "Access Review Operator Service Role",
504+
"description": "Lets you grant Access Review System app permissions to discover and revoke access as needed by the access review process.",
505+
"accessPackageResource": {
506+
"id": "c347ca9b-a9cc-4df9-bc3c-00c8e0297692",
507+
"description": "test-mgmtgroup",
508+
"displayName": "test-mgmtgroup",
509+
"resourceType": "ManagementGroup",
510+
"originId": "/providers/Microsoft.Management/managementGroups/test-mgmtgroup",
511+
"originSystem": "AzureResources"
512+
},
513+
"originSystem": "AzureResources",
514+
"type": "eligible"
515+
},
516+
"accessPackageResourceScope": {
517+
"id": "338613b3-b410-4c6d-b5e9-45590bc8a357",
518+
"displayName": "Root",
519+
"description": "Root Scope",
520+
"originId": "/providers/Microsoft.Management/managementGroups/test-mgmtgroup",
521+
"originSystem": "AzureResources",
522+
"isRootScope": true
523+
}
524+
}
525+
```
526+
527+
#### Response
528+
529+
The following example shows the response.
530+
531+
> **Note:** The response object shown here might be shortened for readability.
532+
533+
<!-- {
534+
"blockType": "response",
535+
"truncated": true,
536+
"@odata.type": "microsoft.graph.accessPackageResourceRoleScope"
537+
} -->
538+
539+
```http
540+
HTTP/1.1 201 Created
541+
Content-type: application/json
542+
543+
{
544+
"id": "055c76c1-a466-4f1a-9279-4a2ccaa7ac3e_338613b3-b410-4c6d-b5e9-45590bc8a357",
545+
"createdBy": "admin@example.com",
546+
"createdDateTime": "2026-02-09T22:23:14.8561335Z",
547+
"modifiedBy": "admin@example.com",
548+
"modifiedDateTime": "2026-02-09T22:23:14.8561335Z"
549+
}
550+
```
551+
552+
### Example 7: Add Active Subscription Resource Role to access package
553+
554+
#### Request
555+
556+
The following example shows a request to Add Active Subscription Resource Role to an access package scoped to a Resource Role to an access package.
557+
558+
Before this request, you must have already added the access package resource `b09a0288-a83e-4ae6-8a53-bc09aeb966ea` for the Subscription `828b526f-c769-4b19-9797-734b4843b978` to the access package catalog containing this access package. The resource could have been added to the catalog by [creating an access package resource request](/graph/api/entitlementmanagement-post-accesspackageresourcerequests?view=graph-rest-beta).
559+
560+
<!-- {
561+
"blockType": "request",
562+
"name": "create_accesspackageresourcerolescope_from_accesspackage_subscription_management_active"
563+
}-->
564+
565+
```http
566+
POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/5f7f4c7d-b3f5-4988-a17b-3f09b6f5a9ee/accessPackageResourceRoleScopes
567+
Content-type: application/json
568+
569+
{
570+
"accessPackageResourceRole": {
571+
"originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978/providers/Microsoft.Authorization/roleDefinitions/76cc9ee4-d5d3-4a45-a930-26add3d73475",
572+
"displayName": "Access Review Operator Service Role",
573+
"description": "Lets you grant Access Review System app permissions to discover and revoke access as needed by the access review process.",
574+
"accessPackageResource": {
575+
"id": "b09a0288-a83e-4ae6-8a53-bc09aeb966ea",
576+
"description": "Dev",
577+
"displayName": "Dev",
578+
"resourceType": "Subscription",
579+
"originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978",
580+
"originSystem": "AzureResources"
581+
},
582+
"originSystem": "AzureResources",
583+
"type": "active"
584+
},
585+
"accessPackageResourceScope": {
586+
"id": "c66c1e22-1093-46fb-a8a8-c0e334113ca4",
587+
"description": "Root",
588+
"displayName": "Root",
589+
"isRootScope": true,
590+
"originSystem": "AzureResources",
591+
"originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978"
592+
}
593+
}
594+
```
595+
596+
#### Response
597+
598+
The following example shows the response.
599+
600+
> **Note:** The response object shown here might be shortened for readability.
601+
602+
<!-- {
603+
"blockType": "response",
604+
"truncated": true,
605+
"@odata.type": "microsoft.graph.accessPackageResourceRoleScope"
606+
} -->
607+
608+
```http
609+
HTTP/1.1 201 Created
610+
Content-type: application/json
611+
612+
{
613+
"id": "34b2d7de-e8d6-4ba8-843e-a03546feac63_c66c1e22-1093-46fb-a8a8-c0e334113ca4",
614+
"createdBy": "admin@example.com",
615+
"createdDateTime": "2026-02-09T22:29:40.3420825Z",
616+
"modifiedBy": "admin@example.com",
617+
"modifiedDateTime": "2026-02-09T22:29:40.3420825Z"
618+
}
619+
```

‎api-reference/beta/api/agentidentityblueprint-post.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ Create a new [agent identity blueprint](../resources/agentidentityblueprint.md)
2121
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions [only if your app requires it](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions). For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
2222

2323

24-
<!-- { "blockType": "permissions", "name": "application_post_applications" } -->
24+
<!-- { "blockType": "permissions", "name": "agentidentityblueprint_post" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/agentidentityblueprint-post-permissions.md)]
2626

2727
[!INCLUDE [rbac-agentid-apis-write](../includes/rbac-for-apis/rbac-agentid-apis-write.md)]
@@ -43,7 +43,7 @@ In the request body, supply a JSON representation of [agent identity blueprint](
4343

4444
## Response
4545

46-
If successful, this method returns `201 Created` response code and an [agent identity blueprint](../resources/agentidentityblueprint.md) object in the response body.
46+
If successful, this method returns `201 Created` response code and an [agentIdentityBlueprint](../resources/agentidentityblueprint.md) object in the response body.
4747

4848
## Examples
4949

@@ -82,4 +82,4 @@ Content-type: application/json
8282
"requiredResourceAccess": [],
8383
"signInAudience": "AzureADMyOrg"
8484
}
85-
```
85+
```

‎api-reference/beta/api/authenticationeventlistener-delete.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ Delete an [authenticationEventListener](../resources/authenticationeventlistener
2626
- [onEmailOtpSendListener](../resources/onemailotpsendlistener.md) resource type
2727
- [onPasswordSubmitListener](../resources/onpasswordsubmitlistener.md) resource type
2828
- [onFraudProtectionLoadStartListener](../resources/onfraudprotectionloadstartlistener.md) resource type
29+
- [onVerifiedIdClaimValidationListener](../resources/onverifiedidclaimvalidationlistener.md) resource type
2930

3031
[!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
3132

‎api-reference/beta/api/authenticationeventlistener-get.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ Read the properties and relationships of an [authenticationEventListener](../res
2626
- [onEmailOtpSendListener](../resources/onemailotpsendlistener.md) resource type
2727
- [onPasswordSubmitListener](../resources/onpasswordsubmitlistener.md) resource type
2828
- [onFraudProtectionLoadStartListener](../resources/onfraudprotectionloadstartlistener.md) resource type
29+
- [onVerifiedIdClaimValidationListener](../resources/onverifiedidclaimvalidationlistener.md) resource type
2930

3031
[!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
3132

‎api-reference/beta/api/authenticationeventlistener-update.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ Update the properties of an [authenticationEventListener](../resources/authentic
2626
- [onEmailOtpSendListener](../resources/onemailotpsendlistener.md) resource type
2727
- [onPasswordSubmitListener](../resources/onpasswordsubmitlistener.md) resource type
2828
- [onFraudProtectionLoadStartListener](../resources/onfraudprotectionloadstartlistener.md) resource type
29+
- [onVerifiedIdClaimValidationListener](../resources/onverifiedidclaimvalidationlistener.md) resource type
2930

3031
[!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
3132

@@ -73,6 +74,7 @@ You must specify the **@odata.type** property and the value of the [authenticati
7374
|handler|[onPhoneMethodLoadStartHandler](../resources/onphonemethodloadstarthandler.md) | The handler to invoke when conditions are met. Can be updated for the **onPhoneMethodStartListener** type. |
7475
|handler|[onPasswordSubmitHandler](../resources/onpasswordsubmithandler.md) | The handler to invoke when conditions are met. Can be updated for the **onPasswordSubmitListener** type. |
7576
|handler|[onFraudProtectionLoadStartHandler](../resources/onFraudProtectionLoadStartHandler.md) | The handler to invoke when conditions are met. Can be updated for the **onFraudProtectionLoadStartListener** type. |
77+
|handler|[onVerifiedIdClaimValidationCustomExtensionHandler](../resources/onverifiedidclaimvalidationcustomextensionhandler.md) | The handler to invoke when conditions are met. Can be updated for the **onVerifiedIdClaimValidationListener** type. |
7678
|priority|Int32|The priority of this handler. Between 0 (lower priority) and 1000 (higher priority). Required.|
7779

7880
## Response
@@ -217,3 +219,47 @@ Content-Type: application/json
217219
"appId": "63856651-13d9-4784-9abf-20758d509e19"
218220
}
219221
```
222+
223+
### Example 3: Update an onVerifiedIdClaimValidationListener object
224+
225+
#### Request
226+
The following example shows a request to update an onVerifiedIdClaimValidationListener object.
227+
<!-- {
228+
"blockType": "request",
229+
"name": "update_authenticationeventlistener_onVerifiedIdClaimValidationListener"
230+
}
231+
-->
232+
``` http
233+
PATCH https://graph.microsoft.com/beta/identity/authenticationEventListeners/6a7455ef-0906-bbc3-f902-0f9ab8903082
234+
Content-Type: application/json
235+
236+
{
237+
"@odata.type": "#microsoft.graph.onVerifiedIdClaimValidationListener",
238+
"displayName": "Verified ID Claim Validation Listener (updated)",
239+
"handler": {
240+
"@odata.type": "#microsoft.graph.onVerifiedIdClaimValidationCustomExtensionHandler",
241+
"configuration": {
242+
"@odata.type": "#microsoft.graph.customExtensionOverwriteConfiguration",
243+
"clientConfiguration": {
244+
"@odata.type": "#microsoft.graph.customExtensionClientConfiguration",
245+
"maximumRetries": 1,
246+
"timeoutInMilliseconds": 2000
247+
},
248+
"behaviorOnError": {
249+
"@odata.type": "#microsoft.graph.customExtensionBehaviorOnError"
250+
}
251+
}
252+
}
253+
}
254+
```
255+
256+
#### Response
257+
The following example shows the response.
258+
<!-- {
259+
"blockType": "response",
260+
"truncated": true
261+
}
262+
-->
263+
``` http
264+
HTTP/1.1 204 No Content
265+
```

‎api-reference/beta/api/customauthenticationextension-delete.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ Delete a [customAuthenticationExtension](../resources/customauthenticationextens
2020
- [onAttributeCollectionSubmitCustomExtension](../resources/onattributecollectionsubmitcustomextension.md) resource type.
2121
- [onOtpSendCustomExtension](../resources/onOtpSendCustomExtension.md) resource type.
2222
- [onPasswordSubmitCustomExtension](../resources/onpasswordsubmitcustomextension.md) resource type.
23+
- [onVerifiedIdClaimValidationCustomExtension](../resources/onverifiedidclaimvalidationcustomextension.md) resource type.
2324

2425
[!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
2526

0 commit comments

Comments
 (0)