ahmido
6a15fe978a
## Summary Automated scanning of Entra ID directory roles to surface high-privilege role assignments as trackable findings with alerting support. ## What's included ### Core Services - **EntraAdminRolesReportService** — Fetches role definitions + assignments via Graph API, builds payload with fingerprint deduplication - **EntraAdminRolesFindingGenerator** — Creates/resolves/reopens findings based on high-privilege role catalog - **HighPrivilegeRoleCatalog** — Curated list of high-privilege Entra roles (Global Admin, Privileged Auth Admin, etc.) - **ScanEntraAdminRolesJob** — Queued job orchestrating scan → report → findings → alerts pipeline ### UI - **AdminRolesSummaryWidget** — Tenant dashboard card showing last scan time, high-privilege assignment count, scan trigger button - RBAC-gated: `ENTRA_ROLES_VIEW` for viewing, `ENTRA_ROLES_MANAGE` for scan trigger ### Infrastructure - Graph contracts for `entraRoleDefinitions` + `entraRoleAssignments` - `config/entra_permissions.php` — Entra permission registry - `StoredReport.fingerprint` migration (deduplication support) - `OperationCatalog` label + duration for `entra.admin_roles.scan` - Artisan command `entra:scan-admin-roles` for CLI/scheduled use ### Global UX improvement - **SummaryCountsNormalizer**: Zero values filtered, snake_case keys humanized (e.g. `report_deduped: 1` → `Report deduped: 1`). Affects all operation notifications. ## Test Coverage - **12 test files**, **79+ tests**, **307+ assertions** - Report service, finding generator, job orchestration, widget rendering, alert integration, RBAC enforcement, badge mapping ## Spec artifacts - `specs/105-entra-admin-roles-evidence-findings/tasks.md` — Full task breakdown (38 tasks, all complete) - `specs/105-entra-admin-roles-evidence-findings/checklists/requirements.md` — All items checked ## Files changed 46 files changed, 3641 insertions(+), 15 deletions(-) Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #128
867 lines
42 KiB
PHP
867 lines
42 KiB
PHP
<?php
|
|
|
|
return [
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Graph Contract Registry
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Central place to describe Graph endpoints, allowed selects/expands, and
|
|
| type families for supported policy types. Used for capability fallbacks
|
|
| and drift checks.
|
|
|
|
|
*/
|
|
'probes' => [
|
|
'organization' => [
|
|
'path' => 'organization',
|
|
],
|
|
'service_principal_by_app_id' => [
|
|
'path' => "servicePrincipals?\$filter=appId eq '{appId}'",
|
|
],
|
|
'service_principal_app_role_assignments' => [
|
|
'path' => 'servicePrincipals/{servicePrincipalId}/appRoleAssignments',
|
|
],
|
|
],
|
|
'types' => [
|
|
'directoryGroups' => [
|
|
'resource' => 'groups',
|
|
'allowed_select' => ['id', 'displayName', 'groupTypes', 'securityEnabled', 'mailEnabled'],
|
|
'allowed_expand' => [],
|
|
],
|
|
'directoryRoleDefinitions' => [
|
|
'resource' => 'deviceManagement/roleDefinitions',
|
|
'allowed_select' => ['id', 'displayName', 'isBuiltIn'],
|
|
'allowed_expand' => [],
|
|
],
|
|
'managedDevices' => [
|
|
'resource' => 'deviceManagement/managedDevices',
|
|
'allowed_select' => ['id', 'complianceState'],
|
|
'allowed_expand' => [],
|
|
],
|
|
'configurationPolicyTemplate' => [
|
|
'resource' => 'deviceManagement/configurationPolicyTemplates',
|
|
'allowed_select' => ['id', 'displayName', 'displayVersion', 'templateFamily'],
|
|
'allowed_expand' => [],
|
|
'subresources' => [
|
|
'settingTemplates' => [
|
|
'path' => 'deviceManagement/configurationPolicyTemplates/{id}/settingTemplates',
|
|
'collection' => true,
|
|
'paging' => true,
|
|
'allowed_select' => [],
|
|
'allowed_expand' => ['settingDefinitions'],
|
|
],
|
|
],
|
|
],
|
|
'settingsCatalogDefinition' => [
|
|
'resource' => 'deviceManagement/configurationSettings',
|
|
'allowed_select' => ['id', 'displayName', 'description', 'helpText', 'categoryId', 'uxBehavior'],
|
|
'allowed_expand' => [],
|
|
],
|
|
'settingsCatalogCategory' => [
|
|
'resource' => 'deviceManagement/configurationCategories',
|
|
'allowed_select' => ['id', 'displayName', 'description'],
|
|
'allowed_expand' => [],
|
|
],
|
|
'rbacRoleAssignment' => [
|
|
'resource' => 'deviceManagement/roleAssignments',
|
|
'allowed_select' => ['id', 'displayName', 'resourceScopes', 'members'],
|
|
'allowed_expand' => ['roleDefinition($select=id,displayName)'],
|
|
],
|
|
'entraRoleDefinitions' => [
|
|
'resource' => 'roleManagement/directory/roleDefinitions',
|
|
'allowed_select' => ['id', 'displayName', 'templateId', 'isBuiltIn'],
|
|
'allowed_expand' => [],
|
|
],
|
|
'entraRoleAssignments' => [
|
|
'resource' => 'roleManagement/directory/roleAssignments',
|
|
'allowed_select' => ['id', 'roleDefinitionId', 'principalId', 'directoryScopeId'],
|
|
'allowed_expand' => ['principal'],
|
|
],
|
|
'deviceConfiguration' => [
|
|
'resource' => 'deviceManagement/deviceConfigurations',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'version', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceConfiguration',
|
|
'#microsoft.graph.windows10CustomConfiguration',
|
|
'#microsoft.graph.windows10GeneralConfiguration',
|
|
'#microsoft.graph.windowsHealthMonitoringConfiguration',
|
|
'#microsoft.graph.iosGeneralDeviceConfiguration',
|
|
'#microsoft.graph.androidGeneralDeviceConfiguration',
|
|
'#microsoft.graph.macOSGeneralDeviceConfiguration',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceManagement/deviceConfigurations/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceConfigurations/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_update_path' => '/deviceManagement/deviceConfigurations/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/deviceConfigurations/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
'supports_scope_tags' => true,
|
|
'scope_tag_field' => 'roleScopeTagIds',
|
|
],
|
|
'groupPolicyConfiguration' => [
|
|
'resource' => 'deviceManagement/groupPolicyConfigurations',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'createdDateTime', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.groupPolicyConfiguration',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'definitionValues',
|
|
],
|
|
'member_hydration_strategy' => 'subresource_definition_values',
|
|
'subresources' => [
|
|
'definitionValues' => [
|
|
'path' => 'deviceManagement/groupPolicyConfigurations/{id}/definitionValues?$expand=definition',
|
|
'collection' => true,
|
|
'paging' => true,
|
|
'allowed_select' => [],
|
|
'allowed_expand' => [],
|
|
],
|
|
'presentationValues' => [
|
|
'path' => 'deviceManagement/groupPolicyConfigurations/{id}/definitionValues/{definitionValueId}/presentationValues?$expand=presentation',
|
|
'collection' => true,
|
|
'paging' => true,
|
|
'allowed_select' => [],
|
|
'allowed_expand' => [],
|
|
],
|
|
],
|
|
'assignments_list_path' => '/deviceManagement/groupPolicyConfigurations/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/groupPolicyConfigurations/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_update_path' => '/deviceManagement/groupPolicyConfigurations/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/groupPolicyConfigurations/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
],
|
|
'settingsCatalogPolicy' => [
|
|
'resource' => 'deviceManagement/configurationPolicies',
|
|
'allowed_select' => ['id', 'name', 'description', '@odata.type', 'platforms', 'technologies', 'templateReference', 'roleScopeTagIds', 'lastModifiedDateTime'],
|
|
'allowed_expand' => ['settings'],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceManagementConfigurationPolicy',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_whitelist' => [
|
|
'name',
|
|
'description',
|
|
],
|
|
'update_map' => [
|
|
'displayName' => 'name',
|
|
],
|
|
'update_strip_keys' => [
|
|
'platforms',
|
|
'technologies',
|
|
'templateReference',
|
|
'assignments',
|
|
],
|
|
'member_hydration_strategy' => 'subresource_settings',
|
|
'subresources' => [
|
|
'settings' => [
|
|
'path' => 'deviceManagement/configurationPolicies/{id}/settings',
|
|
'collection' => true,
|
|
'paging' => true,
|
|
'allowed_select' => [],
|
|
'allowed_expand' => [],
|
|
],
|
|
],
|
|
'settings_write' => [
|
|
'path_template' => 'deviceManagement/configurationPolicies/{id}/settings',
|
|
'method' => 'POST',
|
|
'bulk' => true,
|
|
'body_shape' => 'collection',
|
|
'fallback_body_shape' => 'wrapped',
|
|
],
|
|
'update_strategy' => 'settings_catalog_policy_with_settings',
|
|
|
|
// Assignments CRUD (standard Graph pattern)
|
|
'assignments_list_path' => '/deviceManagement/configurationPolicies/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/configurationPolicies/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_update_path' => '/deviceManagement/configurationPolicies/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/configurationPolicies/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
|
|
// Scope Tags
|
|
'supports_scope_tags' => true,
|
|
'scope_tag_field' => 'roleScopeTagIds',
|
|
],
|
|
'endpointSecurityPolicy' => [
|
|
'resource' => 'deviceManagement/configurationPolicies',
|
|
'allowed_select' => ['id', 'name', 'description', '@odata.type', 'platforms', 'technologies', 'roleScopeTagIds', 'lastModifiedDateTime', 'templateReference'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceManagementConfigurationPolicy',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_whitelist' => [
|
|
'name',
|
|
'description',
|
|
],
|
|
'update_map' => [
|
|
'displayName' => 'name',
|
|
],
|
|
'update_strip_keys' => [
|
|
'platforms',
|
|
'technologies',
|
|
'templateReference',
|
|
'assignments',
|
|
],
|
|
'member_hydration_strategy' => 'subresource_settings',
|
|
'subresources' => [
|
|
'settings' => [
|
|
'path' => 'deviceManagement/configurationPolicies/{id}/settings',
|
|
'collection' => true,
|
|
'paging' => true,
|
|
'allowed_select' => [],
|
|
'allowed_expand' => [],
|
|
],
|
|
],
|
|
'settings_write' => [
|
|
'path_template' => 'deviceManagement/configurationPolicies/{id}/settings',
|
|
'method' => 'POST',
|
|
'bulk' => true,
|
|
'body_shape' => 'collection',
|
|
'fallback_body_shape' => 'wrapped',
|
|
],
|
|
|
|
// Assignments CRUD (standard Graph pattern)
|
|
'assignments_list_path' => '/deviceManagement/configurationPolicies/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/configurationPolicies/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_update_path' => '/deviceManagement/configurationPolicies/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/configurationPolicies/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
|
|
// Scope Tags
|
|
'supports_scope_tags' => true,
|
|
'scope_tag_field' => 'roleScopeTagIds',
|
|
],
|
|
'securityBaselinePolicy' => [
|
|
'resource' => 'deviceManagement/configurationPolicies',
|
|
'allowed_select' => ['id', 'name', 'description', '@odata.type', 'platforms', 'technologies', 'roleScopeTagIds', 'lastModifiedDateTime', 'templateReference'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceManagementConfigurationPolicy',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'member_hydration_strategy' => 'subresource_settings',
|
|
'subresources' => [
|
|
'settings' => [
|
|
'path' => 'deviceManagement/configurationPolicies/{id}/settings',
|
|
'collection' => true,
|
|
'paging' => true,
|
|
'allowed_select' => [],
|
|
'allowed_expand' => [],
|
|
],
|
|
],
|
|
|
|
// Assignments CRUD (standard Graph pattern)
|
|
'assignments_list_path' => '/deviceManagement/configurationPolicies/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/configurationPolicies/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_update_path' => '/deviceManagement/configurationPolicies/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/configurationPolicies/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
|
|
// Scope Tags
|
|
'supports_scope_tags' => true,
|
|
'scope_tag_field' => 'roleScopeTagIds',
|
|
],
|
|
'windowsUpdateRing' => [
|
|
'resource' => 'deviceManagement/deviceConfigurations',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'version', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.windowsUpdateForBusinessConfiguration',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'version',
|
|
'qualityUpdatesPauseStartDate',
|
|
'featureUpdatesPauseStartDate',
|
|
'qualityUpdatesWillBeRolledBack',
|
|
'featureUpdatesWillBeRolledBack',
|
|
],
|
|
'assignments_list_path' => '/deviceManagement/deviceConfigurations/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceConfigurations/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_update_path' => '/deviceManagement/deviceConfigurations/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/deviceConfigurations/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
'supports_scope_tags' => true,
|
|
'scope_tag_field' => 'roleScopeTagIds',
|
|
],
|
|
'windowsFeatureUpdateProfile' => [
|
|
'resource' => 'deviceManagement/windowsFeatureUpdateProfiles',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'createdDateTime', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.windowsFeatureUpdateProfile',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'deployableContentDisplayName',
|
|
'endOfSupportDate',
|
|
],
|
|
'assignments_list_path' => '/deviceManagement/windowsFeatureUpdateProfiles/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/windowsFeatureUpdateProfiles/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_update_path' => '/deviceManagement/windowsFeatureUpdateProfiles/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/windowsFeatureUpdateProfiles/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
],
|
|
'windowsQualityUpdateProfile' => [
|
|
'resource' => 'deviceManagement/windowsQualityUpdateProfiles',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'createdDateTime', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.windowsQualityUpdateProfile',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'releaseDateDisplayName',
|
|
'deployableContentDisplayName',
|
|
],
|
|
'assignments_list_path' => '/deviceManagement/windowsQualityUpdateProfiles/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/windowsQualityUpdateProfiles/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_update_path' => '/deviceManagement/windowsQualityUpdateProfiles/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/windowsQualityUpdateProfiles/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
],
|
|
'windowsDriverUpdateProfile' => [
|
|
'resource' => 'deviceManagement/windowsDriverUpdateProfiles',
|
|
'allowed_select' => [
|
|
'id',
|
|
'displayName',
|
|
'description',
|
|
'@odata.type',
|
|
'createdDateTime',
|
|
'lastModifiedDateTime',
|
|
'approvalType',
|
|
'deploymentDeferralInDays',
|
|
'roleScopeTagIds',
|
|
],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.windowsDriverUpdateProfile',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'deviceReporting',
|
|
'newUpdates',
|
|
'inventorySyncStatus',
|
|
],
|
|
'assignments_list_path' => '/deviceManagement/windowsDriverUpdateProfiles/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/windowsDriverUpdateProfiles/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_update_path' => '/deviceManagement/windowsDriverUpdateProfiles/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/windowsDriverUpdateProfiles/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
'supports_scope_tags' => true,
|
|
'scope_tag_field' => 'roleScopeTagIds',
|
|
],
|
|
'deviceCompliancePolicy' => [
|
|
'resource' => 'deviceManagement/deviceCompliancePolicies',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'version', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [
|
|
'scheduledActionsForRule',
|
|
'scheduledActionsForRule($expand=scheduledActionConfigurations)',
|
|
],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceCompliancePolicy',
|
|
'#microsoft.graph.windows10CompliancePolicy',
|
|
'#microsoft.graph.iosCompliancePolicy',
|
|
'#microsoft.graph.androidCompliancePolicy',
|
|
'#microsoft.graph.androidDeviceOwnerCompliancePolicy',
|
|
'#microsoft.graph.androidWorkProfileCompliancePolicy',
|
|
'#microsoft.graph.macOSCompliancePolicy',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceManagement/deviceCompliancePolicies/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceCompliancePolicies/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_update_path' => '/deviceManagement/deviceCompliancePolicies/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/deviceCompliancePolicies/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
'supports_scope_tags' => true,
|
|
'scope_tag_field' => 'roleScopeTagIds',
|
|
],
|
|
'appProtectionPolicy' => [
|
|
'resource' => 'deviceAppManagement/managedAppPolicies',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'version'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.managedAppPolicy',
|
|
'#microsoft.graph.targetedManagedAppProtection',
|
|
'#microsoft.graph.iosManagedAppProtection',
|
|
'#microsoft.graph.androidManagedAppProtection',
|
|
'#microsoft.graph.windowsManagedAppProtection',
|
|
'#microsoft.graph.windowsInformationProtectionPolicy',
|
|
'#microsoft.graph.mdmWindowsInformationProtectionPolicy',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'isAssigned',
|
|
'deployedAppCount',
|
|
'apps',
|
|
'apps@odata.context',
|
|
'protectedAppLockerFiles',
|
|
'exemptAppLockerFiles',
|
|
],
|
|
'assignments_list_path' => '/deviceAppManagement/managedAppPolicies/{id}/assignments',
|
|
'assignments_create_path' => '/deviceAppManagement/managedAppPolicies/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'assignments',
|
|
],
|
|
'mamAppConfiguration' => [
|
|
'resource' => 'deviceAppManagement/targetedManagedAppConfigurations',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'version', 'createdDateTime', 'lastModifiedDateTime', 'roleScopeTagIds'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.targetedManagedAppConfiguration',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceAppManagement/targetedManagedAppConfigurations/{id}/assignments',
|
|
'assignments_create_path' => '/deviceAppManagement/targetedManagedAppConfigurations/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'assignments',
|
|
'supports_scope_tags' => true,
|
|
'scope_tag_field' => 'roleScopeTagIds',
|
|
],
|
|
'managedDeviceAppConfiguration' => [
|
|
'resource' => 'deviceAppManagement/mobileAppConfigurations',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'createdDateTime', 'lastModifiedDateTime', 'roleScopeTagIds'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.managedDeviceMobileAppConfiguration',
|
|
'#microsoft.graph.mobileAppConfiguration',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceAppManagement/mobileAppConfigurations/{id}/assignments',
|
|
'assignments_create_path' => '/deviceAppManagement/mobileAppConfigurations/{id}/microsoft.graph.managedDeviceMobileAppConfiguration/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'assignments',
|
|
'supports_scope_tags' => true,
|
|
'scope_tag_field' => 'roleScopeTagIds',
|
|
],
|
|
'conditionalAccessPolicy' => [
|
|
'resource' => 'identity/conditionalAccess/policies',
|
|
'allowed_select' => ['id', 'displayName', 'state', 'createdDateTime', 'modifiedDateTime', '@odata.type'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.conditionalAccessPolicy',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
],
|
|
'deviceComplianceScript' => [
|
|
'resource' => 'deviceManagement/deviceComplianceScripts',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceComplianceScript',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceManagement/deviceComplianceScripts/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceComplianceScripts/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'deviceHealthScriptAssignments',
|
|
'assignments_update_path' => '/deviceManagement/deviceComplianceScripts/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/deviceComplianceScripts/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
],
|
|
'deviceManagementScript' => [
|
|
'resource' => 'deviceManagement/deviceManagementScripts',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceManagementScript',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceManagement/deviceManagementScripts/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceManagementScripts/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'deviceManagementScriptAssignments',
|
|
'assignments_update_path' => '/deviceManagement/deviceManagementScripts/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/deviceManagementScripts/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
],
|
|
'deviceShellScript' => [
|
|
'resource' => 'deviceManagement/deviceShellScripts',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceShellScript',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceManagement/deviceShellScripts/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceShellScripts/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'deviceManagementScriptAssignments',
|
|
'assignments_update_path' => '/deviceManagement/deviceShellScripts/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/deviceShellScripts/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
],
|
|
'deviceHealthScript' => [
|
|
'resource' => 'deviceManagement/deviceHealthScripts',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceHealthScript',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceManagement/deviceHealthScripts/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceHealthScripts/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'deviceHealthScriptAssignments',
|
|
'assignments_update_path' => '/deviceManagement/deviceHealthScripts/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/deviceHealthScripts/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
],
|
|
'deviceEnrollmentLimitConfiguration' => [
|
|
'resource' => 'deviceManagement/deviceEnrollmentConfigurations',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'version'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceEnrollmentLimitConfiguration',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceManagement/deviceEnrollmentConfigurations/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceEnrollmentConfigurations/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'enrollmentConfigurationAssignments',
|
|
],
|
|
'deviceEnrollmentPlatformRestrictionsConfiguration' => [
|
|
'resource' => 'deviceManagement/deviceEnrollmentConfigurations',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'version'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceEnrollmentPlatformRestrictionConfiguration',
|
|
'#microsoft.graph.deviceEnrollmentPlatformRestrictionsConfiguration',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceManagement/deviceEnrollmentConfigurations/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceEnrollmentConfigurations/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'enrollmentConfigurationAssignments',
|
|
],
|
|
'deviceEnrollmentNotificationConfiguration' => [
|
|
'resource' => 'deviceManagement/deviceEnrollmentConfigurations',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'version'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceEnrollmentNotificationConfiguration',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'notificationTemplateSnapshots',
|
|
],
|
|
'assignments_list_path' => '/deviceManagement/deviceEnrollmentConfigurations/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceEnrollmentConfigurations/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'enrollmentConfigurationAssignments',
|
|
],
|
|
'enrollmentRestriction' => [
|
|
'resource' => 'deviceManagement/deviceEnrollmentConfigurations',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'version'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceEnrollmentConfiguration',
|
|
'#microsoft.graph.deviceEnrollmentWindowsHelloForBusinessConfiguration',
|
|
'#microsoft.graph.windowsRestoreDeviceEnrollmentConfiguration',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceManagement/deviceEnrollmentConfigurations/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceEnrollmentConfigurations/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'enrollmentConfigurationAssignments',
|
|
],
|
|
'termsAndConditions' => [
|
|
'resource' => 'deviceManagement/termsAndConditions',
|
|
'allowed_select' => [
|
|
'id',
|
|
'displayName',
|
|
'description',
|
|
'title',
|
|
'bodyText',
|
|
'acceptanceStatement',
|
|
'version',
|
|
'roleScopeTagIds',
|
|
'lastModifiedDateTime',
|
|
'createdDateTime',
|
|
],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.termsAndConditions',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'createdDateTime',
|
|
'lastModifiedDateTime',
|
|
'modifiedDateTime',
|
|
'version',
|
|
'acceptanceStatuses',
|
|
'assignments',
|
|
'groupAssignments',
|
|
],
|
|
'assignments_list_path' => '/deviceManagement/termsAndConditions/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/termsAndConditions/{id}/assignments',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'termsAndConditionsAssignments',
|
|
'assignments_update_path' => '/deviceManagement/termsAndConditions/{id}/assignments/{assignmentId}',
|
|
'assignments_update_method' => 'PATCH',
|
|
'assignments_delete_path' => '/deviceManagement/termsAndConditions/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
'supports_scope_tags' => true,
|
|
'scope_tag_field' => 'roleScopeTagIds',
|
|
],
|
|
'windowsAutopilotDeploymentProfile' => [
|
|
'resource' => 'deviceManagement/windowsAutopilotDeploymentProfiles',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.windowsAutopilotDeploymentProfile',
|
|
'#microsoft.graph.azureADWindowsAutopilotDeploymentProfile',
|
|
'#microsoft.graph.activeDirectoryWindowsAutopilotDeploymentProfile',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'strip_odata' => false,
|
|
'update_strip_keys' => [
|
|
'assignments',
|
|
'managementServiceAppId',
|
|
'outOfBoxExperienceSetting',
|
|
'hardwareHashExtractionEnabled',
|
|
'locale',
|
|
],
|
|
'assignments_list_path' => '/deviceManagement/windowsAutopilotDeploymentProfiles/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/windowsAutopilotDeploymentProfiles/{id}/assignments',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_delete_path' => '/deviceManagement/windowsAutopilotDeploymentProfiles/{id}/assignments/{assignmentId}',
|
|
'assignments_delete_method' => 'DELETE',
|
|
],
|
|
'windowsEnrollmentStatusPage' => [
|
|
'resource' => 'deviceManagement/deviceEnrollmentConfigurations',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'version'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.windows10EnrollmentCompletionPageConfiguration',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceManagement/deviceEnrollmentConfigurations/{id}/assignments',
|
|
'assignments_create_path' => '/deviceManagement/deviceEnrollmentConfigurations/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'enrollmentConfigurationAssignments',
|
|
],
|
|
'endpointSecurityIntent' => [
|
|
'resource' => 'deviceManagement/intents',
|
|
'allowed_select' => ['id', 'displayName', 'description', '@odata.type', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceManagementIntent',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'isAssigned',
|
|
'templateId',
|
|
'isMigratingToConfigurationPolicy',
|
|
],
|
|
],
|
|
'mobileApp' => [
|
|
'resource' => 'deviceAppManagement/mobileApps',
|
|
'allowed_select' => ['id', 'displayName', 'publisher', 'description', '@odata.type', 'createdDateTime', 'lastModifiedDateTime', 'roleScopeTagIds'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.mobileApp',
|
|
'#microsoft.graph.androidLobApp',
|
|
'#microsoft.graph.androidStoreApp',
|
|
'#microsoft.graph.androidManagedStoreApp',
|
|
'#microsoft.graph.iosLobApp',
|
|
'#microsoft.graph.iosStoreApp',
|
|
'#microsoft.graph.iosVppApp',
|
|
'#microsoft.graph.winGetApp',
|
|
'#microsoft.graph.macOSLobApp',
|
|
'#microsoft.graph.macOSMicrosoftEdgeApp',
|
|
'#microsoft.graph.macOSMicrosoftDefenderApp',
|
|
'#microsoft.graph.macOSDmgApp',
|
|
'#microsoft.graph.macOSPkgApp',
|
|
'#microsoft.graph.macOsVppApp',
|
|
'#microsoft.graph.macOSWebClip',
|
|
'#microsoft.graph.managedAndroidLobApp',
|
|
'#microsoft.graph.managedAndroidStoreApp',
|
|
'#microsoft.graph.managedIOSLobApp',
|
|
'#microsoft.graph.managedIOSStoreApp',
|
|
'#microsoft.graph.microsoftStoreForBusinessApp',
|
|
'#microsoft.graph.officeSuiteApp',
|
|
'#microsoft.graph.macOSOfficeSuiteApp',
|
|
'#microsoft.graph.webApp',
|
|
'#microsoft.graph.windowsWebApp',
|
|
'#microsoft.graph.windowsAppX',
|
|
'#microsoft.graph.windowsUniversalAppX',
|
|
'#microsoft.graph.windowsMicrosoftEdgeApp',
|
|
'#microsoft.graph.windowsMobileMSI',
|
|
'#microsoft.graph.windowsPhone81AppXBundle',
|
|
'#microsoft.graph.windowsPhone81AppX',
|
|
'#microsoft.graph.windowsPhone81StoreApp',
|
|
'#microsoft.graph.windowsPhoneXAP',
|
|
'#microsoft.graph.windowsStoreApp',
|
|
'#microsoft.graph.win32LobApp',
|
|
'#microsoft.graph.win32CatalogApp',
|
|
'#microsoft.graph.iOSiPadOSWebClip',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'assignments_list_path' => '/deviceAppManagement/mobileApps/{id}/assignments',
|
|
'assignments_create_path' => '/deviceAppManagement/mobileApps/{id}/assign',
|
|
'assignments_create_method' => 'POST',
|
|
'assignments_payload_key' => 'mobileAppAssignments',
|
|
],
|
|
'assignmentFilter' => [
|
|
'resource' => 'deviceManagement/assignmentFilters',
|
|
'allowed_select' => ['id', 'displayName', 'description', 'platform', 'rule'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.deviceAndAppManagementAssignmentFilter',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'isBuiltIn',
|
|
'createdDateTime',
|
|
'lastModifiedDateTime',
|
|
],
|
|
],
|
|
'roleScopeTag' => [
|
|
'resource' => 'deviceManagement/roleScopeTags',
|
|
'allowed_select' => ['id', 'displayName', 'description', 'isBuiltIn'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.roleScopeTag',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'isBuiltIn',
|
|
'createdDateTime',
|
|
'lastModifiedDateTime',
|
|
],
|
|
],
|
|
'notificationMessageTemplate' => [
|
|
'resource' => 'deviceManagement/notificationMessageTemplates',
|
|
'allowed_select' => ['id', 'displayName', 'description', 'brandingOptions', 'lastModifiedDateTime'],
|
|
'allowed_expand' => [],
|
|
'type_family' => [
|
|
'#microsoft.graph.notificationMessageTemplate',
|
|
],
|
|
'create_method' => 'POST',
|
|
'update_method' => 'PATCH',
|
|
'id_field' => 'id',
|
|
'hydration' => 'properties',
|
|
'update_strip_keys' => [
|
|
'localizedNotificationMessages',
|
|
'createdDateTime',
|
|
'lastModifiedDateTime',
|
|
],
|
|
],
|
|
],
|
|
];
|