[ { "path": "/auditLogs/auditActivityTypes", "method": "GET", "delegated": [ "AuditLog.Read.All" ], "application": [ "AuditLog.Read.All" ], "summary": "List auditActivityType objects", "description": "Gets a list of all of the possible audit log types and which services they come from as defined in the auditActivityType object.", "deprecated": false, "area": "auditlog", "resource": "auditActivityTypes" }, { "path": "/auditLogs/customSecurityAttributeAudits", "method": "GET", "delegated": [ "CustomSecAttributeAuditLogs.Read.All" ], "application": [ "CustomSecAttributeAuditLogs.Read.All" ], "summary": "List customSecurityAttributeAudits", "description": "Get a list of customSecurityAttributeAudit objects representing audit logs generated by activities related to custom security attribute management in Microsoft Entra ID.", "deprecated": false, "area": "auditlog", "resource": "customSecurityAttributeAudits" }, { "path": "/auditLogs/customSecurityAttributeAudits/{customSecurityAttributeAuditId}", "method": "GET", "delegated": [ "CustomSecAttributeAuditLogs.Read.All" ], "application": [ "CustomSecAttributeAuditLogs.Read.All" ], "summary": "Get customSecurityAttributeAudits from auditLogs", "description": "Represents a custom security attribute audit log.", "deprecated": false, "area": "auditlog", "resource": "customSecurityAttributeAudits" }, { "path": "/auditLogs/directoryAudits", "method": "GET", "delegated": [ "AuditLog.Read.All" ], "application": [ "AuditLog.Read.All" ], "summary": "List directoryAudits", "description": "Get a list of directoryAudit objects representing the audit logs generated by Microsoft Entra ID. This includes audit logs generated by various services within Microsoft Entra ID, including user, app, device and group Management, privileged identity management (PIM), access reviews, terms of use,...", "deprecated": false, "area": "auditlog", "resource": "directoryAudits" }, { "path": "/auditLogs/directoryAudits/{id}", "method": "GET", "delegated": [ "AuditLog.Read.All", "Directory.Read.All" ], "application": [ "AuditLog.Read.All", "Directory.Read.All" ], "summary": "Get directoryAudit", "description": "Get a specific directoryAudit item. This includes an audit log item generated by various services within Microsoft Entra ID like user, application, device and group management, privileged identity management (PIM), access reviews, terms of use, identity protection, password management (self-servi...", "deprecated": false, "area": "auditlog", "resource": "directoryAudits" }, { "path": "/auditLogs/getSummarizedMSISignIns(aggregationWindow='{aggregationWindow}')", "method": "GET", "delegated": [ "AuditLog.Read.All" ], "application": [ "AuditLog.Read.All" ], "summary": "Invoke function getSummarizedMSISignIns", "description": "Returns aggregated MSI sign-in event counts grouped by user, application, IP address, and time window, with drill-down capability using individual requestIds via the /signIns endpoint.", "deprecated": false, "area": "auditlog", "resource": "getSummarizedMSISignIns(aggregationWindow='{aggregationWindow}')" }, { "path": "/auditLogs/getSummarizedNonInteractiveSignIns(aggregationWindow='{aggregationWindow}')", "method": "GET", "delegated": [ "AuditLog.Read.All" ], "application": [ "AuditLog.Read.All" ], "summary": "Invoke function getSummarizedNonInteractiveSignIns", "description": "Returns aggregated non-interactive sign-in event counts grouped by user, application, IP address, and time window, with drill-down capability using individual requestIds via the /signIns endpoint. This includes autonomous agent sign-in events.", "deprecated": false, "area": "auditlog", "resource": "getSummarizedNonInteractiveSignIns(aggregationWindow='{aggregationWindow}')" }, { "path": "/auditLogs/getSummarizedServicePrincipalSignIns(aggregationWindow='{aggregationWindow}')", "method": "GET", "delegated": [ "AuditLog.Read.All" ], "application": [ "AuditLog.Read.All" ], "summary": "Invoke function getSummarizedServicePrincipalSignIns", "description": "Returns aggregated service principal sign-in event counts grouped by user, application, IP address, and time window, with drill-down capability using individual requestIds via the /signIns endpoint. This includes autonomous agent sign-in events.", "deprecated": false, "area": "auditlog", "resource": "getSummarizedServicePrincipalSignIns(aggregationWindow='{aggregationWindow}')" }, { "path": "/auditLogs/provisioning", "method": "GET", "delegated": [ "AuditLog.Read.All", "Directory.Read.All" ], "application": [ "AuditLog.Read.All", "Directory.Read.All" ], "summary": "List provisioningObjectSummary", "description": "Get all provisioningObjectSummary events that occurred in your tenant, such as the deletion of a group in a target application or the creation of a user when provisioning user accounts from your HR system.", "deprecated": false, "area": "auditlog", "resource": "provisioning" }, { "path": "/auditLogs/signInEventsAppSummary", "method": "GET", "delegated": [ "AuditLog.Read.All" ], "application": [ "AuditLog.Read.All" ], "summary": "List signInEventsAppActivity objects", "description": "Get a list of applications and their number of sign-in events in the past 30 days as defined in the signInEventsAppActivity object.", "deprecated": false, "area": "auditlog", "resource": "signInEventsAppSummary" }, { "path": "/auditLogs/signInEventsSummary", "method": "GET", "delegated": [ "AuditLog.Read.All" ], "application": [ "AuditLog.Read.All" ], "summary": "List signInEventsActivity objects", "description": "Get a list of the number of signin events for a specific day as defined in the signInEventsActivity object.", "deprecated": false, "area": "auditlog", "resource": "signInEventsSummary" }, { "path": "/auditLogs/signIns", "method": "GET", "delegated": [ "AuditLog.Read.All" ], "application": [ "AuditLog.Read.All" ], "summary": "List signIns", "description": "Get a list of signIn objects. The list contains the user sign-ins for your Microsoft Entra tenant. Sign-ins where a username and password are passed as part of authorization token, and successful federated sign-ins are currently included in the sign-in logs. The maximum and default page size is 1...", "deprecated": false, "area": "auditlog", "resource": "signIns" }, { "path": "/auditLogs/signIns/confirmCompromised", "method": "POST", "delegated": [ "IdentityRiskyUser.ReadWrite.All" ], "application": [ "IdentityRiskEvent.ReadWrite.All" ], "summary": "Invoke action confirmCompromised", "description": "Allow admins to mark an event in the Microsoft Entra sign-in logs as risky. Events marked as risky by an admin are immediately flagged as high risk in Microsoft Entra ID Protection, overriding previous risk states. Admins can confirm that events flagged as risky by Microsoft Entra ID Protection a...", "deprecated": false, "area": "auditlog", "resource": "signIns" }, { "path": "/auditLogs/signIns/confirmSafe", "method": "POST", "delegated": [ "IdentityRiskyUser.ReadWrite.All" ], "application": [ "IdentityRiskEvent.ReadWrite.All" ], "summary": "Invoke action confirmSafe", "description": "Allow admins to mark an event in Microsoft Entra sign-in logs as safe. Admins can either mark the events flagged as risky by Microsoft Entra ID Protection as safe, or they can mark unflagged events as safe. For details about investigating Identity Protection risks, see How to investigate risk.", "deprecated": false, "area": "auditlog", "resource": "signIns" }, { "path": "/auditLogs/signIns/dismiss", "method": "POST", "delegated": [ "IdentityRiskyUser.ReadWrite.All" ], "application": [ "IdentityRiskEvent.ReadWrite.All" ], "summary": "Invoke action dismiss", "description": "Mark an event in Microsoft Entra sign-in logs as dismissed. For details about investigating Identity Protection risks, see How to investigate risk.", "deprecated": false, "area": "auditlog", "resource": "signIns" }, { "path": "/auditLogs/signIns/{id}", "method": "GET", "delegated": [ "AuditLog.Read.All" ], "application": [ "AuditLog.Read.All" ], "summary": "Get signIn", "description": "Retrieve a specific Microsoft Entra user sign-in event for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.", "deprecated": false, "area": "auditlog", "resource": "signIns" }, { "path": "/auditLogs/signUps", "method": "GET", "delegated": [ "AuditLog.Read.All" ], "application": [ "AuditLog.Read.All" ], "summary": "List signUps", "description": "Retrieve the Microsoft Entra External ID user selfServiceSignUps events for your tenant. The maximum and default page size is 1,000 objects and by default, the most recent sign-ups are returned first. Only sign-up events that occurred within the Microsoft Entra ID default retention period are ava...", "deprecated": false, "area": "auditlog", "resource": "signUps" }, { "path": "/auditLogs/signUps/{id}", "method": "GET", "delegated": [ "AuditLog.Read.All" ], "application": [ "AuditLog.Read.All" ], "summary": "Get selfServiceSignUp", "description": "Retrieve a specific Microsoft Entra External ID user selfServiceSignUp event for your tenant.", "deprecated": false, "area": "auditlog", "resource": "signUps" }, { "path": "/deviceManagement/auditEvents", "method": "GET", "delegated": [ "DeviceManagementApps.Read.All", "DeviceManagementApps.ReadWrite.All" ], "application": [ "DeviceManagementApps.Read.All", "DeviceManagementApps.ReadWrite.All" ], "summary": "Get auditEvents from deviceManagement", "description": "The Audit Events", "deprecated": false, "area": "Other", "resource": "auditEvents" }, { "path": "/deviceManagement/auditEvents", "method": "POST", "delegated": [ "DeviceManagementApps.ReadWrite.All" ], "application": [ "DeviceManagementApps.ReadWrite.All" ], "summary": "Create new navigation property to auditEvents for deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "auditEvents" }, { "path": "/deviceManagement/auditEvents/getAuditActivityTypes", "method": "GET", "delegated": [ "DeviceManagementApps.Read.All", "DeviceManagementApps.ReadWrite.All" ], "application": [ "DeviceManagementApps.Read.All", "DeviceManagementApps.ReadWrite.All" ], "summary": "Get deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "getAuditActivityTypes" }, { "path": "/deviceManagement/auditEvents/getAuditCategories", "method": "GET", "delegated": [ "DeviceManagementApps.Read.All", "DeviceManagementApps.ReadWrite.All" ], "application": [ "DeviceManagementApps.Read.All", "DeviceManagementApps.ReadWrite.All" ], "summary": "Get deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "getAuditCategories" }, { "path": "/deviceManagement/auditEvents/{auditEventId}", "method": "DELETE", "delegated": [ "DeviceManagementApps.ReadWrite.All" ], "application": [ "DeviceManagementApps.ReadWrite.All" ], "summary": "Delete navigation property auditEvents for deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "auditEvents" }, { "path": "/deviceManagement/auditEvents/{auditEventId}", "method": "GET", "delegated": [ "DeviceManagementApps.Read.All", "DeviceManagementApps.ReadWrite.All" ], "application": [ "DeviceManagementApps.Read.All", "DeviceManagementApps.ReadWrite.All" ], "summary": "Get auditEvents from deviceManagement", "description": "The Audit Events", "deprecated": false, "area": "Other", "resource": "auditEvents" }, { "path": "/deviceManagement/auditEvents/{auditEventId}", "method": "PATCH", "delegated": [ "DeviceManagementApps.ReadWrite.All" ], "application": [ "DeviceManagementApps.ReadWrite.All" ], "summary": "Update the navigation property auditEvents in deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "auditEvents" }, { "path": "/deviceManagement/auditPolicies/{deviceManagementAuditPolicyId}/settings", "method": "GET", "delegated": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Get deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "settings" }, { "path": "/deviceManagement/auditPolicies/{deviceManagementAuditPolicyId}/settings", "method": "POST", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "", "description": "", "deprecated": false, "area": "Other", "resource": "settings" }, { "path": "/deviceManagement/auditPolicies/{deviceManagementAuditPolicyId}/settings/{deviceManagementConfigurationSettingId}", "method": "DELETE", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "", "description": "", "deprecated": false, "area": "Other", "resource": "settings" }, { "path": "/deviceManagement/auditPolicies/{deviceManagementAuditPolicyId}/settings/{deviceManagementConfigurationSettingId}", "method": "GET", "delegated": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Get deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "settings" }, { "path": "/deviceManagement/auditPolicies/{deviceManagementAuditPolicyId}/settings/{deviceManagementConfigurationSettingId}", "method": "PATCH", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Update deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "settings" }, { "path": "/deviceManagement/remoteActionAudits", "method": "GET", "delegated": [ "DeviceManagementManagedDevices.Read.All", "DeviceManagementManagedDevices.ReadWrite.All" ], "application": [ "DeviceManagementManagedDevices.Read.All", "DeviceManagementManagedDevices.ReadWrite.All" ], "summary": "Get remoteActionAudits from deviceManagement", "description": "The list of device remote action audits with the tenant.", "deprecated": false, "area": "Other", "resource": "remoteActionAudits" }, { "path": "/deviceManagement/remoteActionAudits", "method": "POST", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementManagedDevices.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementManagedDevices.ReadWrite.All" ], "summary": "Create new navigation property to remoteActionAudits for deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "remoteActionAudits" }, { "path": "/deviceManagement/remoteActionAudits/{remoteActionAuditId}", "method": "DELETE", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementManagedDevices.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementManagedDevices.ReadWrite.All" ], "summary": "Delete navigation property remoteActionAudits for deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "remoteActionAudits" }, { "path": "/deviceManagement/remoteActionAudits/{remoteActionAuditId}", "method": "GET", "delegated": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementManagedDevices.Read.All", "DeviceManagementManagedDevices.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementManagedDevices.Read.All", "DeviceManagementManagedDevices.ReadWrite.All" ], "summary": "Get remoteActionAudits from deviceManagement", "description": "The list of device remote action audits with the tenant.", "deprecated": false, "area": "Other", "resource": "remoteActionAudits" }, { "path": "/deviceManagement/remoteActionAudits/{remoteActionAuditId}", "method": "PATCH", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementManagedDevices.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementManagedDevices.ReadWrite.All" ], "summary": "Update the navigation property remoteActionAudits in deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "remoteActionAudits" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/categoryDeviceStateSummaries", "method": "GET", "delegated": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Get deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "categoryDeviceStateSummaries" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/categoryDeviceStateSummaries", "method": "POST", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Create new navigation property to templates for deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "categoryDeviceStateSummaries" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/categoryDeviceStateSummaries/{securityBaselineCategoryStateSummaryId}", "method": "DELETE", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "", "description": "", "deprecated": false, "area": "Other", "resource": "categoryDeviceStateSummaries" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/categoryDeviceStateSummaries/{securityBaselineCategoryStateSummaryId}", "method": "GET", "delegated": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Get deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "categoryDeviceStateSummaries" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/categoryDeviceStateSummaries/{securityBaselineCategoryStateSummaryId}", "method": "PATCH", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Update deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "categoryDeviceStateSummaries" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/deviceStateSummary", "method": "GET", "delegated": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Get deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "deviceStateSummary" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/deviceStateSummary", "method": "PATCH", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Update deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "deviceStateSummary" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/deviceStates", "method": "GET", "delegated": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Get deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "deviceStates" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/deviceStates", "method": "POST", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Create new navigation property to templates for deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "deviceStates" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/deviceStates/{securityBaselineDeviceStateId}", "method": "DELETE", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "", "description": "", "deprecated": false, "area": "Other", "resource": "deviceStates" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/deviceStates/{securityBaselineDeviceStateId}", "method": "GET", "delegated": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.Read.All", "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Get deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "deviceStates" }, { "path": "/deviceManagement/templates/{deviceManagementTemplateId}/microsoft.graph.securityBaselineTemplate/deviceStates/{securityBaselineDeviceStateId}", "method": "PATCH", "delegated": [ "DeviceManagementConfiguration.ReadWrite.All" ], "application": [ "DeviceManagementConfiguration.ReadWrite.All" ], "summary": "Update deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "deviceStates" }, { "path": "/deviceManagement/virtualEndpoint/auditEvents", "method": "GET", "delegated": [ "CloudPC.Read.All" ], "application": [ "CloudPC.Read.All" ], "summary": "List auditEvents", "description": "List all the cloudPcAuditEvent objects for the tenant.", "deprecated": false, "area": "Other", "resource": "auditEvents" }, { "path": "/deviceManagement/virtualEndpoint/auditEvents/getAuditActivityTypes", "method": "GET", "delegated": [ "CloudPC.Read.All" ], "application": [ "CloudPC.Read.All" ], "summary": "Get deviceManagement", "description": "", "deprecated": false, "area": "Other", "resource": "getAuditActivityTypes" }, { "path": "/deviceManagement/virtualEndpoint/auditEvents/{id}", "method": "GET", "delegated": [ "CloudPC.Read.All" ], "application": [ "CloudPC.Read.All" ], "summary": "Get cloudPcAuditEvent", "description": "Read the properties and relationships of a cloudPcAuditEvent object.", "deprecated": false, "area": "Other", "resource": "auditEvents" }, { "path": "/directory/customSecurityAttributeDefinitions", "method": "GET", "delegated": [ "CustomSecAttributeDefinition.Read.All" ], "application": [ "CustomSecAttributeDefinition.Read.All" ], "summary": "List customSecurityAttributeDefinitions", "description": "Get a list of the customSecurityAttributeDefinition objects and their properties.", "deprecated": false, "area": "Other", "resource": "customSecurityAttributeDefinitions" }, { "path": "/directory/customSecurityAttributeDefinitions", "method": "POST", "delegated": [ "CustomSecAttributeDefinition.ReadWrite.All" ], "application": [ "CustomSecAttributeDefinition.ReadWrite.All" ], "summary": "Create customSecurityAttributeDefinition", "description": "Create a new customSecurityAttributeDefinition object.", "deprecated": false, "area": "Other", "resource": "customSecurityAttributeDefinitions" }, { "path": "/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinitionId}", "method": "GET", "delegated": [ "CustomSecAttributeDefinition.Read.All" ], "application": [ "CustomSecAttributeDefinition.Read.All" ], "summary": "Get customSecurityAttributeDefinition", "description": "Read the properties and relationships of a customSecurityAttributeDefinition object.", "deprecated": false, "area": "Other", "resource": "customSecurityAttributeDefinitions" }, { "path": "/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinitionId}", "method": "PATCH", "delegated": [ "CustomSecAttributeDefinition.ReadWrite.All" ], "application": [ "CustomSecAttributeDefinition.ReadWrite.All" ], "summary": "Update customSecurityAttributeDefinition", "description": "Update the properties of a customSecurityAttributeDefinition object.", "deprecated": false, "area": "Other", "resource": "customSecurityAttributeDefinitions" }, { "path": "/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinitionId}/allowedValues", "method": "GET", "delegated": [ "CustomSecAttributeDefinition.Read.All" ], "application": [ "CustomSecAttributeDefinition.Read.All" ], "summary": "List allowedValues", "description": "Get a list of the allowedValue objects and their properties.", "deprecated": false, "area": "Other", "resource": "allowedValues" }, { "path": "/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinitionId}/allowedValues", "method": "POST", "delegated": [ "CustomSecAttributeDefinition.ReadWrite.All" ], "application": [ "CustomSecAttributeDefinition.ReadWrite.All" ], "summary": "Create allowedValue", "description": "Create a new allowedValue object.", "deprecated": false, "area": "Other", "resource": "allowedValues" }, { "path": "/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinitionId}/allowedValues/{allowedValueId}", "method": "GET", "delegated": [ "CustomSecAttributeDefinition.Read.All" ], "application": [ "CustomSecAttributeDefinition.Read.All" ], "summary": "Get allowedValue", "description": "Read the properties and relationships of an allowedValue object.", "deprecated": false, "area": "Other", "resource": "allowedValues" }, { "path": "/directory/customSecurityAttributeDefinitions/{customSecurityAttributeDefinitionId}/allowedValues/{allowedValueId}", "method": "PATCH", "delegated": [ "CustomSecAttributeDefinition.ReadWrite.All" ], "application": [ "CustomSecAttributeDefinition.ReadWrite.All" ], "summary": "Update allowedValue", "description": "Update the properties of an allowedValue object.", "deprecated": false, "area": "Other", "resource": "allowedValues" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings('id')/microsoft.graph.openAwsSecurityGroupFinding/assignedComputeInstancesDetails", "method": "GET", "delegated": [], "application": [], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "assignedComputeInstancesDetails" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings/microsoft.graph.openAwsSecurityGroupFinding", "method": "GET", "delegated": [], "application": [ "PermissionsAnalytics.Read.OwnedBy" ], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.openAwsSecurityGroupFinding" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings/microsoft.graph.raph.securityToolAwsResourceAdministratorFinding", "method": "GET", "delegated": [], "application": [ "PermissionsAnalytics.Read.OwnedBy" ], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.raph.securityToolAwsResourceAdministratorFinding" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings/microsoft.graph.raph.securityToolAwsServerlessFunctionAdministratorFinding", "method": "GET", "delegated": [], "application": [ "PermissionsAnalytics.Read.OwnedBy" ], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.raph.securityToolAwsServerlessFunctionAdministratorFinding" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings/microsoft.graph.securityToolAwsResourceAdministratorFinding", "method": "GET", "delegated": [], "application": [ "PermissionsAnalytics.Read.OwnedBy" ], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.securityToolAwsResourceAdministratorFinding" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings/microsoft.graph.securityToolAwsRoleAdministratorFinding", "method": "GET", "delegated": [], "application": [ "PermissionsAnalytics.Read.OwnedBy" ], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.securityToolAwsRoleAdministratorFinding" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings/microsoft.graph.securityToolAwsServerlessFunctionAdministratorFinding", "method": "GET", "delegated": [], "application": [ "PermissionsAnalytics.Read.OwnedBy" ], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.securityToolAwsServerlessFunctionAdministratorFinding" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings/microsoft.graph.securityToolAwsUserAdministratorFinding", "method": "GET", "delegated": [], "application": [ "PermissionsAnalytics.Read.OwnedBy" ], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.securityToolAwsUserAdministratorFinding" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings/{id}/microsoft.graph.openAwsSecurityGroupFinding", "method": "GET", "delegated": [], "application": [], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.openAwsSecurityGroupFinding" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings/{id}/microsoft.graph.openAwsSecurityGroupFinding/assignedComputeInstancesDetails/{id}", "method": "GET", "delegated": [], "application": [], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "assignedComputeInstancesDetails" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings/{id}/microsoft.graph.securityToolAwsRoleAdministratorFinding", "method": "GET", "delegated": [], "application": [], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.securityToolAwsRoleAdministratorFinding" }, { "path": "/identityGovernance/permissionsAnalytics/aws/findings/{id}/microsoft.graph.securityToolAwsUserAdministratorFinding", "method": "GET", "delegated": [], "application": [], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.securityToolAwsUserAdministratorFinding" }, { "path": "/identityGovernance/permissionsAnalytics/azure/findings/microsoft.graph.openNetworkAzureSecurityGroupFinding", "method": "GET", "delegated": [], "application": [ "PermissionsAnalytics.Read.OwnedBy" ], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.openNetworkAzureSecurityGroupFinding" }, { "path": "/identityGovernance/permissionsAnalytics/azure/findings/{id}/microsoft.graph.openNetworkAzureSecurityGroupFinding", "method": "GET", "delegated": [], "application": [], "summary": "Get identity", "description": "", "deprecated": false, "area": "Other", "resource": "microsoft.graph.openNetworkAzureSecurityGroupFinding" }, { "path": "/identityProtection/agentRiskDetections", "method": "GET", "delegated": [ "IdentityRiskEvent.Read.All" ], "application": [ "IdentityRiskEvent.Read.All" ], "summary": "List agentRiskDetections", "description": "Retrieve the properties of a collection of agentRiskDetection objects.", "deprecated": false, "area": "identityprotection", "resource": "agentRiskDetections" }, { "path": "/identityProtection/agentRiskDetections/{agentRiskDetectionId}", "method": "GET", "delegated": [ "IdentityRiskEvent.Read.All" ], "application": [ "IdentityRiskEvent.Read.All" ], "summary": "Get agentRiskDetection", "description": "Read the properties and relationships of agentRiskDetection object.", "deprecated": false, "area": "identityprotection", "resource": "agentRiskDetections" }, { "path": "/identityProtection/riskyAgents", "method": "GET", "delegated": [ "IdentityRiskyAgent.Read.All" ], "application": [ "IdentityRiskyAgent.Read.All" ], "summary": "List riskyAgents", "description": "Retrieve the properties and relationships of a collection of riskyAgent objects.", "deprecated": false, "area": "identityprotection", "resource": "riskyAgents" }, { "path": "/identityProtection/riskyAgents/confirmCompromised", "method": "POST", "delegated": [ "IdentityRiskyAgent.ReadWrite.All" ], "application": [ "IdentityRiskyAgent.ReadWrite.All" ], "summary": "Invoke action confirmCompromised", "description": "Confirm one or more riskyAgent objects as compromised. This action sets the targeted agent's riskLevel to high.", "deprecated": false, "area": "identityprotection", "resource": "riskyAgents" }, { "path": "/identityProtection/riskyAgents/confirmSafe", "method": "POST", "delegated": [ "IdentityRiskyAgent.ReadWrite.All" ], "application": [ "IdentityRiskyAgent.ReadWrite.All" ], "summary": "Invoke action confirmSafe", "description": "Confirm one or more riskyAgent objects as safe. This action sets the targeted agent's riskLevel to none.", "deprecated": false, "area": "identityprotection", "resource": "riskyAgents" }, { "path": "/identityProtection/riskyAgents/dismiss", "method": "POST", "delegated": [ "IdentityRiskyAgent.ReadWrite.All" ], "application": [ "IdentityRiskyAgent.ReadWrite.All" ], "summary": "Invoke action dismiss", "description": "Dismiss the risk of one or more riskyAgent objects. This action sets the targeted agent's riskLevel to none.", "deprecated": false, "area": "identityprotection", "resource": "riskyAgents" }, { "path": "/identityProtection/riskyAgents/{riskyAgentId}", "method": "GET", "delegated": [ "IdentityRiskyAgent.Read.All" ], "application": [ "IdentityRiskyAgent.Read.All" ], "summary": "Get riskyAgent", "description": "Read the properties and relationships of riskyAgent object.", "deprecated": false, "area": "identityprotection", "resource": "riskyAgents" }, { "path": "/identityProtection/riskyServicePrincipals", "method": "GET", "delegated": [ "IdentityRiskyServicePrincipal.Read.All" ], "application": [ "IdentityRiskyServicePrincipal.Read.All" ], "summary": "List riskyServicePrincipals", "description": "Retrieve the properties and relationships of riskyServicePrincipal objects.", "deprecated": false, "area": "identityprotection", "resource": "riskyServicePrincipals" }, { "path": "/identityProtection/riskyServicePrincipals/confirmCompromised", "method": "POST", "delegated": [ "IdentityRiskyServicePrincipal.ReadWrite.All" ], "application": [ "IdentityRiskyServicePrincipal.ReadWrite.All" ], "summary": "Invoke action confirmCompromised", "description": "Confirm one or more riskyServicePrincipal objects as compromised. This action sets the targeted service principal account's risk level to high.", "deprecated": false, "area": "identityprotection", "resource": "riskyServicePrincipals" }, { "path": "/identityProtection/riskyServicePrincipals/dismiss", "method": "POST", "delegated": [ "IdentityRiskyServicePrincipal.ReadWrite.All" ], "application": [ "IdentityRiskyServicePrincipal.ReadWrite.All" ], "summary": "Invoke action dismiss", "description": "Dismiss the risk of one or more riskyServicePrincipal objects. This action sets the targeted service principal account's risk level to none. You can dismiss up to 60 service principal accounts in one request.", "deprecated": false, "area": "identityprotection", "resource": "riskyServicePrincipals" }, { "path": "/identityProtection/riskyServicePrincipals/{riskyServicePrincipalId}", "method": "GET", "delegated": [ "IdentityRiskyServicePrincipal.Read.All" ], "application": [ "IdentityRiskyServicePrincipal.Read.All" ], "summary": "Get riskyServicePrincipal", "description": "Read the properties and relationships of a riskyServicePrincipal object.", "deprecated": false, "area": "identityprotection", "resource": "riskyServicePrincipals" }, { "path": "/identityProtection/riskyServicePrincipals/{riskyServicePrincipalId}/history", "method": "GET", "delegated": [ "IdentityRiskyServicePrincipal.Read.All" ], "application": [ "IdentityRiskyServicePrincipal.Read.All" ], "summary": "List history (risk history of riskyServicePrincipal)", "description": "Get the risk history of a riskyServicePrincipal object.", "deprecated": false, "area": "identityprotection", "resource": "riskyServicePrincipals" }, { "path": "/identityProtection/servicePrincipalRiskDetections", "method": "GET", "delegated": [ "IdentityRiskEvent.Read.All" ], "application": [ "IdentityRiskEvent.Read.All" ], "summary": "List servicePrincipalRiskDetections", "description": "Retrieve the properties of a collection of servicePrincipalRiskDetection objects.", "deprecated": false, "area": "identityprotection", "resource": "servicePrincipalRiskDetections" }, { "path": "/identityProtection/servicePrincipalRiskDetections/{servicePrincipalRiskDetectionId}", "method": "GET", "delegated": [ "IdentityRiskEvent.Read.All" ], "application": [ "IdentityRiskEvent.Read.All" ], "summary": "Get servicePrincipalRiskDetection", "description": "Read the properties and relationships of a servicePrincipalRiskDetection object.", "deprecated": false, "area": "identityprotection", "resource": "servicePrincipalRiskDetections" }, { "path": "/me/dataSecurityAndGovernance/activities/contentActivities", "method": "POST", "delegated": [ "ContentActivity.Write" ], "application": [ "ContentActivity.Write" ], "summary": "Create contentActivity", "description": "Create a content activity for the signed-in user.", "deprecated": false, "area": "Other", "resource": "contentActivities" }, { "path": "/me/dataSecurityAndGovernance/processContent", "method": "POST", "delegated": [ "Content.Process.User" ], "application": [ "Content.Process.User" ], "summary": "Invoke action processContent", "description": "Process content against data protection policies in the context of the current, or specified, user.", "deprecated": false, "area": "Other", "resource": "processContent" }, { "path": "/me/dataSecurityAndGovernance/protectionScopes/compute", "method": "POST", "delegated": [ "ProtectionScopes.Compute.User" ], "application": [ "ProtectionScopes.Compute.User" ], "summary": "Invoke action compute", "description": "", "deprecated": false, "area": "Other", "resource": "compute" }, { "path": "/policies/identitySecurityDefaultsEnforcementPolicy", "method": "GET", "delegated": [ "Policy.Read.All" ], "application": [ "Policy.Read.All" ], "summary": "Get identitySecurityDefaultsEnforcementPolicy", "description": "Retrieve the properties of an identitySecurityDefaultsEnforcementPolicy object.", "deprecated": false, "area": "Other", "resource": "identitySecurityDefaultsEnforcementPolicy" }, { "path": "/policies/identitySecurityDefaultsEnforcementPolicy", "method": "PATCH", "delegated": [ "Policy.Read.All" ], "application": [ "Policy.Read.All" ], "summary": "Update identitySecurityDefaultsEnforcementPolicy", "description": "Update the properties of an identitySecurityDefaultsEnforcementPolicy object.", "deprecated": false, "area": "Other", "resource": "identitySecurityDefaultsEnforcementPolicy" }, { "path": "/reports/security/getAttackSimulationRepeatOffenders", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get reports", "description": "", "deprecated": false, "area": "security", "resource": "getAttackSimulationRepeatOffenders" }, { "path": "/reports/security/getAttackSimulationSimulationUserCoverage", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get reports", "description": "", "deprecated": false, "area": "security", "resource": "getAttackSimulationSimulationUserCoverage" }, { "path": "/reports/security/getAttackSimulationTrainingUserCoverage", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get reports", "description": "", "deprecated": false, "area": "security", "resource": "getAttackSimulationTrainingUserCoverage" }, { "path": "/riskDetections", "method": "GET", "delegated": [ "IdentityRiskEvent.Read.All" ], "application": [ "IdentityRiskEvent.Read.All" ], "summary": "Get riskDetection", "description": "Retrieve the properties of a riskDetection object.", "deprecated": false, "area": "riskdetections", "resource": "riskDetections" }, { "path": "/riskDetections/{id}", "method": "GET", "delegated": [ "IdentityRiskEvent.Read.All" ], "application": [ "IdentityRiskEvent.Read.All" ], "summary": "Get entity from riskDetections by key", "description": "", "deprecated": false, "area": "riskdetections", "resource": "riskDetections" }, { "path": "/riskyUsers", "method": "GET", "delegated": [ "IdentityRiskyUser.Read.All" ], "application": [ "IdentityRiskyUser.Read.All" ], "summary": "List riskyUsers", "description": "Retrieve the properties and relationships of a collection of riskyUser objects.", "deprecated": false, "area": "riskyusers", "resource": "riskyUsers" }, { "path": "/riskyUsers/confirmCompromised", "method": "POST", "delegated": [ "IdentityRiskyUser.ReadWrite.All" ], "application": [ "IdentityRiskyUser.ReadWrite.All" ], "summary": "Invoke action confirmCompromised", "description": "Confirm one or more riskyUser objects as compromised. This action sets the targeted user's risk level to high.", "deprecated": false, "area": "riskyusers", "resource": "confirmCompromised" }, { "path": "/riskyUsers/confirmSafe", "method": "POST", "delegated": [ "IdentityRiskyUser.ReadWrite.All" ], "application": [ "IdentityRiskyUser.ReadWrite.All" ], "summary": "Invoke action confirmSafe", "description": "Confirm one or more riskyUser objects as safe. This action sets the targeted user's risk level to none.", "deprecated": false, "area": "riskyusers", "resource": "confirmSafe" }, { "path": "/riskyUsers/dismiss", "method": "POST", "delegated": [ "IdentityRiskyUser.ReadWrite.All" ], "application": [ "IdentityRiskyUser.ReadWrite.All" ], "summary": "Invoke action dismiss", "description": "Dismiss the risk of one or more riskyUser objects. This action sets the targeted user's risk level to none. The maximum count of users to dismiss in one call is 60.", "deprecated": false, "area": "riskyusers", "resource": "dismiss" }, { "path": "/riskyUsers/{id}", "method": "GET", "delegated": [ "IdentityRiskyUser.Read.All" ], "application": [ "IdentityRiskyUser.Read.All" ], "summary": "Get riskyUser", "description": "Retrieve the properties and relationships of a riskyUser object.", "deprecated": false, "area": "riskyusers", "resource": "riskyUsers" }, { "path": "/riskyUsers/{id}/history", "method": "GET", "delegated": [ "IdentityRiskyUser.Read.All" ], "application": [ "IdentityRiskyUser.Read.All" ], "summary": "List history of riskyUser", "description": "Get the risk history of a riskyUser resource.", "deprecated": false, "area": "riskyusers", "resource": "history" }, { "path": "/riskyUsers/{userid}/history/{id}", "method": "GET", "delegated": [ "IdentityRiskyUser.Read.All" ], "application": [ "IdentityRiskyUser.Read.All" ], "summary": "Get riskyUserHistoryItem", "description": "Get a riskyUserHistoryItem object of a riskyUser.", "deprecated": false, "area": "riskyusers", "resource": "history" }, { "path": "/security/alerts", "method": "GET", "delegated": [ "SecurityEvents.Read.All" ], "application": [ "SecurityEvents.Read.All" ], "summary": "List alerts (deprecated)", "description": "Retrieve a list of alert objects.", "deprecated": true, "area": "security", "resource": "alerts" }, { "path": "/security/alerts/updateAlerts", "method": "POST", "delegated": [ "SecurityEvents.ReadWrite.All" ], "application": [ "SecurityEvents.ReadWrite.All" ], "summary": "Invoke action updateAlerts", "description": "Update multiple alerts in one request instead of multiple requests.", "deprecated": false, "area": "security", "resource": "alerts" }, { "path": "/security/alerts/{alert_id}", "method": "PATCH", "delegated": [ "SecurityEvents.ReadWrite.All" ], "application": [ "SecurityEvents.ReadWrite.All" ], "summary": "Update alert (deprecated)", "description": "Update an editable alert property within any integrated solution to keep alert status and assignments in sync across solutions. This method updates any solution that has a record of the referenced alert ID.", "deprecated": true, "area": "security", "resource": "alerts" }, { "path": "/security/alerts/{id}", "method": "GET", "delegated": [ "SecurityEvents.Read.All" ], "application": [ "SecurityEvents.Read.All" ], "summary": "Get alert (deprecated)", "description": "Retrieve the properties and relationships of an alert object.", "deprecated": true, "area": "security", "resource": "alerts" }, { "path": "/security/alerts_v2", "method": "GET", "delegated": [ "SecurityAlert.Read.All" ], "application": [ "SecurityAlert.Read.All" ], "summary": "List alerts_v2", "description": "Get a list of alert resources that were created to track suspicious activities in an organization. This operation lets you filter and sort through alerts to create an informed cyber security response. It exposes a collection of alerts that were flagged in your network, within the time range you s...", "deprecated": false, "area": "security", "resource": "alerts_v2" }, { "path": "/security/alerts_v2", "method": "POST", "delegated": [ "SecurityAlert.Create.All" ], "application": [ "SecurityAlert.Create.All" ], "summary": "Create manualAlert", "description": "Create a manual security alert in Microsoft 365 Defender with specified entities and metadata. When the alert is created, the backend automatically creates a new incident to contain the alert, or links the alert to an existing incident if linkToIncident is specified.", "deprecated": false, "area": "security", "resource": "alerts_v2" }, { "path": "/security/alerts_v2/createAlert", "method": "POST", "delegated": [ "SecurityAlert.Create.All" ], "application": [ "SecurityAlert.Create.All" ], "summary": "Create new navigation property to alerts for security", "description": "", "deprecated": false, "area": "security", "resource": "alerts_v2" }, { "path": "/security/alerts_v2/moveAlerts", "method": "POST", "delegated": [ "SecurityData.Manage.All" ], "application": [ "SecurityData.Manage.All" ], "summary": "Create new navigation property to alerts for security", "description": "", "deprecated": false, "area": "security", "resource": "alerts_v2" }, { "path": "/security/alerts_v2/{alertId}", "method": "GET", "delegated": [ "SecurityAlert.Read.All" ], "application": [ "SecurityAlert.Read.All" ], "summary": "Get alert", "description": "Get the properties and relationships of an alert object.", "deprecated": false, "area": "security", "resource": "alerts_v2" }, { "path": "/security/alerts_v2/{alertId}", "method": "PATCH", "delegated": [ "SecurityAlert.ReadWrite.All" ], "application": [ "SecurityAlert.ReadWrite.All" ], "summary": "Update alert", "description": "Update the properties of an alert object.", "deprecated": false, "area": "security", "resource": "alerts_v2" }, { "path": "/security/alerts_v2/{alertId}/comments", "method": "POST", "delegated": [ "SecurityAlert.ReadWrite.All" ], "application": [ "SecurityAlert.ReadWrite.All" ], "summary": "Create comment for alert", "description": "Create a comment for an existing alert based on the specified alert id property.", "deprecated": false, "area": "security", "resource": "alerts_v2" }, { "path": "/security/attackSimulation/endUserNotifications?$filter=source", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/landingPages?$filter=source", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/loginPages?$filter=source", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/operations/{operationsId}", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get attackSimulationOperation", "description": "Get an attack simulation operation to track a long-running operation request for a tenant.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/payloads/{payloadId}", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get payload", "description": "Get an attack simulation campaign payload for a tenant.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/payloads/{payloadId}/detail", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/payloads?$filter=source", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulationAutomations", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "List simulationAutomations", "description": "Get a list of attack simulation automations for a tenant.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulationAutomations/{simulationAutomationId}", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get simulationAutomation", "description": "Get an attack simulation automation for a tenant.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulationAutomations/{simulationAutomationId}/runs", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "List runs", "description": "Get a list of the attack simulation automation runs for a tenant.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulations", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "List simulations", "description": "Get a list of attack simulation campaigns for a tenant.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulations", "method": "POST", "delegated": [ "AttackSimulation.ReadWrite.All" ], "application": [ "AttackSimulation.ReadWrite.All" ], "summary": "Create simulation", "description": "Create an attack simulation campaign for a tenant.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulations/{simulationId}", "method": "DELETE", "delegated": [ "AttackSimulation.ReadWrite.All" ], "application": [ "AttackSimulation.ReadWrite.All" ], "summary": "Delete simulation", "description": "Delete an attack simulation campaign for a tenant.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulations/{simulationId}", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get simulation", "description": "Get an attack simulation campaign for a tenant.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulations/{simulationId}", "method": "PATCH", "delegated": [ "AttackSimulation.ReadWrite.All" ], "application": [ "AttackSimulation.ReadWrite.All" ], "summary": "Update simulation", "description": "Update an attack simulation campaign for a tenant. You can only update simulations that are in draft status.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulations/{simulationId}/excludedAccountTarget", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulations/{simulationId}/includedAccountTarget", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulations/{simulationId}/report/overview", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/simulations/{simulationId}/report/simulationUsers", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/trainingCampaigns", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "List trainingCampaign objects", "description": "Get a list of trainingCampaign objects and their properties.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/trainingCampaigns", "method": "POST", "delegated": [ "AttackSimulation.ReadWrite.All" ], "application": [ "AttackSimulation.ReadWrite.All" ], "summary": "Create trainingCampaign", "description": "Create a new trainingCampaign object.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/trainingCampaigns/{trainingCampaignId}", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get trainingCampaign", "description": "Read the properties and relationships of a trainingCampaign object.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/trainingCampaigns/{trainingCampaignId}", "method": "PATCH", "delegated": [ "AttackSimulation.ReadWrite.All" ], "application": [ "AttackSimulation.ReadWrite.All" ], "summary": "Update trainingCampaign", "description": "Update the properties of a trainingCampaign object.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/trainingCampaigns/{trainingCampaignId}/$ref", "method": "DELETE", "delegated": [ "AttackSimulation.ReadWrite.All" ], "application": [ "AttackSimulation.ReadWrite.All" ], "summary": "Delete navigation property attackSimulation for security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/trainingCampaigns/{trainingCampaignId}/report/campaignUsers", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/trainingCampaigns/{trainingCampaignId}/report/overview", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/attackSimulation/trainings", "method": "GET", "delegated": [ "AttackSimulation.Read.All" ], "application": [ "AttackSimulation.Read.All" ], "summary": "List trainings", "description": "Get a list of the training objects and their properties.", "deprecated": false, "area": "security", "resource": "attackSimulation" }, { "path": "/security/auditLog/queries", "method": "GET", "delegated": [], "application": [], "summary": "List auditLogQueries", "description": "Get a list of auditLogQuery objects and their properties.", "deprecated": false, "area": "security", "resource": "auditLog" }, { "path": "/security/auditLog/queries", "method": "POST", "delegated": [], "application": [], "summary": "Create auditLogQuery", "description": "Create a new auditLogQuery object.", "deprecated": false, "area": "security", "resource": "auditLog" }, { "path": "/security/auditLog/queries/{auditLogQueryId}", "method": "GET", "delegated": [], "application": [], "summary": "Get auditLogQuery", "description": "Read the properties and relationships of an auditLogQuery object.", "deprecated": false, "area": "security", "resource": "auditLog" }, { "path": "/security/auditLog/queries/{auditLogQueryId}/records", "method": "GET", "delegated": [], "application": [], "summary": "List auditLogRecords", "description": "Get a list of the auditLogRecord objects and their properties.", "deprecated": false, "area": "security", "resource": "auditLog" }, { "path": "/security/caseManagement/caseTypeConfigurations", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "List caseTypeConfigurations", "description": "Get a list of the caseTypeConfiguration objects and their properties. Each object describes the allowed status tree and the custom-field schema for one case type (genericCase, incidentCase, or exposureCase).", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/caseTypeConfigurations/{caseTypeConfigurationId}", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "Get caseTypeConfigurations from security", "description": "The collection of case type configurations that define the statuses and custom fields available for each case type. Read-only. Supports $select, $count, and $expand of the statuses and customFields relationships.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/caseTypeConfigurations/{caseTypeConfigurationId}/customFields", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "Get customFields from security", "description": "The contained custom-field definitions that make up the blank-form schema for this case type. Read-only. Supports $count, $expand, $filter, $orderby, $select, $skip, and $top.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/caseTypeConfigurations/{caseTypeConfigurationId}/customFields/{customFieldDefinitionId}", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "Get customFields from security", "description": "The contained custom-field definitions that make up the blank-form schema for this case type. Read-only. Supports $count, $expand, $filter, $orderby, $select, $skip, and $top.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/caseTypeConfigurations/{caseTypeConfigurationId}/statuses", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "Get statuses from security", "description": "The contained top-level statuses that a case of this type can be set to. Read-only. Supports $count, $expand, $filter, $orderby, $select, $skip, and $top.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/caseTypeConfigurations/{caseTypeConfigurationId}/statuses/{statusDefinitionId}", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "Get statuses from security", "description": "The contained top-level statuses that a case of this type can be set to. Read-only. Supports $count, $expand, $filter, $orderby, $select, $skip, and $top.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "List case objects", "description": "Get a list of the case objects and their properties.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases", "method": "POST", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Create case management case", "description": "Create a case object in case management.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}", "method": "DELETE", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Delete case management case", "description": "Delete a case object from case management.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "Get case management case", "description": "Read the properties and relationships of a microsoft.graph.security.caseManagement.case object.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}", "method": "PATCH", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Update case management case", "description": "Update the properties of a microsoft.graph.security.caseManagement.case object.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/activities", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "List case activities", "description": "Get a list of activity objects in a case timeline.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/activities", "method": "POST", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Create case activity", "description": "Create a comment activity for a case.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/activities/{activityId}", "method": "DELETE", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Delete activity", "description": "Delete a comment activity from a case timeline. Only comment activities support delete.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/activities/{activityId}", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "Get activity", "description": "Read the properties and relationships of a microsoft.graph.security.caseManagement.activity object. The response can be a comment or auditLog object, identified by @odata.type.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/activities/{activityId}", "method": "PATCH", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Update activity", "description": "Update a comment activity in a case timeline. Only comment activities support update. Include @odata.type with #microsoft.graph.security.caseManagement.comment in the request body to identify the concrete activity type.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/attachments", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "List case attachments", "description": "Get a list of attachment objects for a case.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/attachments", "method": "POST", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Create case attachment", "description": "Create attachment metadata for a case. This method doesn't upload the file content. After creating the attachment, use Upload attachment content.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/attachments/{attachmentId}", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "Get attachment", "description": "Read the properties and relationships of an attachment object.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/attachments/{attachmentId}", "method": "PATCH", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Update attachment", "description": "Update the properties of an attachment object.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/attachments/{attachmentId}/content", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "Download attachment content", "description": "Download the binary content of an attachment. After an upload completes, the service asynchronously scans the attachment for malware. Poll the attachment metadata by using Get attachment. If scanResult is unscanned, wait and try again later. Download the content only when scanResult is noThreatsF...", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/attachments/{attachmentId}/content", "method": "PUT", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Upload attachment content", "description": "Upload binary content for an attachment. Create the attachment metadata first by using Create case attachment. The maximum file size is 100 MB. Upload files in chunks of no more than 1 MB. For files larger than 1 MB, send one PUT request for each chunk until all byte ranges are uploaded.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/relations", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "List case relations", "description": "Get a list of external resource relation objects for a case. Each relation is an incidentRelation, recommendationRelation, or workspaceIndicatorRelation, identified by @odata.type.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/relations", "method": "POST", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Create case relation", "description": "Create a concrete external resource relation for a case.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/relations/{relationId}", "method": "DELETE", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Delete relation", "description": "Delete a concrete relation from a case.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/relations/{relationId}", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "Get relation", "description": "Read a concrete relation from a case. The response is an incidentRelation, recommendationRelation, or workspaceIndicatorRelation, identified by @odata.type.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/relations/{relationId}", "method": "PATCH", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Update relation", "description": "Update the properties of a concrete relation object.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/tasks", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "List case tasks", "description": "Get a list of task objects for a case.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/tasks", "method": "POST", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Create case task", "description": "Create a task for a case.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/tasks/{taskId}", "method": "DELETE", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Delete task", "description": "Delete a task from a case.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/tasks/{taskId}", "method": "GET", "delegated": [ "CaseManagement.Read.All" ], "application": [ "CaseManagement.Read.All" ], "summary": "Get task", "description": "Read the properties and relationships of a task object.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/caseManagement/cases/{caseId}/tasks/{taskId}", "method": "PATCH", "delegated": [ "CaseManagement.ReadWrite.All" ], "application": [ "CaseManagement.ReadWrite.All" ], "summary": "Update task", "description": "Update the properties of a task object.", "deprecated": false, "area": "security", "resource": "caseManagement" }, { "path": "/security/cases/ediscoveryCases", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List ediscoveryCases", "description": "Get a list of the ediscoveryCase objects and their properties.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{eDiscoveryCaseId}/reviewSets/{eDiscoveryReviewSetId}/addToReviewSet", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{eDiscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{eDiscoveryReviewSetQueryId}", "method": "DELETE", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Delete ediscoveryReviewSetQuery", "description": "Delete an ediscoveryReviewSetQuery object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}", "method": "DELETE", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Delete ediscoveryCase", "description": "Delete an ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get ediscoveryCase", "description": "Read the properties and relationships of an ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}", "method": "PATCH", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Update ediscoveryCase", "description": "Update the properties of an ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/close", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List ediscoveryCustodian", "description": "Get a list of the custodian objects and their properties.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create custodians", "description": "Create a new ediscoveryCustodian object. After the custodian object is created, you will need to create the custodian's userSource to reference their mailbox and OneDrive for Business site.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/applyHold", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/removeHold", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/updateIndex", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/siteSources", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List siteSources", "description": "Get a list of the siteSource objects associated with an ediscoveryCustodian.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/siteSources", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create siteSource", "description": "Create a new siteSource object associated with an eDiscovery custodian.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/unifiedGroupSources", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List unifiedGroupSources", "description": "Get a list of the unifiedGroupSource objects associated with an ediscoveryCustodian.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/unifiedGroupSources", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create custodian unifiedGroupSource", "description": "Create a new unifiedGroupSource object associated with an eDiscovery custodian.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/userSources", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List userSources", "description": "Get a list of the userSource objects associated with an ediscoveryCustodian or ediscoveryHoldPolicy.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{custodianId}/userSources", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create custodian userSource", "description": "Create a new userSource object associated with an eDiscovery custodian.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get ediscoveryCustodian", "description": "Read the properties and relationships of an ediscoveryCustodian object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/activate", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/release", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/siteSources/{siteSourceId}", "method": "DELETE", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Delete siteSource", "description": "Delete a siteSource object associated with an ediscoveryCustodian.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/unifiedGroupSources/{unifiedGroupSourceId}", "method": "DELETE", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Delete unifiedGroupSource", "description": "Delete a unifiedGroupSource object associated with an ediscoveryCustodian.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoveryCustodianId}/userSources/{userSourceId}", "method": "DELETE", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Delete userSource", "description": "Delete a userSource object associated with an ediscoveryCustodian.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/custodians/{ediscoverycustodianId}/lastIndexOperation", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List lastIndexOperation", "description": "Get a list of the ediscoveryIndexOperation associated with an ediscoveryCustodian.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List ediscoveryHoldPolicies", "description": "Get a list of the ediscoveryHoldPolicy objects and their properties.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryHoldPolicy", "description": "Create a new ediscoveryHoldPolicy object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}", "method": "DELETE", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Delete navigation property legalHolds for security", "description": "", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get legalHolds from security", "description": "Returns a list of case eDiscoveryHoldPolicy objects for this case.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}", "method": "PATCH", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Update the navigation property legalHolds in security", "description": "", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/disablePolicy", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/enablePolicy", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/retryPolicy", "method": "POST", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/siteSources", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get siteSources from security", "description": "Data sources that represent SharePoint sites.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/siteSources", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create siteSource", "description": "Create a new siteSource object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/siteSources/{siteSourceId}", "method": "DELETE", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Delete siteSource", "description": "Delete a siteSource object associated with an ediscoveryHoldPolicy.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/userSources", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get userSources from security", "description": "Data sources that represent Exchange mailboxes.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/userSources", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create userSource", "description": "Create a new userSource object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/legalHolds/{ediscoveryHoldPolicyId}/userSources/{userSourceId}", "method": "DELETE", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Delete userSource", "description": "Delete a userSource object associated with an ediscoveryHoldPolicy.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create nonCustodialDataSources", "description": "Create a new ediscoveryNoncustodialDataSource object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/applyHold", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/removeHold", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get noncustodialDataSources from security", "description": "Returns a list of case ediscoveryNoncustodialDataSource objects for this case.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}/release", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/noncustodialDataSources/{ediscoveryNoncustodialDataSourceId}/updateIndex", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/operations", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List caseOperations", "description": "Get a list of the caseOperation objects and their properties.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/operations/{caseOperationId}", "method": "GET", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Get caseOperation", "description": "Read the properties and relationships of a caseOperation object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/operations/{eDiscoveryCaseOperationId}/microsoft.graph.security.ediscoveryExportOperation/getDownloadUrl", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reopen", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List reviewSets", "description": "Get a list of ediscoveryReviewSet objects associated with an eDiscovery case.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create reviewSets", "description": "Create a new ediscoveryReviewSet object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/export", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List ediscoveryFiles", "description": "Get a list of the ediscoveryFile objects and their properties.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/files/{ediscoveryFileId}", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get ediscoveryFile", "description": "Read the properties and relationships of an ediscoveryFile object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List queries", "description": "Get the list of queries associated with an eDiscovery review set.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryReviewSetQuery", "description": "Create a new ediscoveryReviewSetQuery object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get ediscoveryReviewSetQuery", "description": "Read the properties and relationships of an ediscoveryReviewSetQuery object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}", "method": "PATCH", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Update ediscoveryReviewSetQuery", "description": "Update the properties of an ediscoveryReviewSetQuery object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/applyTags", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/export", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{ediscoveryReviewSetId}/queries/{queryId}/run", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/reviewSets/{reviewSetId}", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get ediscoveryReviewSet", "description": "Read the properties and relationships of an ediscoveryReviewSet object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List searches", "description": "Get the list of ediscoverySearch resources from an eDiscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create searches", "description": "Create a new ediscoverySearch object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}", "method": "DELETE", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Delete ediscoverySearch", "description": "Delete an ediscoverySearch object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get ediscoverySearch", "description": "Read the properties and relationships of an ediscoverySearch object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}", "method": "PATCH", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Update ediscoverySearch", "description": "Update the properties of an ediscoverySearch object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/additionalSources", "method": "GET", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "List additionalSources", "description": "Get the list of additional sources associated with an eDiscovery search.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/additionalSources", "method": "POST", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Add additional sources", "description": "Create a new additional source associated with an eDiscovery search.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/custodianSources", "method": "GET", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "List custodianSources", "description": "Get the list of custodial data sources associated with an eDiscovery search.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/custodianSources/$ref", "method": "POST", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/custodianSources/{id}/$ref", "method": "DELETE", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Delete navigation property cases for security", "description": "", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/estimateStatistics", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/exportReport", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/exportResult", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/lastEstimateStatisticsOperation", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List lastEstimateStatisticsOperation", "description": "Get the last ediscoveryEstimateOperation objects and their properties.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/noncustodialSources", "method": "GET", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Get noncustodialSources from security", "description": "noncustodialDataSource sources that are included in the eDiscovery search", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/noncustodialSources/$ref", "method": "POST", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/noncustodialSources/{id}/$ref", "method": "DELETE", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Delete navigation property cases for security", "description": "", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/searches/{ediscoverySearchId}/purgeData", "method": "POST", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/settings", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get ediscoveryCaseSettings", "description": "Read the properties and relationships of an ediscoveryCaseSettings object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/settings", "method": "PATCH", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Update ediscoveryCaseSettings", "description": "Update the properties of an ediscoveryCaseSettings object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/settings/resetToDefault", "method": "POST", "delegated": [ "eDiscovery.ReadWrite.All" ], "application": [ "eDiscovery.ReadWrite.All" ], "summary": "Create ediscoveryCase", "description": "Create a new ediscoveryCase object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/tags", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "List tags", "description": "Get a list of eDiscoveryReviewTag objects and their properties.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/tags", "method": "POST", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Create tags", "description": "Create a new ediscoveryReviewTag object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/asHierarchy", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{ediscoveryReviewTagId}", "method": "GET", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Get ediscoveryReviewTag", "description": "Read the properties and relationships of an ediscoveryReviewTag object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{ediscoveryReviewTagId}", "method": "PATCH", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Update ediscoveryReviewTag", "description": "Update the properties of an ediscoveryReviewTag object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoveryCaseId}/tags/{tagId}", "method": "DELETE", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Remove ediscoveryReviewTag", "description": "Remove an ediscoveryReviewTag object.", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/cases/ediscoveryCases/{ediscoverycaseId}/reviewSets/{reviewSetId}", "method": "PATCH", "delegated": [ "eDiscovery.Read.All" ], "application": [ "eDiscovery.Read.All" ], "summary": "Update the navigation property reviewSets in security", "description": "", "deprecated": false, "area": "security", "resource": "cases" }, { "path": "/security/collaboration/analyzedEmails", "method": "GET", "delegated": [], "application": [ "SecurityAnalyzedMessage.Read.All" ], "summary": "Get analyzedEmail", "description": "Read the properties and relationships of an analyzedEmail object.", "deprecated": false, "area": "security", "resource": "collaboration" }, { "path": "/security/collaboration/analyzedEmails/remediate", "method": "POST", "delegated": [], "application": [ "SecurityAnalyzedMessage.ReadWrite.All" ], "summary": "Create new navigation property to analyzedEmails for security", "description": "", "deprecated": false, "area": "security", "resource": "collaboration" }, { "path": "/security/collaboration/analyzedEmails/{analyzedEmailId}", "method": "GET", "delegated": [], "application": [ "SecurityAnalyzedMessage.Read.All" ], "summary": "Get analyzedEmail", "description": "Read the properties and relationships of an analyzedEmail object.", "deprecated": false, "area": "security", "resource": "collaboration" }, { "path": "/security/dataDiscovery/cloudAppDiscovery/uploadedStreams", "method": "GET", "delegated": [ "CloudApp-Discovery.Read.All" ], "application": [ "CloudApp-Discovery.Read.All" ], "summary": "List uploadedStreams", "description": "Get visibility into all the manually uploaded streams from your firewalls and proxies.", "deprecated": false, "area": "security", "resource": "dataDiscovery" }, { "path": "/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/{streamId}/microsoft.graph.security.aggregatedAppsDetails(period=duration'{duration}')", "method": "GET", "delegated": [ "CloudApp-Discovery.Read.All" ], "application": [ "CloudApp-Discovery.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "dataDiscovery" }, { "path": "/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/{streamId}/microsoft.graph.security.aggregatedAppsDetails(period=duration'{duration}')/{appId}", "method": "GET", "delegated": [ "CloudApp-Discovery.Read.All" ], "application": [ "CloudApp-Discovery.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "dataDiscovery" }, { "path": "/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/{streamId}/microsoft.graph.security.aggregatedAppsDetails(period=duration'{duration}')/{appId}/appInfo", "method": "GET", "delegated": [ "CloudApp-Discovery.Read.All" ], "application": [ "CloudApp-Discovery.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "dataDiscovery" }, { "path": "/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/{streamId}/microsoft.graph.security.aggregatedAppsDetails(period=duration'{duration}')/{appId}/devices", "method": "GET", "delegated": [ "CloudApp-Discovery.Read.All" ], "application": [ "CloudApp-Discovery.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "dataDiscovery" }, { "path": "/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/{streamId}/microsoft.graph.security.aggregatedAppsDetails(period=duration'{duration}')/{appId}/ipAddresses", "method": "GET", "delegated": [ "CloudApp-Discovery.Read.All" ], "application": [ "CloudApp-Discovery.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "dataDiscovery" }, { "path": "/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/{streamId}/microsoft.graph.security.aggregatedAppsDetails(period=duration'{duration}')/{appId}/users", "method": "GET", "delegated": [ "CloudApp-Discovery.Read.All" ], "application": [ "CloudApp-Discovery.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "dataDiscovery" }, { "path": "/security/dataSecurityAndGovernance/processContent", "method": "POST", "delegated": [ "Content.Process.All" ], "application": [ "Content.Process.All" ], "summary": "Invoke action processContent", "description": "Evaluate content against Microsoft Purview Data Loss Prevention (DLP) policies and return the policy actions that apply to the supplied content. Use this API when an application needs to evaluate content before or during data movement. In Agent-to-Tool (A2T) scenarios, the agent runtime calls thi...", "deprecated": false, "area": "security", "resource": "dataSecurityAndGovernance" }, { "path": "/security/dataSecurityAndGovernance/processContentAsync", "method": "POST", "delegated": [ "Content.Process.All" ], "application": [ "Content.Process.All" ], "summary": "Invoke action processContentAsync", "description": "", "deprecated": false, "area": "security", "resource": "dataSecurityAndGovernance" }, { "path": "/security/dataSecurityAndGovernance/protectionScopes/compute", "method": "POST", "delegated": [ "ProtectionScopes.Compute.All" ], "application": [ "ProtectionScopes.Compute.All" ], "summary": "Invoke action compute", "description": "", "deprecated": false, "area": "security", "resource": "dataSecurityAndGovernance" }, { "path": "/security/dataSecurityAndGovernance/sensitivityLabels", "method": "GET", "delegated": [ "SensitivityLabel.Read" ], "application": [ "SensitivityLabel.Read" ], "summary": "List sensitivityLabels", "description": "List the sensitivity labels available for the entire tenant.", "deprecated": false, "area": "security", "resource": "dataSecurityAndGovernance" }, { "path": "/security/dataSecurityAndGovernance/sensitivityLabels/computeInheritance", "method": "GET", "delegated": [ "SensitivityLabel.Evaluate" ], "application": [ "SensitivityLabel.Evaluate" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "dataSecurityAndGovernance" }, { "path": "/security/dataSecurityAndGovernance/sensitivityLabels/computeRightsAndInheritance", "method": "POST", "delegated": [ "SensitivityLabel.Evaluate" ], "application": [ "SensitivityLabel.Evaluate" ], "summary": "Invoke action computeRightsAndInheritance", "description": "Computes the rights and inheritance for sensitivity labels based on the input content and labels.", "deprecated": false, "area": "security", "resource": "dataSecurityAndGovernance" }, { "path": "/security/dataSecurityAndGovernance/sensitivityLabels/{labelId}", "method": "GET", "delegated": [ "SensitivityLabel.Read" ], "application": [ "SensitivityLabel.Read" ], "summary": "Get sensitivityLabel", "description": "Get a sensitivity label available for the entire tenant.", "deprecated": false, "area": "security", "resource": "dataSecurityAndGovernance" }, { "path": "/security/dataSecurityAndGovernance/sensitivityLabels/{labelId}/rights", "method": "GET", "delegated": [ "SensitivityLabel.Read" ], "application": [ "SensitivityLabel.Read" ], "summary": "Get usageRightsIncluded", "description": "Get the usage rights granted to the calling user for a specific sensitivity label that has admin-defined permissions.", "deprecated": false, "area": "security", "resource": "dataSecurityAndGovernance" }, { "path": "/security/getHuntingSchema", "method": "GET", "delegated": [], "application": [], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "getHuntingSchema" }, { "path": "/security/getHuntingSchemaTables", "method": "GET", "delegated": [ "ThreatHunting.Read.All" ], "application": [ "ThreatHunting.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "getHuntingSchemaTables" }, { "path": "/security/getRunHuntingQuery(query='{query}',timespan='{timespan}',workspaceId={workspaceId})", "method": "GET", "delegated": [ "ThreatHunting.Read.All" ], "application": [ "ThreatHunting.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "getRunHuntingQuery(query='{query}',timespan='{timespan}',workspaceId={workspaceId})" }, { "path": "/security/identities/healthIssues", "method": "GET", "delegated": [ "SecurityIdentitiesHealth.Read.All" ], "application": [ "SecurityIdentitiesHealth.Read.All" ], "summary": "List healthIssues", "description": "Get a list of health issue objects and their properties.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/healthIssues/{healthIssueId}", "method": "GET", "delegated": [ "SecurityIdentitiesHealth.Read.All" ], "application": [ "SecurityIdentitiesHealth.Read.All" ], "summary": "Get healthIssue", "description": "Read the properties and relationships of a healthIssue object.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/healthIssues/{healthIssueId}", "method": "PATCH", "delegated": [ "SecurityIdentitiesHealth.ReadWrite.All" ], "application": [ "SecurityIdentitiesHealth.ReadWrite.All" ], "summary": "Update healthIssue", "description": "Update the properties of a healthIssue object.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/identityAccounts", "method": "GET", "delegated": [ "SecurityIdentitiesAccount.Read.All" ], "application": [ "SecurityIdentitiesAccount.Read.All" ], "summary": "List identityAccounts objects", "description": "Get a list of the identityAccounts objects and their properties.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/identityAccounts/{identityAccountsId}", "method": "GET", "delegated": [ "SecurityIdentitiesAccount.Read.All" ], "application": [ "SecurityIdentitiesAccount.Read.All" ], "summary": "Get identityAccounts", "description": "Read the properties and relationships of a single identity security account object. This allows retrieving information about available identity accounts.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/identityAccounts/{identityAccountsId}/invokeAction", "method": "POST", "delegated": [ "SecurityIdentitiesActions.ReadWrite.All" ], "application": [ "SecurityIdentitiesActions.ReadWrite.All" ], "summary": "Create new navigation property to identityAccounts for security", "description": "", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensorCandidateActivationConfiguration", "method": "GET", "delegated": [ "SecurityIdentitiesSensors.Read.All" ], "application": [ "SecurityIdentitiesSensors.Read.All" ], "summary": "Get sensorCandidateActivationConfiguration", "description": "Read the properties and relationships of microsoft.graph.security.sensorCandidateActivationConfiguration object.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensorCandidateActivationConfigurations", "method": "POST", "delegated": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "application": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "summary": "", "description": "", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensorCandidates", "method": "GET", "delegated": [ "SecurityIdentitiesSensors.Read.All" ], "application": [ "SecurityIdentitiesSensors.Read.All" ], "summary": "List sensorCandidate objects", "description": "Get a list of the sensorCandidate objects and their properties.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensorCandidates/activate", "method": "POST", "delegated": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "application": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "summary": "Create new navigation property to sensorCandidates for security", "description": "", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensorMigration", "method": "GET", "delegated": [ "SecurityIdentitiesMigration.Read.All" ], "application": [ "SecurityIdentitiesMigration.Read.All" ], "summary": "List sensorMigration objects", "description": "Get a list of the sensorMigration objects and their properties.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensorMigration/migrate", "method": "POST", "delegated": [ "SecurityIdentitiesMigration.ReadWrite.All" ], "application": [ "SecurityIdentitiesMigration.ReadWrite.All" ], "summary": "Create new navigation property to sensorMigration for security", "description": "", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensors", "method": "GET", "delegated": [ "SecurityIdentitiesSensors.Read.All" ], "application": [ "SecurityIdentitiesSensors.Read.All" ], "summary": "List sensors", "description": "Get a list of sensor objects and their properties.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensors/getDeploymentAccessKey", "method": "GET", "delegated": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "application": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensors/getDeploymentPackageUri", "method": "GET", "delegated": [ "SecurityIdentitiesSensors.Read.All" ], "application": [ "SecurityIdentitiesSensors.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensors/regenerateDeploymentAccessKey", "method": "POST", "delegated": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "application": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "summary": "Create new navigation property to sensors for security", "description": "", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensors/{sensorId}", "method": "DELETE", "delegated": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "application": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "summary": "Delete sensor", "description": "Delete a sensor object.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensors/{sensorId}", "method": "GET", "delegated": [ "SecurityIdentitiesSensors.Read.All" ], "application": [ "SecurityIdentitiesSensors.Read.All" ], "summary": "Get sensor", "description": "Read the properties and relationships of a sensor object.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/sensors/{sensorId}", "method": "PATCH", "delegated": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "application": [ "SecurityIdentitiesSensors.ReadWrite.All" ], "summary": "Update sensor", "description": "Update the properties of a sensor object.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/settings/autoAuditingConfiguration", "method": "GET", "delegated": [ "SecurityIdentitiesAutoConfig.Read.All" ], "application": [ "SecurityIdentitiesAutoConfig.Read.All" ], "summary": "Get autoAuditingConfiguration", "description": "Get the properties and relationships of an microsoft.graph.security.autoAuditingConfiguration object.", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/identities/settings/autoAuditingConfiguration", "method": "POST", "delegated": [ "SecurityIdentitiesAutoConfig.ReadWrite.All" ], "application": [ "SecurityIdentitiesAutoConfig.ReadWrite.All" ], "summary": "", "description": "", "deprecated": false, "area": "security", "resource": "identities" }, { "path": "/security/incidentTasks", "method": "GET", "delegated": [], "application": [], "summary": "List incidentTasks", "description": "Get incident tasks that Microsoft Defender Experts for XDR identified for remediation.", "deprecated": false, "area": "security", "resource": "incidentTasks" }, { "path": "/security/incidentTasks/{incidentTaskId}", "method": "GET", "delegated": [], "application": [], "summary": "Get incidentTasks from security", "description": "A collection of tasks associated with security incidents.", "deprecated": false, "area": "security", "resource": "incidentTasks" }, { "path": "/security/incidentTasks/{incidentTaskId}", "method": "PATCH", "delegated": [], "application": [], "summary": "Update the navigation property incidentTasks in security", "description": "", "deprecated": false, "area": "security", "resource": "incidentTasks" }, { "path": "/security/incidentTasks/{incidentTaskId}/executeResponseAction", "method": "POST", "delegated": [], "application": [], "summary": "Create new navigation property to incidentTasks for security", "description": "", "deprecated": false, "area": "security", "resource": "incidentTasks" }, { "path": "/security/incidents", "method": "GET", "delegated": [ "SecurityIncident.Read.All" ], "application": [ "SecurityIncident.Read.All" ], "summary": "List incidents", "description": "Get a list of incident objects that Microsoft 365 Defender created to track attacks in an organization. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the sam...", "deprecated": false, "area": "security", "resource": "incidents" }, { "path": "/security/incidents/mergeIncidents", "method": "POST", "delegated": [ "SecurityData.Manage.All" ], "application": [ "SecurityData.Manage.All" ], "summary": "Create new navigation property to incidents for security", "description": "", "deprecated": false, "area": "security", "resource": "incidents" }, { "path": "/security/incidents/{incidentId}", "method": "GET", "delegated": [ "SecurityIncident.Read.All" ], "application": [ "SecurityIncident.Read.All" ], "summary": "Get incident", "description": "Retrieve the properties and relationships of an incident object. Attacks are typically inflicted on different types of entities, such as devices, users, and mailboxes, resulting in multiple alert objects. Microsoft 365 Defender correlates alerts with the same attack techniques or the same attacke...", "deprecated": false, "area": "security", "resource": "incidents" }, { "path": "/security/incidents/{incidentId}", "method": "PATCH", "delegated": [ "SecurityIncident.ReadWrite.All" ], "application": [ "SecurityIncident.ReadWrite.All" ], "summary": "Update incident", "description": "Update the properties of an incident object.", "deprecated": false, "area": "security", "resource": "incidents" }, { "path": "/security/incidents/{incidentId}/comments", "method": "POST", "delegated": [ "SecurityIncident.ReadWrite.All" ], "application": [ "SecurityIncident.ReadWrite.All" ], "summary": "Create new navigation property to incidents for security", "description": "", "deprecated": false, "area": "security", "resource": "incidents" }, { "path": "/security/labels/authorities", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "List authorityTemplates", "description": "Get a list of the authorityTemplate objects and their properties.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/authorities", "method": "POST", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Create authorityTemplate", "description": "Create a new authorityTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/authorities/{authorityTemplateId}", "method": "DELETE", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Delete navigation property authorities for security", "description": "", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/authorities/{authorityTemplateId}", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "Get authorityTemplate", "description": "Read the properties and relationships of a authorityTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/categories", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "List categoryTemplates", "description": "Get a list of the categoryTemplate objects and their properties.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/categories", "method": "POST", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Create categoryTemplate", "description": "Create a new categoryTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/categories/{categoryTemplateId}", "method": "DELETE", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Delete navigation property categories for security", "description": "", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/categories/{categoryTemplateId}", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "Get categoryTemplate", "description": "Read the properties and relationships of a categoryTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/categories/{categoryTemplateId}/subcategories", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "List subcategories", "description": "Get a list of subcategoryTemplate objects associated with a category template.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/categories/{categoryTemplateId}/subcategories", "method": "POST", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Create subcategoryTemplate", "description": "Create a new subcategoryTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/categories/{categoryTemplateId}/subcategories/{subcategoryTemplateId}", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "Get subcategoryTemplate", "description": "Read the properties and relationships of a subcategoryTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/categories/{categoryTemplateId}/subcategories/{subcategoryTemplateId}/$ref", "method": "DELETE", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Delete navigation property labels for security", "description": "", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/citations", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "List citationTemplates", "description": "Get a list of the citationTemplate objects and their properties.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/citations", "method": "POST", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Create citationTemplate", "description": "Create a new citationTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/citations/{citationTemplateId}", "method": "DELETE", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Delete navigation property citations for security", "description": "", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/citations/{citationTemplateId}", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "Get citationTemplate", "description": "Read the properties and relationships of a citationTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/departments", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "List departmentTemplates", "description": "Get a list of the departmentTemplate objects and their properties.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/departments", "method": "POST", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Create departmentTemplate", "description": "Create a new departmentTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/departments/{departmentTemplateId}", "method": "DELETE", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Delete navigation property departments for security", "description": "", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/departments/{departmentTemplateId}", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "Get departmentTemplate", "description": "Read the properties and relationships of a departmentTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/filePlanReferences", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "List filePlanReferenceTemplates", "description": "Get a list of the filePlanReferenceTemplate objects and their properties.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/filePlanReferences", "method": "POST", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Create filePlanReferenceTemplate", "description": "Create a new filePlanReferenceTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/filePlanReferences/{filePlanReferenceTemplateId}", "method": "DELETE", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Delete navigation property filePlanReferences for security", "description": "", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/filePlanReferences/{filePlanReferenceTemplateId}", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "Get filePlanReferenceTemplate", "description": "Read the properties and relationships of a filePlanReferenceTemplate object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/retentionLabels", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [], "summary": "List retentionLabels", "description": "Get a list of the retentionLabel objects and their properties.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/retentionLabels", "method": "POST", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [], "summary": "Create retentionLabel", "description": "Create a new retentionLabel object. To create a disposition review stage, include the actionAfterRetentionPeriod property in the request body with one of the possible values specified.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/retentionLabels/{retentionLabelId}", "method": "DELETE", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [], "summary": "Delete retentionLabel", "description": "Delete a retentionLabel object.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/retentionLabels/{retentionLabelId}", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [], "summary": "Get retentionLabels from security", "description": "Represents how customers can manage their data, whether and for how long to retain or delete it.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/retentionLabels/{retentionLabelId}", "method": "PATCH", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [], "summary": "Update retentionLabel", "description": "Update the properties of a retentionLabel object. To update a disposition review stage, include the actionAfterRetentionPeriod property in the request body with one of the possible values specified.", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/retentionLabels/{retentionLabelId}/eventType", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/retentionLabels/{retentionLabelId}/eventType", "method": "PATCH", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Update security", "description": "", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/labels/retentionLabels/{retentionLabelId}/eventType/$ref", "method": "DELETE", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Delete navigation property labels for security", "description": "", "deprecated": false, "area": "security", "resource": "labels" }, { "path": "/security/partner/securityAlerts", "method": "GET", "delegated": [ "PartnerSecurity.Read.All" ], "application": [ "PartnerSecurity.Read.All" ], "summary": "List securityAlerts", "description": "Get a list of the partnerSecurityAlert objects and their properties.", "deprecated": false, "area": "security", "resource": "partner" }, { "path": "/security/partner/securityAlerts/{partnerSecurityAlertId}", "method": "GET", "delegated": [ "PartnerSecurity.Read.All" ], "application": [ "PartnerSecurity.Read.All" ], "summary": "Get partnerSecurityAlert", "description": "Read the properties and relationships of a partnerSecurityAlert object.", "deprecated": false, "area": "security", "resource": "partner" }, { "path": "/security/partner/securityAlerts/{partnerSecurityAlertId}", "method": "PATCH", "delegated": [ "PartnerSecurity.ReadWrite.All" ], "application": [ "PartnerSecurity.ReadWrite.All" ], "summary": "Update partnerSecurityAlert", "description": "Update the properties of a partnerSecurityAlert object.", "deprecated": false, "area": "security", "resource": "partner" }, { "path": "/security/partner/securityScore", "method": "GET", "delegated": [ "PartnerSecurity.Read.All" ], "application": [ "PartnerSecurity.Read.All" ], "summary": "Get partnerSecurityScore", "description": "Read the properties and relationships of a partnerSecurityScore object.", "deprecated": false, "area": "security", "resource": "partner" }, { "path": "/security/partner/securityScore/customerInsights", "method": "GET", "delegated": [ "PartnerSecurity.Read.All" ], "application": [ "PartnerSecurity.Read.All" ], "summary": "List customerInsights", "description": "Get a list of the customerInsight objects and their properties.", "deprecated": false, "area": "security", "resource": "partner" }, { "path": "/security/partner/securityScore/history", "method": "GET", "delegated": [ "PartnerSecurity.Read.All" ], "application": [ "PartnerSecurity.Read.All" ], "summary": "List securityScoreHistory", "description": "Get a list of securityScoreHistory entries.", "deprecated": false, "area": "security", "resource": "partner" }, { "path": "/security/partner/securityScore/history/{securityScoreHistoryId}", "method": "GET", "delegated": [ "PartnerSecurity.Read.All" ], "application": [ "PartnerSecurity.Read.All" ], "summary": "Get securityScoreHistory", "description": "Read the properties and relationships of a securityScoreHistory object.", "deprecated": false, "area": "security", "resource": "partner" }, { "path": "/security/partner/securityScore/requirements", "method": "GET", "delegated": [ "PartnerSecurity.Read.All" ], "application": [ "PartnerSecurity.Read.All" ], "summary": "List requirements", "description": "Get a list of securityRequirement objects and their properties.", "deprecated": false, "area": "security", "resource": "partner" }, { "path": "/security/partner/securityScore/requirements/{securityRequirementId}", "method": "GET", "delegated": [ "PartnerSecurity.Read.All" ], "application": [ "PartnerSecurity.Read.All" ], "summary": "Get securityRequirement", "description": "Read the properties and relationships of a securityRequirement object.", "deprecated": false, "area": "security", "resource": "partner" }, { "path": "/security/rules/detectionRules", "method": "GET", "delegated": [ "CustomDetection.Read.All" ], "application": [ "CustomDetection.Read.All" ], "summary": "List detectionRule objects", "description": "Get a list of detectionRule objects and their properties.", "deprecated": false, "area": "security", "resource": "rules" }, { "path": "/security/rules/detectionRules", "method": "POST", "delegated": [ "CustomDetection.ReadWrite.All" ], "application": [ "CustomDetection.ReadWrite.All" ], "summary": "Create detectionRule", "description": "Create a new detectionRule object.", "deprecated": false, "area": "security", "resource": "rules" }, { "path": "/security/rules/detectionRules/{detectionRuleId}", "method": "DELETE", "delegated": [ "CustomDetection.ReadWrite.All" ], "application": [ "CustomDetection.ReadWrite.All" ], "summary": "Delete detectionRule", "description": "Delete a detectionRule object.", "deprecated": false, "area": "security", "resource": "rules" }, { "path": "/security/rules/detectionRules/{detectionRuleId}", "method": "GET", "delegated": [ "CustomDetection.Read.All" ], "application": [ "CustomDetection.Read.All" ], "summary": "Get detectionRules from security", "description": "The custom detection rules configured for the tenant.", "deprecated": false, "area": "security", "resource": "rules" }, { "path": "/security/rules/detectionRules/{detectionRuleId}", "method": "PATCH", "delegated": [ "CustomDetection.ReadWrite.All" ], "application": [ "CustomDetection.ReadWrite.All" ], "summary": "Update the navigation property detectionRules in security", "description": "", "deprecated": false, "area": "security", "resource": "rules" }, { "path": "/security/runHuntingQuery", "method": "POST", "delegated": [ "ThreatHunting.Read.All" ], "application": [ "ThreatHunting.Read.All" ], "summary": "", "description": "", "deprecated": false, "area": "security", "resource": "runHuntingQuery" }, { "path": "/security/secureScoreControlProfiles", "method": "GET", "delegated": [ "SecurityEvents.Read.All" ], "application": [ "SecurityEvents.Read.All" ], "summary": "List secureScoreControlProfiles", "description": "Retrieves a list of secureScoreControlProfile objects for a tenant.", "deprecated": false, "area": "security", "resource": "secureScoreControlProfiles" }, { "path": "/security/secureScoreControlProfiles/{id}", "method": "PATCH", "delegated": [ "SecurityEvents.ReadWrite.All" ], "application": [ "SecurityEvents.ReadWrite.All" ], "summary": "Update secureScoreControlProfiles", "description": "Update an editable secureScoreControlProfiles property within any integrated solution to change various properties, such as assignedTo or tenantNote.", "deprecated": false, "area": "security", "resource": "secureScoreControlProfiles" }, { "path": "/security/secureScores", "method": "GET", "delegated": [ "SecurityEvents.Read.All" ], "application": [ "SecurityEvents.Read.All" ], "summary": "List secureScores", "description": "Retrieve the properties and relationships of a secureScore object.", "deprecated": false, "area": "security", "resource": "secureScores" }, { "path": "/security/securityActions", "method": "GET", "delegated": [], "application": [ "SecurityActions.Read.All" ], "summary": "List securityActions", "description": "Retrieve a list of securityAction objects.", "deprecated": false, "area": "security", "resource": "securityActions" }, { "path": "/security/securityActions", "method": "POST", "delegated": [], "application": [ "SecurityActions.ReadWrite.All" ], "summary": "Create securityAction", "description": "Create a new securityAction object.", "deprecated": false, "area": "security", "resource": "securityActions" }, { "path": "/security/securityActions/{id}", "method": "GET", "delegated": [], "application": [ "SecurityActions.Read.All" ], "summary": "Get securityAction", "description": "Retrieve the properties and relationships of a securityAction object.", "deprecated": false, "area": "security", "resource": "securityActions" }, { "path": "/security/securityActions/{id}/cancelSecurityAction", "method": "POST", "delegated": [], "application": [ "SecurityActions.ReadWrite.All" ], "summary": "Invoke action cancelSecurityAction", "description": "Cancel a security operation.", "deprecated": false, "area": "security", "resource": "securityActions" }, { "path": "/security/securityCopilot/workspaces", "method": "GET", "delegated": [ "SecurityCopilotWorkspaces.Read.All" ], "application": [ "SecurityCopilotWorkspaces.Read.All" ], "summary": "List workspace objects", "description": "Get a list of the workspace objects and their properties.", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/securityCopilot/workspaces/{workspaceId}/plugins", "method": "GET", "delegated": [ "SecurityCopilotWorkspaces.Read.All" ], "application": [ "SecurityCopilotWorkspaces.Read.All" ], "summary": "Get plugins from security", "description": "Represents plugins in Security Copilot.", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/securityCopilot/workspaces/{workspaceId}/sessions", "method": "GET", "delegated": [ "SecurityCopilotWorkspaces.Read.All" ], "application": [ "SecurityCopilotWorkspaces.Read.All" ], "summary": "Get sessions from security", "description": "Represents sessions in Security Copilot.", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/securityCopilot/workspaces/{workspaceId}/sessions", "method": "POST", "delegated": [ "SecurityCopilotWorkspaces.ReadWrite.All" ], "application": [ "SecurityCopilotWorkspaces.ReadWrite.All" ], "summary": "Create new navigation property to sessions for security", "description": "", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/securityCopilot/workspaces/{workspaceId}/sessions/{sessionId}", "method": "GET", "delegated": [ "SecurityCopilotWorkspaces.Read.All" ], "application": [ "SecurityCopilotWorkspaces.Read.All" ], "summary": "Get sessions from security", "description": "Represents sessions in Security Copilot.", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/securityCopilot/workspaces/{workspaceId}/sessions/{sessionId}", "method": "PATCH", "delegated": [ "SecurityCopilotWorkspaces.ReadWrite.All" ], "application": [ "SecurityCopilotWorkspaces.ReadWrite.All" ], "summary": "Update the navigation property sessions in security", "description": "", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/securityCopilot/workspaces/{workspaceId}/sessions/{sessionId}/prompts", "method": "GET", "delegated": [ "SecurityCopilotWorkspaces.Read.All" ], "application": [ "SecurityCopilotWorkspaces.Read.All" ], "summary": "Get prompts from security", "description": "The collection of prompts in the session.", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/securityCopilot/workspaces/{workspaceId}/sessions/{sessionId}/prompts", "method": "POST", "delegated": [ "SecurityCopilotWorkspaces.ReadWrite.All" ], "application": [ "SecurityCopilotWorkspaces.ReadWrite.All" ], "summary": "Create new navigation property to prompts for security", "description": "", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/securityCopilot/workspaces/{workspaceId}/sessions/{sessionId}/prompts/{promptId}", "method": "GET", "delegated": [ "SecurityCopilotWorkspaces.Read.All" ], "application": [ "SecurityCopilotWorkspaces.Read.All" ], "summary": "Get prompts from security", "description": "The collection of prompts in the session.", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/securityCopilot/workspaces/{workspaceId}/sessions/{sessionId}/prompts/{promptId}/evaluations", "method": "GET", "delegated": [ "SecurityCopilotWorkspaces.Read.All" ], "application": [ "SecurityCopilotWorkspaces.Read.All" ], "summary": "Get evaluations from security", "description": "Collection of evaluations", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/securityCopilot/workspaces/{workspaceId}/sessions/{sessionId}/prompts/{promptId}/evaluations", "method": "POST", "delegated": [ "SecurityCopilotWorkspaces.ReadWrite.All" ], "application": [ "SecurityCopilotWorkspaces.ReadWrite.All" ], "summary": "Create new navigation property to evaluations for security", "description": "", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/securityCopilot/workspaces/{workspaceId}/sessions/{sessionId}/prompts/{promptId}/evaluations/{evaluationId}", "method": "GET", "delegated": [ "SecurityCopilotWorkspaces.Read.All" ], "application": [ "SecurityCopilotWorkspaces.Read.All" ], "summary": "Get evaluations from security", "description": "Collection of evaluations", "deprecated": false, "area": "security", "resource": "securityCopilot" }, { "path": "/security/subjectRightsRequests", "method": "GET", "delegated": [ "SubjectRightsRequest.Read.All" ], "application": [], "summary": "Get subjectRightsRequests from security", "description": "", "deprecated": false, "area": "security", "resource": "subjectRightsRequests" }, { "path": "/security/subjectRightsRequests", "method": "POST", "delegated": [ "SubjectRightsRequest.ReadWrite.All" ], "application": [], "summary": "Create new navigation property to subjectRightsRequests for security", "description": "", "deprecated": false, "area": "security", "resource": "subjectRightsRequests" }, { "path": "/security/subjectRightsRequests/{subjectRightsRequestId}", "method": "GET", "delegated": [ "SubjectRightsRequest.Read.All" ], "application": [], "summary": "Get subjectRightsRequests from security", "description": "", "deprecated": false, "area": "security", "resource": "subjectRightsRequests" }, { "path": "/security/subjectRightsRequests/{subjectRightsRequestId}", "method": "PATCH", "delegated": [ "SubjectRightsRequest.ReadWrite.All" ], "application": [], "summary": "Update the navigation property subjectRightsRequests in security", "description": "", "deprecated": false, "area": "security", "resource": "subjectRightsRequests" }, { "path": "/security/subjectRightsRequests/{subjectRightsRequestId}/getFinalAttachment", "method": "GET", "delegated": [ "SubjectRightsRequest.Read.All" ], "application": [], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "subjectRightsRequests" }, { "path": "/security/subjectRightsRequests/{subjectRightsRequestId}/getFinalReport", "method": "GET", "delegated": [ "SubjectRightsRequest.Read.All" ], "application": [], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "subjectRightsRequests" }, { "path": "/security/subjectRightsRequests/{subjectRightsRequestId}/notes", "method": "GET", "delegated": [ "SubjectRightsRequest.Read.All" ], "application": [], "summary": "Get notes from security", "description": "List of notes associated with the request.", "deprecated": false, "area": "security", "resource": "subjectRightsRequests" }, { "path": "/security/subjectRightsRequests/{subjectRightsRequestId}/notes", "method": "POST", "delegated": [ "SubjectRightsRequest.ReadWrite.All" ], "application": [], "summary": "Create new navigation property to notes for security", "description": "", "deprecated": false, "area": "security", "resource": "subjectRightsRequests" }, { "path": "/security/threatIntelligence/articleIndicators/{articleIndicatorId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get articleIndicator", "description": "Read the properties and relationships of an articleIndicator object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/articles", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List articles", "description": "Get a list of article objects, including their properties and relationships.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/articles/{articleId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get article", "description": "Read the properties and relationships of an article object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/articles/{articleId}/indicators", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List indicators", "description": "Get a list of articleIndicator objects that represent indicators of threat or compromise related to the contents of an article.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hostComponents/{hostComponentId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get hostComponent", "description": "Read the properties and relationships of a hostComponent object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hostCookies/{hostCookieId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get hostCookie", "description": "Read the properties and relationships of a hostCookie object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hostPairs/{hostPairId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get hostPair", "description": "Read the properties and relationships of a hostPair object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hostPorts/{hostPortId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get hostPort", "description": "Read the properties and relationships of a hostPort object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hostSslCertificates/{hostSslCertificateId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get hostSslCertificate", "description": "Get the properties and relationships of a hostSslCertificate object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hostTrackers/{hostTrackerId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get hostTracker", "description": "Read the properties and relationships of a hostTracker object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get host", "description": "Read the properties and relationships of a host object. The host resource is the abstract base type that returns an implementation. A host can be of one of the following types:", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/childHostPairs", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List childHostPairs", "description": "Get the list of hostPair resources associated with a specified host, where that host is the *parent* and has an outgoing pairing to a *child*.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/components", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List components", "description": "Get a list of hostComponent resources.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/cookies", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List cookies", "description": "Get a list of hostCookie resources.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/hostPairs", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List hostPairs", "description": "Get the list of hostPair resources associated with a specified host, where that host is *either* the *parent* or the *child*.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/parentHostPairs", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List parentHostPairs", "description": "Get the list of hostPair resources associated with a specified host, where that host is the *child* and has an incoming pairing with a *parent*.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/passiveDns", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List passiveDns", "description": "Get a list of passiveDnsRecord resources associated with a host. This method is a forward DNS lookup that queries the IP address of the specified host using its hostname.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/passiveDnsReverse", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List passiveDnsReverse", "description": "Get a collection of passiveDnsRecord resources from a reverse passive DNS retrieval. A reverse DNS lookup queries the hostname of a host using an IP address.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/ports", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List hostPorts", "description": "Get the list of hostPort resources associated with a host.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/reputation", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get hostReputation", "description": "Get the properties and relationships of a hostReputation object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/sslCertificates", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List hostSslCertificates", "description": "Get a list of hostSslCertificate objects from the host navigation property.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/subdomains", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List subdomains", "description": "Get the list of subdomain resources associated with a host.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/trackers", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List trackers", "description": "Get a list of hostTracker resources.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/whois", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get whoisRecord", "description": "Get the specified whoisRecord resource. Specify the desired whoisRecord in one of the following two ways: - Identify a host and get its current whoisRecord. - Specify an id value to get the corresponding whoisRecord.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/hosts/{hostId}/whois/history", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/intelProfiles", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List intelProfiles", "description": "Get a list of the intelligenceProfile objects and their properties.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/intelProfiles/{intelligenceProfileId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get intelligenceProfile", "description": "Read the properties and relationships of a intelligenceProfile object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/intelProfiles/{intelligenceProfileId}/indicators", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List indicators", "description": "Get the intelligenceProfileIndicator resources from the indicators navigation property of an intelligenceProfile.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/intelligenceProfileIndicators/{intelligenceProfileIndicatorId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get intelligenceProfileIndicator", "description": "Read the properties and relationships of a intelligenceProfileIndicator object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/passiveDnsRecords/{passiveDnsRecordId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get passiveDnsRecord", "description": "Read the properties and relationships of a passiveDnsRecord object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/sslCertificates", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List sslCertificates", "description": "Get a list of sslCertificate objects and their properties.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/sslCertificates/{sslCertificateId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get sslCertificate", "description": "Get the properties and relationships of an sslCertificate object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/subdomains/{subdomainId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get subdomain", "description": "Read the properties and relationships of a subdomain object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/vulnerabilities/{vulnerabilityId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get vulnerability", "description": "Read the properties and relationships of a vulnerability object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "List components", "description": "Get a list of vulnerabilityComponent objects related to a known vulnerability.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/vulnerabilities/{vulnerabilityId}/components/{vulnerabilityComponentId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get vulnerabilityComponent", "description": "Read the properties and relationships of a vulnerabilityComponent object.", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/whoisHistoryRecord/{whoisHistoryRecordId}", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatIntelligence/whoisRecords?$search=\"{value}\"", "method": "GET", "delegated": [ "ThreatIntelligence.Read.All" ], "application": [ "ThreatIntelligence.Read.All" ], "summary": "Get security", "description": "", "deprecated": false, "area": "security", "resource": "threatIntelligence" }, { "path": "/security/threatSubmission/emailThreatSubmissionPolicies", "method": "POST", "delegated": [ "ThreatSubmissionPolicy.ReadWrite.All" ], "application": [ "ThreatSubmissionPolicy.ReadWrite.All" ], "summary": "Create new navigation property to emailThreatSubmissionPolicies for security", "description": "", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/emailThreatSubmissionPolicies/{emailThreatSubmissionPoliciesId}", "method": "GET", "delegated": [ "ThreatSubmissionPolicy.ReadWrite.All" ], "application": [ "ThreatSubmission.Read.All" ], "summary": "Get emailThreatSubmissionPolicy", "description": "Read the properties and relationships of an emailThreatSubmissionPolicy object.", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/emailThreatSubmissionPolicies/{id}", "method": "DELETE", "delegated": [ "ThreatSubmissionPolicies.ReadWrite.All" ], "application": [ "ThreatSubmissionPolicy.ReadWrite.All" ], "summary": "Delete navigation property emailThreatSubmissionPolicies for security", "description": "", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/emailThreats", "method": "GET", "delegated": [ "ThreatSubmission.Read" ], "application": [ "ThreatSubmission.Read.All" ], "summary": "List emailThreatSubmissions", "description": "Get a list of the emailThreatSubmission objects and their properties.", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/emailThreats", "method": "POST", "delegated": [ "ThreatSubmission.ReadWrite" ], "application": [ "ThreatSubmission.ReadWrite.All" ], "summary": "Create emailThreatSubmission", "description": "Create a new emailThreatSubmission object.", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/emailThreats/{emailThreatsId}", "method": "GET", "delegated": [ "ThreatSubmission.Read" ], "application": [ "ThreatSubmission.Read.All" ], "summary": "Get emailThreatSubmission", "description": "Read the properties and relationships of an emailThreatSubmission object.", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/emailThreats/{emailThreatsId}/review", "method": "POST", "delegated": [ "ThreatSubmission.ReadWrite.All" ], "application": [ "ThreatSubmission.ReadWrite.All" ], "summary": "Create emailThreatSubmission", "description": "Create a new emailThreatSubmission object.", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/fileThreats", "method": "GET", "delegated": [ "ThreatSubmission.Read" ], "application": [ "ThreatSubmission.Read.All" ], "summary": "List fileThreatSubmissions", "description": "Get a list of the fileThreatSubmission objects and their properties.", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/fileThreats", "method": "POST", "delegated": [ "ThreatSubmission.ReadWrite" ], "application": [ "ThreatSubmission.ReadWrite.All" ], "summary": "Create fileThreatSubmission", "description": "Create a new fileThreatSubmission object.", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/fileThreats/{fileThreatsId}", "method": "GET", "delegated": [ "ThreatSubmission.Read" ], "application": [ "ThreatSubmission.Read.All" ], "summary": "Get fileThreatSubmission", "description": "Read the properties and relationships of a fileThreatSubmission object.", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/urlThreats", "method": "GET", "delegated": [ "ThreatSubmission.Read" ], "application": [ "ThreatSubmission.Read.All" ], "summary": "List urlThreatSubmissions", "description": "Get a list of the urlThreatSubmission objects and their properties.", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/urlThreats", "method": "POST", "delegated": [ "ThreatSubmission.ReadWrite" ], "application": [ "ThreatSubmission.ReadWrite.All" ], "summary": "Create urlThreatSubmission", "description": "Create a new urlThreatSubmission object.", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/threatSubmission/urlThreats/{urlThreatsId}", "method": "GET", "delegated": [ "ThreatSubmission.Read" ], "application": [ "ThreatSubmission.Read.All" ], "summary": "Get urlThreatSubmission", "description": "Read the properties and relationships of an urlThreatSubmission object.", "deprecated": false, "area": "security", "resource": "threatSubmission" }, { "path": "/security/tiIndicators", "method": "GET", "delegated": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "application": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "summary": "List threat intelligence indicators (deprecated)", "description": "Retrieve a list of tiIndicator objects.", "deprecated": true, "area": "security", "resource": "tiIndicators" }, { "path": "/security/tiIndicators", "method": "POST", "delegated": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "application": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "summary": "Create threat intelligence indicator (deprecated)", "description": "Create a new tiIndicator object.", "deprecated": true, "area": "security", "resource": "tiIndicators" }, { "path": "/security/tiIndicators/deleteTiIndicators", "method": "POST", "delegated": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "application": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "summary": "Invoke action deleteTiIndicators", "description": "Delete multiple threat intelligence (TI) indicators in one request instead of multiple requests.", "deprecated": false, "area": "security", "resource": "tiIndicators" }, { "path": "/security/tiIndicators/deleteTiIndicatorsByExternalId", "method": "POST", "delegated": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "application": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "summary": "Invoke action deleteTiIndicatorsByExternalId", "description": "Delete multiple threat intelligence (TI) indicators in one request instead of multiple requests, when the request contains external IDs instead of IDs.", "deprecated": false, "area": "security", "resource": "tiIndicators" }, { "path": "/security/tiIndicators/submitTiIndicators", "method": "POST", "delegated": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "application": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "summary": "Invoke action submitTiIndicators", "description": "Upload multiple threat intelligence (TI) indicators in one request instead of multiple requests.", "deprecated": false, "area": "security", "resource": "tiIndicators" }, { "path": "/security/tiIndicators/updateTiIndicators", "method": "POST", "delegated": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "application": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "summary": "Invoke action updateTiIndicators", "description": "Update multiple threat intelligence (TI) indicators in one request instead of multiple requests.", "deprecated": false, "area": "security", "resource": "tiIndicators" }, { "path": "/security/tiIndicators/{id}", "method": "DELETE", "delegated": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "application": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "summary": "Delete threat intelligence indicator (deprecated)", "description": "Delete a tiIndicator object.", "deprecated": true, "area": "security", "resource": "tiIndicators" }, { "path": "/security/tiIndicators/{id}", "method": "GET", "delegated": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "application": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "summary": "Get threat intelligence indicator (deprecated)", "description": "Retrieve the properties and relationships of a tiIndicator object.", "deprecated": true, "area": "security", "resource": "tiIndicators" }, { "path": "/security/tiIndicators/{id}", "method": "PATCH", "delegated": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "application": [ "ThreatIndicators.ReadWrite.OwnedBy" ], "summary": "Update tiIndicator (deprecated)", "description": "Update the properties of a tiIndicator object.", "deprecated": true, "area": "security", "resource": "tiIndicators" }, { "path": "/security/triggerTypes/retentionEventTypes", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "List retentionEventTypes", "description": "Get a list of the retentionEventType objects and their properties.", "deprecated": false, "area": "security", "resource": "triggerTypes" }, { "path": "/security/triggerTypes/retentionEventTypes", "method": "POST", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Create retentionEventType", "description": "Create a new retentionEventType object.", "deprecated": false, "area": "security", "resource": "triggerTypes" }, { "path": "/security/triggers/retentionEvents", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "List retentionEvents", "description": "Get a list of the retentionEvent objects and their properties.", "deprecated": false, "area": "security", "resource": "triggers" }, { "path": "/security/triggers/retentionEvents", "method": "POST", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Create retentionEvent", "description": "Create a new retentionEvent object.", "deprecated": false, "area": "security", "resource": "triggers" }, { "path": "/security/triggers/retentionEvents/{retentionEventId}", "method": "DELETE", "delegated": [ "RecordsManagement.ReadWrite.All" ], "application": [ "RecordsManagement.ReadWrite.All" ], "summary": "Delete retentionEvent", "description": "Delete a retentionEvent object.", "deprecated": false, "area": "security", "resource": "triggers" }, { "path": "/security/triggers/retentionEvents/{retentionEventId}", "method": "GET", "delegated": [ "RecordsManagement.Read.All" ], "application": [ "RecordsManagement.Read.All" ], "summary": "Get retentionEvent", "description": "Read the properties and relationships of a retentionEvent object.", "deprecated": false, "area": "security", "resource": "triggers" }, { "path": "/security/zones", "method": "GET", "delegated": [ "Zone.Read.All" ], "application": [ "Zone.Read.All" ], "summary": "List zones", "description": "Get a list of the zone objects and their properties.", "deprecated": false, "area": "security", "resource": "zones" }, { "path": "/security/zones", "method": "POST", "delegated": [ "Zone.ReadWrite.All" ], "application": [ "Zone.ReadWrite.All" ], "summary": "Create zone", "description": "Create a new zone object. You can create up to 1,000 zones per tenant.", "deprecated": false, "area": "security", "resource": "zones" }, { "path": "/security/zones/{zoneId}", "method": "DELETE", "delegated": [ "Zone.ReadWrite.All" ], "application": [ "Zone.ReadWrite.All" ], "summary": "Delete zone", "description": "Delete a zone object by providing the zoneId.", "deprecated": false, "area": "security", "resource": "zones" }, { "path": "/security/zones/{zoneId}", "method": "GET", "delegated": [ "Zone.Read.All" ], "application": [ "Zone.Read.All" ], "summary": "Get zone", "description": "Get a zone object by a specific zoneId.", "deprecated": false, "area": "security", "resource": "zones" }, { "path": "/security/zones/{zoneId}", "method": "PATCH", "delegated": [ "Zone.ReadWrite.All" ], "application": [ "Zone.ReadWrite.All" ], "summary": "Update zone", "description": "Update the properties of a zone object.", "deprecated": false, "area": "security", "resource": "zones" }, { "path": "/security/zones/{zoneId}/environments", "method": "GET", "delegated": [ "Zone.Read.All" ], "application": [ "Zone.Read.All" ], "summary": "List environments", "description": "Get all environment objects associated with a zone object.", "deprecated": false, "area": "security", "resource": "zones" }, { "path": "/security/zones/{zoneId}/environments", "method": "POST", "delegated": [ "Zone.ReadWrite.All" ], "application": [ "Zone.ReadWrite.All" ], "summary": "Create environment", "description": "Create an environment object to attach it to a zone. You can create up to 1,000 environments per zone.", "deprecated": false, "area": "security", "resource": "zones" }, { "path": "/security/zones/{zoneId}/environments/{environmentId}", "method": "DELETE", "delegated": [ "Zone.ReadWrite.All" ], "application": [ "Zone.ReadWrite.All" ], "summary": "Delete environment", "description": "Delete an environment object from a zone object by providing the environment ID. The environment ID should be URL-encoded.", "deprecated": false, "area": "security", "resource": "zones" }, { "path": "/security/zones/{zoneId}/environments/{environmentId}", "method": "GET", "delegated": [ "Zone.Read.All" ], "application": [ "Zone.Read.All" ], "summary": "Get environments from security", "description": "Collection of attached environments. Supports $expand.", "deprecated": false, "area": "security", "resource": "zones" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration", "method": "GET", "delegated": [ "Application.Read.All" ], "application": [ "Application.Read.All" ], "summary": "Get remoteDesktopSecurityConfiguration", "description": "Read the properties and relationships of a remoteDesktopSecurityConfiguration object on a servicePrincipal. Use this configuration to view the Microsoft Entra ID Remote Desktop Services (RDS) authentication protocol to authenticate a user to Microsoft Entra joined or Microsoft Entra hybrid joined...", "deprecated": false, "area": "Other", "resource": "remoteDesktopSecurityConfiguration" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration", "method": "PATCH", "delegated": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "application": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "summary": "Update remoteDesktopSecurityConfiguration", "description": "Update the properties of a remoteDesktopSecurityConfiguration object on the servicePrincipal. Use this configuration to enable or disable the Microsoft Entra ID Remote Desktop Services (RDS) authentication protocol to authenticate a user to Microsoft Entra joined or Microsoft Entra hybrid joined ...", "deprecated": false, "area": "Other", "resource": "remoteDesktopSecurityConfiguration" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration", "method": "POST", "delegated": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "application": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "summary": "Create servicePrincipal", "description": "Create a new servicePrincipal object. This API can also create an agentIdentityBlueprintPrincipal object from an agentIdentityBlueprint when the @odata.type property is set to #microsoft.graph.agentIdentityBlueprintPrincipal.", "deprecated": false, "area": "Other", "resource": "remoteDesktopSecurityConfiguration" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration/$ref", "method": "DELETE", "delegated": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "application": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "summary": "", "description": "", "deprecated": false, "area": "Other", "resource": "$ref" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration/approvedClientApps", "method": "GET", "delegated": [ "Application.Read.All" ], "application": [ "Application.Read.All" ], "summary": "List approvedClientApps", "description": "Get a list of the approvedClientApp objects and their properties on the remoteDesktopSecurityConfiguration resource on a service principal.", "deprecated": false, "area": "Other", "resource": "approvedClientApps" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration/approvedClientApps", "method": "POST", "delegated": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "application": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "summary": "Create approvedClientApp", "description": "Create a new approvedClientApp object for the remoteDesktopSecurityConfiguration object on a service principal. You can configure a maximum of 20 approved client apps.", "deprecated": false, "area": "Other", "resource": "approvedClientApps" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration/approvedClientApps/{approvedClientAppId}", "method": "DELETE", "delegated": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "application": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "summary": "Delete approvedClientApp", "description": "Delete a approvedClientApp object for the remoteDesktopSecurityConfiguration object on a service principal.", "deprecated": false, "area": "Other", "resource": "approvedClientApps" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration/approvedClientApps/{approvedClientAppId}", "method": "GET", "delegated": [ "Application.Read.All" ], "application": [ "Application.Read.All" ], "summary": "Get approvedClientApp", "description": "Read the properties and relationships of a approvedClientApp object for the remoteDesktopSecurityConfiguration object on a servicePrincipal.", "deprecated": false, "area": "Other", "resource": "approvedClientApps" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration/approvedClientApps/{approvedClientAppId}", "method": "PATCH", "delegated": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "application": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "summary": "Update approvedClientApp", "description": "Update the properties of an approvedClientApp object for a remotedesktopsecurityconfiguration.", "deprecated": false, "area": "Other", "resource": "approvedClientApps" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration/targetDeviceGroups", "method": "GET", "delegated": [ "Application.Read.All" ], "application": [ "Application.Read.All" ], "summary": "List targetDeviceGroups", "description": "Get a list of the targetDeviceGroup objects and their properties on the remoteDesktopSecurityConfiguration resource on the servicePrincipal. Any user authenticating using the Microsoft Entra ID Remote Desktop Services (RDS) authentication protocol to a Microsoft Entra joined or Microsoft Entra hy...", "deprecated": false, "area": "Other", "resource": "targetDeviceGroups" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration/targetDeviceGroups", "method": "POST", "delegated": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "application": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "summary": "Create targetDeviceGroup", "description": "Create a new targetDeviceGroup object for the remoteDesktopSecurityConfiguration object on the servicePrincipal. You can configure a maximum of 10 target device groups for the remoteDesktopSecurityConfiguration object on the servicePrincipal.", "deprecated": false, "area": "Other", "resource": "targetDeviceGroups" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration/targetDeviceGroups/{targetDeviceGroupId}", "method": "GET", "delegated": [ "Application.Read.All" ], "application": [ "Application.Read.All" ], "summary": "Get targetDeviceGroup", "description": "Read the properties and relationships of a targetDeviceGroup object for the remoteDesktopSecurityConfiguration object on the servicePrincipal.", "deprecated": false, "area": "Other", "resource": "targetDeviceGroups" }, { "path": "/servicePrincipals/{id}/remoteDesktopSecurityConfiguration/targetDeviceGroups/{targetDeviceGroupId}/$ref", "method": "DELETE", "delegated": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "application": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "summary": "", "description": "", "deprecated": false, "area": "Other", "resource": "$ref" }, { "path": "/servicePrincipals/{servicePrincipalsId}/remoteDesktopSecurityConfiguration/targetDeviceGroups/{targetDeviceGroupId}", "method": "PATCH", "delegated": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "application": [ "Application-RemoteDesktopConfig.ReadWrite.All" ], "summary": "Update targetDeviceGroup", "description": "Update the properties of a targetDeviceGroup object for remoteDesktopSecurityConfiguration object on the servicePrincipal. You can configure a maximum of 10 target device groups for the remoteDesktopSecurityConfiguraiton object on the servicePrincipal.", "deprecated": false, "area": "Other", "resource": "targetDeviceGroups" }, { "path": "/tenantRelationships/managedTenants/auditEvents", "method": "GET", "delegated": [ "ManagedTenant.Read.All" ], "application": [], "summary": "List auditEvents", "description": "Get a list of the auditEvent objects and their properties.", "deprecated": false, "area": "Other", "resource": "auditEvents" }, { "path": "/tenantRelationships/managedTenants/auditEvents/{auditEventId}", "method": "GET", "delegated": [ "ManagedTenants.Read.All" ], "application": [], "summary": "Get auditEvent", "description": "Read the properties and relationships of an auditEvent object.", "deprecated": false, "area": "Other", "resource": "auditEvents" }, { "path": "/users/{usersId}/security/informationProtection/labelPolicySettings", "method": "GET", "delegated": [ "InformationProtectionPolicy.Read" ], "application": [ "InformationProtectionPolicy.Read.All" ], "summary": "Get informationProtectionPolicySetting", "description": "Read the properties and relationships of an informationProtectionPolicySetting object. The settings exposed by this API should be used in applications to populate the moreInfoUrl property for Microsoft Purview Information Protection help, and indicate whether labeling is mandatory for the user an...", "deprecated": false, "area": "security", "resource": "informationProtection" }, { "path": "/users/{usersId}/security/informationProtection/sensitivityLabels", "method": "GET", "delegated": [ "InformationProtectionPolicy.Read" ], "application": [ "InformationProtectionPolicy.Read.All" ], "summary": "List sensitivityLabels", "description": "Get a list of sensitivityLabel objects associated with a user or organization.", "deprecated": false, "area": "security", "resource": "informationProtection" }, { "path": "/users/{usersId}/security/informationProtection/sensitivityLabels/evaluateApplication", "method": "POST", "delegated": [ "InformationProtectionPolicy.Read" ], "application": [ "InformationProtectionPolicy.Read.All" ], "summary": "Create user", "description": "Create a new user. If you specify an @odata.type property with a value of #microsoft.graph.agentUser with the required properties, this API creates an agentUser object. At a minimum, you must specify the required properties. You can optionally specify any other writable properties. This operation...", "deprecated": false, "area": "security", "resource": "informationProtection" }, { "path": "/users/{usersId}/security/informationProtection/sensitivityLabels/evaluateClassificationResults", "method": "POST", "delegated": [ "InformationProtectionPolicy.Read" ], "application": [ "InformationProtectionPolicy.Read.All" ], "summary": "Create user", "description": "Create a new user. If you specify an @odata.type property with a value of #microsoft.graph.agentUser with the required properties, this API creates an agentUser object. At a minimum, you must specify the required properties. You can optionally specify any other writable properties. This operation...", "deprecated": false, "area": "security", "resource": "informationProtection" }, { "path": "/users/{usersId}/security/informationProtection/sensitivityLabels/evaluateRemoval", "method": "POST", "delegated": [ "InformationProtectionPolicy.Read" ], "application": [ "InformationProtectionPolicy.Read.All" ], "summary": "Create user", "description": "Create a new user. If you specify an @odata.type property with a value of #microsoft.graph.agentUser with the required properties, this API creates an agentUser object. At a minimum, you must specify the required properties. You can optionally specify any other writable properties. This operation...", "deprecated": false, "area": "security", "resource": "informationProtection" }, { "path": "/users/{usersId}/security/informationProtection/sensitivityLabels/extractContentLabel", "method": "POST", "delegated": [ "InformationProtectionPolicy.Read" ], "application": [ "InformationProtectionPolicy.Read.All" ], "summary": "Create user", "description": "Create a new user. If you specify an @odata.type property with a value of #microsoft.graph.agentUser with the required properties, this API creates an agentUser object. At a minimum, you must specify the required properties. You can optionally specify any other writable properties. This operation...", "deprecated": false, "area": "security", "resource": "informationProtection" }, { "path": "/users/{usersId}/security/informationProtection/sensitivityLabels/{sensitivityLabelId}", "method": "GET", "delegated": [ "InformationProtectionPolicy.Read" ], "application": [ "InformationProtectionPolicy.Read.All" ], "summary": "Get sensitivityLabels from users", "description": "Read the Microsoft Purview Information Protection labels for the user or organization.", "deprecated": false, "area": "security", "resource": "informationProtection" } ]