{"resources":{"microsoft":{"id":"microsoft","name":"microsoft","fields":{"accessReviews":{"name":"accessReviews","type":"\u001bmicrosoft.identityAndAccess.accessReviews","title":"Access review definitions","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"adminConsentRequestPolicy":{"name":"adminConsentRequestPolicy","type":"\u001bmicrosoft.adminConsentRequestPolicy","title":"Microsoft Entra admin consent request policy","desc":"Tenant-wide configuration for the admin consent workflow, which lets users request administrator approval to grant applications access to data they cannot consent to themselves. Audit whether the workflow is active (isEnabled), how requests are routed to reviewers, whether reviewers are notified and reminded, and how long a request stays open before it expires. A disabled workflow means users have no sanctioned path to request access, which often pushes them toward risky self-service consent or shadow IT.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"application":{"name":"application","type":"\u001bmicrosoft.application","title":"Microsoft Entra ID Application Registration","desc":"Application registration in Microsoft Entra ID, the object that defines an application's identity, credentials, and the API permissions it requests. Audit credential hygiene through `hasExpiredCredentials`, `secrets`, and `certificates`, review the permissions the app requests via `requiredResourceAccess`, and inspect the web, single-page, and public client sign-in configuration. Select an application by `name` or `id`, for example `microsoft.application(name: \"MyApp\")`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"applications":{"name":"applications","type":"\u001bmicrosoft.applications","title":"List of applications","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"authenticationMethodConfiguration":{"name":"authenticationMethodConfiguration","type":"\u001bmicrosoft.authenticationMethodConfiguration","title":"Configuration for a specific authentication method","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"authenticationMethodsPolicy":{"name":"authenticationMethodsPolicy","type":"\u001bmicrosoft.authenticationMethodsPolicy","title":"Tenant-wide authentication methods policy","desc":"Tenant policy that controls which authentication methods (FIDO2, Microsoft Authenticator, Temporary Access Pass, email OTP, voice call, and others) users may register and use for sign-in and self-service password reset. The `authenticationMethodConfigurations` list holds the raw per-method configurations, while `fido2`, `microsoftAuthenticator`, `temporaryAccessPass`, `email`, and `voice` expose the individual method policies with their settings and user targeting.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"conditionalAccess":{"name":"conditionalAccess","type":"\u001bmicrosoft.conditionalAccess","title":"Microsoft Entra Conditional Access","desc":"Tenant-wide Conditional Access configuration, the identity control plane that gates sign-ins by evaluating signals (user, device, location, application, risk) and enforcing requirements such as multifactor authentication or a compliant device. Auditing this surface confirms that policies enforce the intended controls, that no gaps leave privileged users or sensitive apps unprotected, and that named locations and allowed authentication methods match tenant policy.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"crossTenantAccessPolicyDefault":{"name":"crossTenantAccessPolicyDefault","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault","title":"Cross-tenant access policy default configuration","desc":"Tenant-wide defaults that govern how users from other Microsoft Entra tenants collaborate with your organization when no partner-specific configuration applies. Audit this to confirm inbound and outbound B2B collaboration and B2B direct connect are scoped as intended, which external trust signals (MFA, compliant devices, hybrid Entra joined devices) are honored, whether automatic user consent is granted, and how invitation redemption resolves identity providers. The isServiceDefault field indicates whether these values are still the Microsoft-provided defaults or have been customized.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"defaultAppManagementPolicy":{"name":"defaultAppManagementPolicy","type":"\u001bmicrosoft.defaultAppManagementPolicy","title":"Tenant Default App Management Policy","desc":"Tenant-wide default policy that restricts the secrets and certificates configurable on application registrations and service principals. The isEnabled field reports whether the restrictions are enforced, while applicationRestrictions and servicePrincipalRestrictions expose the password- and key-credential rules (maximum allowed lifetime, the restriction type, and the date after which newly created apps become subject to them). Audit this policy to confirm long-lived or unrestricted app credentials are disallowed across the tenant.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"device":{"name":"device","type":"\u001bmicrosoft.device","title":"Microsoft device","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"devicemanagement":{"name":"devicemanagement","type":"\u001bmicrosoft.devicemanagement","title":"Microsoft Intune Device Management","desc":"Microsoft Intune device management configuration and inventory. Exposes `managedDevices` (enrolled devices with compliance state, OS details, and encryption status), `deviceConfigurations`, `deviceCompliancePolicies`, `deviceEnrollmentConfigurations`, endpoint security intents, app protection policies, settings catalog policies, Windows Update rings, and Intune RBAC roles.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"devices":{"name":"devices","type":"\u001bmicrosoft.devices","title":"Microsoft Entra ID Devices","desc":"Devices registered in Microsoft Entra ID, each exposing compliance state, management status, operating system details, enrollment type, trust type, and on-premises sync information. Supports optional `filter` (OData property filter) and `search` (keyword search) parameters to narrow the results.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"domain":{"name":"domain","type":"\u001bmicrosoft.domain","title":"Microsoft Entra domain","desc":"DNS namespace registered to a Microsoft Entra tenant, such as `contoso.com` or the tenant's built-in `contoso.onmicrosoft.com`. Domains govern how user principal names are formed and how sign-in is handled: `authenticationType` distinguishes a cloud-managed domain from one that federates authentication to an external identity provider, and `isVerified` shows whether tenant ownership has been proven by publishing the required DNS records. Also exposes the password expiration policy applied to the domain and the service configuration records a tenant must publish to enable Microsoft 365 services.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"domaindnsrecord":{"name":"domaindnsrecord","type":"\u001bmicrosoft.domaindnsrecord","title":"Microsoft domain DNS record","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"domains":{"name":"domains","type":"\u0019\u001bmicrosoft.domain","title":"List of domains","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enterpriseApplications":{"name":"enterpriseApplications","type":"\u0019\u001bmicrosoft.serviceprincipal","title":"List of enterprise applications","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"externalIdentitiesPolicy":{"name":"externalIdentitiesPolicy","type":"\u001bmicrosoft.externalIdentitiesPolicy","title":"Tenant-wide policy that controls whether external users can leave a tenant via self-service controls","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"graph":{"name":"graph","type":"\u001bmicrosoft.graph","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"group":{"name":"group","type":"\u001bmicrosoft.group","title":"Microsoft group","desc":"Entra ID group, covering security groups, Microsoft 365 groups, and mail-enabled distribution groups. Group membership governs access to applications, SharePoint sites, Teams, and other resources, which makes groups a core object for access reviews and least-privilege audits. The members and owners fields resolve the principals that belong to and administer the group, isAssignableToRole flags groups that can be granted Entra directory roles, and membershipRule exposes the rule that drives dynamic membership.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"groupLifecyclePolicies":{"name":"groupLifecyclePolicies","type":"\u0019\u001bmicrosoft.groupLifecyclePolicy","title":"Group lifecycle policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"groupLifecyclePolicy":{"name":"groupLifecyclePolicy","type":"\u001bmicrosoft.groupLifecyclePolicy","title":"Microsoft 365 group lifecycle policy","desc":"Expiration policy that governs how long Microsoft 365 groups live before they must be renewed, and what happens when they are not. Auditing this tells you whether stale, unowned, or abandoned groups (and their SharePoint sites, mailboxes, and Teams) are cleaned up automatically or allowed to accumulate. The policy sets the renewal lifetime in days, which group types it applies to, and the fallback notification recipients used when a group has no owner to receive renewal notices.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"groupSettings":{"name":"groupSettings","type":"\u0019\u001bmicrosoft.setting","title":"Microsoft 365 settings","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"groups":{"name":"groups","type":"\u001bmicrosoft.groups","title":"List of groups","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identityAndAccess":{"name":"identityAndAccess","type":"\u001bmicrosoft.identityAndAccess","title":"Identity and Access policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"keyCredential":{"name":"keyCredential","type":"\u001bmicrosoft.keyCredential","title":"Microsoft Entra application certificate credential","desc":"A public-key certificate registered on an Entra application or service principal and used to authenticate the app when it requests tokens. Audit these to find certificates that are expired or close to expiry, to review what key material an application trusts, and to flag long-lived or unused credentials that widen the blast radius if the app is compromised. The `expired` predicate reports whether the certificate is past its end date, and `expires` gives the exact expiration time.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"oauth2PermissionGrant":{"name":"oauth2PermissionGrant","type":"\u001bmicrosoft.oauth2PermissionGrant","title":"Microsoft Entra ID OAuth2 Permission Grant","desc":"Delegated permission grant authorizing a client application to call an API on behalf of signed-in users. The `consentType` is `AllPrincipals` when an administrator consented for the entire tenant, or `Principal` when an individual user consented, in which case `principal` resolves to that user. `scopes` lists the delegated permissions granted. `client` is the service principal of the application receiving access and `resource` is the service principal of the API being accessed. Audit this collection to review tenant-wide application consent, for example finding broad admin grants or user-consented access to sensitive APIs.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"oauth2PermissionGrants":{"name":"oauth2PermissionGrants","type":"\u0019\u001bmicrosoft.oauth2PermissionGrant","title":"Delegated permission grants consented across the tenant","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"organization":{"name":"organization","type":"\u001bmicrosoft.organization","title":"Microsoft Entra Tenant","desc":"Configuration of the connected Microsoft Entra ID (Azure AD) tenant. Exposes the tenant's `name`, `id`, `type`, verified domains, provisioned plans, on-premises sync status, privacy profile, technical notification contacts, and security compliance notification addresses. Related resources include `settings`, `formsSettings`, `realm`, and `branding`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"organizations":{"name":"organizations","type":"\u0019\u001bmicrosoft.tenant","title":"Microsoft 365 tenant organizations","desc":"Deprecated in favor of `microsoft.tenant`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"passwordCredential":{"name":"passwordCredential","type":"\u001bmicrosoft.passwordCredential","title":"Microsoft Entra AD Application secrets","desc":"Client secret (password credential) registered on an Entra ID application or service principal. Client secrets authenticate an application to the Microsoft identity platform, so their expiration and rotation are common audit targets: `expires` and `expired` surface stale or soon-to-lapse credentials, and `startDateTime` shows when the secret became valid. The `hint` field carries only the leading characters of the secret value, never the secret itself.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"policies":{"name":"policies","type":"\u001bmicrosoft.policies","title":"Microsoft Entra ID Policies","desc":"Tenant-wide Microsoft Entra ID policy configuration that governs how identities, external users, application consent, and authentication methods are controlled across the organization. These policies define the baseline security posture for guest invitations, admin consent workflows, permission grants, session timeouts, and cross-tenant access, making them central to auditing an Entra tenant's hardening.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"powerbi":{"name":"powerbi","type":"\u001bmicrosoft.powerbi","title":"Microsoft Power BI","desc":"Use this namespace to examine tenant-wide Power BI (Microsoft Fabric) governance posture. Exposes the tenant feature switches that control sharing and export (`tenantSettings`), the `workspaces` provisioned in the tenant and who has access to them, the `capacities` backing those workspaces, and the reports and dashboards that have broad exposure — either `publishedToWeb` or `sharedToWholeOrganization`. Data is collected through the Power BI admin REST APIs, which require the service principal to be granted read-only admin API access in the Power BI tenant settings.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"rolemanagement":{"name":"rolemanagement","type":"\u001bmicrosoft.rolemanagement","title":"Microsoft role management namespace","desc":"Deprecated in favor of `microsoft.roles`. This namespace previously exposed role definitions and assignments; use `microsoft.roles` for role definitions going forward.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true,"maturity":"deprecated"},"roles":{"name":"roles","type":"\u001bmicrosoft.roles","title":"List of roles","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"security":{"name":"security","type":"\u001bmicrosoft.security","title":"Microsoft Security","desc":"Microsoft 365 security posture and detections across the tenant. `secureScores` and `latestSecureScores` report Secure Score posture, `riskyUsers` and `riskDetections` surface Microsoft Entra ID Protection risk signals, `alerts` and `incidents` cover Microsoft Defender XDR detections, `exchange` exposes Exchange Online security settings, and `informationProtection` covers sensitivity label configuration.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"serviceprincipal":{"name":"serviceprincipal","type":"\u001bmicrosoft.serviceprincipal","title":"Microsoft Entra Service Principal","desc":"Service principal (enterprise application) registered in the tenant, representing an application's identity and the access it has been granted. Service principals govern which applications can sign in, what API permissions and app roles they hold, and which users and groups are assigned to them, making them a central surface for auditing both third-party and internally registered application access. Use `isFirstParty` to distinguish Microsoft-owned service principals from those added by the tenant, and `enabled` to check whether sign-in is permitted.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"serviceprincipals":{"name":"serviceprincipals","type":"\u0019\u001bmicrosoft.serviceprincipal","title":"List of service principals","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"setting":{"name":"setting","type":"\u001bmicrosoft.setting","title":"Microsoft 365 Group Setting","desc":"Directory-level group setting applied across the tenant, identified by its `templateId` and `displayName`. Each setting carries a list of `values` that control group behavior such as guest access, self-service group creation, and naming policies. Audit these to confirm that group governance matches your organization's requirements.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"settingValue":{"name":"settingValue","type":"\u001bmicrosoft.settingValue","title":"Microsoft 365 Group Setting Value","desc":"A single name/value pair within a `microsoft.setting`. The `name` identifies the specific setting key (for example, `AllowGuestsToBeGroupOwner`) and `value` holds its current string representation, which governs group behavior such as guest access, group creation limits, or naming policies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"settings":{"name":"settings","type":"\n","title":"Tenant-wide settings","desc":"Deprecated in favor of `groupSettings`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"systemCredentialPreferences":{"name":"systemCredentialPreferences","type":"\u001bmicrosoft.systemCredentialPreferences","title":"System credential preferences for the authentication methods policy","desc":"Tenant-wide setting that controls whether users are nudged toward system-preferred credentials (the strongest authentication method registered for their account, such as passwordless or push-based sign-in over SMS or voice call) during sign-in. The `state` field reports whether the nudge is on, off, or following the Microsoft-managed default, and `includeTargets`/`excludeTargets` scope it to specific groups. Audit this to confirm that users are steered to phishing-resistant methods rather than weaker ones.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"tenant":{"name":"tenant","type":"\u001bmicrosoft.tenant","title":"Microsoft Entra Tenant","desc":"Configuration of the connected Microsoft Entra ID (Azure AD) tenant. Exposes the tenant's `name`, `id`, `type`, verified domains, provisioned plans, on-premises sync status, privacy profile, technical notification contacts, and security compliance notification addresses. Related resources include `settings`, `formsSettings`, `realm`, and `branding`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"tenantDomainName":{"name":"tenantDomainName","type":"\u0007","title":"The connected tenant's default domain name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"tenantFormsSettings":{"name":"tenantFormsSettings","type":"\u001bmicrosoft.tenantFormsSettings","title":"Company-wide settings for Microsoft Forms","desc":"Organization-level controls that govern how Microsoft Forms can be shared, collected, and protected across the tenant. The boolean fields determine whether forms, results, and templates can leave the organization (external sending, sharing, and collaboration), whether respondent identities are recorded, whether Bing image search is available inside forms, and whether phishing scanning runs on user-created forms. Audit these to confirm data-sharing and anti-phishing controls match your data-governance policy.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"tenantSettings":{"name":"tenantSettings","type":"\u001bmicrosoft.tenantSettings","title":"Company-wide configuration for apps and services.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"user":{"name":"user","type":"\u001bmicrosoft.user","title":"Microsoft Entra ID user","desc":"User account in the tenant directory, covering identity attributes (userPrincipalName, displayName, userType), account state (accountEnabled, externalUserState), sign-in and password history (signInActivity, lastPasswordChangeDateTime, passwordPolicies), on-premises directory-sync status, assigned licenses, and registered authentication methods. Audit accountEnabled, isAdministrator, and mfaEnabled to find privileged or unprotected accounts, and authMethods for the multifactor and passwordless methods a user has registered.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"users":{"name":"users","type":"\u001bmicrosoft.users","title":"List of users","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365","desc":"Namespace for Microsoft 365 services and resources including users, groups, domains, applications, service principals, roles, and identity and access policies. Serves as the top-level entry point for querying tenant-wide Microsoft Entra ID and Microsoft 365 configuration.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.adminConsentRequestPolicy":{"id":"microsoft.adminConsentRequestPolicy","name":"microsoft.adminConsentRequestPolicy","fields":{"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Specifies whether the admin consent request feature is enabled or disabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notifyReviewers":{"name":"notifyReviewers","type":"\u0004","is_mandatory":true,"title":"Specifies whether reviewers will receive notifications","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"remindersEnabled":{"name":"remindersEnabled","type":"\u0004","is_mandatory":true,"title":"Specifies whether reviewers will receive reminder emails","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"requestDurationInDays":{"name":"requestDurationInDays","type":"\u0005","is_mandatory":true,"title":"Specifies the duration the request is active before it automatically expires if no decision is applied","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reviewers":{"name":"reviewers","type":"\u0019\u001bmicrosoft.graph.accessReviewReviewerScope","is_mandatory":true,"title":"The list of reviewers for the admin consent","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Specifies the version of this policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra admin consent request policy","desc":"Tenant-wide configuration for the admin consent workflow, which lets users request administrator approval to grant applications access to data they cannot consent to themselves. Audit whether the workflow is active (isEnabled), how requests are routed to reviewers, whether reviewers are notified and reminded, and how long a request stays open before it expires. A disabled workflow means users have no sanctioned path to request access, which often pushes them toward risky self-service consent or shadow IT.","private":true,"min_provider_version":"11.1.42","defaults":"isEnabled notifyReviewers","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.application":{"id":"microsoft.application","name":"microsoft.application","fields":{"api":{"name":"api","type":"\n","is_mandatory":true,"title":"Settings for an application that implements a web API","desc":"Keys: `acceptMappedClaims`, `knownClientApplications`, `oauth2PermissionScopes` (delegated permission scopes the API exposes), `preAuthorizedApplications` (clients pre-consented to those scopes), and `requestedAccessTokenVersion`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"appId":{"name":"appId","type":"\u0007","is_mandatory":true,"title":"Application (client) ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"appRoles":{"name":"appRoles","type":"\u0019\u001bmicrosoft.application.role","is_mandatory":true,"title":"Application roles","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"applicationTemplateId":{"name":"applicationTemplateId","type":"\u0007","is_mandatory":true,"title":"Application template ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"certificates":{"name":"certificates","type":"\u0019\u001bmicrosoft.keyCredential","is_mandatory":true,"title":"X.509 key credentials used for application authentication","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"certification":{"name":"certification","type":"\n","is_mandatory":true,"title":"App certification details including compliance status and certifier","desc":"Keys: `certificationDetailsUrl`, `certificationExpirationDateTime`, `isCertifiedByMicrosoft`, `isPublisherAttested`, and `lastCertificationDateTime`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Application creation date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"defaultRedirectUri":{"name":"defaultRedirectUri","type":"\u0007","is_mandatory":true,"title":"Default redirect URI","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-form description of the application","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"disabledByMicrosoftStatus":{"name":"disabledByMicrosoftStatus","type":"\u0007","is_mandatory":true,"title":"Microsoft disabled status","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"groupMembershipClaims":{"name":"groupMembershipClaims","type":"\u0007","is_mandatory":true,"title":"Group membership claims","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"hasExpiredCredentials":{"name":"hasExpiredCredentials","type":"\u0004","title":"Whether the credentials have expired","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Object ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identifierUris":{"name":"identifierUris","type":"\u0019\u0007","is_mandatory":true,"title":"Application identifier URIs","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"info":{"name":"info","type":"\n","is_mandatory":true,"title":"Basic profile information","desc":"Informational URLs shown to users on the consent screen, with the keys `logoUrl`, `marketingUrl`, `privacyStatementUrl`, `supportUrl`, and `termsOfServiceUrl`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isDeviceOnlyAuthSupported":{"name":"isDeviceOnlyAuthSupported","type":"\u0004","is_mandatory":true,"title":"Whether the application supports device-only authentication","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isFallbackPublicClient":{"name":"isFallbackPublicClient","type":"\u0004","is_mandatory":true,"title":"Specifies the fallback application type as public client","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"nativeAuthenticationApisEnabled":{"name":"nativeAuthenticationApisEnabled","type":"\u0007","is_mandatory":true,"title":"Native authentication APIs enablement state","desc":"Whether native authentication APIs are enabled for the application. One of `none` or `all`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notes":{"name":"notes","type":"\u0007","is_mandatory":true,"title":"Internal notes about the application (admin-only)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"optionalClaims":{"name":"optionalClaims","type":"\n","is_mandatory":true,"title":"Optional claims","desc":"Claims returned in tokens issued for the application, grouped by token type under the keys `accessToken`, `idToken`, and `saml2Token`. Each entry has `name`, `source`, and `essential`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"owners":{"name":"owners","type":"\u0019\u001bmicrosoft.user","title":"Application owner","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"parentalControlSettings":{"name":"parentalControlSettings","type":"\n","is_mandatory":true,"title":"Parental control settings","desc":"Keys: `legalAgeGroupRule`, the age-group rule applied to the application, and `countriesBlockedForMinors`, the two-letter country codes where the app is blocked for minors.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"permission":{"name":"permission","type":"\u001bmicrosoft.application.permission","title":"Microsoft Service Principal Permission","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"publicClient":{"name":"publicClient","type":"\n","is_mandatory":true,"title":"Public client configuration","desc":"Contains the key `redirectUris`, the redirect URIs registered for installed clients such as mobile and desktop applications.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"publisherDomain":{"name":"publisherDomain","type":"\u0007","is_mandatory":true,"title":"Application publisher domain","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"requestSignatureVerification":{"name":"requestSignatureVerification","type":"\n","is_mandatory":true,"title":"SAML request signature verification settings","desc":"Keys: `isSignedRequestRequired`, whether the application requires signed authentication requests, and `allowedWeakAlgorithms`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"requiredResourceAccess":{"name":"requiredResourceAccess","type":"\u0019\n","is_mandatory":true,"title":"API permissions the application requests, grouped by resource API","desc":"The configured permissions, distinct from what has actually been consented on the service principal. Each entry has `resourceAppId` (the API's application ID) and `resourceAccess`, a list of `{id, type}` where `type` is `Scope` for a delegated permission or `Role` for an application permission.","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"role":{"name":"role","type":"\u001bmicrosoft.application.role","title":"Microsoft Entra ID app roles are custom roles to assign permissions to users or apps","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"samlMetadataUrl":{"name":"samlMetadataUrl","type":"\u0007","is_mandatory":true,"title":"SAML metadata URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"secrets":{"name":"secrets","type":"\u0019\u001bmicrosoft.passwordCredential","is_mandatory":true,"title":"Client secrets","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"serviceManagementReference":{"name":"serviceManagementReference","type":"\u0007","is_mandatory":true,"title":"Service management reference","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"servicePrincipal":{"name":"servicePrincipal","type":"\u001bmicrosoft.serviceprincipal","title":"Managed application in local directory","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"servicePrincipalLockConfiguration":{"name":"servicePrincipalLockConfiguration","type":"\n","is_mandatory":true,"title":"Locked properties on the associated service principal","desc":"Which sensitive properties are protected from edits by non-privileged actors. Keys: `isEnabled`, `allProperties`, `credentialsWithUsageSignIns`, `credentialsWithUsageVerify`, and `tokenEncryptionKeyId`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"signInAudience":{"name":"signInAudience","type":"\u0007","is_mandatory":true,"title":"Application sign-in audience","desc":"Account types that can sign in to the application. One of `AzureADMyOrg` (single tenant), `AzureADMultipleOrgs` (any Entra tenant), `AzureADandPersonalMicrosoftAccount`, or `PersonalMicrosoftAccount`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"spa":{"name":"spa","type":"\n","is_mandatory":true,"title":"Settings for a single-page application","desc":"Contains the key `redirectUris`, the redirect URIs registered for the single-page application.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Custom tags for organizing the application","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"tokenEncryptionKeyId":{"name":"tokenEncryptionKeyId","type":"\u0007","is_mandatory":true,"title":"Token encryption key ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"web":{"name":"web","type":"\n","is_mandatory":true,"title":"Settings for a web application","desc":"Keys: `homePageUrl`, `logoutUrl`, `redirectUris`, `redirectUriSettings`, and `implicitGrantSettings` (with `enableAccessTokenIssuance` and `enableIdTokenIssuance`, the implicit grant flows the app allows).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"init":{"args":[{"name":"name","type":"\u0007"},{"name":"id","type":"\u0007"}]},"title":"Microsoft Entra ID Application Registration","desc":"Application registration in Microsoft Entra ID, the object that defines an application's identity, credentials, and the API permissions it requests. Audit credential hygiene through `hasExpiredCredentials`, `secrets`, and `certificates`, review the permissions the app requests via `requiredResourceAccess`, and inspect the web, single-page, and public client sign-in configuration. Select an application by `name` or `id`, for example `microsoft.application(name: \"MyApp\")`.","min_provider_version":"9.0.0","defaults":"id name hasExpiredCredentials","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.application.permission":{"id":"microsoft.application.permission","name":"microsoft.application.permission","fields":{"appId":{"name":"appId","type":"\u0007","is_mandatory":true,"title":"ID of the API","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"appName":{"name":"appName","type":"\u0007","is_mandatory":true,"title":"Name of the API","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Permission description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Permission ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Permission name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Permission grant status (e.g., `granted` for consented permissions, `available` for app roles the application could request but has not been granted)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type eg. `application` or `delegated`","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Service Principal Permission","private":true,"min_provider_version":"11.0.30","defaults":"appName name type status","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.application.role":{"id":"microsoft.application.role","name":"microsoft.application.role","fields":{"allowedMemberTypes":{"name":"allowedMemberTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed member types","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the permissions granted by the role","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"App role ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the app role is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Role value as it appears in the roles claim of issued tokens","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra ID app roles are custom roles to assign permissions to users or apps","private":true,"min_provider_version":"11.0.29","defaults":"name value isEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.applications":{"id":"microsoft.applications","name":"microsoft.applications","fields":{"count":{"name":"count","type":"\u0005","title":"Total number of application registrations","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"list":{"name":"list","type":"\u0019\u001bmicrosoft.application","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"list_type":"\u001bmicrosoft.application","title":"Microsoft Entra ID Application Registrations","desc":"Collection of every application registration in the connected Microsoft Entra ID (Azure AD) tenant. Each registration defines an app's identity, its OAuth client credentials, and which accounts are allowed to sign in, making this collection the entry point for auditing credential hygiene (expired or long-lived secrets and certificates), overly broad sign-in audiences, and stale or unused registrations across the tenant. The `count` field returns the total number of registered applications.","min_provider_version":"11.1.19","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.authenticationMethodConfiguration":{"id":"microsoft.authenticationMethodConfiguration","name":"microsoft.authenticationMethodConfiguration","fields":{"excludeTargets":{"name":"excludeTargets","type":"\u0019\n","is_mandatory":true,"title":"Groups of users excluded from the method","desc":"Each entry has an `id` (the object ID of the excluded group) and a `targetType` naming what the ID refers to (`group`, `user`, or `unknownFutureValue`).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"The state of the policy. Possible values are: enabled, disabled.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Configuration for a specific authentication method","private":true,"min_provider_version":"11.1.99","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.authenticationMethodsPolicy":{"id":"microsoft.authenticationMethodsPolicy","name":"microsoft.authenticationMethodsPolicy","fields":{"authenticationMethodConfigurations":{"name":"authenticationMethodConfigurations","type":"\u0019\u001bmicrosoft.authenticationMethodConfiguration","is_mandatory":true,"title":"Configurations for specific authentication methods","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Policy display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"email":{"name":"email","type":"\u001bmicrosoft.authenticationMethodsPolicy.email","title":"Email one-time passcode authentication method configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"fido2":{"name":"fido2","type":"\u001bmicrosoft.authenticationMethodsPolicy.fido2","title":"FIDO2 security key authentication method configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"The date and time the policy was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoftAuthenticator":{"name":"microsoftAuthenticator","type":"\u001bmicrosoft.authenticationMethodsPolicy.microsoftAuthenticator","title":"Microsoft Authenticator authentication method configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policyVersion":{"name":"policyVersion","type":"\u0007","is_mandatory":true,"title":"The version of the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"registrationCampaign":{"name":"registrationCampaign","type":"\u001bmicrosoft.authenticationMethodsPolicy.registrationCampaign","title":"Registration campaign that nudges users to set up a stronger method","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"systemCredentialPreferences":{"name":"systemCredentialPreferences","type":"\u001bmicrosoft.systemCredentialPreferences","title":"System credential preferences for the authentication methods policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"temporaryAccessPass":{"name":"temporaryAccessPass","type":"\u001bmicrosoft.authenticationMethodsPolicy.temporaryAccessPass","title":"Temporary Access Pass authentication method configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"voice":{"name":"voice","type":"\u001bmicrosoft.authenticationMethodsPolicy.voice","title":"Voice call authentication method configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Tenant-wide authentication methods policy","desc":"Tenant policy that controls which authentication methods (FIDO2, Microsoft Authenticator, Temporary Access Pass, email OTP, voice call, and others) users may register and use for sign-in and self-service password reset. The `authenticationMethodConfigurations` list holds the raw per-method configurations, while `fido2`, `microsoftAuthenticator`, `temporaryAccessPass`, `email`, and `voice` expose the individual method policies with their settings and user targeting.","private":true,"min_provider_version":"11.1.99","defaults":"displayName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.authenticationMethodsPolicy.email":{"id":"microsoft.authenticationMethodsPolicy.email","name":"microsoft.authenticationMethodsPolicy.email","fields":{"allowExternalIdToUseEmailOtp":{"name":"allowExternalIdToUseEmailOtp","type":"\u0007","is_mandatory":true,"title":"Whether external Entra identities may use email OTP (default, enabled, disabled)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"excludeTargets":{"name":"excludeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups excluded from the method","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeTargets":{"name":"includeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups the method applies to","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether email OTP is enabled (enabled, disabled)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Email one-time passcode authentication method configuration","desc":"Tenant policy for email one-time passcode (OTP) authentication. Reports whether the method is `state` enabled and whether external Microsoft Entra identities may use email OTP (`allowExternalIdToUseEmailOtp`, one of default, enabled, or disabled). The `includeTargets` and `excludeTargets` fields show which users the method applies to.","private":true,"min_provider_version":"13.3.1","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.authenticationMethodsPolicy.fido2":{"id":"microsoft.authenticationMethodsPolicy.fido2","name":"microsoft.authenticationMethodsPolicy.fido2","fields":{"excludeTargets":{"name":"excludeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups excluded from the method","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeTargets":{"name":"includeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups the method applies to","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isAttestationEnforced":{"name":"isAttestationEnforced","type":"\u0004","is_mandatory":true,"title":"Whether attestation is enforced for FIDO2 security keys","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isSelfServiceRegistrationAllowed":{"name":"isSelfServiceRegistrationAllowed","type":"\u0004","is_mandatory":true,"title":"Whether users can self-service register FIDO2 security keys","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"keyRestrictionsAaGuids":{"name":"keyRestrictionsAaGuids","type":"\u0019\u0007","is_mandatory":true,"title":"The AAGUIDs that the key restriction allows or blocks","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"keyRestrictionsEnforced":{"name":"keyRestrictionsEnforced","type":"\u0004","is_mandatory":true,"title":"Whether AAGUID key restrictions are enforced","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"keyRestrictionsEnforcementType":{"name":"keyRestrictionsEnforcementType","type":"\u0007","is_mandatory":true,"title":"How the AAGUID list is applied (allow, block)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether FIDO2 is enabled (enabled, disabled)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"FIDO2 security key authentication method configuration","desc":"Tenant policy for FIDO2 (passkey) authentication. Reports whether the method is `state` enabled, whether attestation is enforced (`isAttestationEnforced`) and self-service registration is allowed (`isSelfServiceRegistrationAllowed`), and the AAGUID key restrictions (`keyRestrictionsEnforced`, `keyRestrictionsEnforcementType` of allow or block, and the `keyRestrictionsAaGuids` list). The `includeTargets` and `excludeTargets` fields show which users the method applies to.","private":true,"min_provider_version":"13.3.1","defaults":"state isAttestationEnforced","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.authenticationMethodsPolicy.microsoftAuthenticator":{"id":"microsoft.authenticationMethodsPolicy.microsoftAuthenticator","name":"microsoft.authenticationMethodsPolicy.microsoftAuthenticator","fields":{"displayAppInformationRequiredState":{"name":"displayAppInformationRequiredState","type":"\u0007","is_mandatory":true,"title":"Application context shown in push notifications (default, enabled, disabled)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayLocationInformationRequiredState":{"name":"displayLocationInformationRequiredState","type":"\u0007","is_mandatory":true,"title":"Geographic context shown in push notifications (default, enabled, disabled)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"excludeTargets":{"name":"excludeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups excluded from the method","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeTargets":{"name":"includeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups the method applies to","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isSoftwareOathEnabled":{"name":"isSoftwareOathEnabled","type":"\u0004","is_mandatory":true,"title":"Whether software OATH tokens are enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether Microsoft Authenticator is enabled (enabled, disabled)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Authenticator authentication method configuration","desc":"Tenant policy for Microsoft Authenticator authentication. Reports whether the method is `state` enabled, whether software OATH tokens are enabled (`isSoftwareOathEnabled`), and the push-notification feature states for showing application context (`displayAppInformationRequiredState`) and geographic context (`displayLocationInformationRequiredState`), each one of default, enabled, or disabled. The `includeTargets` and `excludeTargets` fields show which users the method applies to.","private":true,"min_provider_version":"13.3.1","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.authenticationMethodsPolicy.registrationCampaign":{"id":"microsoft.authenticationMethodsPolicy.registrationCampaign","name":"microsoft.authenticationMethodsPolicy.registrationCampaign","fields":{"excludeTargets":{"name":"excludeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups excluded from the campaign","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeTargets":{"name":"includeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups the campaign applies to","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"snoozeDurationInDays":{"name":"snoozeDurationInDays","type":"\u0005","is_mandatory":true,"title":"Number of days a user may defer the registration prompt","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether the registration campaign is enabled (default, enabled, disabled)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Authentication methods registration campaign","desc":"Registration campaign that nudges users to set up Microsoft Authenticator during sign-in. Reports whether the campaign is `state` enabled, how many days a user may defer the prompt (`snoozeDurationInDays`), and which users it applies to via `includeTargets` and `excludeTargets`.","private":true,"min_provider_version":"13.3.1","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.authenticationMethodsPolicy.temporaryAccessPass":{"id":"microsoft.authenticationMethodsPolicy.temporaryAccessPass","name":"microsoft.authenticationMethodsPolicy.temporaryAccessPass","fields":{"defaultLength":{"name":"defaultLength","type":"\u0005","is_mandatory":true,"title":"Default length of a generated Temporary Access Pass","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"defaultLifetimeInMinutes":{"name":"defaultLifetimeInMinutes","type":"\u0005","is_mandatory":true,"title":"Default lifetime of a Temporary Access Pass, in minutes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"excludeTargets":{"name":"excludeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups excluded from the method","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeTargets":{"name":"includeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups the method applies to","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isUsableOnce":{"name":"isUsableOnce","type":"\u0004","is_mandatory":true,"title":"Whether a Temporary Access Pass can be used only once","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"maximumLifetimeInMinutes":{"name":"maximumLifetimeInMinutes","type":"\u0005","is_mandatory":true,"title":"Maximum lifetime of a Temporary Access Pass, in minutes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"minimumLifetimeInMinutes":{"name":"minimumLifetimeInMinutes","type":"\u0005","is_mandatory":true,"title":"Minimum lifetime of a Temporary Access Pass, in minutes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether Temporary Access Pass is enabled (enabled, disabled)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Temporary Access Pass authentication method configuration","desc":"Tenant policy for Temporary Access Pass (TAP) authentication. Reports whether the method is `state` enabled, the lifetime bounds (`defaultLifetimeInMinutes`, `minimumLifetimeInMinutes`, `maximumLifetimeInMinutes`), the generated pass `defaultLength`, and whether a pass is single-use (`isUsableOnce`). The `includeTargets` and `excludeTargets` fields show which users the method applies to.","private":true,"min_provider_version":"13.3.1","defaults":"state isUsableOnce","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.authenticationMethodsPolicy.voice":{"id":"microsoft.authenticationMethodsPolicy.voice","name":"microsoft.authenticationMethodsPolicy.voice","fields":{"excludeTargets":{"name":"excludeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups excluded from the method","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeTargets":{"name":"includeTargets","type":"\u0019\n","is_mandatory":true,"title":"Users and groups the method applies to","desc":"Each entry has an `id` (the user or group object ID) and a `targetType` of `user` or `group`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isOfficePhoneAllowed":{"name":"isOfficePhoneAllowed","type":"\u0004","is_mandatory":true,"title":"Whether office phones may be used for voice call authentication","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether voice call is enabled (enabled, disabled)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Voice call authentication method configuration","desc":"Tenant policy for voice call authentication. Reports whether the method is `state` enabled and whether office phones may be used (`isOfficePhoneAllowed`). The `includeTargets` and `excludeTargets` fields show which users the method applies to.","private":true,"min_provider_version":"13.3.1","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess":{"id":"microsoft.conditionalAccess","name":"microsoft.conditionalAccess","fields":{"authenticationMethodConfiguration":{"name":"authenticationMethodConfiguration","type":"\u001bmicrosoft.conditionalAccess.authenticationMethodConfiguration","title":"Configuration for a specific authentication method","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"authenticationMethodsPolicy":{"name":"authenticationMethodsPolicy","type":"\u001bmicrosoft.conditionalAccess.authenticationMethodsPolicy","title":"Tenant-wide authentication methods policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"countryNamedLocation":{"name":"countryNamedLocation","type":"\u001bmicrosoft.conditionalAccess.countryNamedLocation","title":"Microsoft Entra Conditional Access Country Named Location","desc":"Country or region-based named location referenced by Conditional Access policy conditions. The lookupMethod field records how a sign-in's country is resolved, either from the client IP address or from authenticator app GPS signal. The id is the value policies use in their include and exclude location lists.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"ipNamedLocation":{"name":"ipNamedLocation","type":"\u001bmicrosoft.conditionalAccess.ipNamedLocation","title":"Microsoft Entra Conditional Access IP Named Location","desc":"IP address range-based named location referenced by Conditional Access policy conditions. The trusted flag marks the range as a trusted network, which policies can treat as lower risk or exempt from controls, so verifying which ranges carry that flag is a common audit. The id is the value policies use in their include and exclude location lists.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"namedLocations":{"name":"namedLocations","type":"\u001bmicrosoft.conditionalAccess.namedLocations","title":"Named locations container","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policies":{"name":"policies","type":"\u0019\u001bmicrosoft.conditionalAccess.policy","title":"Policies collection","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policy":{"name":"policy","type":"\u001bmicrosoft.conditionalAccess.policy","title":"Microsoft Entra Conditional Access Policy","desc":"Single Conditional Access policy in the tenant. The state field (enabled, disabled, or enabledForReportingButNotEnforced) determines whether the policy is enforced, reporting-only, or off. conditions scope the policy to specific users, applications, platforms, locations, and risk levels; grantControls define what a matching sign-in must satisfy (block, MFA, compliant device, and so on); and sessionControls constrain the resulting session (sign-in frequency, persistent browser). Auditing policies confirms that enforced controls cover privileged users and sensitive apps with no exclusion gaps.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true}},"title":"Microsoft Entra Conditional Access","desc":"Tenant-wide Conditional Access configuration, the identity control plane that gates sign-ins by evaluating signals (user, device, location, application, risk) and enforcing requirements such as multifactor authentication or a compliant device. Auditing this surface confirms that policies enforce the intended controls, that no gaps leave privileged users or sensitive apps unprotected, and that named locations and allowed authentication methods match tenant policy.","min_provider_version":"11.0.34","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.authenticationMethodConfiguration":{"id":"microsoft.conditionalAccess.authenticationMethodConfiguration","name":"microsoft.conditionalAccess.authenticationMethodConfiguration","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Identifier of the authentication method (for example fido2, microsoftAuthenticator, sms, email)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether the authentication method is enabled or disabled for the tenant","desc":"The possible values are: enabled, disabled.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Configuration for a specific authentication method","private":true,"min_provider_version":"11.1.41","defaults":"id state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.authenticationMethodsPolicy":{"id":"microsoft.conditionalAccess.authenticationMethodsPolicy","name":"microsoft.conditionalAccess.authenticationMethodsPolicy","fields":{"authenticationMethodConfigurations":{"name":"authenticationMethodConfigurations","type":"\u0019\u001bmicrosoft.conditionalAccess.authenticationMethodConfiguration","is_mandatory":true,"title":"Represents the settings for each authentication method","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"A description of the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"The name of the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"The identifier of the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"The date and time of the last update to the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policyVersion":{"name":"policyVersion","type":"\u0007","is_mandatory":true,"title":"The version of the policy in use","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"The tenant-wide policy that controls which authentication methods are allowed","private":true,"min_provider_version":"11.1.41","defaults":"id displayName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.countryNamedLocation":{"id":"microsoft.conditionalAccess.countryNamedLocation","name":"microsoft.conditionalAccess.countryNamedLocation","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Named location ID","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lookupMethod":{"name":"lookupMethod","type":"\u0007","is_mandatory":true,"title":"Method to determine the country location","desc":"The possible values are: clientIpAddress, authenticatorAppGps, unknownFutureValue.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Named location name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra Conditional Access Country Named Location","desc":"Country or region-based named location referenced by Conditional Access policy conditions. The lookupMethod field records how a sign-in's country is resolved, either from the client IP address or from authenticator app GPS signal. The id is the value policies use in their include and exclude location lists.","min_provider_version":"11.0.46","defaults":"id name lookupMethod","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.ipNamedLocation":{"id":"microsoft.conditionalAccess.ipNamedLocation","name":"microsoft.conditionalAccess.ipNamedLocation","fields":{"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"When the location was created","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Named location ID","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"modifiedDateTime":{"name":"modifiedDateTime","type":"\t","is_mandatory":true,"title":"When the location was last modified","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Named location name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"trusted":{"name":"trusted","type":"\u0004","is_mandatory":true,"title":"Whether the location is marked as trusted","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra Conditional Access IP Named Location","desc":"IP address range-based named location referenced by Conditional Access policy conditions. The trusted flag marks the range as a trusted network, which policies can treat as lower risk or exempt from controls, so verifying which ranges carry that flag is a common audit. The id is the value policies use in their include and exclude location lists.","min_provider_version":"11.0.34","defaults":"id name trusted","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.namedLocations":{"id":"microsoft.conditionalAccess.namedLocations","name":"microsoft.conditionalAccess.namedLocations","fields":{"countryLocations":{"name":"countryLocations","type":"\u0019\u001bmicrosoft.conditionalAccess.countryNamedLocation","title":"Country-based named locations","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ipLocations":{"name":"ipLocations","type":"\u0019\u001bmicrosoft.conditionalAccess.ipNamedLocation","title":"IP-based named locations","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra Conditional Access Named Locations","desc":"Named location definitions referenced by Conditional Access policy conditions to include or exclude sign-ins from specific networks. Split into ipLocations (IP address ranges, often flagged trusted) and countryLocations (countries or regions). Auditing named locations verifies that trusted-network and geographic controls point at the right ranges before policies rely on them.","min_provider_version":"11.0.46","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy":{"id":"microsoft.conditionalAccess.policy","name":"microsoft.conditionalAccess.policy","fields":{"conditions":{"name":"conditions","type":"\u001bmicrosoft.conditionalAccess.policy.conditions","is_mandatory":true,"title":"Policy conditions","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Specifies a display name for the conditionalAccessPolicy object","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"grantControls":{"name":"grantControls","type":"\u001bmicrosoft.conditionalAccess.policy.grantControls","is_mandatory":true,"title":"Specifies the grant controls that must be fulfilled to pass the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Specifies the identifier of a conditionalAccessPolicy object","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"modifiedDateTime":{"name":"modifiedDateTime","type":"\t","is_mandatory":true,"title":"The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sessionControls":{"name":"sessionControls","type":"\u001bmicrosoft.conditionalAccess.policy.sessionControls","is_mandatory":true,"title":"Specifies the session controls that are enforced after sign-in","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Specifies the state of the conditionalAccessPolicy object. Possible values are: enabled, disabled, enabledForReportingButNotEnforced.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"templateId":{"name":"templateId","type":"\u0007","is_mandatory":true,"title":"Template ID (if created from template)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra Conditional Access Policy","desc":"Single Conditional Access policy in the tenant. The state field (enabled, disabled, or enabledForReportingButNotEnforced) determines whether the policy is enforced, reporting-only, or off. conditions scope the policy to specific users, applications, platforms, locations, and risk levels; grantControls define what a matching sign-in must satisfy (block, MFA, compliant device, and so on); and sessionControls constrain the resulting session (sign-in frequency, persistent browser). Auditing policies confirms that enforced controls cover privileged users and sensitive apps with no exclusion gaps.","min_provider_version":"11.1.38","defaults":"id displayName state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.conditions":{"id":"microsoft.conditionalAccess.policy.conditions","name":"microsoft.conditionalAccess.policy.conditions","fields":{"applications":{"name":"applications","type":"\u001bmicrosoft.conditionalAccess.policy.conditions.applications","is_mandatory":true,"title":"Applications and user actions included in and excluded from the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"authenticationFlows":{"name":"authenticationFlows","type":"\u001bmicrosoft.conditionalAccess.policy.conditions.authenticationFlows","is_mandatory":true,"title":"Authentication flows included in the policy scope","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"clientAppTypes":{"name":"clientAppTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Client application types included in the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"clientApplications":{"name":"clientApplications","type":"\u001bmicrosoft.conditionalAccess.policy.conditions.clientApplications","is_mandatory":true,"title":"Client applications (service principals and workload identities) included in and excluded from the policy","desc":"Either users or clientApplications is required.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal ID based on policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"insiderRiskLevels":{"name":"insiderRiskLevels","type":"\u0007","is_mandatory":true,"title":"Insider risk levels included in the policy. The possible values are: minor, moderate, elevated, unknownFutureValue.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"locations":{"name":"locations","type":"\u001bmicrosoft.conditionalAccess.policy.conditions.locations","is_mandatory":true,"title":"Locations included in and excluded from the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"platforms":{"name":"platforms","type":"\u001bmicrosoft.conditionalAccess.policy.conditions.platforms","is_mandatory":true,"title":"Platforms included in and excluded from the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"servicePrincipalRiskLevels":{"name":"servicePrincipalRiskLevels","type":"\u0019\u0007","is_mandatory":true,"title":"Service principal risk levels included in the policy. Possible values are: low, medium, high, none, unknownFutureValue.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"signInRiskLevels":{"name":"signInRiskLevels","type":"\u0019\u0007","is_mandatory":true,"title":"Sign-in risk levels included in the policy. Possible values are: low, medium, high, hidden, none, unknownFutureValue.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userRiskLevels":{"name":"userRiskLevels","type":"\u0019\u0007","is_mandatory":true,"title":"User risk levels included in the policy. Possible values are: low, medium, high, hidden, none, unknownFutureValue.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"users":{"name":"users","type":"\u001bmicrosoft.conditionalAccess.policy.conditions.users","is_mandatory":true,"title":"Users, groups, and roles included in and excluded from the policy. Either users or clientApplications is required.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Represents the type of conditions that govern when the policy applies","private":true,"min_provider_version":"11.1.38","defaults":"id applications platforms","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.conditions.applications":{"id":"microsoft.conditionalAccess.policy.conditions.applications","name":"microsoft.conditionalAccess.policy.conditions.applications","fields":{"excludeApplications":{"name":"excludeApplications","type":"\u0019\u0007","is_mandatory":true,"title":"Can be one of the following: appId, All, Office365, MicrosoftAdminPortals","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeApplications":{"name":"includeApplications","type":"\u0019\u0007","is_mandatory":true,"title":"Can be one of the following: appId, All, Office365, MicrosoftAdminPortals","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeUserActions":{"name":"includeUserActions","type":"\u0019\u0007","is_mandatory":true,"title":"User actions to include","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Represents the applications and user actions included in and excluded from the conditional access policy","private":true,"min_provider_version":"11.1.38","defaults":"includeApplications excludeApplications includeUserActions","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.conditions.authenticationFlows":{"id":"microsoft.conditionalAccess.policy.conditions.authenticationFlows","name":"microsoft.conditionalAccess.policy.conditions.authenticationFlows","fields":{"transferMethods":{"name":"transferMethods","type":"\u0007","is_mandatory":true,"title":"Represents the transfer methods in scope for the policy. The possible values are: none, deviceCodeFlow, authenticationTransfer, unknownFutureValue.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"The authentication flows in scope for a Microsoft Entra Conditional Access policy","private":true,"min_provider_version":"11.1.38","defaults":"transferMethods","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.conditions.clientApplications":{"id":"microsoft.conditionalAccess.policy.conditions.clientApplications","name":"microsoft.conditionalAccess.policy.conditions.clientApplications","fields":{"excludeServicePrincipals":{"name":"excludeServicePrincipals","type":"\u0019\u0007","is_mandatory":true,"title":"Service principal IDs excluded from the policy scope","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"excludeServicePrincipalsRefs":{"name":"excludeServicePrincipalsRefs","type":"\u0019\u001bmicrosoft.serviceprincipal","title":"Service principals excluded from the policy scope","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeServicePrincipals":{"name":"includeServicePrincipals","type":"\u0019\u0007","is_mandatory":true,"title":"Service principal IDs included in the policy scope, or ServicePrincipalsInMyTenant","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeServicePrincipalsRefs":{"name":"includeServicePrincipalsRefs","type":"\u0019\u001bmicrosoft.serviceprincipal","title":"Service principals included in the policy scope","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Represents client applications (service principals and workload identities) included in and excluded from the policy scope","private":true,"min_provider_version":"11.1.38","defaults":"excludeServicePrincipals includeServicePrincipals","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.conditions.locations":{"id":"microsoft.conditionalAccess.policy.conditions.locations","name":"microsoft.conditionalAccess.policy.conditions.locations","fields":{"excludeLocations":{"name":"excludeLocations","type":"\u0019\u0007","is_mandatory":true,"title":"Location IDs excluded from scope of policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeLocations":{"name":"includeLocations","type":"\u0019\u0007","is_mandatory":true,"title":"Location IDs in scope of policy unless explicitly excluded, All, or AllTrusted","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Locations included in and excluded from a Conditional Access policy","desc":"Named locations a Microsoft Entra Conditional Access policy applies to or excludes, expressed as country/region or IP address definitions. The includeLocations and excludeLocations lists hold named-location IDs plus the reserved values All and AllTrusted.","private":true,"min_provider_version":"11.1.38","defaults":"includeLocations excludeLocations","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.conditions.platforms":{"id":"microsoft.conditionalAccess.policy.conditions.platforms","name":"microsoft.conditionalAccess.policy.conditions.platforms","fields":{"excludePlatforms":{"name":"excludePlatforms","type":"\u0019\u0007","is_mandatory":true,"title":"Possible values are: android, iOS, windows, windowsPhone, macOS, linux, all, unknownFutureValue","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includePlatforms":{"name":"includePlatforms","type":"\u0019\u0007","is_mandatory":true,"title":"Possible values are: android, iOS, windows, windowsPhone, macOS, linux, all, unknownFutureValue","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Platforms included in and excluded from the policy scope","private":true,"min_provider_version":"11.1.38","defaults":"excludePlatforms includePlatforms","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.conditions.users":{"id":"microsoft.conditionalAccess.policy.conditions.users","name":"microsoft.conditionalAccess.policy.conditions.users","fields":{"excludeGroups":{"name":"excludeGroups","type":"\u0019\u0007","is_mandatory":true,"title":"Group IDs excluded from scope of policy","desc":"Deprecated in favor of excludeGroupsRefs.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"excludeGroupsRefs":{"name":"excludeGroupsRefs","type":"\u0019\u001bmicrosoft.group","title":"Groups excluded from scope of policy","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"excludeRoles":{"name":"excludeRoles","type":"\u0019\u0007","is_mandatory":true,"title":"Role IDs excluded from scope of policy","desc":"Deprecated in favor of excludeRolesRefs.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"excludeRolesRefs":{"name":"excludeRolesRefs","type":"\u0019\u001bmicrosoft.rolemanagement.roledefinition","title":"Roles excluded from scope of policy","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"excludeUsers":{"name":"excludeUsers","type":"\u0019\u0007","is_mandatory":true,"title":"User IDs excluded from scope of policy and/or GuestsOrExternalUsers","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"excludeUsersRefs":{"name":"excludeUsersRefs","type":"\u0019\u001bmicrosoft.user","title":"Users excluded from scope of policy","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeGroups":{"name":"includeGroups","type":"\u0019\u0007","is_mandatory":true,"title":"Group IDs in scope of policy unless explicitly excluded","desc":"Deprecated in favor of includeGroupsRefs.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"includeGroupsRefs":{"name":"includeGroupsRefs","type":"\u0019\u001bmicrosoft.group","title":"Groups in scope of policy","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeRoles":{"name":"includeRoles","type":"\u0019\u0007","is_mandatory":true,"title":"Role IDs in scope of policy unless explicitly excluded","desc":"Deprecated in favor of includeRolesRefs.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"includeRolesRefs":{"name":"includeRolesRefs","type":"\u0019\u001bmicrosoft.rolemanagement.roledefinition","title":"Roles in scope of policy","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeUsers":{"name":"includeUsers","type":"\u0019\u0007","is_mandatory":true,"title":"User IDs in scope of policy unless explicitly excluded, None, All, or GuestsOrExternalUsers","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeUsersRefs":{"name":"includeUsersRefs","type":"\u0019\u001bmicrosoft.user","title":"Users in scope of policy","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Users, groups, and roles included in and excluded from a Microsoft Entra Conditional Access policy scope","private":true,"min_provider_version":"11.1.38","defaults":"includeUsers excludeUsers","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.grantControls":{"id":"microsoft.conditionalAccess.policy.grantControls","name":"microsoft.conditionalAccess.policy.grantControls","fields":{"authenticationStrength":{"name":"authenticationStrength","type":"\u001bmicrosoft.conditionalAccess.policy.grantControls.authenticationStrength","is_mandatory":true,"title":"The authentication strength required by the conditional access policy (Optional)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"builtInControls":{"name":"builtInControls","type":"\u0019\u0007","is_mandatory":true,"title":"List of values of built-in controls required by the policy","desc":"Possible values: block, mfa, compliantDevice, domainJoinedDevice, approvedApplication, compliantApplication, passwordChange, unknownFutureValue.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"customAuthenticationFactors":{"name":"customAuthenticationFactors","type":"\u0019\u0007","is_mandatory":true,"title":"List of custom controls IDs required by the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal ID based on policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"operator":{"name":"operator","type":"\u0007","is_mandatory":true,"title":"Defines the relationship of the grant controls. Possible values: AND, OR.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"termsOfUse":{"name":"termsOfUse","type":"\u0019\u0007","is_mandatory":true,"title":"List of terms of use IDs required by the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Represents grant controls that must be fulfilled to pass the policy","private":true,"min_provider_version":"11.1.38","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.grantControls.authenticationStrength":{"id":"microsoft.conditionalAccess.policy.grantControls.authenticationStrength","name":"microsoft.conditionalAccess.policy.grantControls.authenticationStrength","fields":{"allowedCombinations":{"name":"allowedCombinations","type":"\u0019\u0007","is_mandatory":true,"title":"A collection of authentication method modes that are required be used to satisfy this authentication strength","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"The time when this policy was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"The human-readable description of this policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"The human-readable display name of this policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"The system-generated identifier for this mode","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"modifiedDateTime":{"name":"modifiedDateTime","type":"\t","is_mandatory":true,"title":"The time when this policy was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policyType":{"name":"policyType","type":"\u0007","is_mandatory":true,"title":"A descriptor if this policy is built into Microsoft Entra ID or created by an admin for the tenant","desc":"The possible values are: builtIn, custom, unknownFutureValue.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"requirementsSatisfied":{"name":"requirementsSatisfied","type":"\u0007","is_mandatory":true,"title":"A descriptor if this authentication strength grants the MFA claim upon successful satisfaction","desc":"The possible values are: none, mfa, unknownFutureValue.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"A collection of settings that define specific combinations of authentication methods and metadata","private":true,"min_provider_version":"11.1.38","defaults":"id displayName allowedCombinations","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.sessionControls":{"id":"microsoft.conditionalAccess.policy.sessionControls","name":"microsoft.conditionalAccess.policy.sessionControls","fields":{"applicationEnforcedRestrictions":{"name":"applicationEnforcedRestrictions","type":"\u001bmicrosoft.conditionalAccess.policy.sessionControls.applicationEnforcedRestrictions","is_mandatory":true,"title":"Session control to enforce application restrictions. Only Exchange Online and SharePoint Online support this session control","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"cloudAppSecurity":{"name":"cloudAppSecurity","type":"\u001bmicrosoft.conditionalAccess.policy.sessionControls.cloudAppSecurity","is_mandatory":true,"title":"Session control to apply cloud app security","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal ID based on policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"persistentBrowser":{"name":"persistentBrowser","type":"\n","is_mandatory":true,"title":"Session control to define whether to persist cookies or not. All apps should be selected for this session control to work correctly.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"secureSignInSession":{"name":"secureSignInSession","type":"\n","is_mandatory":true,"title":"Secure application model for continuous access evaluation","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"signInFrequency":{"name":"signInFrequency","type":"\u001bmicrosoft.conditionalAccess.policy.sessionControls.signInFrequency","is_mandatory":true,"title":"Session control to enforce signin frequency","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra Conditional Access Policy Session Controls","private":true,"min_provider_version":"11.1.38","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.sessionControls.applicationEnforcedRestrictions":{"id":"microsoft.conditionalAccess.policy.sessionControls.applicationEnforcedRestrictions","name":"microsoft.conditionalAccess.policy.sessionControls.applicationEnforcedRestrictions","fields":{"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Specifies whether the session control is enabled or not","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Session control to enforce application restrictions","private":true,"min_provider_version":"11.1.38","defaults":"isEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.sessionControls.cloudAppSecurity":{"id":"microsoft.conditionalAccess.policy.sessionControls.cloudAppSecurity","name":"microsoft.conditionalAccess.policy.sessionControls.cloudAppSecurity","fields":{"cloudAppSecurityType":{"name":"cloudAppSecurityType","type":"\u0007","is_mandatory":true,"title":"Specifies CloudApp security session control types","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Specifies whether the session control is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Session control used to enforce cloud app security checks","private":true,"min_provider_version":"11.1.38","defaults":"cloudAppSecurityType isEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.sessionControls.persistentBrowser":{"id":"microsoft.conditionalAccess.policy.sessionControls.persistentBrowser","name":"microsoft.conditionalAccess.policy.sessionControls.persistentBrowser","fields":{"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Specifies whether the session control is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Possible values are: always, never","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Session control to define whether to persist cookies or not","private":true,"min_provider_version":"11.1.38","defaults":"mode isEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.conditionalAccess.policy.sessionControls.signInFrequency":{"id":"microsoft.conditionalAccess.policy.sessionControls.signInFrequency","name":"microsoft.conditionalAccess.policy.sessionControls.signInFrequency","fields":{"authenticationType":{"name":"authenticationType","type":"\u0007","is_mandatory":true,"title":"The possible values are primaryAndSecondaryAuthentication, secondaryAuthentication, unknownFutureValue.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"frequencyInterval":{"name":"frequencyInterval","type":"\u0007","is_mandatory":true,"title":"The frequency interval type","desc":"The possible values are timeBased, everyTime, unknownFutureValue. Sign-in frequency of everyTime is available for risky users, risky sign-ins, and Intune device enrollment.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Specifies whether the session control is enabled.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"The sign-in frequency type (days, hours)","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"value":{"name":"value","type":"\u0005","is_mandatory":true,"title":"The sign-in frequency value","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Session control to enforce sign-in frequency","private":true,"min_provider_version":"11.1.38","defaults":"authenticationType isEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.crossTenantAccessPolicyDefault":{"id":"microsoft.crossTenantAccessPolicyDefault","name":"microsoft.crossTenantAccessPolicyDefault","fields":{"automaticUserConsentSettings":{"name":"automaticUserConsentSettings","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.automaticUserConsentSettings","title":"Determines the default configuration for automatic user consent settings","desc":"Controls if users consent automatically to apps on behalf of users in other tenants.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"b2bCollaborationInbound":{"name":"b2bCollaborationInbound","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.b2bSetting","title":"Defines your default configuration for users from other organizations accessing your resources via Microsoft Entra B2B collaboration.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"b2bCollaborationOutbound":{"name":"b2bCollaborationOutbound","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.b2bSetting","title":"Defines your default configuration for users in your organization going outbound to access other organizations via Microsoft Entra B2B collaboration.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"b2bDirectConnectInbound":{"name":"b2bDirectConnectInbound","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.b2bSetting","title":"Defines your default configuration for users from other organizations accessing your resources via Azure AD B2B direct connect.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"b2bDirectConnectOutbound":{"name":"b2bDirectConnectOutbound","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.b2bSetting","title":"Defines your default configuration for users in your organization going outbound to access other organizations via Azure AD B2B direct connect.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"b2bSetting":{"name":"b2bSetting","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.b2bSetting","title":"B2B setting for cross-tenant access policy (used for collaboration, direct connect, and tenant restrictions)","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"inboundTrust":{"name":"inboundTrust","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.inboundTrust","title":"Defines if MFA, compliant devices, and hybrid Azure AD joined devices from external tenants are accepted.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"invitationRedemptionIdentityProviderConfiguration":{"name":"invitationRedemptionIdentityProviderConfiguration","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.invitationRedemptionIdentityProviderConfiguration","title":"Specifies the default configuration for invitation redemption for external users in your organization.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isServiceDefault":{"name":"isServiceDefault","type":"\u0004","is_mandatory":true,"title":"True if the default configuration is inherited from the service default. False if the default configuration has been customized.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"tenantRestrictions":{"name":"tenantRestrictions","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.b2bSetting","title":"Defines the default configuration for tenant restrictions settings.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Cross-tenant access policy default configuration","desc":"Tenant-wide defaults that govern how users from other Microsoft Entra tenants collaborate with your organization when no partner-specific configuration applies. Audit this to confirm inbound and outbound B2B collaboration and B2B direct connect are scoped as intended, which external trust signals (MFA, compliant devices, hybrid Entra joined devices) are honored, whether automatic user consent is granted, and how invitation redemption resolves identity providers. The isServiceDefault field indicates whether these values are still the Microsoft-provided defaults or have been customized.","private":true,"min_provider_version":"11.1.99","defaults":"isServiceDefault automaticUserConsentSettings inboundTrust","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.crossTenantAccessPolicyDefault.automaticUserConsentSettings":{"id":"microsoft.crossTenantAccessPolicyDefault.automaticUserConsentSettings","name":"microsoft.crossTenantAccessPolicyDefault.automaticUserConsentSettings","fields":{"inboundAllowed":{"name":"inboundAllowed","type":"\u0004","is_mandatory":true,"title":"Whether automatic consent for inbound collaboration is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"outboundAllowed":{"name":"outboundAllowed","type":"\u0004","is_mandatory":true,"title":"Whether automatic consent for outbound collaboration is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Automatic user consent settings for cross-tenant access policy","private":true,"min_provider_version":"11.1.99","defaults":"inboundAllowed outboundAllowed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.crossTenantAccessPolicyDefault.b2bSetting":{"id":"microsoft.crossTenantAccessPolicyDefault.b2bSetting","name":"microsoft.crossTenantAccessPolicyDefault.b2bSetting","fields":{"applications":{"name":"applications","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.b2bSetting.targetConfig","title":"Defines the default configuration for applications.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"target":{"name":"target","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.b2bSetting.target","title":"Target for B2B setting configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"targetConfig":{"name":"targetConfig","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.b2bSetting.targetConfig","title":"Users and groups configuration for B2B settings","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"usersAndGroups":{"name":"usersAndGroups","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault.b2bSetting.targetConfig","title":"Defines the default configuration for users and groups.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"B2B setting for cross-tenant access policy (used for collaboration, direct connect, and tenant restrictions)","private":true,"min_provider_version":"11.1.99","defaults":"usersAndGroups applications","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.crossTenantAccessPolicyDefault.b2bSetting.target":{"id":"microsoft.crossTenantAccessPolicyDefault.b2bSetting.target","name":"microsoft.crossTenantAccessPolicyDefault.b2bSetting.target","fields":{"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"The unique identifier for the target.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"targetType":{"name":"targetType","type":"\u0007","is_mandatory":true,"title":"The type of target. Possible values are: user, application.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Target for B2B setting configuration","private":true,"min_provider_version":"11.1.99","defaults":"target targetType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.crossTenantAccessPolicyDefault.b2bSetting.targetConfig":{"id":"microsoft.crossTenantAccessPolicyDefault.b2bSetting.targetConfig","name":"microsoft.crossTenantAccessPolicyDefault.b2bSetting.targetConfig","fields":{"accessType":{"name":"accessType","type":"\u0007","is_mandatory":true,"title":"The type of access. Possible values are: blocked, allowed.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"targets":{"name":"targets","type":"\u0019\u001bmicrosoft.crossTenantAccessPolicyDefault.b2bSetting.target","is_mandatory":true,"title":"The targets of the policy configuration.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Users and groups configuration for B2B settings","private":true,"min_provider_version":"11.1.99","defaults":"accessType targets","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.crossTenantAccessPolicyDefault.inboundTrust":{"id":"microsoft.crossTenantAccessPolicyDefault.inboundTrust","name":"microsoft.crossTenantAccessPolicyDefault.inboundTrust","fields":{"isCompliantDeviceAccepted":{"name":"isCompliantDeviceAccepted","type":"\u0004","is_mandatory":true,"title":"If true, compliant devices from external tenants are accepted.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isHybridAzureADJoinedDeviceAccepted":{"name":"isHybridAzureADJoinedDeviceAccepted","type":"\u0004","is_mandatory":true,"title":"If true, hybrid Azure AD joined devices from external tenants are accepted.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isMfaAccepted":{"name":"isMfaAccepted","type":"\u0004","is_mandatory":true,"title":"If true, MFA from external tenants is accepted.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Inbound trust settings for cross-tenant access policy","private":true,"min_provider_version":"11.1.99","defaults":"isMfaAccepted isCompliantDeviceAccepted isHybridAzureADJoinedDeviceAccepted","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.crossTenantAccessPolicyDefault.invitationRedemptionIdentityProviderConfiguration":{"id":"microsoft.crossTenantAccessPolicyDefault.invitationRedemptionIdentityProviderConfiguration","name":"microsoft.crossTenantAccessPolicyDefault.invitationRedemptionIdentityProviderConfiguration","fields":{"fallbackIdentityProvider":{"name":"fallbackIdentityProvider","type":"\u0007","is_mandatory":true,"title":"Specifies an identity provider for invitations when no precedence order is provided.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"primaryIdentityProviderPrecedenceOrder":{"name":"primaryIdentityProviderPrecedenceOrder","type":"\u0019\u0007","is_mandatory":true,"title":"Specifies the precedence order for identity providers.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Invitation redemption identity provider configuration","private":true,"min_provider_version":"11.1.99","defaults":"fallbackIdentityProvider primaryIdentityProviderPrecedenceOrder","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.defaultAppManagementPolicy":{"id":"microsoft.defaultAppManagementPolicy","name":"microsoft.defaultAppManagementPolicy","fields":{"appManagementConfiguration":{"name":"appManagementConfiguration","type":"\u001bmicrosoft.defaultAppManagementPolicy.appManagementConfiguration","title":"App Management Credential Restrictions","desc":"Password- and key-credential restrictions enforced on applications or service principals. Each entry in passwordCredentials and keyCredentials carries the restriction type, the maximum allowed credential lifetime, the state (enabled or disabled), and the date after which apps created later are subject to the restriction.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"applicationRestrictions":{"name":"applicationRestrictions","type":"\u001bmicrosoft.defaultAppManagementPolicy.appManagementConfiguration","is_mandatory":true,"title":"Restrictions that apply to application objects in the tenant","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Policy display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Denotes whether the policy restrictions are enforced for all applications and service principals in the tenant","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"servicePrincipalRestrictions":{"name":"servicePrincipalRestrictions","type":"\u001bmicrosoft.defaultAppManagementPolicy.appManagementConfiguration","is_mandatory":true,"title":"Restrictions that apply to service principal objects in the tenant","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Tenant Default App Management Policy","desc":"Tenant-wide default policy that restricts the secrets and certificates configurable on application registrations and service principals. The isEnabled field reports whether the restrictions are enforced, while applicationRestrictions and servicePrincipalRestrictions expose the password- and key-credential rules (maximum allowed lifetime, the restriction type, and the date after which newly created apps become subject to them). Audit this policy to confirm long-lived or unrestricted app credentials are disallowed across the tenant.","private":true,"min_provider_version":"13.5.1","defaults":"displayName isEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.defaultAppManagementPolicy.appManagementConfiguration":{"id":"microsoft.defaultAppManagementPolicy.appManagementConfiguration","name":"microsoft.defaultAppManagementPolicy.appManagementConfiguration","fields":{"keyCredentials":{"name":"keyCredentials","type":"\u0019\n","is_mandatory":true,"title":"Restrictions on the key (certificate) credentials that can be added","desc":"Each entry has keys: `restrictionType` (one of passwordAddition, passwordLifetime, symmetricKeyAddition, symmetricKeyLifetime, customPasswordAddition, or unknownFutureValue), `maxLifetime` (the maximum allowed credential lifetime as an ISO 8601 duration), `state` (enabled or disabled), and `restrictForAppsCreatedAfterDateTime` (the timestamp after which apps created later are subject to the restriction).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"passwordCredentials":{"name":"passwordCredentials","type":"\u0019\n","is_mandatory":true,"title":"Restrictions on the password (secret) credentials that can be added","desc":"Each entry has keys: `restrictionType` (one of passwordAddition, passwordLifetime, symmetricKeyAddition, symmetricKeyLifetime, customPasswordAddition, or unknownFutureValue), `maxLifetime` (the maximum allowed credential lifetime as an ISO 8601 duration), `state` (enabled or disabled), and `restrictForAppsCreatedAfterDateTime` (the timestamp after which apps created later are subject to the restriction).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"App Management Credential Restrictions","desc":"Password- and key-credential restrictions enforced on applications or service principals. Each entry in passwordCredentials and keyCredentials carries the restriction type, the maximum allowed credential lifetime, the state (enabled or disabled), and the date after which apps created later are subject to the restriction.","private":true,"min_provider_version":"13.5.1","defaults":"passwordCredentials keyCredentials","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.device":{"id":"microsoft.device","name":"microsoft.device","fields":{"accountEnabled":{"name":"accountEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the device account is enabled","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"approximateLastSignInDateTime":{"name":"approximateLastSignInDateTime","type":"\t","is_mandatory":true,"title":"Date and time the device most recently signed in","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"complianceExpirationDateTime":{"name":"complianceExpirationDateTime","type":"\t","is_mandatory":true,"title":"Date and time when the device's compliance status expires","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deletedDateTime":{"name":"deletedDateTime","type":"\t","is_mandatory":true,"title":"Soft-delete timestamp for the device","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deviceCategory":{"name":"deviceCategory","type":"\u0007","is_mandatory":true,"title":"User-defined property set by Intune","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deviceId":{"name":"deviceId","type":"\u0007","is_mandatory":true,"title":"Immutable identifier assigned at device registration","desc":"Set by the Microsoft Entra Device Registration Service when the device registers. Usable as an alternate key to reference the device, and distinct from `id`, the directory object identifier.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deviceOwnership":{"name":"deviceOwnership","type":"\u0007","is_mandatory":true,"title":"Ownership of the device","desc":"Set by Intune. One of unknown, company, or personal.","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Device display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enrollmentProfileName":{"name":"enrollmentProfileName","type":"\u0007","is_mandatory":true,"title":"Enrollment profile applied to the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enrollmentType":{"name":"enrollmentType","type":"\u0007","is_mandatory":true,"title":"Enrollment type of the device","desc":"Set by Intune. Possible values: unknown, userEnrollment, deviceEnrollmentManager, appleBulkWithUser, appleBulkWithoutUser, windowsAzureADJoin, windowsBulkUserless, windowsAutoEnrollment, windowsBulkAzureDomainJoin, windowsCoManagement, windowsAzureADJoinUsingDeviceAuth, appleUserEnrollment, or appleUserEnrollmentWithServiceAccount. Other values may also be returned.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Device ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isCompliant":{"name":"isCompliant","type":"\u0004","is_mandatory":true,"title":"Whether the device complies with Mobile Device Management (MDM) policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isManaged":{"name":"isManaged","type":"\u0004","is_mandatory":true,"title":"Whether the device is managed by a Mobile Device Management (MDM) app","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isRooted":{"name":"isRooted","type":"\u0004","is_mandatory":true,"title":"Whether the device is rooted or jail-broken","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"manufacturer":{"name":"manufacturer","type":"\u0007","is_mandatory":true,"title":"Device manufacturer or vendor name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mdmAppId":{"name":"mdmAppId","type":"\u0007","is_mandatory":true,"title":"Application identifier used to register device into MDM","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"model":{"name":"model","type":"\u0007","is_mandatory":true,"title":"Model of the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"onPremisesLastSyncDateTime":{"name":"onPremisesLastSyncDateTime","type":"\t","is_mandatory":true,"title":"The last time the device was synced from on-premises","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"onPremisesSyncEnabled":{"name":"onPremisesSyncEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the device is synced from an on-premises directory","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"operatingSystem":{"name":"operatingSystem","type":"\u0007","is_mandatory":true,"title":"The type of operating system on the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"operatingSystemVersion":{"name":"operatingSystemVersion","type":"\u0007","is_mandatory":true,"title":"The version of the operating system on the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"physicalIds":{"name":"physicalIds","type":"\u0019\u0007","is_mandatory":true,"title":"Physical IDs","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"profileType":{"name":"profileType","type":"\u0007","is_mandatory":true,"title":"Profile type of the device","desc":"One of RegisteredDevice (default), SecureVM, Printer, Shared, or IoT.","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"registrationDateTime":{"name":"registrationDateTime","type":"\t","is_mandatory":true,"title":"Date and time of when the device was registered","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"systemLabels":{"name":"systemLabels","type":"\u0019\u0007","is_mandatory":true,"title":"List of labels applied to the device by the system","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"trustType":{"name":"trustType","type":"\u0007","is_mandatory":true,"title":"Type of trust for the joined device","desc":"One of Workplace (registered bring-your-own personal devices), AzureAd (cloud-only joined devices), or ServerAd (on-premises domain devices also joined to Microsoft Entra ID).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft device","private":true,"min_provider_version":"11.1.21","defaults":"id displayName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement":{"id":"microsoft.devicemanagement","name":"microsoft.devicemanagement","fields":{"appProtectionPolicies":{"name":"appProtectionPolicies","type":"\u0019\u001bmicrosoft.devicemanagement.appProtectionPolicy","title":"App protection (MAM) policies for iOS and Android","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"appProtectionPolicy":{"name":"appProtectionPolicy","type":"\u001bmicrosoft.devicemanagement.appProtectionPolicy","title":"Microsoft Intune app protection (MAM) policy","desc":"Intune mobile application management policy that protects corporate data inside managed apps on iOS and Android, selected by its `id`; `platformType` reports which platform it targets. The policy governs access protection (`pinRequired`, `minimumPinLength`, `maximumPinRetries`, `simplePinBlocked`, `fingerprintBlocked`, `periodOfflineBeforeAccessCheck`), data containment (`dataBackupBlocked`, `saveAsBlocked`, `printBlocked`, `contactSyncBlocked`, `allowedDataStorageLocations`, the inbound/outbound data-transfer levels, and `allowedOutboundClipboardSharingLevel`), the required `managedBrowser` behavior, and device-health requirements (`deviceComplianceRequired`, `minimumRequiredOsVersion`, `minimumRequiredAppVersion`). Use `isAssigned` to spot policies that are configured but not targeted at anyone.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"assignmentFilter":{"name":"assignmentFilter","type":"\u001bmicrosoft.devicemanagement.assignmentFilter","title":"Microsoft Intune assignment filter","desc":"Assignment filter used to narrow which devices a policy or app assignment targets, selected by its `id`. The `rule` holds the filter expression evaluated against device properties, `platform` reports the device platform it applies to, and `assignmentFilterManagementType` distinguishes device filters from managed-app filters. A policy assignment references a filter through `microsoft.devicemanagement.policyAssignment.filter`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"assignmentFilters":{"name":"assignmentFilters","type":"\u0019\u001bmicrosoft.devicemanagement.assignmentFilter","title":"Assignment filters used to scope policy and app assignments","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"complianceManagementPartner":{"name":"complianceManagementPartner","type":"\u001bmicrosoft.devicemanagement.complianceManagementPartner","title":"Microsoft Intune compliance management partner","desc":"Device compliance management partner connected to Intune, selected by its `id`. `partnerState` and `lastHeartbeatDateTime` report connection health, and `androidOnboarded`, `iosOnboarded`, and `macOsOnboarded` show which platforms the partner has been onboarded for.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"complianceManagementPartners":{"name":"complianceManagementPartners","type":"\u0019\u001bmicrosoft.devicemanagement.complianceManagementPartner","title":"Compliance management partner connectors","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"configurationPolicies":{"name":"configurationPolicies","type":"\u0019\u001bmicrosoft.devicemanagement.configurationPolicy","title":"Settings catalog configuration policies","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"configurationPolicy":{"name":"configurationPolicy","type":"\u001bmicrosoft.devicemanagement.configurationPolicy","title":"Microsoft Intune settings catalog policy","desc":"Settings catalog (unified configuration) policy, selected by its `id`. Metadata covers the `name`, `description`, the `platforms` and `technologies` the policy targets, the number of configured settings (`settingCount`), `roleScopeTagIds`, and whether it `isAssigned`. When the policy was created from a template, `templateId`, `templateDisplayName`, and `templateFamily` identify it. Use `settings` to read the individual configured settings; each entry reports its `settingDefinitionId`, `settingType`, and `value`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"detectedApps":{"name":"detectedApps","type":"\u0019\u001bmicrosoft.devicemanagement.detectedapp","title":"Apps detected as installed on managed devices, aggregated across the tenant","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"detectedapp":{"name":"detectedapp","type":"\u001bmicrosoft.devicemanagement.detectedapp","title":"App detected as installed on managed devices","desc":"Application inventory that Intune builds from managed-device reporting. `deviceCount` is the number of devices in the tenant on which Intune has detected this app at the given `version`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"deviceCompliancePolicies":{"name":"deviceCompliancePolicies","type":"\u0019\u001bmicrosoft.devicemanagement.devicecompliancepolicy","title":"List of device compliance policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deviceConfigurations":{"name":"deviceConfigurations","type":"\u0019\u001bmicrosoft.devicemanagement.deviceconfiguration","title":"List of device configurations","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deviceEnrollmentConfiguration":{"name":"deviceEnrollmentConfiguration","type":"\u001bmicrosoft.devicemanagement.deviceEnrollmentConfiguration","title":"Microsoft Device Enrollment Configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"deviceEnrollmentConfigurations":{"name":"deviceEnrollmentConfigurations","type":"\u0019\u001bmicrosoft.devicemanagement.deviceEnrollmentConfiguration","title":"Device Enrollment Configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"devicecompliancepolicy":{"name":"devicecompliancepolicy","type":"\u001bmicrosoft.devicemanagement.devicecompliancepolicy","title":"Microsoft device compliance policy","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"deviceconfiguration":{"name":"deviceconfiguration","type":"\u001bmicrosoft.devicemanagement.deviceconfiguration","title":"Microsoft device configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"groupPolicyConfiguration":{"name":"groupPolicyConfiguration","type":"\u001bmicrosoft.devicemanagement.groupPolicyConfiguration","title":"Microsoft Intune group policy configuration","desc":"Administrative-templates (ADMX) policy configuration, selected by its `id`. `policyConfigurationIngestionType` reports whether it uses the built-in or custom (ingested) ADMX templates. `definitionValues` reads the individual administrative-template settings the configuration sets.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"groupPolicyConfigurations":{"name":"groupPolicyConfigurations","type":"\u0019\u001bmicrosoft.devicemanagement.groupPolicyConfiguration","title":"Group policy (administrative template) configurations","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"groupPolicyDefinitionValue":{"name":"groupPolicyDefinitionValue","type":"\u001bmicrosoft.devicemanagement.groupPolicyDefinitionValue","title":"Microsoft Intune group policy definition value","desc":"Single administrative-template setting configured by a group policy configuration. `definitionName` names the policy, `enabled` reports whether it is enabled or disabled, `definitionClassType` whether it applies to the machine or the user, and `definitionCategoryPath` its location in the administrative-templates tree.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"intent":{"name":"intent","type":"\u001bmicrosoft.devicemanagement.intent","title":"Endpoint security intent","desc":"Endpoint security policies created from Intune templates: antivirus, disk encryption, firewall, endpoint detection and response, account protection, and attack surface reduction. `templateId` and `templateDisplayName` identify which template the intent was created from; `settings` returns the configured settings; `assignments` returns the groups and devices it targets.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"intents":{"name":"intents","type":"\u0019\u001bmicrosoft.devicemanagement.intent","title":"Endpoint security intents (antivirus, disk encryption, firewall, EDR, account protection, attack surface reduction)","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"managedAppConfiguration":{"name":"managedAppConfiguration","type":"\u001bmicrosoft.devicemanagement.managedAppConfiguration","title":"Microsoft Intune managed app configuration policy","desc":"App configuration policy that delivers settings to managed apps (MAM), selected by its `id`. `customSettings` holds the configured key/value pairs delivered to the apps, `deployedAppCount` reports how many apps it targets, and `isAssigned` whether it is assigned to any group.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"managedAppConfigurations":{"name":"managedAppConfigurations","type":"\u0019\u001bmicrosoft.devicemanagement.managedAppConfiguration","title":"App configuration policies for managed apps (MAM)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"managedDevices":{"name":"managedDevices","type":"\u0019\u001bmicrosoft.devicemanagement.manageddevice","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"manageddevice":{"name":"manageddevice","type":"\u001bmicrosoft.devicemanagement.manageddevice","title":"Microsoft managed device","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"mobileAppConfiguration":{"name":"mobileAppConfiguration","type":"\u001bmicrosoft.devicemanagement.mobileAppConfiguration","title":"Microsoft Intune managed device app configuration policy","desc":"App configuration policy that delivers settings to managed devices (MDM), selected by its `id`. `targetedMobileApps` lists the IDs of the apps the policy configures.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"mobileAppConfigurations":{"name":"mobileAppConfigurations","type":"\u0019\u001bmicrosoft.devicemanagement.mobileAppConfiguration","title":"App configuration policies for managed devices (MDM)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mobileApps":{"name":"mobileApps","type":"\u0019\u001bmicrosoft.devicemanagement.mobileapp","title":"Apps published to the Intune tenant","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mobileThreatDefenseConnector":{"name":"mobileThreatDefenseConnector","type":"\u001bmicrosoft.devicemanagement.mobileThreatDefenseConnector","title":"Microsoft Intune Mobile Threat Defense connector","desc":"Integration between Intune and a Mobile Threat Defense (MTD) partner, selected by its `id`. `partnerState` and `lastHeartbeatDateTime` report whether the partner is connected and responsive, and the per-platform flags show where the connection is active: `androidEnabled`, `iosEnabled`, and `windowsEnabled` gate device-compliance evaluation, the `*MobileApplicationManagementEnabled` flags gate app protection, and the `*DeviceBlockedOnMissingPartnerData` flags decide whether devices are blocked when the partner has not reported. `microsoftDefenderForEndpointAttachEnabled` indicates the Defender for Endpoint connector is attached.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"mobileThreatDefenseConnectors":{"name":"mobileThreatDefenseConnectors","type":"\u0019\u001bmicrosoft.devicemanagement.mobileThreatDefenseConnector","title":"Mobile Threat Defense partner connectors","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mobileapp":{"name":"mobileapp","type":"\u001bmicrosoft.devicemanagement.mobileapp","title":"Mobile app published to the Intune tenant","desc":"Apps published to Intune for deployment to managed devices. Apps include store apps, line-of-business apps, web apps, and managed Google Play apps. `properties` holds subtype-specific fields keyed by `@odata.type` (for example `bundleId`, `productCode`, `appStoreUrl`, `installCommandLine`), `publishingState` indicates whether the app is ready for deployment, and `assignments` returns the groups it targets.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"policyAssignment":{"name":"policyAssignment","type":"\u001bmicrosoft.devicemanagement.policyAssignment","title":"Assignment of an Intune device management policy","desc":"Binding of an Intune policy to the groups, devices, or licensed users it targets, recording whether each assignment is an include or an exclude. `policyAssignment` is used by compliance policies, configuration profiles, endpoint security intents, and mobile apps. `targetType` identifies the kind of target (`groupAssignmentTarget`, `exclusionGroupAssignmentTarget`, `allDevicesAssignmentTarget`, `allLicensedUsersAssignmentTarget`); `groupId` is populated only when the target is a group.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"roleAssignment":{"name":"roleAssignment","type":"\u001bmicrosoft.devicemanagement.roleAssignment","title":"Assignment of an Intune RBAC role to members","desc":"Binding of an Intune role to the security groups that receive it and the scope tags that constrain where they can act. `members` are the groups that receive the role; `scopeMembers` are the groups whose objects the role applies to; `resourceScopes` is the set of scope-tag IDs the assignment is limited to.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"roleAssignments":{"name":"roleAssignments","type":"\u0019\u001bmicrosoft.devicemanagement.roleAssignment","title":"Intune RBAC role assignments","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleDefinition":{"name":"roleDefinition","type":"\u001bmicrosoft.devicemanagement.roleDefinition","title":"Intune RBAC role definition","desc":"Intune role-based access control catalog: built-in Microsoft roles plus any custom roles defined in the tenant. `rolePermissions` lists the Intune resource actions the role grants; `roleScopeTagIds` lists the scope tags the role is allowed to operate against.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"roleDefinitions":{"name":"roleDefinitions","type":"\u0019\u001bmicrosoft.devicemanagement.roleDefinition","title":"Intune RBAC role definitions","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleScopeTag":{"name":"roleScopeTag","type":"\u001bmicrosoft.devicemanagement.roleScopeTag","title":"Intune RBAC role scope tag","desc":"Scope tags used to partition Intune resources by team or region. Tags are attached to managed devices, policies, and apps, and constrain which administrators can see and modify which objects.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"roleScopeTags":{"name":"roleScopeTags","type":"\u0019\u001bmicrosoft.devicemanagement.roleScopeTag","title":"Intune RBAC role scope tags","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"settings":{"name":"settings","type":"\u001bmicrosoft.devicemanagement.settings","title":"Tenant-wide Intune device management settings","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"windowsAutopilotDeploymentProfile":{"name":"windowsAutopilotDeploymentProfile","type":"\u001bmicrosoft.devicemanagement.windowsAutopilotDeploymentProfile","title":"Windows Autopilot deployment profile","desc":"Windows Autopilot deployment profiles that drive zero-touch provisioning. The profile sets language, locale, device-name template, and the out-of-box experience that end users see during first sign-in; `deploymentProfileType` distinguishes Azure AD joined, Hybrid Azure AD joined, and self-deploying flows.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"windowsAutopilotDeploymentProfiles":{"name":"windowsAutopilotDeploymentProfiles","type":"\u0019\u001bmicrosoft.devicemanagement.windowsAutopilotDeploymentProfile","title":"Windows Autopilot deployment profiles","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"windowsFeatureUpdateProfile":{"name":"windowsFeatureUpdateProfile","type":"\u001bmicrosoft.devicemanagement.windowsFeatureUpdateProfile","title":"Microsoft Intune Windows feature update profile","desc":"Windows feature update deployment profile, selected by its `id`. `featureUpdateVersion` is the Windows version the profile pins devices to, `deployableContentDisplayName` names the deployable build, and `endOfSupportDate` reports when that version stops receiving servicing.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"windowsFeatureUpdateProfiles":{"name":"windowsFeatureUpdateProfiles","type":"\u0019\u001bmicrosoft.devicemanagement.windowsFeatureUpdateProfile","title":"Windows feature update deployment profiles","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"windowsQualityUpdateProfile":{"name":"windowsQualityUpdateProfile","type":"\u001bmicrosoft.devicemanagement.windowsQualityUpdateProfile","title":"Microsoft Intune Windows quality update profile","desc":"Windows quality update deployment profile, selected by its `id`. These profiles drive expedited quality (security) update rollout; `expeditedQualityUpdateRelease` identifies the release to expedite and `expeditedDaysUntilForcedReboot` how long users may defer the reboot.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"windowsQualityUpdateProfiles":{"name":"windowsQualityUpdateProfiles","type":"\u0019\u001bmicrosoft.devicemanagement.windowsQualityUpdateProfile","title":"Windows quality update deployment profiles","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"windowsUpdateRing":{"name":"windowsUpdateRing","type":"\u001bmicrosoft.devicemanagement.windowsUpdateRing","title":"Microsoft Intune Windows Update for Business ring","desc":"Windows Update for Business update ring, selected by its `id`. The ring governs how quickly devices receive updates: `automaticUpdateMode` and `businessReadyUpdatesOnly` set the servicing branch, the `featureUpdatesDeferralPeriodInDays` and `qualityUpdatesDeferralPeriodInDays` defer updates, `featureUpdatesPaused` / `qualityUpdatesPaused` halt them, and the deadline settings (`deadlineForFeatureUpdatesInDays`, `deadlineForQualityUpdatesInDays`, `deadlineGracePeriodInDays`, `postponeRebootUntilAfterDeadline`) force installation. `driversExcluded` reports whether driver updates are withheld and `userPauseAccess` whether users may pause updates.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"windowsUpdateRings":{"name":"windowsUpdateRings","type":"\u0019\u001bmicrosoft.devicemanagement.windowsUpdateRing","title":"Windows Update for Business update rings","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune Device Management","desc":"Microsoft Intune device management configuration and inventory. Exposes `managedDevices` (enrolled devices with compliance state, OS details, and encryption status), `deviceConfigurations`, `deviceCompliancePolicies`, `deviceEnrollmentConfigurations`, endpoint security intents, app protection policies, settings catalog policies, Windows Update rings, and Intune RBAC roles.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.appProtectionPolicy":{"id":"microsoft.devicemanagement.appProtectionPolicy","name":"microsoft.devicemanagement.appProtectionPolicy","fields":{"allowedDataStorageLocations":{"name":"allowedDataStorageLocations","type":"\u0019\u0007","is_mandatory":true,"title":"Data storage locations that organizational data may be saved to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowedInboundDataTransferSources":{"name":"allowedInboundDataTransferSources","type":"\u0007","is_mandatory":true,"title":"Sources organizational data may be transferred in from (allApps, managedApps, none)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowedOutboundClipboardSharingLevel":{"name":"allowedOutboundClipboardSharingLevel","type":"\u0007","is_mandatory":true,"title":"Level at which clipboard content may be shared (allApps, managedAppsWithPasteIn, managedApps, blocked)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowedOutboundDataTransferDestinations":{"name":"allowedOutboundDataTransferDestinations","type":"\u0007","is_mandatory":true,"title":"Destinations organizational data may be transferred out to (allApps, managedApps, none)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"contactSyncBlocked":{"name":"contactSyncBlocked","type":"\u0004","is_mandatory":true,"title":"Whether contact sync to the native address book is blocked","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Date and time the policy was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"dataBackupBlocked":{"name":"dataBackupBlocked","type":"\u0004","is_mandatory":true,"title":"Whether app data backup to iTunes, iCloud, or Android Backup is blocked","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deviceComplianceRequired":{"name":"deviceComplianceRequired","type":"\u0004","is_mandatory":true,"title":"Whether device compliance is required for the managed app","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"disableAppPinIfDevicePinIsSet":{"name":"disableAppPinIfDevicePinIsSet","type":"\u0004","is_mandatory":true,"title":"Whether the app PIN is disabled when the device already has a PIN set","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Policy display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"fingerprintBlocked":{"name":"fingerprintBlocked","type":"\u0004","is_mandatory":true,"title":"Whether biometric (fingerprint) unlock is blocked in place of the PIN","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isAssigned":{"name":"isAssigned","type":"\u0004","is_mandatory":true,"title":"Whether the policy is assigned to any group","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Date and time the policy was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"managedBrowser":{"name":"managedBrowser","type":"\u0007","is_mandatory":true,"title":"Managed browser the policy enforces (notConfigured, microsoftEdge)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"managedBrowserToOpenLinksRequired":{"name":"managedBrowserToOpenLinksRequired","type":"\u0004","is_mandatory":true,"title":"Whether app web content must open in the managed browser","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"maximumPinRetries":{"name":"maximumPinRetries","type":"\u0005","is_mandatory":true,"title":"Number of PIN retries allowed before the configured action is taken","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"minimumPinLength":{"name":"minimumPinLength","type":"\u0005","is_mandatory":true,"title":"Minimum number of characters required for the app PIN","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"minimumRequiredAppVersion":{"name":"minimumRequiredAppVersion","type":"\u0007","is_mandatory":true,"title":"Minimum app version required to use the managed app","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"minimumRequiredOsVersion":{"name":"minimumRequiredOsVersion","type":"\u0007","is_mandatory":true,"title":"Minimum OS version required to use the managed app","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"organizationalCredentialsRequired":{"name":"organizationalCredentialsRequired","type":"\u0004","is_mandatory":true,"title":"Whether organizational credentials are required to use the app","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"periodOfflineBeforeAccessCheck":{"name":"periodOfflineBeforeAccessCheck","type":"\u0007","is_mandatory":true,"title":"Period a managed app may run offline before an access check is required (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"periodOfflineBeforeWipeIsEnforced":{"name":"periodOfflineBeforeWipeIsEnforced","type":"\u0007","is_mandatory":true,"title":"Period of offline use before protected data is wiped (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"periodOnlineBeforeAccessCheck":{"name":"periodOnlineBeforeAccessCheck","type":"\u0007","is_mandatory":true,"title":"Period a managed app may run online before an access check is required (ISO 8601 duration)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"pinCharacterSet":{"name":"pinCharacterSet","type":"\u0007","is_mandatory":true,"title":"Required PIN character set (numeric, alphanumericAndSymbol)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"pinRequired":{"name":"pinRequired","type":"\u0004","is_mandatory":true,"title":"Whether an access PIN is required to use the managed app","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"platformType":{"name":"platformType","type":"\u0007","is_mandatory":true,"title":"Platform the policy targets (ios, android)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"printBlocked":{"name":"printBlocked","type":"\u0004","is_mandatory":true,"title":"Whether printing organizational data is blocked","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"saveAsBlocked":{"name":"saveAsBlocked","type":"\u0004","is_mandatory":true,"title":"Whether Save As is blocked in the managed app","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"simplePinBlocked":{"name":"simplePinBlocked","type":"\u0004","is_mandatory":true,"title":"Whether simple PINs (for example 1234, 1111) are blocked","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Policy version","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune app protection (MAM) policy","desc":"Intune mobile application management policy that protects corporate data inside managed apps on iOS and Android, selected by its `id`; `platformType` reports which platform it targets. The policy governs access protection (`pinRequired`, `minimumPinLength`, `maximumPinRetries`, `simplePinBlocked`, `fingerprintBlocked`, `periodOfflineBeforeAccessCheck`), data containment (`dataBackupBlocked`, `saveAsBlocked`, `printBlocked`, `contactSyncBlocked`, `allowedDataStorageLocations`, the inbound/outbound data-transfer levels, and `allowedOutboundClipboardSharingLevel`), the required `managedBrowser` behavior, and device-health requirements (`deviceComplianceRequired`, `minimumRequiredOsVersion`, `minimumRequiredAppVersion`). Use `isAssigned` to spot policies that are configured but not targeted at anyone.","private":true,"min_provider_version":"13.3.1","defaults":"displayName platformType pinRequired","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.assignmentFilter":{"id":"microsoft.devicemanagement.assignmentFilter","name":"microsoft.devicemanagement.assignmentFilter","fields":{"assignmentFilterManagementType":{"name":"assignmentFilterManagementType","type":"\u0007","is_mandatory":true,"title":"What the filter manages (devices, apps)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Date and time the filter was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Filter description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Filter display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Filter ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Date and time the filter was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"platform":{"name":"platform","type":"\u0007","is_mandatory":true,"title":"Device platform the filter applies to","desc":"For example android, androidForWork, iOS, macOS, windowsPhone81, windows81AndLater, windows10AndLater, or androidWorkProfile.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleScopeTags":{"name":"roleScopeTags","type":"\u0019\u0007","is_mandatory":true,"title":"Role scope tags assigned to the filter","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"rule":{"name":"rule","type":"\u0007","is_mandatory":true,"title":"Filter rule expression evaluated against device properties","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune assignment filter","desc":"Assignment filter used to narrow which devices a policy or app assignment targets, selected by its `id`. The `rule` holds the filter expression evaluated against device properties, `platform` reports the device platform it applies to, and `assignmentFilterManagementType` distinguishes device filters from managed-app filters. A policy assignment references a filter through `microsoft.devicemanagement.policyAssignment.filter`.","private":true,"min_provider_version":"13.3.1","defaults":"displayName platform","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.complianceManagementPartner":{"id":"microsoft.devicemanagement.complianceManagementPartner","name":"microsoft.devicemanagement.complianceManagementPartner","fields":{"androidOnboarded":{"name":"androidOnboarded","type":"\u0004","is_mandatory":true,"title":"Whether the partner is onboarded for Android","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Partner display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Partner ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"iosOnboarded":{"name":"iosOnboarded","type":"\u0004","is_mandatory":true,"title":"Whether the partner is onboarded for iOS","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastHeartbeatDateTime":{"name":"lastHeartbeatDateTime","type":"\t","is_mandatory":true,"title":"Date and time the partner last reported a heartbeat","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"macOsOnboarded":{"name":"macOsOnboarded","type":"\u0004","is_mandatory":true,"title":"Whether the partner is onboarded for macOS","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"partnerState":{"name":"partnerState","type":"\u0007","is_mandatory":true,"title":"Partner connection state (unknown, unavailable, enabled, unresponsive)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune compliance management partner","desc":"Device compliance management partner connected to Intune, selected by its `id`. `partnerState` and `lastHeartbeatDateTime` report connection health, and `androidOnboarded`, `iosOnboarded`, and `macOsOnboarded` show which platforms the partner has been onboarded for.","private":true,"min_provider_version":"13.3.1","defaults":"displayName partnerState","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.configurationPolicy":{"id":"microsoft.devicemanagement.configurationPolicy","name":"microsoft.devicemanagement.configurationPolicy","fields":{"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Date and time the policy was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isAssigned":{"name":"isAssigned","type":"\u0004","is_mandatory":true,"title":"Whether the policy is assigned to any group","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Date and time the policy was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"platforms":{"name":"platforms","type":"\u0007","is_mandatory":true,"title":"Platforms the policy targets (for example windows10, iOS, macOS, android, linux)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleScopeTagIds":{"name":"roleScopeTagIds","type":"\u0019\u0007","is_mandatory":true,"title":"Role scope tag IDs assigned to the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"settingCount":{"name":"settingCount","type":"\u0005","is_mandatory":true,"title":"Number of settings configured by the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"settings":{"name":"settings","type":"\u0019\n","title":"Configured settings, each a dictionary of settingDefinitionId, settingType, and value","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"technologies":{"name":"technologies","type":"\u0007","is_mandatory":true,"title":"Technologies that enforce the policy (for example mdm, configManager, microsoftSense)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"templateDisplayName":{"name":"templateDisplayName","type":"\u0007","is_mandatory":true,"title":"Template display name when the policy was created from a template","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"templateFamily":{"name":"templateFamily","type":"\u0007","is_mandatory":true,"title":"Template family when the policy was created from a template (for example endpointSecurityAntivirus, baseline)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"templateId":{"name":"templateId","type":"\u0007","is_mandatory":true,"title":"Template ID when the policy was created from a template, empty otherwise","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune settings catalog policy","desc":"Settings catalog (unified configuration) policy, selected by its `id`. Metadata covers the `name`, `description`, the `platforms` and `technologies` the policy targets, the number of configured settings (`settingCount`), `roleScopeTagIds`, and whether it `isAssigned`. When the policy was created from a template, `templateId`, `templateDisplayName`, and `templateFamily` identify it. Use `settings` to read the individual configured settings; each entry reports its `settingDefinitionId`, `settingType`, and `value`.","private":true,"min_provider_version":"13.3.1","defaults":"name platforms technologies settingCount","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.detectedapp":{"id":"microsoft.devicemanagement.detectedapp","name":"microsoft.devicemanagement.detectedapp","fields":{"deviceCount":{"name":"deviceCount","type":"\u0005","is_mandatory":true,"title":"Number of managed devices with this app installed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"App display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Detected app ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"platform":{"name":"platform","type":"\u0007","is_mandatory":true,"title":"Platform the app was detected on (windows, iOS, android, macOS, unknown)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"publisher":{"name":"publisher","type":"\u0007","is_mandatory":true,"title":"Publisher","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sizeInByte":{"name":"sizeInByte","type":"\u0005","is_mandatory":true,"title":"App size in bytes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"App version","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"App detected as installed on managed devices","desc":"Application inventory that Intune builds from managed-device reporting. `deviceCount` is the number of devices in the tenant on which Intune has detected this app at the given `version`.","private":true,"min_provider_version":"13.0.12","defaults":"displayName version deviceCount","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.deviceEnrollmentConfiguration":{"id":"microsoft.devicemanagement.deviceEnrollmentConfiguration","name":"microsoft.devicemanagement.deviceEnrollmentConfiguration","fields":{"configurationType":{"name":"configurationType","type":"\u0007","is_mandatory":true,"title":"Kind of enrollment configuration this entry represents","desc":"One of `limit`, `platformRestrictions`, `windowsHelloForBusiness`, or `unknown`. Derived from the configuration's `@odata.type`. `limit` caps the number of devices a user can enroll. `platformRestrictions` allows or blocks enrollment per platform (Android, iOS, macOS, Windows, Windows Mobile). `windowsHelloForBusiness` controls Windows Hello PIN, gesture, and biometric requirements.","min_provider_version":"13.0.13","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Created date time in UTC of the device enrollment configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"The description of the device enrollment configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"The display name of the device enrollment configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the account","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Last modified date time in UTC of the device enrollment configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policyAssignments":{"name":"policyAssignments","type":"\u0019\u001bmicrosoft.devicemanagement.policyAssignment","is_mandatory":true,"title":"Assignments targeting this enrollment configuration, with each target resolved to its kind, group, and any assignment filter","min_provider_version":"13.0.13","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Priority is used when a user exists in multiple groups that are assigned enrollment configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"settings":{"name":"settings","type":"\n","is_mandatory":true,"title":"Subtype-specific settings, keyed by setting name","desc":"`limit`-type entries populate `limit` (the device cap). `platformRestrictions`-type entries populate per-platform blocks under `iosRestriction`, `androidRestriction`, `macOSRestriction`, `windowsRestriction`, `windowsMobileRestriction`, each with `platformBlocked`, `personalDeviceEnrollmentBlocked`, `osMinimumVersion`, and `osMaximumVersion`. `windowsHelloForBusiness`-type entries populate `state`, `pinMinimumLength`, `pinMaximumLength`, `pinUppercaseCharactersUsage`, `pinLowercaseCharactersUsage`, `pinSpecialCharactersUsage`, `pinExpirationInDays`, `pinPreviousBlockCount`, `securityDeviceRequired`, `unlockWithBiometricsEnabled`, `enhancedBiometricsState`, and `remotePassportEnabled`.","min_provider_version":"13.0.13","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"The version of the device enrollment configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Device Enrollment Configuration","private":true,"min_provider_version":"11.1.40","defaults":"id displayName configurationType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.devicecompliancepolicy":{"id":"microsoft.devicemanagement.devicecompliancepolicy","name":"microsoft.devicemanagement.devicecompliancepolicy","fields":{"assignments":{"name":"assignments","type":"\u0019\n","is_mandatory":true,"title":"Raw assignment entries, each carrying only its assignment `id`","desc":"For the resolved target of each assignment (kind, group, and any filter), use `policyAssignments`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Device compliance policy creation date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Device compliance policy description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Device compliance policy display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Device compliance policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Device compliance policy last modified date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"platformType":{"name":"platformType","type":"\u0007","is_mandatory":true,"title":"Platform this compliance policy targets","desc":"One of `iOS`, `android`, `androidWorkProfile`, `windows10`, `windows10Mobile`, `windows81`, `windowsPhone81`, `macOS`, or `unknown`. Derived from the policy's `@odata.type`.","min_provider_version":"13.0.13","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policyAssignments":{"name":"policyAssignments","type":"\u0019\u001bmicrosoft.devicemanagement.policyAssignment","is_mandatory":true,"title":"Assignments targeting this compliance policy, with each target resolved to its kind, group, and any assignment filter","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw device compliance policy properties","desc":"Deprecated in favor of `settings` and `policyAssignments`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"scheduledActionsForRule":{"name":"scheduledActionsForRule","type":"\u0019\n","is_mandatory":true,"title":"Escalation actions evaluated when the policy is out of compliance","desc":"Each entry has `ruleName` (e.g., `PasswordRequired`) and `scheduledActionConfigurations` — a list of action items with `actionType` (`notification`, `block`, `retire`, `wipe`, `removeResourceAccessProfiles`, `pushNotification`, `remoteLock`), `gracePeriodHours`, `notificationTemplateId`, and `notificationMessageCCList`.","min_provider_version":"13.0.13","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"settings":{"name":"settings","type":"\n","is_mandatory":true,"title":"Configured compliance rules, keyed by setting name","desc":"Union of platform-specific rule fields exposed by the policy's `@odata.type`. Common keys include `passcodeRequired` / `passwordRequired`, `passcodeMinimumLength` / `passwordMinimumLength`, `passcodeRequiredType` / `passwordRequiredType`, `passcodeBlockSimple` / `passwordBlockSimple`, `passcodeExpirationDays` / `passwordExpirationDays`, `passcodeMinutesOfInactivityBeforeLock` / `passwordMinutesOfInactivityBeforeLock`, `storageRequireEncryption`, `osMinimumVersion`, `osMaximumVersion`, `securityBlockJailbrokenDevices`, `deviceThreatProtectionEnabled`, `deviceThreatProtectionRequiredSecurityLevel`, `managedEmailProfileRequired`. iOS-specific keys add `passcodeMinimumCharacterSetCount`, `passcodePreviousPasscodeBlockCount`. Android keys add `minAndroidSecurityPatchLevel`, `securityDisableUsbDebugging`, `securityPreventInstallAppsFromUnknownSources`, `securityRequireGooglePlayServices`, `securityRequireSafetyNetAttestationBasicIntegrity`, `securityRequireSafetyNetAttestationCertifiedDevice`, `securityRequireCompanyPortalAppIntegrity`, `securityRequireUpToDateSecurityProviders`, `securityRequireVerifyApps`. Windows 10 keys add `bitLockerEnabled`, `secureBootEnabled`, `codeIntegrityEnabled`, `earlyLaunchAntiMalwareDriverEnabled`, `requireHealthyDeviceReport`, `passwordRequiredToUnlockFromIdle`, `mobileOsMinimumVersion`, `mobileOsMaximumVersion`. macOS keys add `firewallEnabled`, `firewallBlockAllIncoming`, `firewallEnableStealthMode`, `systemIntegrityProtectionEnabled`.","min_provider_version":"13.0.13","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Device compliance policy version","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft device compliance policy","private":true,"min_provider_version":"9.0.0","defaults":"id displayName platformType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.deviceconfiguration":{"id":"microsoft.devicemanagement.deviceconfiguration","name":"microsoft.devicemanagement.deviceconfiguration","fields":{"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Device configuration creation date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Device configuration description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Device configuration display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Device configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Device configuration last modify date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"platformType":{"name":"platformType","type":"\u0007","is_mandatory":true,"title":"Platform this configuration profile targets","desc":"One of `iOS`, `android`, `androidWorkProfile`, `windows10`, `macOS`, or `unknown`. Derived from the profile's `@odata.type`.","min_provider_version":"13.0.13","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policyAssignments":{"name":"policyAssignments","type":"\u0019\u001bmicrosoft.devicemanagement.policyAssignment","is_mandatory":true,"title":"Assignments targeting this configuration profile, with each target resolved to its kind, group, and any assignment filter","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw device configuration properties","desc":"Deprecated in favor of `settings` and `policyAssignments`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"settings":{"name":"settings","type":"\n","is_mandatory":true,"title":"Configured profile settings, keyed by setting name","desc":"Union of platform-specific configuration fields exposed by the profile's `@odata.type`. General-device-configuration profiles populate password/passcode requirements (`passwordRequired` / `passcodeRequired`, `passwordMinimumLength` / `passcodeMinimumLength`, `passwordRequiredType` / `passcodeRequiredType`, `passwordBlockSimple` / `passcodeBlockSimple`, `passwordExpirationDays` / `passcodeExpirationDays`, `passwordMinutesOfInactivityBeforeScreenTimeout` / `passcodeMinutesOfInactivityBeforeScreenTimeout`, `passcodeMinutesOfInactivityBeforeLock`, `passwordSignInFailureCountBeforeFactoryReset`, `passcodeSignInFailureCountBeforeWipe`). Android Work Profile adds work-profile-scoped variants (`workProfilePasswordRequiredType`, `workProfilePasswordMinutesOfInactivityBeforeScreenTimeout`). Windows 10 General Configuration also surfaces device-restriction flags. Profile types that are not \"general device configuration\" (Wi-Fi, VPN, certificates, custom OMA-URI, etc.) leave this empty — use `policyAssignments` and `displayName` to identify them.","min_provider_version":"13.0.13","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Device configuration version","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft device configuration","private":true,"min_provider_version":"9.0.0","defaults":"id displayName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.groupPolicyConfiguration":{"id":"microsoft.devicemanagement.groupPolicyConfiguration","name":"microsoft.devicemanagement.groupPolicyConfiguration","fields":{"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Date and time the configuration was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"definitionValues":{"name":"definitionValues","type":"\u0019\u001bmicrosoft.devicemanagement.groupPolicyDefinitionValue","title":"Administrative-template settings configured by this configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Configuration description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Configuration display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Configuration ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Date and time the configuration was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policyConfigurationIngestionType":{"name":"policyConfigurationIngestionType","type":"\u0007","is_mandatory":true,"title":"How the ADMX templates are sourced (unknown, builtIn, custom, mixed)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleScopeTagIds":{"name":"roleScopeTagIds","type":"\u0019\u0007","is_mandatory":true,"title":"Role scope tag IDs assigned to the configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune group policy configuration","desc":"Administrative-templates (ADMX) policy configuration, selected by its `id`. `policyConfigurationIngestionType` reports whether it uses the built-in or custom (ingested) ADMX templates. `definitionValues` reads the individual administrative-template settings the configuration sets.","private":true,"min_provider_version":"13.3.1","defaults":"displayName policyConfigurationIngestionType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.groupPolicyDefinitionValue":{"id":"microsoft.devicemanagement.groupPolicyDefinitionValue","name":"microsoft.devicemanagement.groupPolicyDefinitionValue","fields":{"configurationType":{"name":"configurationType","type":"\u0007","is_mandatory":true,"title":"Configuration type (policy, preference)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Date and time the setting was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"definitionCategoryPath":{"name":"definitionCategoryPath","type":"\u0007","is_mandatory":true,"title":"Location of the definition in the administrative-templates tree","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"definitionClassType":{"name":"definitionClassType","type":"\u0007","is_mandatory":true,"title":"Whether the definition applies to the machine or the user (machine, user)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"definitionName":{"name":"definitionName","type":"\u0007","is_mandatory":true,"title":"Name of the administrative-template definition","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the setting is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Definition value ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Date and time the setting was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune group policy definition value","desc":"Single administrative-template setting configured by a group policy configuration. `definitionName` names the policy, `enabled` reports whether it is enabled or disabled, `definitionClassType` whether it applies to the machine or the user, and `definitionCategoryPath` its location in the administrative-templates tree.","private":true,"min_provider_version":"13.3.1","defaults":"definitionName enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.intent":{"id":"microsoft.devicemanagement.intent","name":"microsoft.devicemanagement.intent","fields":{"assignments":{"name":"assignments","type":"\u0019\u001bmicrosoft.devicemanagement.policyAssignment","title":"Assignments targeting this intent","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Intent ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isAssigned":{"name":"isAssigned","type":"\u0004","is_mandatory":true,"title":"Whether the intent has at least one assignment","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Last modification date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"setting":{"name":"setting","type":"\u001bmicrosoft.devicemanagement.intent.setting","title":"Setting configured on an endpoint security intent","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"settings":{"name":"settings","type":"\u0019\u001bmicrosoft.devicemanagement.intent.setting","title":"Settings configured on this intent","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"templateDisplayName":{"name":"templateDisplayName","type":"\u0007","is_mandatory":true,"title":"Display name of the source template","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"templateId":{"name":"templateId","type":"\u0007","is_mandatory":true,"title":"Template ID this intent was created from","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Endpoint security intent","desc":"Endpoint security policies created from Intune templates: antivirus, disk encryption, firewall, endpoint detection and response, account protection, and attack surface reduction. `templateId` and `templateDisplayName` identify which template the intent was created from; `settings` returns the configured settings; `assignments` returns the groups and devices it targets.","private":true,"min_provider_version":"13.0.12","defaults":"id displayName templateDisplayName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.intent.setting":{"id":"microsoft.devicemanagement.intent.setting","name":"microsoft.devicemanagement.intent.setting","fields":{"definitionId":{"name":"definitionId","type":"\u0007","is_mandatory":true,"title":"Setting definition ID, such as deviceConfiguration--windows10EndpointProtectionConfiguration_defenderRequireRealTimeMonitoring","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Setting ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"valueJson":{"name":"valueJson","type":"\u0007","is_mandatory":true,"title":"Configured value, serialized as JSON","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"valueType":{"name":"valueType","type":"\u0007","is_mandatory":true,"title":"Setting value type, the @odata.type of the value wrapper","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Setting configured on an endpoint security intent","private":true,"min_provider_version":"13.0.12","defaults":"definitionId valueJson","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.managedAppConfiguration":{"id":"microsoft.devicemanagement.managedAppConfiguration","name":"microsoft.devicemanagement.managedAppConfiguration","fields":{"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Date and time the policy was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"customSettings":{"name":"customSettings","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Configured key/value settings delivered to the apps","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deployedAppCount":{"name":"deployedAppCount","type":"\u0005","is_mandatory":true,"title":"Number of apps the policy is deployed to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Policy display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isAssigned":{"name":"isAssigned","type":"\u0004","is_mandatory":true,"title":"Whether the policy is assigned to any group","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Date and time the policy was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Policy version","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune managed app configuration policy","desc":"App configuration policy that delivers settings to managed apps (MAM), selected by its `id`. `customSettings` holds the configured key/value pairs delivered to the apps, `deployedAppCount` reports how many apps it targets, and `isAssigned` whether it is assigned to any group.","private":true,"min_provider_version":"13.3.1","defaults":"displayName deployedAppCount isAssigned","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.manageddevice":{"id":"microsoft.devicemanagement.manageddevice","name":"microsoft.devicemanagement.manageddevice","fields":{"androidSecurityPatchLevel":{"name":"androidSecurityPatchLevel","type":"\u0007","is_mandatory":true,"title":"Android security patch level","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"azureADRegistered":{"name":"azureADRegistered","type":"\u0004","is_mandatory":true,"title":"Whether the device is Entra ID (previously Azure AD) registered","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"azureActiveDirectoryDeviceId":{"name":"azureActiveDirectoryDeviceId","type":"\u0007","is_mandatory":true,"title":"The unique identifier for the Entra ID (previously Azure AD) device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"complianceGracePeriodExpirationDateTime":{"name":"complianceGracePeriodExpirationDateTime","type":"\t","is_mandatory":true,"title":"Compliance grace period expiration date and time","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"compliancePolicyStates":{"name":"compliancePolicyStates","type":"\u0019\u001bmicrosoft.devicemanagement.manageddevice.policyState","title":"Compliance policy evaluation states, one entry per policy that has been evaluated against this device","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"complianceState":{"name":"complianceState","type":"\u0007","is_mandatory":true,"title":"Compliance state of the device (compliant, noncompliant, conflict, error, unknown, notApplicable)","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"configurationStates":{"name":"configurationStates","type":"\u0019\u001bmicrosoft.devicemanagement.manageddevice.policyState","title":"Configuration profile evaluation states, one entry per profile that has been evaluated against this device","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"detectedApps":{"name":"detectedApps","type":"\u0019\u001bmicrosoft.devicemanagement.detectedapp","title":"Apps detected as installed on this device","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deviceCategoryDisplayName":{"name":"deviceCategoryDisplayName","type":"\u0007","is_mandatory":true,"title":"Device category display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deviceEnrollmentType":{"name":"deviceEnrollmentType","type":"\u0007","is_mandatory":true,"title":"Device enrollment type","desc":"For example: unknown, userEnrollment, deviceEnrollmentManager, appleBulkWithUser, appleBulkWithoutUser, windowsAzureADJoin, windowsBulkUserless, windowsAutoEnrollment, windowsBulkAzureDomainJoin, windowsCoManagement.","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deviceRegistrationState":{"name":"deviceRegistrationState","type":"\u0007","is_mandatory":true,"title":"Device registration state","desc":"One of: notRegistered, registered, revoked, keyConflict, approvalPending, certificateReset, notRegisteredPendingEnrollment, unknown.","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"easActivated":{"name":"easActivated","type":"\u0004","is_mandatory":true,"title":"Whether the device is Exchange ActiveSync activated","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"easDeviceId":{"name":"easDeviceId","type":"\u0007","is_mandatory":true,"title":"Exchange ActiveSync Id of the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"emailAddress":{"name":"emailAddress","type":"\u0007","is_mandatory":true,"title":"Email(s) for the user associated with the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enrolledDateTime":{"name":"enrolledDateTime","type":"\t","is_mandatory":true,"title":"Date and time that the device was enrolled","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enrollmentProfileName":{"name":"enrollmentProfileName","type":"\u0007","is_mandatory":true,"title":"Name of the enrollment profile assigned to the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ethernetMacAddress":{"name":"ethernetMacAddress","type":"\u0007","is_mandatory":true,"title":"Ethernet MAC address of the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"freeStorageSpaceInBytes":{"name":"freeStorageSpaceInBytes","type":"\u0005","is_mandatory":true,"title":"Available storage in bytes","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"iccid":{"name":"iccid","type":"\u0007","is_mandatory":true,"title":"Integrated Circuit Card Identifier (ICCID)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Managed device ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"imei":{"name":"imei","type":"\u0007","is_mandatory":true,"title":"International Mobile Equipment Identity (IMEI)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isEncrypted":{"name":"isEncrypted","type":"\u0004","is_mandatory":true,"title":"Device encryption status","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isSupervised":{"name":"isSupervised","type":"\u0004","is_mandatory":true,"title":"Device supervised status","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"jailBroken":{"name":"jailBroken","type":"\u0007","is_mandatory":true,"title":"Whether the device is jail broken or rooted","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastSyncDateTime":{"name":"lastSyncDateTime","type":"\t","is_mandatory":true,"title":"Last time the device contacted Intune","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"managementAgent":{"name":"managementAgent","type":"\u0007","is_mandatory":true,"title":"Management agent type (eas, mdm, easMdm, intuneClient, easIntuneClient, configurationManagerClient, etc.)","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"managementCertificateExpirationDate":{"name":"managementCertificateExpirationDate","type":"\t","is_mandatory":true,"title":"Management certificate expiration date","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"manufacturer":{"name":"manufacturer","type":"\u0007","is_mandatory":true,"title":"Device manufacturer","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"meid":{"name":"meid","type":"\u0007","is_mandatory":true,"title":"Mobile Equipment Identifier (MEID)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"model":{"name":"model","type":"\u0007","is_mandatory":true,"title":"Device model","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notes":{"name":"notes","type":"\u0007","is_mandatory":true,"title":"Notes on the device created by IT","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"operatingSystem":{"name":"operatingSystem","type":"\u0007","is_mandatory":true,"title":"Operating system of the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"osVersion":{"name":"osVersion","type":"\u0007","is_mandatory":true,"title":"Operating system version of the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"partnerReportedThreatState":{"name":"partnerReportedThreatState","type":"\u0007","is_mandatory":true,"title":"Threat state reported by a Mobile Threat Defense partner","desc":"One of: unknown, activated, deactivated, secured, lowSeverity, mediumSeverity, highSeverity, unresponsive, compromised, misconfigured.","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"phoneNumber":{"name":"phoneNumber","type":"\u0007","is_mandatory":true,"title":"Phone number of the device","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policyState":{"name":"policyState","type":"\u001bmicrosoft.devicemanagement.manageddevice.policyState","title":"Evaluation state of a single Intune policy on a managed device","desc":"Compliance and configuration evaluation results for a managed device, one entry per policy. The `state` field gives the aggregate result (`compliant`, `nonCompliant`, `conflict`, `error`, `notApplicable`, `inGracePeriod`), and `settingStates` lists per-setting outcomes that rolled up into it. `sourceType` distinguishes compliance from configuration evaluations (`deviceCompliancePolicyState`, `deviceConfigurationState`).","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"serialNumber":{"name":"serialNumber","type":"\u0007","is_mandatory":true,"title":"Serial number of the device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"subscriberCarrier":{"name":"subscriberCarrier","type":"\u0007","is_mandatory":true,"title":"Subscriber carrier of the device","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"totalStorageSpaceInBytes":{"name":"totalStorageSpaceInBytes","type":"\u0005","is_mandatory":true,"title":"Total storage in bytes","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"udid":{"name":"udid","type":"\u0007","is_mandatory":true,"title":"Unique Device Identifier (UDID) for iOS and macOS devices","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"user":{"name":"user","type":"\u001bmicrosoft.user","title":"User associated with the device","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userDisplayName":{"name":"userDisplayName","type":"\u0007","is_mandatory":true,"title":"User display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userId":{"name":"userId","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the user associated with the device","desc":"Deprecated in favor of user.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"userPrincipalName":{"name":"userPrincipalName","type":"\u0007","is_mandatory":true,"title":"Device user principal name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"wiFiMacAddress":{"name":"wiFiMacAddress","type":"\u0007","is_mandatory":true,"title":"Wi-Fi MAC address","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"windowsProtectionState":{"name":"windowsProtectionState","type":"\n","is_mandatory":true,"title":"Windows Defender protection state of the device","desc":"Keys include `antiMalwareVersion`, `engineVersion`, `signatureVersion`, `deviceState` (WindowsDeviceHealthState), `productStatus` (WindowsDefenderProductStatus), `malwareProtectionEnabled`, `realTimeProtectionEnabled`, `networkInspectionSystemEnabled`, `tamperProtectionEnabled`, `fullScanRequired`, `fullScanOverdue`, `quickScanOverdue`, `signatureUpdateOverdue`, `rebootRequired`, `isVirtualMachine`, `lastFullScanDateTime`, `lastQuickScanDateTime`, `lastReportedDateTime`, and `detectedMalwareState`, a list of detected threats each with `category`, `severity`, `executionState`, `state`, and `threatState`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft managed device","private":true,"min_provider_version":"11.1.40","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.manageddevice.policyState":{"id":"microsoft.devicemanagement.manageddevice.policyState","name":"microsoft.devicemanagement.manageddevice.policyState","fields":{"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Policy or profile display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"State ID, composed of the parent device and policy IDs","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"platformType":{"name":"platformType","type":"\u0007","is_mandatory":true,"title":"Platform the policy targets (windows10AndLater, iOS, android, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"settingCount":{"name":"settingCount","type":"\u0005","is_mandatory":true,"title":"Setting count","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"settingStates":{"name":"settingStates","type":"\u0019\n","is_mandatory":true,"title":"Per-setting evaluation states with the setting definition ID and outcome","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sourceType":{"name":"sourceType","type":"\u0007","is_mandatory":true,"title":"Source of the evaluation (deviceCompliancePolicyState, deviceConfigurationState)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Aggregate evaluation state (compliant, nonCompliant, conflict, error, notApplicable, inGracePeriod)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Version of the policy that produced this state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Evaluation state of a single Intune policy on a managed device","desc":"Compliance and configuration evaluation results for a managed device, one entry per policy. The `state` field gives the aggregate result (`compliant`, `nonCompliant`, `conflict`, `error`, `notApplicable`, `inGracePeriod`), and `settingStates` lists per-setting outcomes that rolled up into it. `sourceType` distinguishes compliance from configuration evaluations (`deviceCompliancePolicyState`, `deviceConfigurationState`).","private":true,"min_provider_version":"13.0.12","defaults":"displayName state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.mobileAppConfiguration":{"id":"microsoft.devicemanagement.mobileAppConfiguration","name":"microsoft.devicemanagement.mobileAppConfiguration","fields":{"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Date and time the policy was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Policy display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Date and time the policy was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"targetedMobileApps":{"name":"targetedMobileApps","type":"\u0019\u0007","is_mandatory":true,"title":"IDs of the apps the policy configures","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Policy version","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune managed device app configuration policy","desc":"App configuration policy that delivers settings to managed devices (MDM), selected by its `id`. `targetedMobileApps` lists the IDs of the apps the policy configures.","private":true,"min_provider_version":"13.3.1","defaults":"displayName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.mobileThreatDefenseConnector":{"id":"microsoft.devicemanagement.mobileThreatDefenseConnector","name":"microsoft.devicemanagement.mobileThreatDefenseConnector","fields":{"allowPartnerToCollectIosApplicationMetadata":{"name":"allowPartnerToCollectIosApplicationMetadata","type":"\u0004","is_mandatory":true,"title":"Whether the partner may collect metadata of managed iOS apps","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowPartnerToCollectIosPersonalApplicationMetadata":{"name":"allowPartnerToCollectIosPersonalApplicationMetadata","type":"\u0004","is_mandatory":true,"title":"Whether the partner may collect metadata of personal iOS apps","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"androidDeviceBlockedOnMissingPartnerData":{"name":"androidDeviceBlockedOnMissingPartnerData","type":"\u0004","is_mandatory":true,"title":"Whether Android devices are blocked when the partner has no data on them","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"androidEnabled":{"name":"androidEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the partner evaluates compliance for Android devices","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"androidMobileApplicationManagementEnabled":{"name":"androidMobileApplicationManagementEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the partner provides app protection for Android","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connector ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"iosDeviceBlockedOnMissingPartnerData":{"name":"iosDeviceBlockedOnMissingPartnerData","type":"\u0004","is_mandatory":true,"title":"Whether iOS devices are blocked when the partner has no data on them","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"iosEnabled":{"name":"iosEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the partner evaluates compliance for iOS devices","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"iosMobileApplicationManagementEnabled":{"name":"iosMobileApplicationManagementEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the partner provides app protection for iOS","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastHeartbeatDateTime":{"name":"lastHeartbeatDateTime","type":"\t","is_mandatory":true,"title":"Date and time the partner last reported a heartbeat","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoftDefenderForEndpointAttachEnabled":{"name":"microsoftDefenderForEndpointAttachEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Microsoft Defender for Endpoint connector is attached","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"partnerState":{"name":"partnerState","type":"\u0007","is_mandatory":true,"title":"Partner connection state (available, enabled, unavailable, unresponsive, unknown, notSetUp)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"partnerUnresponsivenessThresholdInDays":{"name":"partnerUnresponsivenessThresholdInDays","type":"\u0005","is_mandatory":true,"title":"Days without a heartbeat before the partner is treated as unresponsive","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"partnerUnsupportedOsVersionBlocked":{"name":"partnerUnsupportedOsVersionBlocked","type":"\u0004","is_mandatory":true,"title":"Whether devices on an unsupported OS version are blocked","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"windowsDeviceBlockedOnMissingPartnerData":{"name":"windowsDeviceBlockedOnMissingPartnerData","type":"\u0004","is_mandatory":true,"title":"Whether Windows devices are blocked when the partner has no data on them","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"windowsEnabled":{"name":"windowsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the partner evaluates compliance for Windows devices","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune Mobile Threat Defense connector","desc":"Integration between Intune and a Mobile Threat Defense (MTD) partner, selected by its `id`. `partnerState` and `lastHeartbeatDateTime` report whether the partner is connected and responsive, and the per-platform flags show where the connection is active: `androidEnabled`, `iosEnabled`, and `windowsEnabled` gate device-compliance evaluation, the `*MobileApplicationManagementEnabled` flags gate app protection, and the `*DeviceBlockedOnMissingPartnerData` flags decide whether devices are blocked when the partner has not reported. `microsoftDefenderForEndpointAttachEnabled` indicates the Defender for Endpoint connector is attached.","private":true,"min_provider_version":"13.3.1","defaults":"id partnerState lastHeartbeatDateTime","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.mobileapp":{"id":"microsoft.devicemanagement.mobileapp","name":"microsoft.devicemanagement.mobileapp","fields":{"assignments":{"name":"assignments","type":"\u0019\u001bmicrosoft.devicemanagement.policyAssignment","title":"Assignments targeting this app","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Creation date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"App description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"App display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Mobile app ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"informationUrl":{"name":"informationUrl","type":"\u0007","is_mandatory":true,"title":"Information URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isFeatured":{"name":"isFeatured","type":"\u0004","is_mandatory":true,"title":"Whether the app is featured in the Company Portal","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Last modification date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"privacyInformationUrl":{"name":"privacyInformationUrl","type":"\u0007","is_mandatory":true,"title":"Privacy information URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Subtype-discriminated fields keyed by @odata.type — bundleId / productCode for store apps, appStoreUrl, packageId, installCommandLine, and similar","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"publisher":{"name":"publisher","type":"\u0007","is_mandatory":true,"title":"Publisher","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"publishingState":{"name":"publishingState","type":"\u0007","is_mandatory":true,"title":"Publishing state (notPublished, processing, published)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Mobile app published to the Intune tenant","desc":"Apps published to Intune for deployment to managed devices. Apps include store apps, line-of-business apps, web apps, and managed Google Play apps. `properties` holds subtype-specific fields keyed by `@odata.type` (for example `bundleId`, `productCode`, `appStoreUrl`, `installCommandLine`), `publishingState` indicates whether the app is ready for deployment, and `assignments` returns the groups it targets.","private":true,"min_provider_version":"13.0.12","defaults":"id displayName publisher","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.policyAssignment":{"id":"microsoft.devicemanagement.policyAssignment","name":"microsoft.devicemanagement.policyAssignment","fields":{"excluded":{"name":"excluded","type":"\u0004","is_mandatory":true,"title":"Whether the assignment excludes the target rather than including it","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"filter":{"name":"filter","type":"\u001bmicrosoft.devicemanagement.assignmentFilter","title":"Assignment filter applied to the target, when one is set","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"filterId":{"name":"filterId","type":"\u0007","is_mandatory":true,"title":"Assignment filter ID when a filter is applied, empty otherwise","desc":"Deprecated in favor of filter.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"filterType":{"name":"filterType","type":"\u0007","is_mandatory":true,"title":"Assignment filter type (none, include, exclude)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"group":{"name":"group","type":"\u001bmicrosoft.group","title":"Group the assignment targets, when targetType is a group","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"groupId":{"name":"groupId","type":"\u0007","is_mandatory":true,"title":"Group ID when the target is a group, empty otherwise","desc":"Deprecated in favor of group.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Assignment ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"targetType":{"name":"targetType","type":"\u0007","is_mandatory":true,"title":"Target kind (groupAssignmentTarget, exclusionGroupAssignmentTarget, allDevicesAssignmentTarget, allLicensedUsersAssignmentTarget)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Assignment of an Intune device management policy","desc":"Binding of an Intune policy to the groups, devices, or licensed users it targets, recording whether each assignment is an include or an exclude. `policyAssignment` is used by compliance policies, configuration profiles, endpoint security intents, and mobile apps. `targetType` identifies the kind of target (`groupAssignmentTarget`, `exclusionGroupAssignmentTarget`, `allDevicesAssignmentTarget`, `allLicensedUsersAssignmentTarget`); `groupId` is populated only when the target is a group.","private":true,"min_provider_version":"13.0.12","defaults":"id targetType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.roleAssignment":{"id":"microsoft.devicemanagement.roleAssignment","name":"microsoft.devicemanagement.roleAssignment","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Role assignment ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"members":{"name":"members","type":"\u0019\u0007","is_mandatory":true,"title":"Group IDs that receive the role","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"resourceScopes":{"name":"resourceScopes","type":"\u0019\u0007","is_mandatory":true,"title":"Scope tag IDs the assignment is limited to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleDefinitionId":{"name":"roleDefinitionId","type":"\u0007","is_mandatory":true,"title":"ID of the role definition this assignment grants","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"scopeMembers":{"name":"scopeMembers","type":"\u0019\u0007","is_mandatory":true,"title":"Group IDs whose objects the role applies to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Assignment of an Intune RBAC role to members","desc":"Binding of an Intune role to the security groups that receive it and the scope tags that constrain where they can act. `members` are the groups that receive the role; `scopeMembers` are the groups whose objects the role applies to; `resourceScopes` is the set of scope-tag IDs the assignment is limited to.","private":true,"min_provider_version":"13.0.12","defaults":"id displayName roleDefinitionId","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.roleDefinition":{"id":"microsoft.devicemanagement.roleDefinition","name":"microsoft.devicemanagement.roleDefinition","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Role definition ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isBuiltIn":{"name":"isBuiltIn","type":"\u0004","is_mandatory":true,"title":"Whether the role is built-in (managed by Microsoft) rather than custom","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"rolePermissions":{"name":"rolePermissions","type":"\u0019\n","is_mandatory":true,"title":"Permission grants, each entry listing allowed Intune resource actions","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleScopeTagIds":{"name":"roleScopeTagIds","type":"\u0019\u0007","is_mandatory":true,"title":"Scope tag IDs this role is constrained to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Intune RBAC role definition","desc":"Intune role-based access control catalog: built-in Microsoft roles plus any custom roles defined in the tenant. `rolePermissions` lists the Intune resource actions the role grants; `roleScopeTagIds` lists the scope tags the role is allowed to operate against.","private":true,"min_provider_version":"13.0.12","defaults":"id displayName isBuiltIn","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.roleScopeTag":{"id":"microsoft.devicemanagement.roleScopeTag","name":"microsoft.devicemanagement.roleScopeTag","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Scope tag ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isBuiltIn":{"name":"isBuiltIn","type":"\u0004","is_mandatory":true,"title":"Whether the scope tag is built-in (the \"Default\" tag with ID \"0\")","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Intune RBAC role scope tag","desc":"Scope tags used to partition Intune resources by team or region. Tags are attached to managed devices, policies, and apps, and constrain which administrators can see and modify which objects.","private":true,"min_provider_version":"13.0.12","defaults":"id displayName isBuiltIn","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.settings":{"id":"microsoft.devicemanagement.settings","name":"microsoft.devicemanagement.settings","fields":{"deviceComplianceCheckinThresholdDays":{"name":"deviceComplianceCheckinThresholdDays","type":"\u0005","is_mandatory":true,"title":"Number of days a device may go without checking in before it is treated as noncompliant","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isScheduledActionEnabled":{"name":"isScheduledActionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether scheduled actions for noncompliant devices are enabled tenant-wide","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"secureByDefault":{"name":"secureByDefault","type":"\u0004","is_mandatory":true,"title":"Whether devices are marked noncompliant when no compliance policy targets them","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Intune tenant-wide device management settings","desc":"Tenant-level Intune settings covering whether devices are marked noncompliant when no compliance policy targets them (`secureByDefault`), how many days a device may go without checking in before it is treated as noncompliant, and whether scheduled actions for noncompliant devices are enabled. This is null when no Intune device management settings are configured for the tenant.","private":true,"min_provider_version":"13.7.2","defaults":"secureByDefault deviceComplianceCheckinThresholdDays isScheduledActionEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.windowsAutopilotDeploymentProfile":{"id":"microsoft.devicemanagement.windowsAutopilotDeploymentProfile","name":"microsoft.devicemanagement.windowsAutopilotDeploymentProfile","fields":{"assignedDeviceCount":{"name":"assignedDeviceCount","type":"\u0005","is_mandatory":true,"title":"Number of devices currently assigned to this profile","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Creation date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deploymentProfileType":{"name":"deploymentProfileType","type":"\u0007","is_mandatory":true,"title":"Deployment profile kind (azureADJoinedDeploymentProfile, activeDirectoryWindowsAutopilotDeploymentProfile, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deviceNameTemplate":{"name":"deviceNameTemplate","type":"\u0007","is_mandatory":true,"title":"Device name template, with substitutable tokens such as %SERIAL%","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableWhiteGlove":{"name":"enableWhiteGlove","type":"\u0004","is_mandatory":true,"title":"Whether the white-glove (pre-provisioning) flow is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"extractHardwareHash":{"name":"extractHardwareHash","type":"\u0004","is_mandatory":true,"title":"Whether hardware hashes are collected during provisioning","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Deployment profile ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"language":{"name":"language","type":"\u0007","is_mandatory":true,"title":"Language tag applied during provisioning","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Last modification date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"locale":{"name":"locale","type":"\u0007","is_mandatory":true,"title":"Locale tag applied during provisioning","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"outOfBoxExperienceSettings":{"name":"outOfBoxExperienceSettings","type":"\n","is_mandatory":true,"title":"Out-of-box experience settings such as user-type, hide-EULA, hide-privacy-settings, and skip-keyboard-selection","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Windows Autopilot deployment profile","desc":"Windows Autopilot deployment profiles that drive zero-touch provisioning. The profile sets language, locale, device-name template, and the out-of-box experience that end users see during first sign-in; `deploymentProfileType` distinguishes Azure AD joined, Hybrid Azure AD joined, and self-deploying flows.","private":true,"min_provider_version":"13.0.12","defaults":"id displayName deploymentProfileType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.windowsFeatureUpdateProfile":{"id":"microsoft.devicemanagement.windowsFeatureUpdateProfile","name":"microsoft.devicemanagement.windowsFeatureUpdateProfile","fields":{"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Date and time the profile was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deployableContentDisplayName":{"name":"deployableContentDisplayName","type":"\u0007","is_mandatory":true,"title":"Display name of the deployable content","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Profile description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Profile display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"endOfSupportDate":{"name":"endOfSupportDate","type":"\t","is_mandatory":true,"title":"Date the deployed version reaches end of support","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"featureUpdateVersion":{"name":"featureUpdateVersion","type":"\u0007","is_mandatory":true,"title":"Windows feature update version the profile deploys","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Profile ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"installFeatureUpdatesOptional":{"name":"installFeatureUpdatesOptional","type":"\u0004","is_mandatory":true,"title":"Whether the feature update is offered as an optional install","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Date and time the profile was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleScopeTagIds":{"name":"roleScopeTagIds","type":"\u0019\u0007","is_mandatory":true,"title":"Role scope tag IDs assigned to the profile","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune Windows feature update profile","desc":"Windows feature update deployment profile, selected by its `id`. `featureUpdateVersion` is the Windows version the profile pins devices to, `deployableContentDisplayName` names the deployable build, and `endOfSupportDate` reports when that version stops receiving servicing.","private":true,"min_provider_version":"13.3.1","defaults":"displayName featureUpdateVersion","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.windowsQualityUpdateProfile":{"id":"microsoft.devicemanagement.windowsQualityUpdateProfile","name":"microsoft.devicemanagement.windowsQualityUpdateProfile","fields":{"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Date and time the profile was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deployableContentDisplayName":{"name":"deployableContentDisplayName","type":"\u0007","is_mandatory":true,"title":"Display name of the deployable content","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Profile description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Profile display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"expeditedDaysUntilForcedReboot":{"name":"expeditedDaysUntilForcedReboot","type":"\u0005","is_mandatory":true,"title":"Days before a reboot is forced after an expedited update","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"expeditedQualityUpdateRelease":{"name":"expeditedQualityUpdateRelease","type":"\u0007","is_mandatory":true,"title":"Quality update release to expedite","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Profile ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Date and time the profile was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"releaseDateDisplayName":{"name":"releaseDateDisplayName","type":"\u0007","is_mandatory":true,"title":"Display name of the release date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleScopeTagIds":{"name":"roleScopeTagIds","type":"\u0019\u0007","is_mandatory":true,"title":"Role scope tag IDs assigned to the profile","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune Windows quality update profile","desc":"Windows quality update deployment profile, selected by its `id`. These profiles drive expedited quality (security) update rollout; `expeditedQualityUpdateRelease` identifies the release to expedite and `expeditedDaysUntilForcedReboot` how long users may defer the reboot.","private":true,"min_provider_version":"13.3.1","defaults":"displayName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devicemanagement.windowsUpdateRing":{"id":"microsoft.devicemanagement.windowsUpdateRing","name":"microsoft.devicemanagement.windowsUpdateRing","fields":{"automaticUpdateMode":{"name":"automaticUpdateMode","type":"\u0007","is_mandatory":true,"title":"How updates are installed","desc":"One of userNotification, autoInstallAtMaintenanceTime, autoInstallAndRebootAtMaintenanceTime, autoInstallAndRebootAtScheduledTime, autoInstallAndRebootWithoutEndUserControl, or windowsDefault.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"businessReadyUpdatesOnly":{"name":"businessReadyUpdatesOnly","type":"\u0007","is_mandatory":true,"title":"Which updates devices receive","desc":"One of userDefined, all, businessReadyOnly, windowsInsiderBuildFast, windowsInsiderBuildSlow, or windowsInsiderBuildRelease.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Date and time the ring was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deadlineForFeatureUpdatesInDays":{"name":"deadlineForFeatureUpdatesInDays","type":"\u0005","is_mandatory":true,"title":"Days after a feature update is available before installation is enforced","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deadlineForQualityUpdatesInDays":{"name":"deadlineForQualityUpdatesInDays","type":"\u0005","is_mandatory":true,"title":"Days after a quality update is available before installation is enforced","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deadlineGracePeriodInDays":{"name":"deadlineGracePeriodInDays","type":"\u0005","is_mandatory":true,"title":"Grace period in days before a deadline reboot is enforced","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Ring description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Ring display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"driversExcluded":{"name":"driversExcluded","type":"\u0004","is_mandatory":true,"title":"Whether driver updates are excluded from the ring","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"featureUpdatesDeferralPeriodInDays":{"name":"featureUpdatesDeferralPeriodInDays","type":"\u0005","is_mandatory":true,"title":"Days feature updates are deferred","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"featureUpdatesPaused":{"name":"featureUpdatesPaused","type":"\u0004","is_mandatory":true,"title":"Whether feature updates are paused","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Ring ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"Date and time the ring was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"postponeRebootUntilAfterDeadline":{"name":"postponeRebootUntilAfterDeadline","type":"\u0004","is_mandatory":true,"title":"Whether reboots are postponed until after the deadline","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"prereleaseFeatures":{"name":"prereleaseFeatures","type":"\u0007","is_mandatory":true,"title":"Whether prerelease (Windows Insider) features are delivered","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"qualityUpdatesDeferralPeriodInDays":{"name":"qualityUpdatesDeferralPeriodInDays","type":"\u0005","is_mandatory":true,"title":"Days quality updates are deferred","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"qualityUpdatesPaused":{"name":"qualityUpdatesPaused","type":"\u0004","is_mandatory":true,"title":"Whether quality updates are paused","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userPauseAccess":{"name":"userPauseAccess","type":"\u0007","is_mandatory":true,"title":"Whether users may pause updates (enabled, disabled, notConfigured)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Intune Windows Update for Business ring","desc":"Windows Update for Business update ring, selected by its `id`. The ring governs how quickly devices receive updates: `automaticUpdateMode` and `businessReadyUpdatesOnly` set the servicing branch, the `featureUpdatesDeferralPeriodInDays` and `qualityUpdatesDeferralPeriodInDays` defer updates, `featureUpdatesPaused` / `qualityUpdatesPaused` halt them, and the deadline settings (`deadlineForFeatureUpdatesInDays`, `deadlineForQualityUpdatesInDays`, `deadlineGracePeriodInDays`, `postponeRebootUntilAfterDeadline`) force installation. `driversExcluded` reports whether driver updates are withheld and `userPauseAccess` whether users may pause updates.","private":true,"min_provider_version":"13.3.1","defaults":"displayName automaticUpdateMode","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.devices":{"id":"microsoft.devices","name":"microsoft.devices","fields":{"filter":{"name":"filter","type":"\u0007","is_mandatory":true,"title":"Filter devices by property values","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"list":{"name":"list","type":"\u0019\u001bmicrosoft.device","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"search":{"name":"search","type":"\u0007","is_mandatory":true,"title":"Search devices by search phrases","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"init":{"args":[{"name":"filter","type":"\u0007","optional":true},{"name":"search","type":"\u0007","optional":true}]},"list_type":"\u001bmicrosoft.device","title":"Microsoft Entra ID Devices","desc":"Devices registered in Microsoft Entra ID, each exposing compliance state, management status, operating system details, enrollment type, trust type, and on-premises sync information. Supports optional `filter` (OData property filter) and `search` (keyword search) parameters to narrow the results.","min_provider_version":"11.1.21","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.domain":{"id":"microsoft.domain","name":"microsoft.domain","fields":{"authenticationType":{"name":"authenticationType","type":"\u0007","is_mandatory":true,"title":"Authentication type of the domain","desc":"Either `Managed` (Microsoft Entra performs user authentication) or `Federated` (authentication is federated to an external identity provider, such as on-premises Active Directory via AD FS).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"availabilityStatus":{"name":"availabilityStatus","type":"\u0007","is_mandatory":true,"title":"Availability status of the domain","desc":"Always null except immediately after a verify action, when it is either `AvailableImmediately` or `EmailVerifiedDomainTakeoverScheduled`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the domain, such as contoso.com","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isAdminManaged":{"name":"isAdminManaged","type":"\u0004","is_mandatory":true,"title":"Whether the domain is admin managed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether the domain is the default domain","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isInitial":{"name":"isInitial","type":"\u0004","is_mandatory":true,"title":"Whether the domain is the initial domain","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isRoot":{"name":"isRoot","type":"\u0004","is_mandatory":true,"title":"Whether the domain is a root domain","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isVerified":{"name":"isVerified","type":"\u0004","is_mandatory":true,"title":"Whether the domain is verified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"passwordNotificationWindowInDays":{"name":"passwordNotificationWindowInDays","type":"\u0005","is_mandatory":true,"title":"Domain password notification window (days)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"passwordValidityPeriodInDays":{"name":"passwordValidityPeriodInDays","type":"\u0005","is_mandatory":true,"title":"Domain password validity period (days)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"serviceConfigurationRecords":{"name":"serviceConfigurationRecords","type":"\u0019\u001bmicrosoft.domaindnsrecord","title":"List of service configuration records","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"supportedServices":{"name":"supportedServices","type":"\u0019\u0007","is_mandatory":true,"title":"Services the domain is configured to support","desc":"Zero or more of `Email`, `Sharepoint`, `EmailInternalRelayOnly`, `OfficeCommunicationsOnline`, `SharePointDefaultDomain`, `FullRedelegation`, `SharePointPublic`, `OrgIdAuthentication`, `Yammer`, or `Intune`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra domain","desc":"DNS namespace registered to a Microsoft Entra tenant, such as `contoso.com` or the tenant's built-in `contoso.onmicrosoft.com`. Domains govern how user principal names are formed and how sign-in is handled: `authenticationType` distinguishes a cloud-managed domain from one that federates authentication to an external identity provider, and `isVerified` shows whether tenant ownership has been proven by publishing the required DNS records. Also exposes the password expiration policy applied to the domain and the service configuration records a tenant must publish to enable Microsoft 365 services.","private":true,"min_provider_version":"9.0.0","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.domaindnsrecord":{"id":"microsoft.domaindnsrecord","name":"microsoft.domaindnsrecord","fields":{"canonicalName":{"name":"canonicalName","type":"\u0007","is_mandatory":true,"title":"Canonical name of a CNAME record","desc":"The target domain name that a CNAME record points to. Empty for record types other than CNAME.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Domain record ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isOptional":{"name":"isOptional","type":"\u0004","is_mandatory":true,"title":"Whether the domain record is optional","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"Domain record label","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mailExchange":{"name":"mailExchange","type":"\u0007","is_mandatory":true,"title":"Mail server of an MX record","desc":"The fully qualified domain name of the mail exchange server for an MX record. Empty for record types other than MX.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"nameTarget":{"name":"nameTarget","type":"\u0007","is_mandatory":true,"title":"Target host of an SRV record","desc":"The fully qualified domain name of the target host for an SRV record. Empty for record types other than SRV.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"port":{"name":"port","type":"\u0005","is_mandatory":true,"title":"Port of an SRV record","desc":"The TCP or UDP port on which the service is found for an SRV record. Zero for record types other than SRV.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"preference":{"name":"preference","type":"\u0005","is_mandatory":true,"title":"Preference of an MX record","desc":"The priority value of the mail exchange server; lower values are preferred. Zero for record types other than MX.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Priority of an SRV record","desc":"The priority of the target host for an SRV record; lower values are preferred. Zero for record types other than SRV.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Raw domain record properties","desc":"Deprecated in favor of the individual fields on this resource (`recordType`, `supportedService`, `ttl`, `label`, `text`, `canonicalName`, `mailExchange`, `preference`, `nameTarget`, `service`, `protocol`, `port`, `priority`, `weight`).","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol of an SRV record","desc":"The transport protocol for an SRV record, for example `_tcp` or `_udp`. Empty for record types other than SRV.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"recordType":{"name":"recordType","type":"\u0007","is_mandatory":true,"title":"Domain record type","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"service":{"name":"service","type":"\u0007","is_mandatory":true,"title":"Service of an SRV record","desc":"The symbolic name of the service for an SRV record, for example `_sip`. Empty for record types other than SRV.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"supportedService":{"name":"supportedService","type":"\u0007","is_mandatory":true,"title":"Domain record supported service","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"text":{"name":"text","type":"\u0007","is_mandatory":true,"title":"Text value of a TXT record","desc":"The record content for a TXT record, for example an SPF policy string like `v=spf1 include:spf.protection.outlook.com -all`. Empty for record types other than TXT.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ttl":{"name":"ttl","type":"\u0005","is_mandatory":true,"title":"Domain record TTL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"weight":{"name":"weight","type":"\u0005","is_mandatory":true,"title":"Weight of an SRV record","desc":"The relative weight for records with the same priority for an SRV record. Zero for record types other than SRV.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft domain DNS record","private":true,"min_provider_version":"9.0.0","defaults":"id label","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.externalIdentitiesPolicy":{"id":"microsoft.externalIdentitiesPolicy","name":"microsoft.externalIdentitiesPolicy","fields":{"allowExternalIdentitiesToLeave":{"name":"allowExternalIdentitiesToLeave","type":"\u0004","is_mandatory":true,"title":"Defines whether external users can leave the guest tenant","desc":"If set to false, self-service controls are disabled, and the admin must manually remove the external user.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Policy display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Tenant-wide policy that controls whether external users can leave a tenant via self-service controls","private":true,"min_provider_version":"11.1.99","defaults":"displayName allowExternalIdentitiesToLeave","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.graph":{"id":"microsoft.graph","fields":{"accessReviewReviewerScope":{"name":"accessReviewReviewerScope","type":"\u001bmicrosoft.graph.accessReviewReviewerScope","title":"Reviewer scope for admin consent requests","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true}},"is_extension":true},"microsoft.graph.accessReviewReviewerScope":{"id":"microsoft.graph.accessReviewReviewerScope","name":"microsoft.graph.accessReviewReviewerScope","fields":{"query":{"name":"query","type":"\u0007","is_mandatory":true,"title":"The query specifying who will be the reviewer","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"queryRoot":{"name":"queryRoot","type":"\u0007","is_mandatory":true,"title":"In the scenario where reviewers need to be specified dynamically, this property is used to indicate the relative source of the query","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"queryType":{"name":"queryType","type":"\u0007","is_mandatory":true,"title":"The type of query","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Reviewer scope for admin consent requests","private":true,"min_provider_version":"11.1.42","defaults":"query queryType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.group":{"id":"microsoft.group","name":"microsoft.group","fields":{"classification":{"name":"classification","type":"\u0007","is_mandatory":true,"title":"Classification assigned to the group (e.g., low, medium, high)","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Group creation time","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deletedDateTime":{"name":"deletedDateTime","type":"\t","is_mandatory":true,"title":"Soft-delete timestamp for the group","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Group description","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Group display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"expirationDateTime":{"name":"expirationDateTime","type":"\t","is_mandatory":true,"title":"Expiration time for the group","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"groupTypes":{"name":"groupTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Group types indicating membership and classification","desc":"Values include Unified for Microsoft 365 groups and DynamicMembership for groups whose members are set by membershipRule. Plain security groups return an empty list.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Group ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isAssignableToRole":{"name":"isAssignableToRole","type":"\u0004","is_mandatory":true,"title":"Whether the group can be assigned to an Entra role","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mail":{"name":"mail","type":"\u0007","is_mandatory":true,"title":"Group email","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mailEnabled":{"name":"mailEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the group is mail-enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mailNickname":{"name":"mailNickname","type":"\u0007","is_mandatory":true,"title":"Group email nickname","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"members":{"name":"members","type":"\u0019\u001bmicrosoft.user","title":"List of group members","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"membershipRule":{"name":"membershipRule","type":"\u0007","is_mandatory":true,"title":"Membership rule used for dynamic group membership","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"membershipRuleProcessingState":{"name":"membershipRuleProcessingState","type":"\u0007","is_mandatory":true,"title":"Processing state for the dynamic membership rule","desc":"One of On or Paused. Paused stops the rule from being evaluated so membership no longer updates automatically.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"onPremisesLastSyncDateTime":{"name":"onPremisesLastSyncDateTime","type":"\t","is_mandatory":true,"title":"Last time the group was synced from on-premises","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"onPremisesSyncEnabled":{"name":"onPremisesSyncEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the group is synced from an on-premises directory","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"owner":{"name":"owner","type":"\u001bmicrosoft.group.owner","title":"Group owner (can be a user or service principal)","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"owners":{"name":"owners","type":"\u0019\u001bmicrosoft.group.owner","title":"List of group owners","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"preferredDataLocation":{"name":"preferredDataLocation","type":"\u0007","is_mandatory":true,"title":"The preferred data location for the group (e.g., a geo region)","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"preferredLanguage":{"name":"preferredLanguage","type":"\u0007","is_mandatory":true,"title":"The group's preferred language (ISO 639-1 code)","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"proxyAddresses":{"name":"proxyAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Email addresses including aliases for the group","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"renewedDateTime":{"name":"renewedDateTime","type":"\t","is_mandatory":true,"title":"Last time the group was renewed","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"securityEnabled":{"name":"securityEnabled","type":"\u0004","is_mandatory":true,"title":"Whether group security is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"theme":{"name":"theme","type":"\u0007","is_mandatory":true,"title":"The color theme for the group (blue, green, orange, pink, purple, red, teal)","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"visibility":{"name":"visibility","type":"\u0007","is_mandatory":true,"title":"Group visibility","desc":"One of Public, Private, or HiddenMembership. HiddenMembership hides the membership list from users who are not members and is supported only on Microsoft 365 groups.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft group","desc":"Entra ID group, covering security groups, Microsoft 365 groups, and mail-enabled distribution groups. Group membership governs access to applications, SharePoint sites, Teams, and other resources, which makes groups a core object for access reviews and least-privilege audits. The members and owners fields resolve the principals that belong to and administer the group, isAssignableToRole flags groups that can be granted Entra directory roles, and membershipRule exposes the rule that drives dynamic membership.","private":true,"min_provider_version":"9.0.0","defaults":"id displayName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.group.owner":{"id":"microsoft.group.owner","name":"microsoft.group.owner","fields":{"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"The owner's display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"The unique identifier for the owner","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ownerType":{"name":"ownerType","type":"\u0007","is_mandatory":true,"title":"The type of owner: \"user\" or \"servicePrincipal\"","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"servicePrincipal":{"name":"servicePrincipal","type":"\u001bmicrosoft.serviceprincipal","title":"The owner as a service principal (if ownerType is \"servicePrincipal\")","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"user":{"name":"user","type":"\u001bmicrosoft.user","title":"The owner as a user (if ownerType is \"user\")","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Group owner (can be a user or service principal)","private":true,"min_provider_version":"11.1.68","defaults":"id displayName ownerType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.groupLifecyclePolicy":{"id":"microsoft.groupLifecyclePolicy","name":"microsoft.groupLifecyclePolicy","fields":{"alternateNotificationEmails":{"name":"alternateNotificationEmails","type":"\u0007","is_mandatory":true,"title":"Fallback notification recipients for ownerless groups","desc":"Semicolon-separated list of email addresses that receive expiration and renewal notifications when a group has no owner to notify.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"groupLifetimeInDays":{"name":"groupLifetimeInDays","type":"\u0005","is_mandatory":true,"title":"Number of days before a group expires and is automatically deleted","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"managedGroupTypes":{"name":"managedGroupTypes","type":"\u0007","is_mandatory":true,"title":"Group types the policy applies to","desc":"One of `All` (every Microsoft 365 group), `Selected` (only groups explicitly added to the policy), or `None` (no groups, expiration effectively disabled).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 group lifecycle policy","desc":"Expiration policy that governs how long Microsoft 365 groups live before they must be renewed, and what happens when they are not. Auditing this tells you whether stale, unowned, or abandoned groups (and their SharePoint sites, mailboxes, and Teams) are cleaned up automatically or allowed to accumulate. The policy sets the renewal lifetime in days, which group types it applies to, and the fallback notification recipients used when a group has no owner to receive renewal notices.","private":true,"min_provider_version":"11.1.42","defaults":"groupLifetimeInDays managedGroupTypes alternateNotificationEmails","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.groups":{"id":"microsoft.groups","name":"microsoft.groups","fields":{"count":{"name":"count","type":"\u0005","title":"Total number of Microsoft groups","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"list":{"name":"list","type":"\u0019\u001bmicrosoft.group","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"list_type":"\u001bmicrosoft.group","title":"Microsoft Entra ID Groups","desc":"Collection of every Microsoft Entra ID (formerly Azure AD) group in the tenant, including security groups, mail-enabled groups, Microsoft 365 groups, and dynamic membership groups. Auditing groups matters because they are the primary mechanism for granting access to resources and applications, so overly broad membership, stale groups, or misconfigured dynamic rules can expand a tenant's attack surface. Each entry is a `microsoft.group`, and `count` reports the total number of groups.","min_provider_version":"11.1.19","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess":{"id":"microsoft.identityAndAccess","name":"microsoft.identityAndAccess","fields":{"accessReviewDefinition":{"name":"accessReviewDefinition","type":"\u001bmicrosoft.identityAndAccess.accessReviewDefinition","title":"Defines a recurring access review schedule and its properties in Microsoft Entra ID.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"accessReviews":{"name":"accessReviews","type":"\u001bmicrosoft.identityAndAccess.accessReviews","title":"Microsoft Entra ID Access Review Definitions","desc":"Recurring access review schedules defined in the tenant, used to audit how access to groups, roles, and applications is periodically re-certified. An optional `filter` parameter accepts OData syntax to narrow results, for example filtering by scope to find reviews targeting group membership. Each entry describes the review's schedule, reviewers, and decision-handling settings.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"filter":{"name":"filter","type":"\u0007","is_mandatory":true,"title":"Policy filter expression","desc":"Deprecated in favor of `microsoft.identityAndAccess.privilegedIdentityManagement.policies`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"identityAndSignIn":{"name":"identityAndSignIn","type":"\u001bmicrosoft.identityAndAccess.identityAndSignIn","title":"Identity and sign-in policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"list":{"name":"list","type":"\u0019\u001bmicrosoft.identityAndAccess.policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"organization":{"name":"organization","type":"\u001bmicrosoft.tenant","title":"Tenant organization information","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policy":{"name":"policy","type":"\u001bmicrosoft.identityAndAccess.policy","title":"PIM role management policy for Microsoft Entra ID roles","desc":"Deprecated in favor of `microsoft.identityAndAccess.privilegedIdentityManagement.policy`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true,"maturity":"deprecated"},"privilegedIdentityManagement":{"name":"privilegedIdentityManagement","type":"\u001bmicrosoft.identityAndAccess.privilegedIdentityManagement","title":"Privileged Identity Management resources","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleEligibilityScheduleInstance":{"name":"roleEligibilityScheduleInstance","type":"\u001bmicrosoft.identityAndAccess.roleEligibilityScheduleInstance","title":"Represents an instance of a role eligibility in PIM","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"roleEligibilityScheduleInstances":{"name":"roleEligibilityScheduleInstances","type":"\u0019\u001bmicrosoft.identityAndAccess.roleEligibilityScheduleInstance","title":"Get the instances of role eligibilities","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"init":{"args":[{"name":"filter","type":"\u0007","optional":true}]},"list_type":"\u001bmicrosoft.identityAndAccess.policy","title":"Microsoft Entra identity and access management","desc":"Container for identity and sign-in policies, PIM role eligibilities and policies, and tenant organization information.","min_provider_version":"11.1.40","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.accessReviewDefinition":{"id":"microsoft.identityAndAccess.accessReviewDefinition","name":"microsoft.identityAndAccess.accessReviewDefinition","fields":{"accessReviewScheduleSettings":{"name":"accessReviewScheduleSettings","type":"\u001bmicrosoft.identityAndAccess.accessReviewDefinition.accessReviewScheduleSettings","title":"Configures the recurrence, notifications, and decision-handling for an access review series.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"The display name for the access review","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"The unique identifier for the access review","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reviewers":{"name":"reviewers","type":"\n","is_mandatory":true,"title":"Reviewer scopes","desc":"List of reviewer scope entries defining who performs the review. Each entry is a dict with `reviewer` (a query selecting the reviewing principals), `queryType`, and `queryRoot`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"scope":{"name":"scope","type":"\u001bmicrosoft.identityAndAccess.accessReviewDefinition.scope","is_mandatory":true,"title":"Defines the entities whose access is reviewed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"settings":{"name":"settings","type":"\u001bmicrosoft.identityAndAccess.accessReviewDefinition.accessReviewScheduleSettings","is_mandatory":true,"title":"The settings for an access review series, see type definition below","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"The status of the access review","desc":"Possible values are: Initializing, NotStarted, Starting, InProgress, Completing, Completed, AutoReviewing, and AutoReviewed.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Defines a recurring access review schedule and its properties in Microsoft Entra ID.","private":true,"min_provider_version":"11.1.46","defaults":"id displayName status","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.accessReviewDefinition.accessReviewScheduleSettings":{"id":"microsoft.identityAndAccess.accessReviewDefinition.accessReviewScheduleSettings","name":"microsoft.identityAndAccess.accessReviewDefinition.accessReviewScheduleSettings","fields":{"autoApplyDecisionsEnabled":{"name":"autoApplyDecisionsEnabled","type":"\u0004","is_mandatory":true,"title":"True if decisions are automatically applied","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"decisionHistoriesForReviewersEnabled":{"name":"decisionHistoriesForReviewersEnabled","type":"\u0004","is_mandatory":true,"title":"True if decisions on previous access review stages are available for reviewers on an accessReviewInstance with multiple subsequent stages","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"defaultDecision":{"name":"defaultDecision","type":"\u0007","is_mandatory":true,"title":"Decision chosen if defaultDecisionEnabled is enabled. Can be one of Approve, Deny, or Recommendation","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"defaultDecisionEnabled":{"name":"defaultDecisionEnabled","type":"\u0004","is_mandatory":true,"title":"True if the default decision is enabled or disabled when reviewers do not respond","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"instanceDurationInDays":{"name":"instanceDurationInDays","type":"\u0005","is_mandatory":true,"title":"Duration of an access review instance in days","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"justificationRequiredOnApproval":{"name":"justificationRequiredOnApproval","type":"\u0004","is_mandatory":true,"title":"True if reviewers are required to provide justification with their decision","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mailNotificationsEnabled":{"name":"mailNotificationsEnabled","type":"\u0004","is_mandatory":true,"title":"True if emails are enabled or disabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"recommendationsEnabled":{"name":"recommendationsEnabled","type":"\u0004","is_mandatory":true,"title":"True if decision recommendations are enabled or disabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"recurrence":{"name":"recurrence","type":"\n","is_mandatory":true,"title":"Recurrence settings","desc":"Recurrence configuration for the review series, as a dict with `pattern` (the recurrence pattern, such as its type and interval) and `range` (the start, end, and range type of the recurrence).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reminderNotificationsEnabled":{"name":"reminderNotificationsEnabled","type":"\u0004","is_mandatory":true,"title":"True if reminders are enabled or disabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Configures the recurrence, notifications, and decision-handling for an access review series.","private":true,"min_provider_version":"11.1.46","defaults":"mailNotificationsEnabled reminderNotificationsEnabled defaultDecision defaultDecisionEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.accessReviewDefinition.scope":{"id":"microsoft.identityAndAccess.accessReviewDefinition.scope","name":"microsoft.identityAndAccess.accessReviewDefinition.scope","fields":{"query":{"name":"query","type":"\u0007","is_mandatory":true,"title":"Query string defining which entities are in scope for the review","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"queryRoot":{"name":"queryRoot","type":"\u0007","is_mandatory":true,"title":"Optional query root path","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"queryType":{"name":"queryType","type":"\u0007","is_mandatory":true,"title":"Type of query being used (e.g., \"MicrosoftGraph\")","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Defines the scope of entities whose access is being reviewed","private":true,"min_provider_version":"11.1.89","defaults":"query queryType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.accessReviews":{"id":"microsoft.identityAndAccess.accessReviews","name":"microsoft.identityAndAccess.accessReviews","fields":{"filter":{"name":"filter","type":"\u0007","is_mandatory":true,"title":"Filter access review definitions, e.g., \"contains(scope/microsoft.graph.accessReviewQueryScope/query, './members')\"","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"list":{"name":"list","type":"\u0019\u001bmicrosoft.identityAndAccess.accessReviewDefinition","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"init":{"args":[{"name":"filter","type":"\u0007","optional":true}]},"list_type":"\u001bmicrosoft.identityAndAccess.accessReviewDefinition","title":"Microsoft Entra ID Access Review Definitions","desc":"Recurring access review schedules defined in the tenant, used to audit how access to groups, roles, and applications is periodically re-certified. An optional `filter` parameter accepts OData syntax to narrow results, for example filtering by scope to find reviews targeting group membership. Each entry describes the review's schedule, reviewers, and decision-handling settings.","min_provider_version":"11.1.46","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.identityAndSignIn":{"id":"microsoft.identityAndAccess.identityAndSignIn","name":"microsoft.identityAndAccess.identityAndSignIn","fields":{"policies":{"name":"policies","type":"\u001bmicrosoft.identityAndAccess.identityAndSignIn.policies","title":"Identity and sign-in policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra Identity and Sign-In Policies","desc":"Identity and sign-in policy configuration for the tenant. The `policies` collection provides access to specific policy objects such as the identity security defaults enforcement policy.","min_provider_version":"11.1.42","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.identityAndSignIn.policies":{"id":"microsoft.identityAndAccess.identityAndSignIn.policies","name":"microsoft.identityAndAccess.identityAndSignIn.policies","fields":{"identitySecurityDefaultsEnforcementPolicy":{"name":"identitySecurityDefaultsEnforcementPolicy","type":"\u001bmicrosoft.identityAndAccess.identityAndSignIn.policies.identitySecurityDefaultsEnforcementPolicy","title":"Identity security defaults enforcement policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra Identity and Sign-In Policy Collection","desc":"Collection of individual sign-in policy objects. The `identitySecurityDefaultsEnforcementPolicy` controls whether Microsoft Entra ID security defaults are enabled for the tenant.","min_provider_version":"11.1.42","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.identityAndSignIn.policies.identitySecurityDefaultsEnforcementPolicy":{"id":"microsoft.identityAndAccess.identityAndSignIn.policies.identitySecurityDefaultsEnforcementPolicy","name":"microsoft.identityAndAccess.identityAndSignIn.policies.identitySecurityDefaultsEnforcementPolicy","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"The description for the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"The display name for the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"The unique identifier for the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"If set to true, Azure Entra ID security defaults is enabled for the tenant","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Identity security defaults enforcement policy","private":true,"min_provider_version":"11.1.42","defaults":"id displayName isEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.policy":{"id":"microsoft.identityAndAccess.policy","name":"microsoft.identityAndAccess.policy","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Policy display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isOrganizationDefault":{"name":"isOrganizationDefault","type":"\u0004","is_mandatory":true,"title":"True if this policy is the default organization policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedBy":{"name":"lastModifiedBy","type":"\n","is_mandatory":true,"title":"The identity of the user who last modified the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"The time when this policy was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"rule":{"name":"rule","type":"\u001bmicrosoft.identityAndAccess.policy.rule","title":"Rule defined for a PIM role management policy","desc":"Deprecated in favor of `microsoft.identityAndAccess.privilegedIdentityManagement.policy.rule`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true,"maturity":"deprecated"},"ruleTarget":{"name":"ruleTarget","type":"\u001bmicrosoft.identityAndAccess.policy.ruleTarget","title":"Scope targeted by a PIM role management policy rule","desc":"Deprecated in favor of `microsoft.identityAndAccess.privilegedIdentityManagement.policy.rule.target`.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true,"maturity":"deprecated"},"rules":{"name":"rules","type":"\u0019\u001bmicrosoft.identityAndAccess.policy.rule","title":"The collection of rules that are part of the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"scopeId":{"name":"scopeId","type":"\u0007","is_mandatory":true,"title":"The identifier of the scope where the policy is defined","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"scopeType":{"name":"scopeType","type":"\u0007","is_mandatory":true,"title":"The type of the scope where the policy is defined","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"PIM role management policy for Microsoft Entra ID roles","desc":"Deprecated in favor of `microsoft.identityAndAccess.privilegedIdentityManagement.policy`.","private":true,"min_provider_version":"11.1.40","defaults":"id displayName scopeType","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"microsoft.identityAndAccess.policy.rule":{"id":"microsoft.identityAndAccess.policy.rule","name":"microsoft.identityAndAccess.policy.rule","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"The unique identifier for the rule","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"target":{"name":"target","type":"\u001bmicrosoft.identityAndAccess.policy.ruleTarget","is_mandatory":true,"title":"Defines details of scope that's targeted by role management policy rule","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Rule defined for a PIM role management policy","desc":"Deprecated in favor of `microsoft.identityAndAccess.privilegedIdentityManagement.policy.rule`.","private":true,"min_provider_version":"11.1.40","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"microsoft.identityAndAccess.policy.ruleTarget":{"id":"microsoft.identityAndAccess.policy.ruleTarget","name":"microsoft.identityAndAccess.policy.ruleTarget","fields":{"caller":{"name":"caller","type":"\u0007","is_mandatory":true,"title":"The type of caller that's the target of the policy rule. Allowed values are: None, Admin, EndUser","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enforcedSettings":{"name":"enforcedSettings","type":"\u0019\u0007","is_mandatory":true,"title":"The list of role settings that are enforced and cannot be overridden by child scopes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"inheritableSettings":{"name":"inheritableSettings","type":"\u0019\u0007","is_mandatory":true,"title":"The list of role settings that are inherited from the parent scope","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"level":{"name":"level","type":"\u0007","is_mandatory":true,"title":"The assignment type that's the target of policy rule. Allowed values are: Eligibility, Assignment","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"operations":{"name":"operations","type":"\u0019\u0007","is_mandatory":true,"title":"The list of role management operations that are the target of the policy rule","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Scope targeted by a PIM role management policy rule","desc":"Deprecated in favor of `microsoft.identityAndAccess.privilegedIdentityManagement.policy.rule.target`.","private":true,"min_provider_version":"11.1.43","defaults":"caller level","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"microsoft.identityAndAccess.privilegedIdentityManagement":{"id":"microsoft.identityAndAccess.privilegedIdentityManagement","name":"microsoft.identityAndAccess.privilegedIdentityManagement","fields":{"policies":{"name":"policies","type":"\u001bmicrosoft.identityAndAccess.privilegedIdentityManagement.policies","title":"PIM role management policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"policy":{"name":"policy","type":"\u001bmicrosoft.identityAndAccess.privilegedIdentityManagement.policy","title":"A PIM role management policy for Microsoft Entra ID roles","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true}},"title":"Microsoft Entra Privileged Identity Management","desc":"Privileged Identity Management (PIM) role management policies for Microsoft Entra ID roles, governing how eligible and active role assignments are activated, approved, and time-bound.","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.privilegedIdentityManagement.policies":{"id":"microsoft.identityAndAccess.privilegedIdentityManagement.policies","name":"microsoft.identityAndAccess.privilegedIdentityManagement.policies","fields":{"filter":{"name":"filter","type":"\u0007","is_mandatory":true,"title":"Filter by scopeId and scopeType","desc":"e.g., \"scopeId eq '/' and scopeType eq 'Directory'\"","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"list":{"name":"list","type":"\u0019\u001bmicrosoft.identityAndAccess.privilegedIdentityManagement.policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"init":{"args":[{"name":"filter","type":"\u0007","optional":true}]},"list_type":"\u001bmicrosoft.identityAndAccess.privilegedIdentityManagement.policy","title":"PIM role management policies","desc":"PIM role management policies defined in the tenant, each governing activation requirements for a directory scope. An optional `filter` parameter narrows results, for example scoped to `scopeId eq '/' and scopeType eq 'Directory'`.","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.privilegedIdentityManagement.policy":{"id":"microsoft.identityAndAccess.privilegedIdentityManagement.policy","name":"microsoft.identityAndAccess.privilegedIdentityManagement.policy","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Policy display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isOrganizationDefault":{"name":"isOrganizationDefault","type":"\u0004","is_mandatory":true,"title":"True if this policy is the default organization policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedBy":{"name":"lastModifiedBy","type":"\n","is_mandatory":true,"title":"Identity that last modified the policy","desc":"Dict identifying the principal that last changed the policy, with `id` and `displayName`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedDateTime":{"name":"lastModifiedDateTime","type":"\t","is_mandatory":true,"title":"The time when this policy was last modified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"rule":{"name":"rule","type":"\u001bmicrosoft.identityAndAccess.privilegedIdentityManagement.policy.rule","title":"A rule defined for a PIM role management policy","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bmicrosoft.identityAndAccess.privilegedIdentityManagement.policy.rule","title":"The collection of rules that are part of the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"scopeId":{"name":"scopeId","type":"\u0007","is_mandatory":true,"title":"The identifier of the scope where the policy is defined","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"scopeType":{"name":"scopeType","type":"\u0007","is_mandatory":true,"title":"The type of the scope where the policy is defined","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"A PIM role management policy for Microsoft Entra ID roles","private":true,"min_provider_version":"13.0.12","defaults":"id displayName scopeType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.privilegedIdentityManagement.policy.rule":{"id":"microsoft.identityAndAccess.privilegedIdentityManagement.policy.rule","name":"microsoft.identityAndAccess.privilegedIdentityManagement.policy.rule","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"The unique identifier for the rule","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"target":{"name":"target","type":"\u001bmicrosoft.identityAndAccess.privilegedIdentityManagement.policy.rule.target","is_mandatory":true,"title":"Defines details of scope that's targeted by role management policy rule","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"A rule defined for a PIM role management policy","private":true,"min_provider_version":"13.0.12","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.privilegedIdentityManagement.policy.rule.target":{"id":"microsoft.identityAndAccess.privilegedIdentityManagement.policy.rule.target","name":"microsoft.identityAndAccess.privilegedIdentityManagement.policy.rule.target","fields":{"caller":{"name":"caller","type":"\u0007","is_mandatory":true,"title":"The type of caller that's the target of the policy rule. Allowed values are: None, Admin, EndUser","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enforcedSettings":{"name":"enforcedSettings","type":"\u0019\u0007","is_mandatory":true,"title":"The list of role settings that are enforced and cannot be overridden by child scopes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"inheritableSettings":{"name":"inheritableSettings","type":"\u0019\u0007","is_mandatory":true,"title":"The list of role settings that can be inherited by child scopes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"level":{"name":"level","type":"\u0007","is_mandatory":true,"title":"The role assignment type that's the target of policy rule","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"operations":{"name":"operations","type":"\u0019\u0007","is_mandatory":true,"title":"The role management operations that are the target of the policy rule","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Defines details of the scope that's targeted by role management policy rule","private":true,"min_provider_version":"13.0.12","defaults":"caller level","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.identityAndAccess.roleEligibilityScheduleInstance":{"id":"microsoft.identityAndAccess.roleEligibilityScheduleInstance","name":"microsoft.identityAndAccess.roleEligibilityScheduleInstance","fields":{"appScopeId":{"name":"appScopeId","type":"\u0007","is_mandatory":true,"title":"The identifier of the app-specific scope of the role eligibility","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"directoryScopeId":{"name":"directoryScopeId","type":"\u0007","is_mandatory":true,"title":"The identifier of the directory object representing the scope of the role eligibility","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"endDateTime":{"name":"endDateTime","type":"\t","is_mandatory":true,"title":"The end time of the role eligibility","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"The unique identifier of the role eligibility schedule instance","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"memberType":{"name":"memberType","type":"\u0007","is_mandatory":true,"title":"The type of member, either 'Direct' or 'Inherited'.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"The identifier of the principal (user, group, or service principal) that has the role eligibility","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleDefinition":{"name":"roleDefinition","type":"\u001bmicrosoft.rolemanagement.roledefinition","title":"Role definition the eligibility grants","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleDefinitionId":{"name":"roleDefinitionId","type":"\u0007","is_mandatory":true,"title":"The identifier of the role definition that the eligibility is for","desc":"Deprecated in favor of roleDefinition.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"roleEligibilityScheduleId":{"name":"roleEligibilityScheduleId","type":"\u0007","is_mandatory":true,"title":"The identifier of the role eligibility schedule from which this instance is created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"startDateTime":{"name":"startDateTime","type":"\t","is_mandatory":true,"title":"The start time of the role eligibility","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Represents an instance of a role eligibility in PIM","private":true,"min_provider_version":"11.1.41","defaults":"memberType principalId","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.keyCredential":{"id":"microsoft.keyCredential","name":"microsoft.keyCredential","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-form description of the certificate's purpose","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"expired":{"name":"expired","type":"\u0004","is_mandatory":true,"title":"Whether the certificate has passed its expiration date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"expires":{"name":"expires","type":"\t","is_mandatory":true,"title":"Certificate expiration date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"keyId":{"name":"keyId","type":"\u0007","is_mandatory":true,"title":"Certificate ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"startDateTime":{"name":"startDateTime","type":"\t","is_mandatory":true,"title":"Certificate validity start date","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"thumbprint":{"name":"thumbprint","type":"\u0007","is_mandatory":true,"title":"Certificate thumbprint","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Certificate type","desc":"One of AsymmetricX509Cert (a standalone X.509 certificate) or X509CertAndPassword (a certificate paired with a password).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"usage":{"name":"usage","type":"\u0007","is_mandatory":true,"title":"Certificate usage","desc":"Purpose the key can be used for: Verify (the app presents this certificate to prove its identity) or Sign (the app signs with it).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra application certificate credential","desc":"A public-key certificate registered on an Entra application or service principal and used to authenticate the app when it requests tokens. Audit these to find certificates that are expired or close to expiry, to review what key material an application trusts, and to flag long-lived or unused credentials that widen the blast radius if the app is compromised. The `expired` predicate reports whether the certificate is past its end date, and `expires` gives the exact expiration time.","private":true,"min_provider_version":"11.0.28","defaults":"thumbprint description expires keyId","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.oauth2PermissionGrant":{"id":"microsoft.oauth2PermissionGrant","name":"microsoft.oauth2PermissionGrant","fields":{"client":{"name":"client","type":"\u001bmicrosoft.serviceprincipal","title":"Client application this grant authorizes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"Object ID of the client service principal granted access","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"clientName":{"name":"clientName","type":"\u0007","is_mandatory":true,"title":"Display name of the client application","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"consentType":{"name":"consentType","type":"\u0007","is_mandatory":true,"title":"Whether consent covers all users (`AllPrincipals`) or a single user (`Principal`)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"OAuth2 permission grant ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"principal":{"name":"principal","type":"\u001bmicrosoft.user","title":"User who granted consent, set when consentType is `Principal`","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Object ID of the user who granted consent, set when consentType is `Principal`","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"resource":{"name":"resource","type":"\u001bmicrosoft.serviceprincipal","title":"API the client application is granted access to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"resourceId":{"name":"resourceId","type":"\u0007","is_mandatory":true,"title":"Object ID of the resource (API) service principal access is granted for","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"resourceName":{"name":"resourceName","type":"\u0007","is_mandatory":true,"title":"Display name of the resource (API) the access is granted for","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Delegated permission scopes granted to the client application","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra ID OAuth2 Permission Grant","desc":"Delegated permission grant authorizing a client application to call an API on behalf of signed-in users. The `consentType` is `AllPrincipals` when an administrator consented for the entire tenant, or `Principal` when an individual user consented, in which case `principal` resolves to that user. `scopes` lists the delegated permissions granted. `client` is the service principal of the application receiving access and `resource` is the service principal of the API being accessed. Audit this collection to review tenant-wide application consent, for example finding broad admin grants or user-consented access to sensitive APIs.","min_provider_version":"13.0.12","defaults":"clientName resourceName consentType scopes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.organization":{"id":"microsoft.tenant","name":"microsoft.tenant","fields":{"assignedPlans":{"name":"assignedPlans","type":"\u0019\n","is_mandatory":true,"title":"Service plans associated with the tenant","desc":"Each entry has keys `service` (the service family, such as `AADPremiumService` or `exchange`), `capabilityStatus` (one of `Enabled`, `Warning`, `Suspended`, `Deleted`, or `LockedOut`), `servicePlanId` (the plan GUID), and `assignedDateTime`. See `enabledServicePlans` for the distinct list of enabled service families.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"branding":{"name":"branding","type":"\u0019\u001bmicrosoft.tenant.brandingInfo","title":"Tenant branding information for all verified domains","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"brandingInfo":{"name":"brandingInfo","type":"\u001bmicrosoft.tenant.brandingInfo","title":"Tenant branding information","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"countryLetterCode":{"name":"countryLetterCode","type":"\u0007","is_mandatory":true,"title":"Country or region abbreviation for the tenant (ISO 3166-2)","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Tenant creation date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Tenant creation date and time","desc":"Deprecated in favor of `createdAt`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"enabledServicePlans":{"name":"enabledServicePlans","type":"\u0019\u0007","title":"Enabled service families on the tenant","desc":"Distinct list of `service` names from `assignedPlans` whose `capabilityStatus` is `Enabled`, sorted alphabetically. Use this to gate license-dependent checks without digging through the `assignedPlans` dicts, for example `microsoft.tenant.enabledServicePlans.contains(\"AADPremiumService\")` to confirm Microsoft Entra ID P1/P2 is active.","min_provider_version":"13.7.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"formsSettings":{"name":"formsSettings","type":"\u001bmicrosoft.tenantFormsSettings","title":"Company-wide settings for Microsoft Forms","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Organization ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tenant display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"onPremisesSyncEnabled":{"name":"onPremisesSyncEnabled","type":"\u0004","is_mandatory":true,"title":"Whether password hash sync is enabled for hybrid deployments","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"paidLicenses":{"name":"paidLicenses","type":"\u0005","title":"Total billed license seats","desc":"Sum of `totalLicenses` across non-trial subscriptions that are still being billed (status `Enabled` or `Warning`, the post-expiry grace period). Suspended, deleted, and locked-out subscriptions are excluded.","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"preferredLanguage":{"name":"preferredLanguage","type":"\u0007","is_mandatory":true,"title":"Preferred language","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"privacyProfile":{"name":"privacyProfile","type":"\n","is_mandatory":true,"title":"Privacy profile data with contact email and statement URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"provisionedPlans":{"name":"provisionedPlans","type":"\u0019\n","is_mandatory":true,"title":"Provisioned plans","desc":"Each entry has keys `service` (the service family, such as `SharePoint` or `exchange`) and `capabilityStatus` (one of `Enabled`, `Warning`, `Suspended`, `Deleted`, or `LockedOut`).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"realm":{"name":"realm","type":"\u0019\u001bmicrosoft.tenant.realmInfo","title":"Tenant realm information for all verified domains","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"realmInfo":{"name":"realmInfo","type":"\u001bmicrosoft.tenant.realmInfo","title":"Tenant realm information","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"securityComplianceNotificationMails":{"name":"securityComplianceNotificationMails","type":"\u0019\u0007","is_mandatory":true,"title":"List of security compliance notification email addresses","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"securityComplianceNotificationPhones":{"name":"securityComplianceNotificationPhones","type":"\u0019\u0007","is_mandatory":true,"title":"List of security compliance notification phone numbers","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"settings":{"name":"settings","type":"\u001bmicrosoft.tenantSettings","title":"Company-wide settings for apps and services.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"subscriptions":{"name":"subscriptions","type":"\u0019\n","title":"Commercial subscriptions","desc":"Each entry has keys `id`, `skuPartNumber` (the license SKU, such as `ENTERPRISEPREMIUM`), `status` (one of `Enabled`, `Warning`, `Suspended`, `Deleted`, or `LockedOut`), `isTrial`, `totalLicenses`, `createdAt`, and `servicePlans` (each with `servicePlanId`, `servicePlanName`, `provisioningStatus`, and `appliesTo`).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"technicalNotificationMails":{"name":"technicalNotificationMails","type":"\u0019\u0007","is_mandatory":true,"title":"List of technical notification mails","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Tenant type","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"verifiedDomains":{"name":"verifiedDomains","type":"\u0019\n","is_mandatory":true,"title":"Organization verified domains","desc":"Each entry has keys `name` (the domain name), `type` (`Managed` or `Federated`), `capabilities` (comma-separated services associated with the domain, such as `Email` or `OfficeCommunicationsOnline`), `isDefault` (the primary domain new users are assigned to), and `isInitial` (the tenant's original `*.onmicrosoft.com` domain).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra Tenant","desc":"Configuration of the connected Microsoft Entra ID (Azure AD) tenant. Exposes the tenant's `name`, `id`, `type`, verified domains, provisioned plans, on-premises sync status, privacy profile, technical notification contacts, and security compliance notification addresses. Related resources include `settings`, `formsSettings`, `realm`, and `branding`.","min_provider_version":"11.0.29","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.passwordCredential":{"id":"microsoft.passwordCredential","name":"microsoft.passwordCredential","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Free-form description of the client secret's purpose","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"expired":{"name":"expired","type":"\u0004","is_mandatory":true,"title":"Whether the secret has expired","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"expires":{"name":"expires","type":"\t","is_mandatory":true,"title":"Secret expiration date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"hint":{"name":"hint","type":"\u0007","is_mandatory":true,"title":"Secret hint","desc":"Leading characters of the client secret value, recorded by Microsoft Entra ID to help identify which secret an entry refers to. The full secret value is never returned by the API.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"keyId":{"name":"keyId","type":"\u0007","is_mandatory":true,"title":"Secret ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"startDateTime":{"name":"startDateTime","type":"\t","is_mandatory":true,"title":"Secret validity start date","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra AD Application secrets","desc":"Client secret (password credential) registered on an Entra ID application or service principal. Client secrets authenticate an application to the Microsoft identity platform, so their expiration and rotation are common audit targets: `expires` and `expired` surface stale or soon-to-lapse credentials, and `startDateTime` shows when the secret became valid. The `hint` field carries only the leading characters of the secret value, never the secret itself.","private":true,"min_provider_version":"11.0.28","defaults":"description expires keyId","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.policies":{"id":"microsoft.policies","name":"microsoft.policies","fields":{"activityBasedTimeoutPolicies":{"name":"activityBasedTimeoutPolicies","type":"\u0019\u001bmicrosoft.policies.activityBasedTimeoutPolicy","title":"Activity-based timeout policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"activityBasedTimeoutPolicy":{"name":"activityBasedTimeoutPolicy","type":"\u001bmicrosoft.policies.activityBasedTimeoutPolicy","title":"Microsoft Entra Activity-Based Timeout Policy","desc":"Activity-based timeout policy that automatically signs users out of web sessions after a period of inactivity. The `definition` field holds the JSON-encoded policy rules, and `isOrganizationDefault` marks whether this policy is the one enforced tenant-wide, which matters because only one policy of a given type can be active as the default.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"adminConsentRequestPolicy":{"name":"adminConsentRequestPolicy","type":"\u001bmicrosoft.adminConsentRequestPolicy","title":"Admin consent request policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"authenticationMethodsPolicy":{"name":"authenticationMethodsPolicy","type":"\u001bmicrosoft.authenticationMethodsPolicy","title":"Authentication methods policy","min_provider_version":"11.1.39","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"authorizationPolicy":{"name":"authorizationPolicy","type":"\n","title":"Authorization policy","desc":"Tenant authorization policy controlling default user permissions and external collaboration. Keys: `allowedToSignUpEmailBasedSubscriptions`, `allowedToUseSSPR` (self-service password reset), `allowEmailVerifiedUsersToJoinOrganization`, `allowInvitesFrom` (one of NONE, ADMINSANDGUESTINVITERS, ADMINSGUESTINVITERSANDALLMEMBERS, EVERYONE, UNKNOWNFUTUREVALUE), `blockMsolPowerShell`, `defaultUserRolePermissions`, `guestUserRoleId`, `displayName`, `description`, and `id`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"consentPolicySettings":{"name":"consentPolicySettings","type":"\n","title":"Consent policy settings","desc":"User-consent related directory group settings, keyed by the setting group display name. Each value is a map of that group's individual setting names to their configured values.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"crossTenantAccessPolicy":{"name":"crossTenantAccessPolicy","type":"\u001bmicrosoft.crossTenantAccessPolicyDefault","title":"Default configuration of cross-tenant access policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"defaultAppManagementPolicy":{"name":"defaultAppManagementPolicy","type":"\u001bmicrosoft.defaultAppManagementPolicy","title":"Tenant-wide default app management policy","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"externalIdentitiesPolicy":{"name":"externalIdentitiesPolicy","type":"\u001bmicrosoft.externalIdentitiesPolicy","title":"Tenant-wide policy that controls whether external users can leave a tenant","min_provider_version":"11.1.43","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identitySecurityDefaultsEnforcementPolicy":{"name":"identitySecurityDefaultsEnforcementPolicy","type":"\n","title":"Identity security default enforcement policy","desc":"Security defaults enforcement state for the tenant. Keys: `isEnabled` (whether Entra ID security defaults are turned on), `displayName`, and `description`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"permissionGrantPolicies":{"name":"permissionGrantPolicies","type":"\u0019\n","title":"Permission grant policies","desc":"Policies defining the conditions under which users may consent to applications that request access to organization data. Each entry has keys: `includes` and `excludes` (condition sets scoping client applications and the permissions they may be granted), `displayName`, `description`, and `id`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra ID Policies","desc":"Tenant-wide Microsoft Entra ID policy configuration that governs how identities, external users, application consent, and authentication methods are controlled across the organization. These policies define the baseline security posture for guest invitations, admin consent workflows, permission grants, session timeouts, and cross-tenant access, making them central to auditing an Entra tenant's hardening.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.policies.activityBasedTimeoutPolicy":{"id":"microsoft.policies.activityBasedTimeoutPolicy","name":"microsoft.policies.activityBasedTimeoutPolicy","fields":{"definition":{"name":"definition","type":"\u0019\u0007","is_mandatory":true,"title":"Policy definition","desc":"Each string is a JSON-encoded rule set describing the timeout behavior, such as the web session idle timeout duration and keep-alive settings.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Policy display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isOrganizationDefault":{"name":"isOrganizationDefault","type":"\u0004","is_mandatory":true,"title":"If set to true, activates this policy","desc":"There can be many policies for the same policy type, but only one can be activated as the organization default.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra Activity-Based Timeout Policy","desc":"Activity-based timeout policy that automatically signs users out of web sessions after a period of inactivity. The `definition` field holds the JSON-encoded policy rules, and `isOrganizationDefault` marks whether this policy is the one enforced tenant-wide, which matters because only one policy of a given type can be active as the default.","min_provider_version":"11.1.42","defaults":"displayName isOrganizationDefault","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.powerbi":{"id":"microsoft.powerbi","name":"microsoft.powerbi","fields":{"artifactAccess":{"name":"artifactAccess","type":"\u001bmicrosoft.powerbi.artifactAccess","title":"Power BI broadly shared artifact","desc":"Examine a Power BI report, dashboard, dataset, or other artifact that has broad sharing in effect — either published to the public web or shared with the entire organization. Each entry reports the artifact's `displayName` and `artifactType`, the `accessRight` granted, the `shareType`, and who shared it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"capacities":{"name":"capacities","type":"\u0019\u001bmicrosoft.powerbi.capacity","title":"Premium and Fabric capacities","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"capacity":{"name":"capacity","type":"\u001bmicrosoft.powerbi.capacity","title":"Power BI capacity","desc":"Examine a Premium or Fabric capacity provisioned in the tenant. Select a capacity by its `id`. Each capacity reports its `displayName`, `sku`, `state`, `region`, and the `admins` who manage it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"publishedToWeb":{"name":"publishedToWeb","type":"\u0019\u001bmicrosoft.powerbi.artifactAccess","title":"Reports and dashboards published to the public web","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharedToWholeOrganization":{"name":"sharedToWholeOrganization","type":"\u0019\u001bmicrosoft.powerbi.artifactAccess","title":"Reports and dashboards shared with the entire organization","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"tenantSetting":{"name":"tenantSetting","type":"\u001bmicrosoft.powerbi.tenantSetting","title":"Power BI tenant feature switch","desc":"Examine a single tenant-level Power BI governance setting — for example whether publishing reports to the web is allowed, whether users can export data, or whether service principals may call Power BI APIs. The `name` field is the API setting name (for example `PublishToWeb`) and selects the setting; `enabled` reports whether the feature is turned on; and when a setting is scoped to specific security groups, `enabledSecurityGroups` lists them.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"tenantSettings":{"name":"tenantSettings","type":"\u0019\u001bmicrosoft.powerbi.tenantSetting","title":"Tenant-wide Power BI feature switches","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"workspace":{"name":"workspace","type":"\u001bmicrosoft.powerbi.workspace","title":"Power BI workspace","desc":"Examine a Power BI workspace (also called a group) provisioned in the tenant. Select a workspace by its `id`. Each workspace reports its `name`, `type` (Workspace, PersonalGroup, or Group), `state` (Active, Deleted, or Orphaned), whether it runs on a dedicated capacity, the `capacity` backing it, and the `users` granted access along with their roles.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"workspaces":{"name":"workspaces","type":"\u0019\u001bmicrosoft.powerbi.workspace","title":"Workspaces provisioned in the tenant","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Power BI","desc":"Use this namespace to examine tenant-wide Power BI (Microsoft Fabric) governance posture. Exposes the tenant feature switches that control sharing and export (`tenantSettings`), the `workspaces` provisioned in the tenant and who has access to them, the `capacities` backing those workspaces, and the reports and dashboards that have broad exposure — either `publishedToWeb` or `sharedToWholeOrganization`. Data is collected through the Power BI admin REST APIs, which require the service principal to be granted read-only admin API access in the Power BI tenant settings.","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.powerbi.artifactAccess":{"id":"microsoft.powerbi.artifactAccess","name":"microsoft.powerbi.artifactAccess","fields":{"accessRight":{"name":"accessRight","type":"\u0007","is_mandatory":true,"title":"Access right granted, for example View","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"artifactId":{"name":"artifactId","type":"\u0007","is_mandatory":true,"title":"Artifact ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"artifactType":{"name":"artifactType","type":"\u0007","is_mandatory":true,"title":"Artifact type","desc":"One of Report, Dashboard, Dataset, Dataflow, or similar.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Artifact display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"shareType":{"name":"shareType","type":"\u0007","is_mandatory":true,"title":"Share type, for example Published or Shared","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharerDisplayName":{"name":"sharerDisplayName","type":"\u0007","is_mandatory":true,"title":"Display name of the user who shared the artifact","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharerEmailAddress":{"name":"sharerEmailAddress","type":"\u0007","is_mandatory":true,"title":"Email address of the user who shared the artifact","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Power BI broadly shared artifact","desc":"Examine a Power BI report, dashboard, dataset, or other artifact that has broad sharing in effect — either published to the public web or shared with the entire organization. Each entry reports the artifact's `displayName` and `artifactType`, the `accessRight` granted, the `shareType`, and who shared it.","private":true,"min_provider_version":"13.5.1","defaults":"artifactId displayName artifactType shareType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.powerbi.capacity":{"id":"microsoft.powerbi.capacity","name":"microsoft.powerbi.capacity","fields":{"admins":{"name":"admins","type":"\u0019\u0007","is_mandatory":true,"title":"Email addresses of the capacity administrators","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Capacity display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Capacity ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Region the capacity is provisioned in","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sku":{"name":"sku","type":"\u0007","is_mandatory":true,"title":"Capacity SKU, for example P1 or F64","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Capacity state, for example Active","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Power BI capacity","desc":"Examine a Premium or Fabric capacity provisioned in the tenant. Select a capacity by its `id`. Each capacity reports its `displayName`, `sku`, `state`, `region`, and the `admins` who manage it.","private":true,"min_provider_version":"13.5.1","defaults":"id displayName sku state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.powerbi.tenantSetting":{"id":"microsoft.powerbi.tenantSetting","name":"microsoft.powerbi.tenantSetting","fields":{"canSpecifySecurityGroups":{"name":"canSpecifySecurityGroups","type":"\u0004","is_mandatory":true,"title":"Whether the setting can be scoped to specific security groups","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the feature is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enabledSecurityGroups":{"name":"enabledSecurityGroups","type":"\u0019\n","is_mandatory":true,"title":"Security groups the setting applies to when scoped, each with graphId and name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"API name of the setting, for example PublishToWeb","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"tenantSettingGroup":{"name":"tenantSettingGroup","type":"\u0007","is_mandatory":true,"title":"Grouping the setting belongs to in the admin portal","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Human-readable title of the setting","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Power BI tenant feature switch","desc":"Examine a single tenant-level Power BI governance setting — for example whether publishing reports to the web is allowed, whether users can export data, or whether service principals may call Power BI APIs. The `name` field is the API setting name (for example `PublishToWeb`) and selects the setting; `enabled` reports whether the feature is turned on; and when a setting is scoped to specific security groups, `enabledSecurityGroups` lists them.","private":true,"min_provider_version":"13.5.1","defaults":"name title enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.powerbi.workspace":{"id":"microsoft.powerbi.workspace","name":"microsoft.powerbi.workspace","fields":{"capacity":{"name":"capacity","type":"\u001bmicrosoft.powerbi.capacity","title":"Capacity backing the workspace, when assigned to a dedicated capacity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Workspace description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Workspace ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isOnDedicatedCapacity":{"name":"isOnDedicatedCapacity","type":"\u0004","is_mandatory":true,"title":"Whether the workspace is assigned to a dedicated (Premium or Fabric) capacity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isReadOnly":{"name":"isReadOnly","type":"\u0004","is_mandatory":true,"title":"Whether the workspace is read-only","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Workspace name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Workspace state","desc":"One of Active, Deleted, Orphaned, or Removing.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Workspace type","desc":"One of Workspace, PersonalGroup, or Group.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"user":{"name":"user","type":"\u001bmicrosoft.powerbi.workspace.user","title":"Power BI workspace access grant","desc":"Examine a single user, group, or service principal granted access to a Power BI workspace, including the `accessRight` (Admin, Member, Contributor, or Viewer) and the `principalType` of the grantee.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bmicrosoft.powerbi.workspace.user","title":"Users and groups granted access to the workspace","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Power BI workspace","desc":"Examine a Power BI workspace (also called a group) provisioned in the tenant. Select a workspace by its `id`. Each workspace reports its `name`, `type` (Workspace, PersonalGroup, or Group), `state` (Active, Deleted, or Orphaned), whether it runs on a dedicated capacity, the `capacity` backing it, and the `users` granted access along with their roles.","private":true,"min_provider_version":"13.5.1","defaults":"id name type state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.powerbi.workspace.user":{"id":"microsoft.powerbi.workspace.user","name":"microsoft.powerbi.workspace.user","fields":{"accessRight":{"name":"accessRight","type":"\u0007","is_mandatory":true,"title":"Access right granted","desc":"One of Admin, Member, Contributor, or Viewer.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the grantee","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"emailAddress":{"name":"emailAddress","type":"\u0007","is_mandatory":true,"title":"Email address of the grantee, when the grantee is a user","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"graphId":{"name":"graphId","type":"\u0007","is_mandatory":true,"title":"Microsoft Graph object ID of the grantee","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Identifier of the grantee","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"principalType":{"name":"principalType","type":"\u0007","is_mandatory":true,"title":"Type of grantee","desc":"One of User, Group, or App.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Power BI workspace access grant","desc":"Examine a single user, group, or service principal granted access to a Power BI workspace, including the `accessRight` (Admin, Member, Contributor, or Viewer) and the `principalType` of the grantee.","private":true,"min_provider_version":"13.5.1","defaults":"emailAddress accessRight principalType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.rolemanagement":{"id":"microsoft.rolemanagement","name":"microsoft.rolemanagement","fields":{"roleDefinitions":{"name":"roleDefinitions","type":"\u001bmicrosoft.roles","title":"Role definitions","desc":"Deprecated in favor of `microsoft.roles`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"roleassignment":{"name":"roleassignment","type":"\u001bmicrosoft.rolemanagement.roleassignment","title":"Microsoft role assignment","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"roledefinition":{"name":"roledefinition","type":"\u001bmicrosoft.rolemanagement.roledefinition","title":"Microsoft role definition","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true}},"title":"Microsoft role management namespace","desc":"Deprecated in favor of `microsoft.roles`. This namespace previously exposed role definitions and assignments; use `microsoft.roles` for role definitions going forward.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"microsoft.rolemanagement.roleassignment":{"id":"microsoft.rolemanagement.roleassignment","name":"microsoft.rolemanagement.roleassignment","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Role assignment ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"principal":{"name":"principal","type":"\n","is_mandatory":true,"title":"Assigned directory principal","desc":"The directory object the role is assigned to, which may be a user, group, or service principal. The dict carries `id` (the principal's directory object ID) and `deletedDateTime` (when the object was soft-deleted, null for active principals). See principalType and principalName for the resolved type and display name.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"principalId":{"name":"principalId","type":"\u0007","is_mandatory":true,"title":"Service principal ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"principalName":{"name":"principalName","type":"\u0007","is_mandatory":true,"title":"Principal display name","desc":"Display name of the assigned principal as returned by the directory. Empty when the API does not return a display name.","min_provider_version":"13.7.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"principalType":{"name":"principalType","type":"\u0007","is_mandatory":true,"title":"Principal type","desc":"Short directory type of the assigned principal, derived from its `@odata.type`, typically `user`, `group`, or `servicePrincipal`. Empty when the API does not return the principal type. Use it to scope privileged-role audits, e.g. flag direct `user` assignments to Global Administrator.","min_provider_version":"13.7.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleDefinition":{"name":"roleDefinition","type":"\u001bmicrosoft.rolemanagement.roledefinition","title":"Role definition assigned","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleDefinitionId":{"name":"roleDefinitionId","type":"\u0007","is_mandatory":true,"title":"Role definition ID","desc":"Deprecated in favor of roleDefinition.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"}},"title":"Microsoft role assignment","private":true,"min_provider_version":"9.0.0","defaults":"id principalId","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.rolemanagement.roledefinition":{"id":"microsoft.rolemanagement.roledefinition","name":"microsoft.rolemanagement.roledefinition","fields":{"assignments":{"name":"assignments","type":"\u0019\u001bmicrosoft.rolemanagement.roleassignment","title":"List of role definition assignments","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Role definition description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Role definition display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Role definition ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isBuiltIn":{"name":"isBuiltIn","type":"\u0004","is_mandatory":true,"title":"Whether the role is built in","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the role is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"rolePermissions":{"name":"rolePermissions","type":"\u0019\n","is_mandatory":true,"title":"Role definition permissions","desc":"One entry per permission set granted by the role. Each dict carries `allowedResourceActions` (list of resource-action strings the role grants), `excludedResourceActions` (list of actions explicitly withheld), and `condition` (a scoping condition string, empty when none applies).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"templateId":{"name":"templateId","type":"\u0007","is_mandatory":true,"title":"Role definition template ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Role definition version","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft role definition","private":true,"min_provider_version":"9.0.0","defaults":"id displayName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.roles":{"id":"microsoft.roles","name":"microsoft.roles","fields":{"filter":{"name":"filter","type":"\u0007","is_mandatory":true,"title":"Filter roles by property values","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"list":{"name":"list","type":"\u0019\u001bmicrosoft.rolemanagement.roledefinition","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"search":{"name":"search","type":"\u0007","is_mandatory":true,"title":"Search roles by search phrases","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"init":{"args":[{"name":"filter","type":"\u0007","optional":true},{"name":"search","type":"\u0007","optional":true}]},"list_type":"\u001bmicrosoft.rolemanagement.roledefinition","title":"Microsoft Entra ID Role Definitions","desc":"Role definitions available in the tenant, both built-in and custom. Each entry is a microsoft.rolemanagement.roledefinition describing a directory role: the permissions it grants and the principals currently assigned to it. Query this to audit privileged access, for example who holds Global Administrator, and to review the permissions of custom roles. The optional filter and search arguments narrow the returned set.","min_provider_version":"11.1.15","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security":{"id":"microsoft.security","name":"microsoft.security","fields":{"alert":{"name":"alert","type":"\u001bmicrosoft.security.alert","title":"Microsoft Defender XDR Alert","desc":"A security alert raised by Microsoft Defender XDR. An alert represents a single detection of a suspicious or malicious activity. Its `severity`, `status`, `category`, `serviceSource`, and `detectionSource` (which Defender workload reported it), the analyst `classification` and `determination` assigned during review, the `mitreTechniques` it maps to, `recommendedActions`, and the activity timeline (`createdDateTime`, `firstActivityDateTime`, `lastActivityDateTime`, `resolvedDateTime`) describe the detection. Related alerts are correlated into an incident that the `incident` field links to.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"alerts":{"name":"alerts","type":"\u0019\u001bmicrosoft.security.alert","title":"Microsoft Defender XDR alerts","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"exchange":{"name":"exchange","type":"\u001bmicrosoft.security.exchange","title":"Exchange security settings","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"incident":{"name":"incident","type":"\u001bmicrosoft.security.incident","title":"Microsoft Defender XDR Incident","desc":"A security incident in Microsoft Defender XDR. An incident is a collection of correlated alerts that together describe an attack story. The aggregate `severity` and `status`, the analyst `classification` and `determination`, the owner it is `assignedTo`, the `summary`, applied `customTags`, and the full set of correlated `alerts` describe the incident. When `redirectIncidentId` is set the incident has been merged into another incident. The `alerts` field drills into the individual detections.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"incidents":{"name":"incidents","type":"\u0019\u001bmicrosoft.security.incident","title":"Microsoft Defender XDR incidents","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"informationProtection":{"name":"informationProtection","type":"\u001bmicrosoft.security.informationProtection","title":"Information protection settings","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"latestSecureScores":{"name":"latestSecureScores","type":"\u001bmicrosoft.security.securityscore","title":"Latest security score","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskDetection":{"name":"riskDetection","type":"\u001bmicrosoft.security.riskDetection","title":"Microsoft Entra ID Protection risk detection","desc":"A single risk detection raised by Microsoft Entra ID Protection. A detection records one risky event tied to a user or a sign-in, selected by its `id`. The `riskEventType` (for example `unfamiliarFeatures`, `anonymizedIPAddress`, `maliciousIPAddress`, or `leakedCredentials`), the `riskLevel` and `riskState`, `riskDetail`, the reporting `source`, and the `detectionTimingType` (realtime versus offline) describe the detection. The `activity` reports whether it relates to a sign-in or a user. Location is broken out into `ipAddress`, `city`, `state`, and `countryOrRegion`, and the `activityDateTime`, `detectedDateTime`, and `lastUpdatedDateTime` timestamps frame when it happened. The `user` field links to the affected `microsoft.user` record.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"riskDetections":{"name":"riskDetections","type":"\u0019\u001bmicrosoft.security.riskDetection","title":"Microsoft Entra ID Protection risk detections","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskyUser":{"name":"riskyUser","type":"\u001bmicrosoft.security.riskyUser","title":"Microsoft Entra ID Risky User","desc":"A Microsoft Entra ID Protection risky user entry, flagging an account that identity risk signals mark as potentially compromised. The `riskLevel` (low, medium, high, hidden, none) and `riskState` (none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised) report the current assessment, `riskDetail` explains the reason, and `isDeleted` and `isProcessing` report the account state. The `user` field links to the full `microsoft.user` record.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"riskyUsers":{"name":"riskyUsers","type":"\u0019\u001bmicrosoft.security.riskyUser","title":"List Microsoft Entra users who are at risk","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"secureScores":{"name":"secureScores","type":"\u0019\u001bmicrosoft.security.securityscore","title":"List of security scores","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"securityscore":{"name":"securityscore","type":"\u001bmicrosoft.security.securityscore","title":"Microsoft Secure Score","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true}},"title":"Microsoft Security","desc":"Microsoft 365 security posture and detections across the tenant. `secureScores` and `latestSecureScores` report Secure Score posture, `riskyUsers` and `riskDetections` surface Microsoft Entra ID Protection risk signals, `alerts` and `incidents` cover Microsoft Defender XDR detections, `exchange` exposes Exchange Online security settings, and `informationProtection` covers sensitivity label configuration.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security.alert":{"id":"microsoft.security.alert","name":"microsoft.security.alert","fields":{"alertWebUrl":{"name":"alertWebUrl","type":"\u0007","is_mandatory":true,"title":"Deep link to the alert in the Microsoft Defender portal","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"assignedTo":{"name":"assignedTo","type":"\u0007","is_mandatory":true,"title":"Owner the alert is assigned to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"categories":{"name":"categories","type":"\u0019\u0007","is_mandatory":true,"title":"All categories the alert is associated with","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"category":{"name":"category","type":"\u0007","is_mandatory":true,"title":"Primary category of the alert","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"classification":{"name":"classification","type":"\u0007","is_mandatory":true,"title":"Analyst classification (unknown, falsePositive, truePositive, informationalExpectedActivity)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"comments":{"name":"comments","type":"\u0019\n","is_mandatory":true,"title":"Analyst comments recorded on the alert","desc":"Each entry has `comment`, `createdByDisplayName`, and `createdDateTime`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"When the alert was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Alert description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"detectionSource":{"name":"detectionSource","type":"\u0007","is_mandatory":true,"title":"Detection technology or sensor that surfaced the alert","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"determination":{"name":"determination","type":"\u0007","is_mandatory":true,"title":"Analyst determination","desc":"One of: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedActivity, lineOfBusinessApplication.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"firstActivityDateTime":{"name":"firstActivityDateTime","type":"\t","is_mandatory":true,"title":"When the earliest activity associated with the alert occurred","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Alert ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"incident":{"name":"incident","type":"\u001bmicrosoft.security.incident","title":"Incident this alert is correlated into","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"incidentId":{"name":"incidentId","type":"\u0007","is_mandatory":true,"title":"ID of the incident this alert is correlated into","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastActivityDateTime":{"name":"lastActivityDateTime","type":"\t","is_mandatory":true,"title":"When the most recent activity associated with the alert occurred","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastUpdateDateTime":{"name":"lastUpdateDateTime","type":"\t","is_mandatory":true,"title":"When the alert was last updated","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mitreTechniques":{"name":"mitreTechniques","type":"\u0019\u0007","is_mandatory":true,"title":"MITRE ATT\u0026CK techniques the alert maps to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"providerAlertId":{"name":"providerAlertId","type":"\u0007","is_mandatory":true,"title":"Alert ID assigned by the detecting Defender service","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"recommendedActions":{"name":"recommendedActions","type":"\u0007","is_mandatory":true,"title":"Recommended remediation actions","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"resolvedDateTime":{"name":"resolvedDateTime","type":"\t","is_mandatory":true,"title":"When the alert was resolved","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"serviceSource":{"name":"serviceSource","type":"\u0007","is_mandatory":true,"title":"Defender service that generated the alert","desc":"One of: microsoftDefenderForEndpoint, microsoftDefenderForIdentity, microsoftDefenderForCloudApps, microsoftDefenderForOffice365, microsoft365Defender, aadIdentityProtection, microsoftAppGovernance, dataLossPrevention.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Severity (unknown, informational, low, medium, high)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (new, inProgress, resolved)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"systemTags":{"name":"systemTags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags applied by the system","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"ID of the tenant the alert belongs to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Alert title","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Defender XDR Alert","desc":"A security alert raised by Microsoft Defender XDR. An alert represents a single detection of a suspicious or malicious activity. Its `severity`, `status`, `category`, `serviceSource`, and `detectionSource` (which Defender workload reported it), the analyst `classification` and `determination` assigned during review, the `mitreTechniques` it maps to, `recommendedActions`, and the activity timeline (`createdDateTime`, `firstActivityDateTime`, `lastActivityDateTime`, `resolvedDateTime`) describe the detection. Related alerts are correlated into an incident that the `incident` field links to.","min_provider_version":"13.0.12","defaults":"title severity status category","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security.exchange":{"id":"microsoft.security.exchange","name":"microsoft.security.exchange","fields":{"antispam":{"name":"antispam","type":"\u001bmicrosoft.security.exchange.antispam","title":"Exchange antispam settings","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Security Exchange Settings","desc":"Exchange Online security configuration. `antispam` provides access to hosted connection filter policy settings.","min_provider_version":"11.1.43","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security.exchange.antispam":{"id":"microsoft.security.exchange.antispam","name":"microsoft.security.exchange.antispam","fields":{"hostedConnectionFilterPolicy":{"name":"hostedConnectionFilterPolicy","type":"\u001bmicrosoft.security.exchange.antispam.hostedConnectionFilterPolicy","title":"Hosted connection filter policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Security Exchange Antispam Settings","desc":"Exchange Online antispam configuration. `hostedConnectionFilterPolicy` controls IP allow and block lists and safe-list behavior for inbound connections.","min_provider_version":"11.1.43","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security.exchange.antispam.hostedConnectionFilterPolicy":{"id":"microsoft.security.exchange.antispam.hostedConnectionFilterPolicy","name":"microsoft.security.exchange.antispam.hostedConnectionFilterPolicy","fields":{"adminDisplayName":{"name":"adminDisplayName","type":"\u0007","is_mandatory":true,"title":"Admin display name for the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableSafeList":{"name":"enableSafeList","type":"\u0004","is_mandatory":true,"title":"Whether to use the safe list","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"Policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ipAllowList":{"name":"ipAllowList","type":"\u0019\u0007","is_mandatory":true,"title":"IP addresses that are always allowed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ipBlockList":{"name":"ipBlockList","type":"\u0019\u0007","is_mandatory":true,"title":"IP addresses that are always blocked","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Exchange Antispam Hosted Connection Filter Policy","desc":"Hosted connection filter policy that controls which external IP addresses are always allowed or always blocked for inbound email. `ipAllowList` and `ipBlockList` hold those addresses, `enableSafeList` reports whether Microsoft's curated safe sender list is consulted, and `identity` names the policy.","min_provider_version":"11.1.43","defaults":"identity enableSafeList","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security.incident":{"id":"microsoft.security.incident","name":"microsoft.security.incident","fields":{"alerts":{"name":"alerts","type":"\u0019\u001bmicrosoft.security.alert","title":"Alerts correlated into this incident","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"assignedTo":{"name":"assignedTo","type":"\u0007","is_mandatory":true,"title":"Owner the incident is assigned to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"classification":{"name":"classification","type":"\u0007","is_mandatory":true,"title":"Analyst classification (unknown, falsePositive, truePositive, informationalExpectedActivity)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"comments":{"name":"comments","type":"\u0019\n","is_mandatory":true,"title":"Analyst comments recorded on the incident","desc":"Each entry has `comment`, `createdByDisplayName`, and `createdDateTime`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"When the incident was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"customTags":{"name":"customTags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags applied by analysts","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Incident description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"determination":{"name":"determination","type":"\u0007","is_mandatory":true,"title":"Analyst determination","desc":"One of: unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedAccount, phishing, maliciousUserActivity, notMalicious, notEnoughDataToValidate, confirmedActivity, lineOfBusinessApplication.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Incident display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Incident ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"incidentWebUrl":{"name":"incidentWebUrl","type":"\u0007","is_mandatory":true,"title":"Deep link to the incident in the Microsoft Defender portal","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastModifiedBy":{"name":"lastModifiedBy","type":"\u0007","is_mandatory":true,"title":"Identity that last modified the incident","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastUpdateDateTime":{"name":"lastUpdateDateTime","type":"\t","is_mandatory":true,"title":"When the incident was last updated","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"redirectIncidentId":{"name":"redirectIncidentId","type":"\u0007","is_mandatory":true,"title":"ID of the incident this incident was merged into","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Severity (unknown, informational, low, medium, high)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status (active, resolved, inProgress, redirected, awaitingAction)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"summary":{"name":"summary","type":"\u0007","is_mandatory":true,"title":"Incident summary","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"systemTags":{"name":"systemTags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags applied by the system","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"ID of the tenant the incident belongs to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Defender XDR Incident","desc":"A security incident in Microsoft Defender XDR. An incident is a collection of correlated alerts that together describe an attack story. The aggregate `severity` and `status`, the analyst `classification` and `determination`, the owner it is `assignedTo`, the `summary`, applied `customTags`, and the full set of correlated `alerts` describe the incident. When `redirectIncidentId` is set the incident has been merged into another incident. The `alerts` field drills into the individual detections.","min_provider_version":"13.0.12","defaults":"displayName severity status","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security.informationProtection":{"id":"microsoft.security.informationProtection","name":"microsoft.security.informationProtection","fields":{"sensitivityLabel":{"name":"sensitivityLabel","type":"\u001bmicrosoft.security.informationProtection.sensitivityLabel","title":"Microsoft Purview Sensitivity Label","desc":"A sensitivity label defined in Microsoft Purview Information Protection, used to classify and protect content by sensitivity. `contentFormats` lists where the label applies (file, email, teamwork), `hasProtection` reports whether encryption or rights protection is attached, `isAppliable` and `isActive` report availability, and `sensitivity` orders labels (lower number means less sensitive). Hierarchical labels reference a `parent` label.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"sensitivityLabels":{"name":"sensitivityLabels","type":"\u0019\u001bmicrosoft.security.informationProtection.sensitivityLabel","title":"List of sensitivity labels","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Purview Information Protection","desc":"Microsoft Purview Information Protection configuration. `sensitivityLabels` lists the sensitivity labels defined in the tenant for classifying and protecting content.","min_provider_version":"11.1.99","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security.informationProtection.sensitivityLabel":{"id":"microsoft.security.informationProtection.sensitivityLabel","name":"microsoft.security.informationProtection.sensitivityLabel","fields":{"color":{"name":"color","type":"\u0007","is_mandatory":true,"title":"UI display color (e.g., \"#EAA300\")","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"contentFormats":{"name":"contentFormats","type":"\u0019\u0007","is_mandatory":true,"title":"Supported content formats (e.g., file, email, teamwork)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the label","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"hasProtection":{"name":"hasProtection","type":"\u0004","is_mandatory":true,"title":"Whether the label has protection enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier for the sensitivity label","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isActive":{"name":"isActive","type":"\u0004","is_mandatory":true,"title":"Whether the label is active","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isAppliable":{"name":"isAppliable","type":"\u0004","is_mandatory":true,"title":"Whether the label can be applied to content","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the label","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"parent":{"name":"parent","type":"\u001bmicrosoft.security.informationProtection.sensitivityLabel","is_mandatory":true,"title":"Parent label in the hierarchy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sensitivity":{"name":"sensitivity","type":"\u0005","is_mandatory":true,"title":"Sensitivity level (lower number = less sensitive)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"toolTip":{"name":"toolTip","type":"\u0007","is_mandatory":true,"title":"Tooltip displayed in UI","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Purview Sensitivity Label","desc":"A sensitivity label defined in Microsoft Purview Information Protection, used to classify and protect content by sensitivity. `contentFormats` lists where the label applies (file, email, teamwork), `hasProtection` reports whether encryption or rights protection is attached, `isAppliable` and `isActive` report availability, and `sensitivity` orders labels (lower number means less sensitive). Hierarchical labels reference a `parent` label.","min_provider_version":"11.1.99","defaults":"id name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security.riskDetection":{"id":"microsoft.security.riskDetection","name":"microsoft.security.riskDetection","fields":{"activity":{"name":"activity","type":"\u0007","is_mandatory":true,"title":"Activity the detection relates to (signin, user, unknownFutureValue)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"activityDateTime":{"name":"activityDateTime","type":"\t","is_mandatory":true,"title":"Time of the activity that triggered the detection","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"additionalInfo":{"name":"additionalInfo","type":"\u0007","is_mandatory":true,"title":"Additional detection details as a JSON string","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"city":{"name":"city","type":"\u0007","is_mandatory":true,"title":"City the activity originated from","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"correlationId":{"name":"correlationId","type":"\u0007","is_mandatory":true,"title":"Correlation identifier for the activity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"countryOrRegion":{"name":"countryOrRegion","type":"\u0007","is_mandatory":true,"title":"Country or region the activity originated from","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"detectedDateTime":{"name":"detectedDateTime","type":"\t","is_mandatory":true,"title":"Time the risk was detected","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"detectionTimingType":{"name":"detectionTimingType","type":"\u0007","is_mandatory":true,"title":"Detection timing (notDefined, realtime, nearRealtime, offline, unknownFutureValue)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Risk detection ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"IP address of the activity that triggered the detection","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastUpdatedDateTime":{"name":"lastUpdatedDateTime","type":"\t","is_mandatory":true,"title":"Time the detection was last updated","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskDetail":{"name":"riskDetail","type":"\u0007","is_mandatory":true,"title":"Risk detail","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskEventType":{"name":"riskEventType","type":"\u0007","is_mandatory":true,"title":"Type of risk event detected (for example unfamiliarFeatures, anonymizedIPAddress, maliciousIPAddress, leakedCredentials, unlikelyTravel)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskLevel":{"name":"riskLevel","type":"\u0007","is_mandatory":true,"title":"Risk level (low, medium, high, hidden, none, unknownFutureValue)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskState":{"name":"riskState","type":"\u0007","is_mandatory":true,"title":"Risk state (none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Source that reported the detection","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"State or province the activity originated from","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"user":{"name":"user","type":"\u001bmicrosoft.user","title":"Affected user","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userDisplayName":{"name":"userDisplayName","type":"\u0007","is_mandatory":true,"title":"Display name of the affected user","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userPrincipalName":{"name":"userPrincipalName","type":"\u0007","is_mandatory":true,"title":"User principal name of the affected user","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra ID Protection risk detection","desc":"A single risk detection raised by Microsoft Entra ID Protection. A detection records one risky event tied to a user or a sign-in, selected by its `id`. The `riskEventType` (for example `unfamiliarFeatures`, `anonymizedIPAddress`, `maliciousIPAddress`, or `leakedCredentials`), the `riskLevel` and `riskState`, `riskDetail`, the reporting `source`, and the `detectionTimingType` (realtime versus offline) describe the detection. The `activity` reports whether it relates to a sign-in or a user. Location is broken out into `ipAddress`, `city`, `state`, and `countryOrRegion`, and the `activityDateTime`, `detectedDateTime`, and `lastUpdatedDateTime` timestamps frame when it happened. The `user` field links to the affected `microsoft.user` record.","min_provider_version":"13.3.1","defaults":"riskEventType riskLevel riskState detectedDateTime","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security.riskyUser":{"id":"microsoft.security.riskyUser","name":"microsoft.security.riskyUser","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Risky user ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isDeleted":{"name":"isDeleted","type":"\u0004","is_mandatory":true,"title":"Whether the user account has been deleted","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isProcessing":{"name":"isProcessing","type":"\u0004","is_mandatory":true,"title":"Whether the backend is processing the user's risky state","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastUpdatedAt":{"name":"lastUpdatedAt","type":"\t","is_mandatory":true,"title":"Risk last updated","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"User name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"principalName":{"name":"principalName","type":"\u0007","is_mandatory":true,"title":"User principal","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskDetail":{"name":"riskDetail","type":"\u0007","is_mandatory":true,"title":"Risk detail","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskLevel":{"name":"riskLevel","type":"\u0007","is_mandatory":true,"title":"Risk level (low, medium, high, hidden, none, unknownFutureValue)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskState":{"name":"riskState","type":"\u0007","is_mandatory":true,"title":"Risk state (none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"user":{"name":"user","type":"\u001bmicrosoft.user","title":"Entra User","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra ID Risky User","desc":"A Microsoft Entra ID Protection risky user entry, flagging an account that identity risk signals mark as potentially compromised. The `riskLevel` (low, medium, high, hidden, none) and `riskState` (none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised) report the current assessment, `riskDetail` explains the reason, and `isDeleted` and `isProcessing` report the account state. The `user` field links to the full `microsoft.user` record.","min_provider_version":"11.0.29","defaults":"principalName riskLevel riskState lastUpdatedAt","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security.securityscore":{"id":"microsoft.security.securityscore","name":"microsoft.security.securityscore","fields":{"activeUserCount":{"name":"activeUserCount","type":"\u0005","is_mandatory":true,"title":"Secure Score active user count","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"averageComparativeScores":{"name":"averageComparativeScores","type":"\u0019\n","is_mandatory":true,"title":"Average comparative scores","desc":"Each entry has `averageScore` (average score within the basis) and `basis` (comparison scope: AllTenants, TotalSeats, or IndustryTypes).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"azureTenantId":{"name":"azureTenantId","type":"\u0007","is_mandatory":true,"title":"Secure Score tenant ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"controlScore":{"name":"controlScore","type":"\u001bmicrosoft.security.securityscore.controlScore","title":"Microsoft Secure Score control score","desc":"A single security control's contribution to the tenant Secure Score. Exposes the `controlName`, the `controlCategory` (Identity, Data, Device, Apps, Infrastructure), the human-readable `description`, and the tenant-achieved `score` for the control.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"controlScores":{"name":"controlScores","type":"\u0019\n","is_mandatory":true,"title":"Secure Score control scores as raw dictionaries","desc":"Deprecated in favor of `controls`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"controls":{"name":"controls","type":"\u0019\u001bmicrosoft.security.securityscore.controlScore","is_mandatory":true,"title":"Per-control score breakdown for the Secure Score","desc":"Each entry exposes the control's `controlName`, `controlCategory`, `description`, and tenant-achieved `score`.","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Secure Score creation time","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"currentScore":{"name":"currentScore","type":"\u0006","is_mandatory":true,"title":"Secure Score current score","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enabledServices":{"name":"enabledServices","type":"\u0019\u0007","is_mandatory":true,"title":"Secure Score enabled services","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Secure Score ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"licensedUserCount":{"name":"licensedUserCount","type":"\u0005","is_mandatory":true,"title":"Secure Score licensed user count","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"maxScore":{"name":"maxScore","type":"\u0006","is_mandatory":true,"title":"Secure Score max score","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"vendorInformation":{"name":"vendorInformation","type":"\n","is_mandatory":true,"title":"Vendor information","desc":"Identifies the security product behind the score, with `provider`, `providerVersion`, `subProvider`, and `vendor`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Secure Score","private":true,"min_provider_version":"9.0.0","defaults":"id azureTenantId","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.security.securityscore.controlScore":{"id":"microsoft.security.securityscore.controlScore","name":"microsoft.security.securityscore.controlScore","fields":{"controlCategory":{"name":"controlCategory","type":"\u0007","is_mandatory":true,"title":"Control action category (Identity, Data, Device, Apps, Infrastructure)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"controlName":{"name":"controlName","type":"\u0007","is_mandatory":true,"title":"Control unique name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the control","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"score":{"name":"score","type":"\u0006","is_mandatory":true,"title":"Tenant-achieved score for the control","desc":"Varies day to day depending on tenant operations on the control.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Secure Score control score","desc":"A single security control's contribution to the tenant Secure Score. Exposes the `controlName`, the `controlCategory` (Identity, Data, Device, Apps, Infrastructure), the human-readable `description`, and the tenant-achieved `score` for the control.","private":true,"min_provider_version":"13.6.1","defaults":"controlName score","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.serviceprincipal":{"id":"microsoft.serviceprincipal","name":"microsoft.serviceprincipal","fields":{"accountEnabled":{"name":"accountEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the service principal account is enabled","desc":"Deprecated in favor of `enabled`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"alternativeNames":{"name":"alternativeNames","type":"\u0019\u0007","is_mandatory":true,"title":"Alternative names for the service principal","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"appDescription":{"name":"appDescription","type":"\u0007","is_mandatory":true,"title":"Description provided by the associated application","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"appId":{"name":"appId","type":"\u0007","is_mandatory":true,"title":"Application ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"appOwnerOrganizationId":{"name":"appOwnerOrganizationId","type":"\u0007","is_mandatory":true,"title":"Application owner ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"appRoleAssignmentRequired":{"name":"appRoleAssignmentRequired","type":"\u0004","is_mandatory":true,"title":"App role assignment required","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"appRoles":{"name":"appRoles","type":"\u0019\u001bmicrosoft.application.role","is_mandatory":true,"title":"Application roles","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"applicationTemplateId":{"name":"applicationTemplateId","type":"\u0007","is_mandatory":true,"title":"Application template ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"assignment":{"name":"assignment","type":"\u001bmicrosoft.serviceprincipal.assignment","title":"Microsoft Service Principal Assignment","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"assignmentRequired":{"name":"assignmentRequired","type":"\u0004","is_mandatory":true,"title":"Whether users or other apps must be assigned to this service principal before using it","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"assignments":{"name":"assignments","type":"\u0019\u001bmicrosoft.serviceprincipal.assignment","is_mandatory":true,"title":"List of users and groups assigned to this service principal","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Application description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"disabledByMicrosoftStatus":{"name":"disabledByMicrosoftStatus","type":"\u0007","is_mandatory":true,"title":"Status set when Microsoft has disabled the service principal","desc":"Empty (null) for active service principals, otherwise a status string such as `DisabledDueToViolationOfServicesAgreement`.","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether users can sign into the service principal (application)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"homepageUrl":{"name":"homepageUrl","type":"\u0007","is_mandatory":true,"title":"Service principal homepage URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Service principal Object ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isFirstParty":{"name":"isFirstParty","type":"\u0004","title":"Whether it is a first-party Microsoft application","desc":"True when the service principal is owned by Microsoft, derived from `appOwnerOrganizationId` matching a Microsoft tenant (or being empty, as with some built-in connectors). Useful for filtering out built-in Microsoft applications when auditing third-party access.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"keyCredentials":{"name":"keyCredentials","type":"\u0019\u001bmicrosoft.keyCredential","is_mandatory":true,"title":"X.509 key credentials registered on the service principal for authentication","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"loginUrl":{"name":"loginUrl","type":"\u0007","is_mandatory":true,"title":"Login URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"logoutUrl":{"name":"logoutUrl","type":"\u0007","is_mandatory":true,"title":"Logout URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service principal name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notes":{"name":"notes","type":"\u0007","is_mandatory":true,"title":"Service principal notes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notificationEmailAddresses":{"name":"notificationEmailAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Notification email addresses","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"oauth2PermissionScopes":{"name":"oauth2PermissionScopes","type":"\u0019\n","is_mandatory":true,"title":"Delegated permission scopes this service principal exposes to client applications","desc":"Each entry is a dict with keys `id`, `value` (the scope string clients request, such as `User.Read`), `type` (`User` or `Admin`, indicating whether user or admin consent is required), `origin`, `isEnabled`, `adminConsentDisplayName`, `adminConsentDescription`, `userConsentDisplayName`, and `userConsentDescription`.","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"passwordCredentials":{"name":"passwordCredentials","type":"\u0019\u001bmicrosoft.passwordCredential","is_mandatory":true,"title":"Client secrets registered on the service principal for authentication","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"permissions":{"name":"permissions","type":"\u0019\u001bmicrosoft.application.permission","title":"API permissions and scopes assigned to this service principal","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"preferredSingleSignOnMode":{"name":"preferredSingleSignOnMode","type":"\u0007","is_mandatory":true,"title":"Preferred single sign-on mode","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"replyUrls":{"name":"replyUrls","type":"\u0019\u0007","is_mandatory":true,"title":"Service principal reply URLs","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"servicePrincipalNames":{"name":"servicePrincipalNames","type":"\u0019\u0007","is_mandatory":true,"title":"Service principal names","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"signInAudience":{"name":"signInAudience","type":"\u0007","is_mandatory":true,"title":"Sign in audience","desc":"Account types that can sign in to the associated application. One of `AzureADMyOrg` (single tenant), `AzureADMultipleOrgs` (multi-tenant), `AzureADandPersonalMicrosoftAccount`, or `PersonalMicrosoftAccount`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Service principal tags","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"termsOfServiceUrl":{"name":"termsOfServiceUrl","type":"\u0007","is_mandatory":true,"title":"Service principal terms of service URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Service principal type","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"verifiedPublisher":{"name":"verifiedPublisher","type":"\n","is_mandatory":true,"title":"Verified publisher of the associated application","desc":"Publisher verification details as a dict with keys `name` (the verified publisher's display name), `verifiedPublisherId`, and `createdAt` (when the verification was added). Empty when the application's publisher has not been verified.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"visibleToUsers":{"name":"visibleToUsers","type":"\u0004","is_mandatory":true,"title":"Whether the service principal is visible to users","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra Service Principal","desc":"Service principal (enterprise application) registered in the tenant, representing an application's identity and the access it has been granted. Service principals govern which applications can sign in, what API permissions and app roles they hold, and which users and groups are assigned to them, making them a central surface for auditing both third-party and internally registered application access. Use `isFirstParty` to distinguish Microsoft-owned service principals from those added by the tenant, and `enabled` to check whether sign-in is permitted.","min_provider_version":"9.0.0","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.serviceprincipal.assignment":{"id":"microsoft.serviceprincipal.assignment","name":"microsoft.serviceprincipal.assignment","fields":{"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Service Principal Assignment name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Service Principal Assignment ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Service Principal Assignment type","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Service Principal Assignment","private":true,"min_provider_version":"9.0.9","defaults":"id","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.setting":{"id":"microsoft.setting","name":"microsoft.setting","fields":{"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the setting","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"templateId":{"name":"templateId","type":"\u0007","is_mandatory":true,"title":"Template ID of the setting","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"values":{"name":"values","type":"\u0019\u001bmicrosoft.settingValue","is_mandatory":true,"title":"Setting values","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Group Setting","desc":"Directory-level group setting applied across the tenant, identified by its `templateId` and `displayName`. Each setting carries a list of `values` that control group behavior such as guest access, self-service group creation, and naming policies. Audit these to confirm that group governance matches your organization's requirements.","min_provider_version":"11.1.68","defaults":"displayName values","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.settingValue":{"id":"microsoft.settingValue","name":"microsoft.settingValue","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the setting value","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Value of the setting","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Group Setting Value","desc":"A single name/value pair within a `microsoft.setting`. The `name` identifies the specific setting key (for example, `AllowGuestsToBeGroupOwner`) and `value` holds its current string representation, which governs group behavior such as guest access, group creation limits, or naming policies.","min_provider_version":"11.1.68","defaults":"name value","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.systemCredentialPreferences":{"id":"microsoft.systemCredentialPreferences","name":"microsoft.systemCredentialPreferences","fields":{"excludeTargets":{"name":"excludeTargets","type":"\u0019\n","is_mandatory":true,"title":"Groups excluded from the policy","desc":"Each entry is a dict with `id` (the group object ID) and `targetType` (the kind of target, for example `group`).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"includeTargets":{"name":"includeTargets","type":"\u0019\n","is_mandatory":true,"title":"Groups the policy applies to","desc":"Each entry is a dict with `id` (the group object ID) and `targetType` (the kind of target, for example `group`).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"The state of the system credential preferences. Possible values are: enabled, disabled, default.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"System credential preferences for the authentication methods policy","desc":"Tenant-wide setting that controls whether users are nudged toward system-preferred credentials (the strongest authentication method registered for their account, such as passwordless or push-based sign-in over SMS or voice call) during sign-in. The `state` field reports whether the nudge is on, off, or following the Microsoft-managed default, and `includeTargets`/`excludeTargets` scope it to specific groups. Audit this to confirm that users are steered to phishing-resistant methods rather than weaker ones.","private":true,"min_provider_version":"11.1.99","defaults":"state","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.tenant":{"id":"microsoft.tenant","name":"microsoft.tenant","fields":{"assignedPlans":{"name":"assignedPlans","type":"\u0019\n","is_mandatory":true,"title":"Service plans associated with the tenant","desc":"Each entry has keys `service` (the service family, such as `AADPremiumService` or `exchange`), `capabilityStatus` (one of `Enabled`, `Warning`, `Suspended`, `Deleted`, or `LockedOut`), `servicePlanId` (the plan GUID), and `assignedDateTime`. See `enabledServicePlans` for the distinct list of enabled service families.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"branding":{"name":"branding","type":"\u0019\u001bmicrosoft.tenant.brandingInfo","title":"Tenant branding information for all verified domains","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"brandingInfo":{"name":"brandingInfo","type":"\u001bmicrosoft.tenant.brandingInfo","title":"Tenant branding information","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"countryLetterCode":{"name":"countryLetterCode","type":"\u0007","is_mandatory":true,"title":"Country or region abbreviation for the tenant (ISO 3166-2)","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Tenant creation date","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Tenant creation date and time","desc":"Deprecated in favor of `createdAt`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"enabledServicePlans":{"name":"enabledServicePlans","type":"\u0019\u0007","title":"Enabled service families on the tenant","desc":"Distinct list of `service` names from `assignedPlans` whose `capabilityStatus` is `Enabled`, sorted alphabetically. Use this to gate license-dependent checks without digging through the `assignedPlans` dicts, for example `microsoft.tenant.enabledServicePlans.contains(\"AADPremiumService\")` to confirm Microsoft Entra ID P1/P2 is active.","min_provider_version":"13.7.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"formsSettings":{"name":"formsSettings","type":"\u001bmicrosoft.tenantFormsSettings","title":"Company-wide settings for Microsoft Forms","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Organization ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tenant display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"onPremisesSyncEnabled":{"name":"onPremisesSyncEnabled","type":"\u0004","is_mandatory":true,"title":"Whether password hash sync is enabled for hybrid deployments","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"paidLicenses":{"name":"paidLicenses","type":"\u0005","title":"Total billed license seats","desc":"Sum of `totalLicenses` across non-trial subscriptions that are still being billed (status `Enabled` or `Warning`, the post-expiry grace period). Suspended, deleted, and locked-out subscriptions are excluded.","min_provider_version":"13.9.3","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"preferredLanguage":{"name":"preferredLanguage","type":"\u0007","is_mandatory":true,"title":"Preferred language","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"privacyProfile":{"name":"privacyProfile","type":"\n","is_mandatory":true,"title":"Privacy profile data with contact email and statement URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"provisionedPlans":{"name":"provisionedPlans","type":"\u0019\n","is_mandatory":true,"title":"Provisioned plans","desc":"Each entry has keys `service` (the service family, such as `SharePoint` or `exchange`) and `capabilityStatus` (one of `Enabled`, `Warning`, `Suspended`, `Deleted`, or `LockedOut`).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"realm":{"name":"realm","type":"\u0019\u001bmicrosoft.tenant.realmInfo","title":"Tenant realm information for all verified domains","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"realmInfo":{"name":"realmInfo","type":"\u001bmicrosoft.tenant.realmInfo","title":"Tenant realm information","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"securityComplianceNotificationMails":{"name":"securityComplianceNotificationMails","type":"\u0019\u0007","is_mandatory":true,"title":"List of security compliance notification email addresses","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"securityComplianceNotificationPhones":{"name":"securityComplianceNotificationPhones","type":"\u0019\u0007","is_mandatory":true,"title":"List of security compliance notification phone numbers","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"settings":{"name":"settings","type":"\u001bmicrosoft.tenantSettings","title":"Company-wide settings for apps and services.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"subscriptions":{"name":"subscriptions","type":"\u0019\n","title":"Commercial subscriptions","desc":"Each entry has keys `id`, `skuPartNumber` (the license SKU, such as `ENTERPRISEPREMIUM`), `status` (one of `Enabled`, `Warning`, `Suspended`, `Deleted`, or `LockedOut`), `isTrial`, `totalLicenses`, `createdAt`, and `servicePlans` (each with `servicePlanId`, `servicePlanName`, `provisioningStatus`, and `appliesTo`).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"technicalNotificationMails":{"name":"technicalNotificationMails","type":"\u0019\u0007","is_mandatory":true,"title":"List of technical notification mails","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Tenant type","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"verifiedDomains":{"name":"verifiedDomains","type":"\u0019\n","is_mandatory":true,"title":"Organization verified domains","desc":"Each entry has keys `name` (the domain name), `type` (`Managed` or `Federated`), `capabilities` (comma-separated services associated with the domain, such as `Email` or `OfficeCommunicationsOnline`), `isDefault` (the primary domain new users are assigned to), and `isInitial` (the tenant's original `*.onmicrosoft.com` domain).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra Tenant","desc":"Configuration of the connected Microsoft Entra ID (Azure AD) tenant. Exposes the tenant's `name`, `id`, `type`, verified domains, provisioned plans, on-premises sync status, privacy profile, technical notification contacts, and security compliance notification addresses. Related resources include `settings`, `formsSettings`, `realm`, and `branding`.","min_provider_version":"11.0.29","defaults":"name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.tenant.brandingInfo":{"id":"microsoft.tenant.brandingInfo","name":"microsoft.tenant.brandingInfo","fields":{"backgroundColor":{"name":"backgroundColor","type":"\u0007","is_mandatory":true,"title":"Tenant branding background color","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"bannerLogo":{"name":"bannerLogo","type":"\u0007","is_mandatory":true,"title":"Tenant branding logo URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"domainName":{"name":"domainName","type":"\u0007","is_mandatory":true,"title":"Domain name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"keepMeSignedInDisabled":{"name":"keepMeSignedInDisabled","type":"\u0004","is_mandatory":true,"title":"if \"Keep me signed in\" is disabled for the tenant","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"useTransparentLightbox":{"name":"useTransparentLightbox","type":"\u0004","is_mandatory":true,"title":"Transparent light box","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Tenant branding information","private":true,"min_provider_version":"11.1.76","defaults":"keepMeSignedInDisabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.tenant.realmInfo":{"id":"microsoft.tenant.realmInfo","name":"microsoft.tenant.realmInfo","fields":{"domainName":{"name":"domainName","type":"\u0007","is_mandatory":true,"title":"Domain name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"federationBrandName":{"name":"federationBrandName","type":"\u0007","is_mandatory":true,"title":"Tenant federation brand name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"login":{"name":"login","type":"\u0007","is_mandatory":true,"title":"Login endpoint","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"nameSpaceType":{"name":"nameSpaceType","type":"\u0007","is_mandatory":true,"title":"Namespace Type","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Tenant realm information","private":true,"min_provider_version":"11.1.76","defaults":"login nameSpaceType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.tenantFormsSettings":{"id":"microsoft.tenantFormsSettings","name":"microsoft.tenantFormsSettings","fields":{"isBingImageSearchEnabled":{"name":"isBingImageSearchEnabled","type":"\u0004","is_mandatory":true,"title":"Controls whether users can add images from Bing to forms","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isExternalSendFormEnabled":{"name":"isExternalSendFormEnabled","type":"\u0004","is_mandatory":true,"title":"Controls whether users can send a link to a form to an external user","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isExternalShareCollaborationEnabled":{"name":"isExternalShareCollaborationEnabled","type":"\u0004","is_mandatory":true,"title":"Controls whether users can collaborate on a form layout and structure with an external user","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isExternalShareResultEnabled":{"name":"isExternalShareResultEnabled","type":"\u0004","is_mandatory":true,"title":"Controls whether users can share form results with external users","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isExternalShareTemplateEnabled":{"name":"isExternalShareTemplateEnabled","type":"\u0004","is_mandatory":true,"title":"Controls whether users can share form templates with external users","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isInOrgFormsPhishingScanEnabled":{"name":"isInOrgFormsPhishingScanEnabled","type":"\u0004","is_mandatory":true,"title":"Controls whether phishing protection is run on forms created by users","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isRecordIdentityByDefaultEnabled":{"name":"isRecordIdentityByDefaultEnabled","type":"\u0004","is_mandatory":true,"title":"Controls whether the names of users who fill out forms are recorded","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Company-wide settings for Microsoft Forms","desc":"Organization-level controls that govern how Microsoft Forms can be shared, collected, and protected across the tenant. The boolean fields determine whether forms, results, and templates can leave the organization (external sending, sharing, and collaboration), whether respondent identities are recorded, whether Bing image search is available inside forms, and whether phishing scanning runs on user-created forms. Audit these to confirm data-sharing and anti-phishing controls match your data-governance policy.","private":true,"min_provider_version":"11.1.43","defaults":"isExternalSendFormEnabled isBingImageSearchEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.tenantSettings":{"id":"microsoft.tenantSettings","name":"microsoft.tenantSettings","fields":{"isAppAndServicesTrialEnabled":{"name":"isAppAndServicesTrialEnabled","type":"\u0004","is_mandatory":true,"title":"Controls whether users can start trial subscriptions for apps and services in your organization.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isOfficeStoreEnabled":{"name":"isOfficeStoreEnabled","type":"\u0004","is_mandatory":true,"title":"Controls whether users can access the Microsoft Store","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Company-wide configuration for apps and services.","private":true,"min_provider_version":"11.1.43","defaults":"isAppAndServicesTrialEnabled isOfficeStoreEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.user":{"id":"microsoft.user","name":"microsoft.user","fields":{"accountEnabled":{"name":"accountEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the user account is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"assignedLicense":{"name":"assignedLicense","type":"\u001bmicrosoft.user.assignedLicense","title":"A single license assigned to a user","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"assignedLicenses":{"name":"assignedLicenses","type":"\u0019\u001bmicrosoft.user.assignedLicense","is_mandatory":true,"title":"The licenses that are assigned to the user, including inherited (group-based) licenses","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"auditlog":{"name":"auditlog","type":"\u001bmicrosoft.user.auditlog","title":"The user's audit log","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"authMethods":{"name":"authMethods","type":"\u001bmicrosoft.user.authenticationMethods","title":"User's configured authentication methods (passwords, MFA, security keys, etc.)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"authenticationMethods":{"name":"authenticationMethods","type":"\u001bmicrosoft.user.authenticationMethods","title":"Microsoft Entra authentication methods","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"authenticationRequirements":{"name":"authenticationRequirements","type":"\u001bmicrosoft.user.authenticationRequirements","title":"Authentication requirements information","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"city":{"name":"city","type":"\u0007","is_mandatory":true,"title":"User city","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"companyName":{"name":"companyName","type":"\u0007","is_mandatory":true,"title":"User company name","desc":"Deprecated in favor of `job.companyName`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"contact":{"name":"contact","type":"\n","title":"User's postal address and contact details","desc":"Dict with keys `streetAddress`, `city`, `state`, `postalCode`, `country`, `BusinessPhones`, `mobilePhone`, `email`, `otherMails`, `faxNumber`, and `mailNickname`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"country":{"name":"country","type":"\u0007","is_mandatory":true,"title":"User country","desc":"Deprecated in favor of `contact.country`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"User create time","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"creationType":{"name":"creationType","type":"\u0007","is_mandatory":true,"title":"The user's creation type","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"department":{"name":"department","type":"\u0007","is_mandatory":true,"title":"User department","desc":"Deprecated in favor of `job.department`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"User display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"employeeHireDate":{"name":"employeeHireDate","type":"\t","is_mandatory":true,"title":"The date and time when the user was hired","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"employeeId":{"name":"employeeId","type":"\u0007","is_mandatory":true,"title":"User employee ID","desc":"Deprecated in favor of `job.employeeId`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"employeeType":{"name":"employeeType","type":"\u0007","is_mandatory":true,"title":"The employee type (e.g., Employee, Contractor, etc.)","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"externalUserState":{"name":"externalUserState","type":"\u0007","is_mandatory":true,"title":"The state of an external user's invitation (PendingAcceptance, Accepted, etc.)","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"givenName":{"name":"givenName","type":"\u0007","is_mandatory":true,"title":"User given name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"User Object ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identities":{"name":"identities","type":"\u0019\u001bmicrosoft.user.identity","is_mandatory":true,"title":"The user's identities","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u001bmicrosoft.user.identity","title":"Microsoft user identity","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"isAdministrator":{"name":"isAdministrator","type":"\u0004","title":"Administrator status","desc":"True when the user is directly assigned at least one active Microsoft Entra directory role. Roles held only through group membership or as not-yet-activated PIM-eligible assignments are not reflected.","min_provider_version":"13.7.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"job":{"name":"job","type":"\n","title":"User's job and organization attributes","desc":"Dict with keys `jobTitle`, `companyName`, `department`, `employeeId`, and `officeLocation`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"jobTitle":{"name":"jobTitle","type":"\u0007","is_mandatory":true,"title":"User job title","desc":"Deprecated in favor of `job.title`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"lastPasswordChangeDateTime":{"name":"lastPasswordChangeDateTime","type":"\t","is_mandatory":true,"title":"The date and time when the user last changed or was assigned a password","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"licenseDetail":{"name":"licenseDetail","type":"\u001bmicrosoft.user.licenseDetail","title":"Details of a single license assigned to a user","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"licenseDetails":{"name":"licenseDetails","type":"\u0019\u001bmicrosoft.user.licenseDetail","title":"A collection of this user's license details","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mail":{"name":"mail","type":"\u0007","is_mandatory":true,"title":"User email address","desc":"Deprecated in favor of `contact.email`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"mfaEnabled":{"name":"mfaEnabled","type":"\u0004","title":"Whether MFA is enabled for the user","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mobilePhone":{"name":"mobilePhone","type":"\u0007","is_mandatory":true,"title":"User mobile phone number","desc":"Deprecated in favor of `contact.mobilePhone`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"officeLocation":{"name":"officeLocation","type":"\u0007","is_mandatory":true,"title":"User office location","desc":"Deprecated in favor of `job.officeLocation`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"onPremisesDomainName":{"name":"onPremisesDomainName","type":"\u0007","is_mandatory":true,"title":"The on-premises domain name of the user","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"onPremisesLastSyncDateTime":{"name":"onPremisesLastSyncDateTime","type":"\t","is_mandatory":true,"title":"The last time the user was synced from on-premises","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"onPremisesSamAccountName":{"name":"onPremisesSamAccountName","type":"\u0007","is_mandatory":true,"title":"The on-premises SAM account name of the user","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"onPremisesSyncEnabled":{"name":"onPremisesSyncEnabled","type":"\u0004","is_mandatory":true,"title":"Whether directory sync is enabled for the user","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"otherMails":{"name":"otherMails","type":"\u0019\u0007","is_mandatory":true,"title":"Additional email addresses for the user","desc":"Deprecated in favor of `contact.otherMails`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"passwordPolicies":{"name":"passwordPolicies","type":"\u0007","is_mandatory":true,"title":"Password policies applied to the user (e.g., DisablePasswordExpiration, DisableStrongPassword)","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"postalCode":{"name":"postalCode","type":"\u0007","is_mandatory":true,"title":"User postal code","desc":"Deprecated in favor of `contact.postalCode`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"preferredLanguage":{"name":"preferredLanguage","type":"\u0007","is_mandatory":true,"title":"The user's preferred language (ISO 639-1 code)","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"settings":{"name":"settings","type":"\n","title":"User's Office Delve content-discovery settings","desc":"Dict with keys `id`, `contributionToContentDiscoveryDisabled` (true when the user has turned off documents in their own Office Delve), and `contributionToContentDiscoveryAsOrganizationDisabled` (true when the organization has disabled Office Delve tenant-wide).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"signInActivity":{"name":"signInActivity","type":"\n","title":"User's most recent sign-in timestamps and request IDs","desc":"Dict with keys `lastSignInDateTime` and `lastSignInRequestId` (last interactive sign-in), `lastNonInteractiveSignInDateTime` and `lastNonInteractiveSignInRequestId` (last non-interactive sign-in), and `lastSuccessfulSignInDateTime` and `lastSuccessfulSignInRequestId` (last successful sign-in). Useful for finding stale or dormant accounts. Requires the AuditLog.Read.All permission.","min_provider_version":"13.0.12","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"signin":{"name":"signin","type":"\u001bmicrosoft.user.signin","title":"Microsoft user sign-in","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"User state or province","desc":"Deprecated in favor of `contact.state`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"streetAddress":{"name":"streetAddress","type":"\u0007","is_mandatory":true,"title":"User street address","desc":"Deprecated in favor of `contact.streetAddress`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"surname":{"name":"surname","type":"\u0007","is_mandatory":true,"title":"User surname","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"usageLocation":{"name":"usageLocation","type":"\u0007","is_mandatory":true,"title":"The two-letter country code for the user's usage location (required for license assignment)","min_provider_version":"11.2.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userPrincipalName":{"name":"userPrincipalName","type":"\u0007","is_mandatory":true,"title":"User service principal name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userType":{"name":"userType","type":"\u0007","is_mandatory":true,"title":"User type","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra ID user","desc":"User account in the tenant directory, covering identity attributes (userPrincipalName, displayName, userType), account state (accountEnabled, externalUserState), sign-in and password history (signInActivity, lastPasswordChangeDateTime, passwordPolicies), on-premises directory-sync status, assigned licenses, and registered authentication methods. Audit accountEnabled, isAdministrator, and mfaEnabled to find privileged or unprotected accounts, and authMethods for the multifactor and passwordless methods a user has registered.","private":true,"min_provider_version":"9.0.0","defaults":"id displayName userPrincipalName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.user.assignedLicense":{"id":"microsoft.user.assignedLicense","name":"microsoft.user.assignedLicense","fields":{"disabledPlans":{"name":"disabledPlans","type":"\u0019\u0007","is_mandatory":true,"title":"A collection of the unique identifiers for plans that have been disabled.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"skuId":{"name":"skuId","type":"\u0007","is_mandatory":true,"title":"The unique identifier for the SKU.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"A single license assigned to a user","private":true,"min_provider_version":"11.1.39","defaults":"skuId","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.user.auditlog":{"id":"microsoft.user.auditlog","name":"microsoft.user.auditlog","fields":{"lastInteractiveSignIn":{"name":"lastInteractiveSignIn","type":"\u001bmicrosoft.user.signin","title":"The user's last interactive sign-in","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastNonInteractiveSignIn":{"name":"lastNonInteractiveSignIn","type":"\u001bmicrosoft.user.signin","title":"The user's last non-interactive sign-in (from the last 24 hours only)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"signins":{"name":"signins","type":"\u0019\u001bmicrosoft.user.signin","title":"The user's interactive sign-in entries (a maximum of 50 entries from the last 24 hours only)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userId":{"name":"userId","type":"\u0007","is_mandatory":true,"title":"The user's ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft user audit log","private":true,"min_provider_version":"11.1.0","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.user.authenticationMethods":{"id":"microsoft.user.authenticationMethods","name":"microsoft.user.authenticationMethods","fields":{"count":{"name":"count","type":"\u0005","is_mandatory":true,"title":"Count of authentication methods","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"emailMethods":{"name":"emailMethods","type":"\u0019\n","is_mandatory":true,"title":"Email addresses registered for self-service password reset (SSPR)","desc":"Each entry is a dict with keys `id` and `emailAddress`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"fido2Methods":{"name":"fido2Methods","type":"\u0019\n","is_mandatory":true,"title":"FIDO2 security keys registered to the user","desc":"Each entry is a dict with keys `id`, `name`, `attestationLevel`, `model`, and `attestationCertificates`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoftAuthenticator":{"name":"microsoftAuthenticator","type":"\u0019\n","is_mandatory":true,"title":"Microsoft Authenticator app registrations for the user","desc":"Each entry is a dict with keys `id`, `name`, `phoneAppVersion`, and `deviceTag`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"passwordMethods":{"name":"passwordMethods","type":"\u0019\n","is_mandatory":true,"title":"Password authentication methods for the user","desc":"Each entry is a dict with key `id`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"phoneMethods":{"name":"phoneMethods","type":"\u0019\n","is_mandatory":true,"title":"Phone numbers registered to the user","desc":"Each entry is a dict with keys `id`, `type` (mobile, alternateMobile, or office), `phoneNumber`, and `ssmSignInState` (whether SMS sign-in is enabled for the number).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"registrationDetails":{"name":"registrationDetails","type":"\u001bmicrosoft.user.authenticationMethods.userRegistrationDetails","title":"Retrieves the registration and capability status for a user's authentication methods","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"softwareMethods":{"name":"softwareMethods","type":"\u0019\n","is_mandatory":true,"title":"Software OATH tokens registered to the user","desc":"Each entry is a dict with key `id`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"temporaryAccessPassMethods":{"name":"temporaryAccessPassMethods","type":"\u0019\n","is_mandatory":true,"title":"Temporary Access Pass methods registered to the user","desc":"Each entry is a dict with keys `id`, `isUsable`, `isUsableOnce`, and `lifetimeInMinutes`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userRegistrationDetails":{"name":"userRegistrationDetails","type":"\u001bmicrosoft.user.authenticationMethods.userRegistrationDetails","title":"Represents the state of a user's authentication methods, including which methods are registered and capable","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"windowsHelloMethods":{"name":"windowsHelloMethods","type":"\u0019\n","is_mandatory":true,"title":"Windows Hello for Business methods registered to the user","desc":"Each entry is a dict with keys `id`, `name`, `deviceId`, and `keyStrength`.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Entra authentication methods","private":true,"min_provider_version":"11.0.29","defaults":"count","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.user.authenticationMethods.userRegistrationDetails":{"id":"microsoft.user.authenticationMethods.userRegistrationDetails","name":"microsoft.user.authenticationMethods.userRegistrationDetails","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"User's object identifier in Microsoft Entra ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isAdmin":{"name":"isAdmin","type":"\u0004","is_mandatory":true,"title":"True if the user has an administrator role in the tenant","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isMfaCapable":{"name":"isMfaCapable","type":"\u0004","is_mandatory":true,"title":"True if the user has registered a strong auth method that is enabled by the multifactor authentication policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isMfaRegistered":{"name":"isMfaRegistered","type":"\u0004","is_mandatory":true,"title":"True if the user has registered at least one strong authentication method, regardless of whether it is enabled by policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isPasswordlessCapable":{"name":"isPasswordlessCapable","type":"\u0004","is_mandatory":true,"title":"True if the user has registered a strong authentication method that doesn't require a password and is enabled by policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isSsprCapable":{"name":"isSsprCapable","type":"\u0004","is_mandatory":true,"title":"True if the user is capable of self-service password reset by having registered the required number of methods and being included in the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isSsprEnabled":{"name":"isSsprEnabled","type":"\u0004","is_mandatory":true,"title":"True if the user is allowed to perform self-service password reset by policy, even if they have not yet registered the required number of methods","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isSsprRegistered":{"name":"isSsprRegistered","type":"\u0004","is_mandatory":true,"title":"True if the user has registered the required number of authentication methods for self-service password reset","desc":"Reported regardless of whether they are enabled by policy.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isSystemPreferredAuthenticationMethodEnabled":{"name":"isSystemPreferredAuthenticationMethodEnabled","type":"\u0004","is_mandatory":true,"title":"True if system-preferred authentication is enabled","desc":"Allows the system to dynamically determine the most secure authentication method for the user.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lastUpdatedDateTime":{"name":"lastUpdatedDateTime","type":"\t","is_mandatory":true,"title":"The date and time when the user's registration details were last updated","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"methodsRegistered":{"name":"methodsRegistered","type":"\u0019\u0007","is_mandatory":true,"title":"Collection of authentication methods registered by the user, such as \"mobilePhone\", \"email\", and \"fido2SecurityKey\"","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"systemPreferredAuthenticationMethods":{"name":"systemPreferredAuthenticationMethods","type":"\u0019\u0007","is_mandatory":true,"title":"Collection of authentication methods that the system determined to be the most secure for the user to perform multifactor authentication","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userDisplayName":{"name":"userDisplayName","type":"\u0007","is_mandatory":true,"title":"The user's display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userPreferredMethodForSecondaryAuthentication":{"name":"userPreferredMethodForSecondaryAuthentication","type":"\u0007","is_mandatory":true,"title":"The method the user selected as their default for second-factor authentication. This is used when system-preferred authentication is disabled.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userPrincipalName":{"name":"userPrincipalName","type":"\u0007","is_mandatory":true,"title":"The user's principal name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userType":{"name":"userType","type":"\u0007","is_mandatory":true,"title":"The user's type, which can be \"member\", \"guest\", or \"unknownFutureValue\"","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Represents the state of a user's authentication methods, including which methods are registered and capable","private":true,"min_provider_version":"11.1.40","defaults":"id userDisplayName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.user.authenticationRequirements":{"id":"microsoft.user.authenticationRequirements","name":"microsoft.user.authenticationRequirements","fields":{"perUserMfaState":{"name":"perUserMfaState","type":"\u0007","is_mandatory":true,"title":"Legacy per-user MFA state","desc":"One of `disabled`, `enabled`, or `enforced`. Reflects the older per-user multifactor authentication setting, not a Conditional Access or Security Defaults policy.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft user authentication method states","private":true,"min_provider_version":"11.1.39","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.user.identity":{"id":"microsoft.user.identity","name":"microsoft.user.identity","fields":{"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"The identity issuer","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"issuerAssignedId":{"name":"issuerAssignedId","type":"\u0007","is_mandatory":true,"title":"The identity as assigned by the issuer","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"signInType":{"name":"signInType","type":"\u0007","is_mandatory":true,"title":"The sign-in type for the identity (e.g., 'federated' or 'userPrincipalName')","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft user identity","private":true,"min_provider_version":"11.1.0","defaults":"issuerAssignedId","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.user.licenseDetail":{"id":"microsoft.user.licenseDetail","name":"microsoft.user.licenseDetail","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"The unique identifier for the license detail object","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"servicePlanInfo":{"name":"servicePlanInfo","type":"\u001bmicrosoft.user.licenseDetail.servicePlanInfo","title":"Contains information about a service plan associated with a subscribed SKU","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"servicePlans":{"name":"servicePlans","type":"\u0019\u001bmicrosoft.user.licenseDetail.servicePlanInfo","is_mandatory":true,"title":"A collection of the service plans that are provided with the SKU.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"skuId":{"name":"skuId","type":"\u0007","is_mandatory":true,"title":"The unique identifier for the SKU.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"skuPartNumber":{"name":"skuPartNumber","type":"\u0007","is_mandatory":true,"title":"The unique, friendly name for the product.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Details of a single license assigned to a user","private":true,"min_provider_version":"11.1.41","defaults":"skuId skuPartNumber","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.user.licenseDetail.servicePlanInfo":{"id":"microsoft.user.licenseDetail.servicePlanInfo","name":"microsoft.user.licenseDetail.servicePlanInfo","fields":{"appliesTo":{"name":"appliesTo","type":"\u0007","is_mandatory":true,"title":"The object the service plan can be assigned to. The possible values are: User or Company","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"provisioningStatus":{"name":"provisioningStatus","type":"\u0007","is_mandatory":true,"title":"The provisioning status of the service plan","desc":"The possible values are: Success, Disabled, Error, PendingInput, PendingActivation, PendingProvisioning.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"servicePlanId":{"name":"servicePlanId","type":"\u0007","is_mandatory":true,"title":"The unique identifier of the service plan","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"servicePlanName":{"name":"servicePlanName","type":"\u0007","is_mandatory":true,"title":"The name of the service plan.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Contains information about a service plan associated with a subscribed SKU","private":true,"min_provider_version":"11.1.41","defaults":"appliesTo provisioningStatus servicePlanName","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.user.signin":{"id":"microsoft.user.signin","name":"microsoft.user.signin","fields":{"appDisplayName":{"name":"appDisplayName","type":"\u0007","is_mandatory":true,"title":"The display name of the client app used to perform the sign-in","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"appId":{"name":"appId","type":"\u0007","is_mandatory":true,"title":"The application identifier","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"city":{"name":"city","type":"\u0007","is_mandatory":true,"title":"The city the sign-in originated from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"clientAppUsed":{"name":"clientAppUsed","type":"\u0007","is_mandatory":true,"title":"The client app used to perform the sign-in","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"conditionalAccessStatus":{"name":"conditionalAccessStatus","type":"\u0007","is_mandatory":true,"title":"The conditional access status (success, failure, notApplied, unknownFutureValue)","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"correlationId":{"name":"correlationId","type":"\u0007","is_mandatory":true,"title":"The correlation identifier for the sign-in","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"countryOrRegion":{"name":"countryOrRegion","type":"\u0007","is_mandatory":true,"title":"The country or region the sign-in originated from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"The date and time the sign-in entry was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"The sign-in entry's identifier","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"interactive":{"name":"interactive","type":"\u0004","is_mandatory":true,"title":"Whether the sign-in was interactive","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"The IP address of the client","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"resourceDisplayName":{"name":"resourceDisplayName","type":"\u0007","is_mandatory":true,"title":"The resource's display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"resourceId":{"name":"resourceId","type":"\u0007","is_mandatory":true,"title":"The resource identifier","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskDetail":{"name":"riskDetail","type":"\u0007","is_mandatory":true,"title":"The risk detail (none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, etc.)","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskEventTypes":{"name":"riskEventTypes","type":"\u0019\u0007","is_mandatory":true,"title":"The risk event types associated with the sign-in","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskLevelAggregated":{"name":"riskLevelAggregated","type":"\u0007","is_mandatory":true,"title":"The aggregated risk level (none, low, medium, high, hidden, unknownFutureValue)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskLevelDuringSignIn":{"name":"riskLevelDuringSignIn","type":"\u0007","is_mandatory":true,"title":"The risk level during sign-in (none, low, medium, high, hidden, unknownFutureValue)","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"riskState":{"name":"riskState","type":"\u0007","is_mandatory":true,"title":"The risk state (none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue)","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"The state or province the sign-in originated from","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"statusErrorCode":{"name":"statusErrorCode","type":"\u0005","is_mandatory":true,"title":"The sign-in error code; 0 indicates the sign-in succeeded","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"statusFailureReason":{"name":"statusFailureReason","type":"\u0007","is_mandatory":true,"title":"The reason behind a failed sign-in","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userAgent":{"name":"userAgent","type":"\u0007","is_mandatory":true,"title":"The user agent used for the sign-in","min_provider_version":"11.1.102","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userDisplayName":{"name":"userDisplayName","type":"\u0007","is_mandatory":true,"title":"The display name of the user","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"userId":{"name":"userId","type":"\u0007","is_mandatory":true,"title":"The ID of the user","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft user sign-in","private":true,"min_provider_version":"11.1.0","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"microsoft.users":{"id":"microsoft.users","name":"microsoft.users","fields":{"filter":{"name":"filter","type":"\u0007","is_mandatory":true,"title":"Filter users by property values","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"list":{"name":"list","type":"\u0019\u001bmicrosoft.user","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"search":{"name":"search","type":"\u0007","is_mandatory":true,"title":"Search users by search phrases","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"init":{"args":[{"name":"filter","type":"\u0007","optional":true},{"name":"search","type":"\u0007","optional":true}]},"list_type":"\u001bmicrosoft.user","title":"Microsoft Entra ID Users","desc":"Microsoft Entra ID (formerly Azure AD) users in the tenant. Supports optional `filter` (OData property filter) and `search` (keyword search) parameters to narrow results. Each entry is a `microsoft.user` exposing account status, contact details, job information, MFA state, assigned licenses, sign-in history, and authentication method registration.","min_provider_version":"11.1.15","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365":{"id":"ms365","fields":{"exchangeonline":{"name":"exchangeonline","type":"\u001bms365.exchangeonline","title":"Microsoft 365 Exchange Online","desc":"Exchange Online configuration and security settings for the tenant, covering mail filtering policies (`malwareFilterPolicies`, `hostedContentFilterPolicies`, `antiPhishPolicies`, `hostedOutboundSpamFilterPolicies`), transport rules, Safe Links and Safe Attachments policies, DKIM signing configuration, authentication policies, Outlook on the web mailbox policies, mailbox audit settings, quarantine policies, retention policies, journal rules, report submission policies, Teams protection policies, and organization-wide configuration.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"exchangeonlineMailboxAuditBypassAssociation":{"name":"exchangeonlineMailboxAuditBypassAssociation","type":"\u001bms365.exchangeonlineMailboxAuditBypassAssociation","title":"Mailbox audit bypass association","desc":"User or computer account that is exempted from mailbox audit logging in Exchange Online. When auditBypassEnabled is true, the account's mailbox access and actions are excluded from the mailbox audit log, so its activity leaves no audit trail. Review these associations to confirm that no account has been silently exempted from auditing, since bypass entries can conceal privileged or malicious mailbox access. The account is identified by name.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"sharepointonline":{"name":"sharepointonline","type":"\u001bms365.sharepointonline","title":"Microsoft 365 SharePoint Online","desc":"SharePoint Online and OneDrive governance for the tenant, spanning the tenant-wide sharing and security configuration, OneDrive sync client access controls, and the inventory of site collections with their external-sharing and custom-script settings. Query it to audit how broadly content can be shared outside the organization and whether device and script protections are enforced.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"teams":{"name":"teams","type":"\u001bms365.teams","title":"Microsoft 365 Teams","desc":"Tenant-wide Microsoft Teams configuration and inventory. Covers the client feature controls, external access and federation settings, meeting policy (lobby admission, recording, and participant controls), and messaging policy (chat and security reporting), plus the teams provisioned in the tenant and their channels. Audit these to verify guest access, external federation, meeting recording, and lobby screening are governed to policy.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true}},"is_extension":true},"ms365.exchangeonline":{"id":"ms365.exchangeonline","name":"ms365.exchangeonline","fields":{"adminAuditLogConfig":{"name":"adminAuditLogConfig","type":"\n","title":"Admin audit log configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"antiPhishPolicies":{"name":"antiPhishPolicies","type":"\u0019\u001bms365.exchangeonline.antiPhishPolicyEntry","title":"Anti-phishing policies","desc":"Each policy exposes fields for the impersonation protection, spoof intelligence, and phishing threshold settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"antiPhishPolicy":{"name":"antiPhishPolicy","type":"\u0019\n","title":"Anti-phishing policies as raw dictionaries","desc":"Deprecated in favor of antiPhishPolicies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"antiPhishPolicyEntry":{"name":"antiPhishPolicyEntry","type":"\u001bms365.exchangeonline.antiPhishPolicyEntry","title":"Exchange Online anti-phishing policy","desc":"Single anti-phishing policy returned by Get-AntiPhishPolicy, selected by `name`. Each policy reports whether it is `enabled`, the `phishThresholdLevel` (1-4, where higher is more aggressive), the mailbox-intelligence, spoof-intelligence, and impersonation-protection toggles, and the actions taken when impersonation is detected or sender authentication fails.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"atpPoliciesForO365":{"name":"atpPoliciesForO365","type":"\u0019\u001bms365.exchangeonline.atpPolicyForO365Entry","title":"Defender for Office 365 ATP policies","desc":"Each policy exposes fields for the Safe Documents and SharePoint, OneDrive, and Teams protection settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"atpPolicyForO365":{"name":"atpPolicyForO365","type":"\u0019\n","title":"ATP policies for Office 365 as raw dictionaries","desc":"Deprecated in favor of atpPoliciesForO365.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"atpPolicyForO365Entry":{"name":"atpPolicyForO365Entry","type":"\u001bms365.exchangeonline.atpPolicyForO365Entry","title":"Exchange Online Defender for Office 365 ATP policy","desc":"Defender for Office 365 advanced threat protection policy returned by Get-AtpPolicyForO365, selected by `name`. It reports whether Safe Documents is enabled, whether users may bypass it to open a file, and whether ATP protection is enabled for SharePoint, OneDrive, and Teams.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"authenticationPolicies":{"name":"authenticationPolicies","type":"\u0019\u001bms365.exchangeonline.authenticationPolicyEntry","title":"Authentication policies","desc":"Each policy exposes fields for which legacy basic authentication protocols are still allowed.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"authenticationPolicy":{"name":"authenticationPolicy","type":"\u0019\n","title":"Authentication policies as raw dictionaries","desc":"Deprecated in favor of authenticationPolicies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"authenticationPolicyEntry":{"name":"authenticationPolicyEntry","type":"\u001bms365.exchangeonline.authenticationPolicyEntry","title":"Exchange Online authentication policy","desc":"Single authentication policy returned by Get-AuthenticationPolicy, selected by `name`. Each policy exposes one boolean per connection protocol (ActiveSync, Autodiscover, IMAP, MAPI, offline address book, the Outlook service, POP, remote PowerShell, reporting web services, Outlook RPC, authenticated SMTP, and Exchange Web Services) indicating whether legacy basic authentication is still allowed for it.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"dkimSigningConfig":{"name":"dkimSigningConfig","type":"\u0019\n","title":"DKIM signing configurations as raw dictionaries","desc":"Deprecated in favor of dkimSigningConfigs.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"dkimSigningConfigEntry":{"name":"dkimSigningConfigEntry","type":"\u001bms365.exchangeonline.dkimSigningConfigEntry","title":"Exchange Online DKIM signing configuration","desc":"DKIM signing configuration for one accepted domain, returned by Get-DkimSigningConfig and selected by `domain`. The `enabled` field reports whether outbound DKIM signing is on for the domain, and `status` reports its current state.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"dkimSigningConfigs":{"name":"dkimSigningConfigs","type":"\u0019\u001bms365.exchangeonline.dkimSigningConfigEntry","title":"DKIM signing configurations","desc":"One configuration per accepted domain, with fields for whether outbound DKIM signing is enabled and its status.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"dlpCompliancePolicy":{"name":"dlpCompliancePolicy","type":"\u001bms365.exchangeonline.dlpCompliancePolicy","title":"Microsoft 365 Data Loss Prevention compliance policy","desc":"Data Loss Prevention (DLP) compliance policy, selected by its `name`. `mode` reports the enforcement level (Enable, TestWithNotifications, TestWithoutNotifications, or Disable) and `enabled` whether it is on. The `workload` lists which services it covers — Exchange, SharePoint, OneDriveForBusiness, Teams, or EndpointDevices — and `priority` orders policy evaluation. `distributionStatus` reports whether the policy has rolled out to the workloads, and `whenCreated` / `whenChanged` frame its history.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"dlpComplianceRule":{"name":"dlpComplianceRule","type":"\u001bms365.exchangeonline.dlpComplianceRule","title":"Microsoft 365 Data Loss Prevention compliance rule","desc":"Data Loss Prevention (DLP) rule holding the conditions and actions that make up a DLP policy, selected by its `name`. `parentPolicyName` links the rule to its policy. The rule detects the sensitive information types listed in `sensitiveInformationTypes`, and when matched it can block access (`blockAccess`, `blockAccessScope`), notify users (`notifyUser`, `notifyUserType`), and raise alerts at `reportSeverityLevel`. `disabled` reports whether the rule is turned off, `mode` its enforcement level, and `isAdvancedRule` whether it uses the advanced (JSON) condition builder.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"exoMailbox":{"name":"exoMailbox","type":"\u001bms365.exchangeonline.exoMailbox","title":"Microsoft 365 Exchange Online Mailbox","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"externalInOutlook":{"name":"externalInOutlook","type":"\u0019\u001bms365.exchangeonline.externalSender","title":"List of external sender configurations","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"externalSender":{"name":"externalSender","type":"\u001bms365.exchangeonline.externalSender","title":"Microsoft 365 Exchange Online External Sender","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"hostedContentFilterPolicies":{"name":"hostedContentFilterPolicies","type":"\u0019\u001bms365.exchangeonline.hostedContentFilterPolicyEntry","title":"Inbound anti-spam policies","desc":"Each policy exposes fields for the spam, phishing, and bulk-mail actions and the allowed and blocked sender domains.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"hostedContentFilterPolicy":{"name":"hostedContentFilterPolicy","type":"\u0019\n","title":"Hosted content (anti-spam) filter policies as raw dictionaries","desc":"Deprecated in favor of hostedContentFilterPolicies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"hostedContentFilterPolicyEntry":{"name":"hostedContentFilterPolicyEntry","type":"\u001bms365.exchangeonline.hostedContentFilterPolicyEntry","title":"Exchange Online hosted content (anti-spam) filter policy","desc":"Single inbound anti-spam policy returned by Get-HostedContentFilterPolicy, selected by `name`. Each policy reports the actions taken on spam, high-confidence spam, phishing, high-confidence phishing, and bulk mail, the `bulkThreshold` (1-9), whether end-user spam notifications are sent, and the always-allowed and always-blocked sender domains.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"hostedOutboundSpamFilterPolicies":{"name":"hostedOutboundSpamFilterPolicies","type":"\u0019\u001bms365.exchangeonline.hostedOutboundSpamFilterPolicyEntry","title":"Outbound spam filter policies","desc":"Each policy exposes fields for the sending limits and the automatic email-forwarding mode.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"hostedOutboundSpamFilterPolicy":{"name":"hostedOutboundSpamFilterPolicy","type":"\u0019\n","title":"Hosted outbound spam filter policies as raw dictionaries","desc":"Deprecated in favor of hostedOutboundSpamFilterPolicies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"hostedOutboundSpamFilterPolicyEntry":{"name":"hostedOutboundSpamFilterPolicyEntry","type":"\u001bms365.exchangeonline.hostedOutboundSpamFilterPolicyEntry","title":"Exchange Online hosted outbound spam filter policy","desc":"Single outbound spam policy returned by Get-HostedOutboundSpamFilterPolicy, selected by `name`. Each policy reports the external, internal, and daily recipient limits, the action taken when a limit is reached, the automatic email-forwarding mode (Automatic, On, or Off), and whether suspicious outbound mail is bcc'd and notified.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"journalRule":{"name":"journalRule","type":"\u001bms365.exchangeonline.journalRule","title":"Journal Rule","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"journalRules":{"name":"journalRules","type":"\u0019\u001bms365.exchangeonline.journalRule","title":"List of journal rules","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mailbox":{"name":"mailbox","type":"\u0019\n","title":"List of mailboxes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mailboxAuditBypassAssociation":{"name":"mailboxAuditBypassAssociation","type":"\u0019\u001bms365.exchangeonlineMailboxAuditBypassAssociation","title":"List of mailbox audit bypass associations","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mailboxPlan":{"name":"mailboxPlan","type":"\u001bms365.exchangeonline.mailboxPlan","title":"Mailbox Plan","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"mailboxPlans":{"name":"mailboxPlans","type":"\u0019\u001bms365.exchangeonline.mailboxPlan","title":"List of mailbox plans","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mailboxesWithAudit":{"name":"mailboxesWithAudit","type":"\u0019\u001bms365.exchangeonline.mailbox","title":"List of mailboxes with audit settings","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"malwareFilterPolicies":{"name":"malwareFilterPolicies","type":"\u0019\u001bms365.exchangeonline.malwareFilterPolicyEntry","title":"Malware filter policies","desc":"Each policy exposes fields for common-attachment filtering, zero-hour auto purge, and admin notification settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"malwareFilterPolicy":{"name":"malwareFilterPolicy","type":"\u0019\n","title":"Malware filter policies as raw dictionaries","desc":"Deprecated in favor of malwareFilterPolicies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"malwareFilterPolicyEntry":{"name":"malwareFilterPolicyEntry","type":"\u001bms365.exchangeonline.malwareFilterPolicyEntry","title":"Exchange Online malware filter policy","desc":"Single malware filter policy returned by Get-MalwareFilterPolicy, selected by `name`. Each policy reports whether the common-attachment file filter is enabled and the `fileTypes` it blocks, whether zero-hour auto purge is on, and whether internal- and external-sender admin notifications are sent.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"organizationConfig":{"name":"organizationConfig","type":"\n","title":"Organization configurations","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"owaMailboxPolicies":{"name":"owaMailboxPolicies","type":"\u0019\u001bms365.exchangeonline.owaMailboxPolicyEntry","title":"Outlook on the web mailbox policies","desc":"Each policy exposes fields for the third-party storage availability and direct file-access settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"owaMailboxPolicy":{"name":"owaMailboxPolicy","type":"\u0019\n","title":"OWA mailbox policies as raw dictionaries","desc":"Deprecated in favor of owaMailboxPolicies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"owaMailboxPolicyEntry":{"name":"owaMailboxPolicyEntry","type":"\u001bms365.exchangeonline.owaMailboxPolicyEntry","title":"Exchange Online Outlook on the web mailbox policy","desc":"Single Outlook on the web mailbox policy returned by Get-OwaMailboxPolicy, selected by `name`. Each policy reports whether third-party storage providers are available, whether direct file access is enabled on public and private computers, whether forced save applies to filtered attachments, and the allowed and blocked attachment file types.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"phishFilterPolicy":{"name":"phishFilterPolicy","type":"\u0019\n","title":"List of phishing filter policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"quarantinePolicies":{"name":"quarantinePolicies","type":"\u0019\u001bms365.exchangeonline.quarantinePolicyEntry","title":"Quarantine policies","desc":"Each policy exposes fields for the end-user permission bitmask and whether quarantine notifications are sent.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"quarantinePolicy":{"name":"quarantinePolicy","type":"\u0019\n","title":"Quarantine policies as raw dictionaries","desc":"Deprecated in favor of quarantinePolicies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"quarantinePolicyEntry":{"name":"quarantinePolicyEntry","type":"\u001bms365.exchangeonline.quarantinePolicyEntry","title":"Exchange Online quarantine policy","desc":"Single quarantine policy returned by Get-QuarantinePolicy, selected by `name`. Each policy reports the `endUserQuarantinePermissionsValue` bitmask that controls what recipients may do with their quarantined messages, and whether end-user spam (quarantine) notifications are enabled.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"remoteDomain":{"name":"remoteDomain","type":"\u0019\n","title":"Remote domains as raw dictionaries","desc":"Deprecated in favor of remoteDomains.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"remoteDomainEntry":{"name":"remoteDomainEntry","type":"\u001bms365.exchangeonline.remoteDomainEntry","title":"Exchange Online remote domain configuration","desc":"Mail-handling configuration for one remote domain returned by Get-RemoteDomain, selected by `name`. The `domainName` field reports the domain it applies to, and further fields report the out-of-office reply type allowed and whether automatic replies, automatic forwarding, delivery reports, and non-delivery reports are permitted to that domain.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"remoteDomains":{"name":"remoteDomains","type":"\u0019\u001bms365.exchangeonline.remoteDomainEntry","title":"Remote domain configurations","desc":"Each configuration exposes fields for the automatic reply, forwarding, and delivery-report settings for mail sent to that domain.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reportSubmissionPolicies":{"name":"reportSubmissionPolicies","type":"\u0019\u001bms365.exchangeonline.reportSubmissionPolicy","title":"List of report submission policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reportSubmissionPolicy":{"name":"reportSubmissionPolicy","type":"\u001bms365.exchangeonline.reportSubmissionPolicy","title":"Report Submission Policy configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"retentionPolicies":{"name":"retentionPolicies","type":"\u0019\u001bms365.exchangeonline.retentionPolicy","title":"List of retention policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"retentionPolicy":{"name":"retentionPolicy","type":"\u001bms365.exchangeonline.retentionPolicy","title":"Retention Policy","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"roleAssignmentPolicies":{"name":"roleAssignmentPolicies","type":"\u0019\u001bms365.exchangeonline.roleAssignmentPolicyEntry","title":"Role assignment policies","desc":"Each policy exposes fields for the management roles assigned to mailboxes and whether it is the default policy.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"roleAssignmentPolicy":{"name":"roleAssignmentPolicy","type":"\u0019\n","title":"Role assignment policies as raw dictionaries","desc":"Deprecated in favor of roleAssignmentPolicies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"roleAssignmentPolicyEntry":{"name":"roleAssignmentPolicyEntry","type":"\u001bms365.exchangeonline.roleAssignmentPolicyEntry","title":"Exchange Online role assignment policy","desc":"Single role assignment policy returned by Get-RoleAssignmentPolicy, selected by `name`. Each policy reports whether it is the tenant default, its `description`, and the management roles it assigns to mailboxes (for example MyProfileInformation or MyBaseOptions), which govern the self-service capabilities users have over their own mailbox.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"safeAttachmentPolicies":{"name":"safeAttachmentPolicies","type":"\u0019\u001bms365.exchangeonline.safeAttachmentPolicyEntry","title":"Defender for Office 365 Safe Attachments policies","desc":"Each policy exposes fields for the malware-detection action and redirect settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"safeAttachmentPolicy":{"name":"safeAttachmentPolicy","type":"\u0019\n","title":"Safe Attachments policies as raw dictionaries","desc":"Deprecated in favor of safeAttachmentPolicies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"safeAttachmentPolicyEntry":{"name":"safeAttachmentPolicyEntry","type":"\u001bms365.exchangeonline.safeAttachmentPolicyEntry","title":"Exchange Online Safe Attachments policy","desc":"Single Defender for Office 365 Safe Attachments policy returned by Get-SafeAttachmentPolicy, selected by `name`. Each policy reports whether it is enabled, the `action` taken on detected malware (Allow, Block, Replace, or DynamicDelivery), and whether and where detected messages are redirected.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"safeLinksPolicies":{"name":"safeLinksPolicies","type":"\u0019\u001bms365.exchangeonline.safeLinksPolicyEntry","title":"Defender for Office 365 Safe Links policies","desc":"Each policy exposes fields for the URL scanning coverage, click tracking, and click-through settings.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"safeLinksPolicy":{"name":"safeLinksPolicy","type":"\u0019\n","title":"Safe Links policies as raw dictionaries","desc":"Deprecated in favor of safeLinksPolicies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"safeLinksPolicyEntry":{"name":"safeLinksPolicyEntry","type":"\u001bms365.exchangeonline.safeLinksPolicyEntry","title":"Exchange Online Safe Links policy","desc":"Single Defender for Office 365 Safe Links policy returned by Get-SafeLinksPolicy, selected by `name`. Each policy reports which workloads URL scanning covers (email, Teams, and Office apps), whether clicks are tracked, whether users may click through to the original URL, and whether URL rewriting is disabled.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"securityAndCompliance":{"name":"securityAndCompliance","type":"\u001bms365.exchangeonline.securityAndCompliance","title":"Security and Compliance policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharedMailboxes":{"name":"sharedMailboxes","type":"\u0019\u001bms365.exchangeonline.exoMailbox","title":"List of shared mailboxes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharingPolicies":{"name":"sharingPolicies","type":"\u0019\u001bms365.exchangeonline.sharingPolicyEntry","title":"Calendar and contact sharing policies","desc":"Each policy exposes fields for whether sharing is enabled and the domains and sharing actions it permits.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharingPolicy":{"name":"sharingPolicy","type":"\u0019\n","title":"Sharing policies as raw dictionaries","desc":"Deprecated in favor of sharingPolicies.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"sharingPolicyEntry":{"name":"sharingPolicyEntry","type":"\u001bms365.exchangeonline.sharingPolicyEntry","title":"Exchange Online sharing policy","desc":"Single calendar and contact sharing policy returned by Get-SharingPolicy, selected by `name`. The `enabled` field reports whether the policy is active, `isDefault` reports whether it is the tenant default, and the `domains` field lists which external domains may be shared with and at what level.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"teamsProtectionPolicies":{"name":"teamsProtectionPolicies","type":"\u0019\u001bms365.exchangeonline.teamsProtectionPolicy","title":"List of Teams protection policies","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"teamsProtectionPolicy":{"name":"teamsProtectionPolicy","type":"\u001bms365.exchangeonline.teamsProtectionPolicy","title":"Teams Protection Policy configuration","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"transportConfig":{"name":"transportConfig","type":"\n","title":"Transport configuration settings","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"transportRule":{"name":"transportRule","type":"\u0019\n","title":"Transport rules as raw dictionaries","desc":"Deprecated in favor of transportRules.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"transportRuleEntry":{"name":"transportRuleEntry","type":"\u001bms365.exchangeonline.transportRuleEntry","title":"Exchange Online mail flow transport rule","desc":"Single mail flow rule returned by Get-TransportRule, selected by `name`. Each rule reports its evaluation `priority` (lower numbers run first), enablement `state`, operating `mode`, administrator `comments`, and whether it forces outbound TLS via `routeMessageOutboundRequireTls`. The full condition and action set of a rule remains available through the deprecated `transportRule` dictionary.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"transportRules":{"name":"transportRules","type":"\u0019\u001bms365.exchangeonline.transportRuleEntry","title":"Mail flow (transport) rules","desc":"Each rule exposes fields for its name, evaluation priority, and enablement state.","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"unifiedAuditLogIngestionEnabled":{"name":"unifiedAuditLogIngestionEnabled","type":"\u0004","title":"Whether unified audit log ingestion is enabled for the organization","desc":"When true, admin and user activity is recorded to the unified audit log and available for search in the Microsoft Purview compliance portal.","min_provider_version":"13.6.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Exchange Online","desc":"Exchange Online configuration and security settings for the tenant, covering mail filtering policies (`malwareFilterPolicies`, `hostedContentFilterPolicies`, `antiPhishPolicies`, `hostedOutboundSpamFilterPolicies`), transport rules, Safe Links and Safe Attachments policies, DKIM signing configuration, authentication policies, Outlook on the web mailbox policies, mailbox audit settings, quarantine policies, retention policies, journal rules, report submission policies, Teams protection policies, and organization-wide configuration.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.antiPhishPolicyEntry":{"id":"ms365.exchangeonline.antiPhishPolicyEntry","name":"ms365.exchangeonline.antiPhishPolicyEntry","fields":{"authenticationFailAction":{"name":"authenticationFailAction","type":"\u0007","is_mandatory":true,"title":"Action when sender authentication (SPF/DKIM/DMARC) fails","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"dmarcQuarantineAction":{"name":"dmarcQuarantineAction","type":"\u0007","is_mandatory":true,"title":"Action applied when the sender's DMARC policy is quarantine","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"dmarcRejectAction":{"name":"dmarcRejectAction","type":"\u0007","is_mandatory":true,"title":"Action applied when the sender's DMARC policy is reject","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableFirstContactSafetyTips":{"name":"enableFirstContactSafetyTips","type":"\u0004","is_mandatory":true,"title":"Whether first-contact safety tips are shown","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableMailboxIntelligence":{"name":"enableMailboxIntelligence","type":"\u0004","is_mandatory":true,"title":"Whether mailbox intelligence is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableMailboxIntelligenceProtection":{"name":"enableMailboxIntelligenceProtection","type":"\u0004","is_mandatory":true,"title":"Whether mailbox intelligence impersonation protection is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableOrganizationDomainsProtection":{"name":"enableOrganizationDomainsProtection","type":"\u0004","is_mandatory":true,"title":"Whether impersonation protection covers all organization domains","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableSimilarDomainsSafetyTips":{"name":"enableSimilarDomainsSafetyTips","type":"\u0004","is_mandatory":true,"title":"Whether similar-domains safety tips are shown","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableSimilarUsersSafetyTips":{"name":"enableSimilarUsersSafetyTips","type":"\u0004","is_mandatory":true,"title":"Whether similar-users safety tips are shown","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableSpoofIntelligence":{"name":"enableSpoofIntelligence","type":"\u0004","is_mandatory":true,"title":"Whether spoof intelligence is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableSuspiciousSafetyTip":{"name":"enableSuspiciousSafetyTip","type":"\u0004","is_mandatory":true,"title":"Whether the suspicious safety tip is shown","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableTargetedDomainsProtection":{"name":"enableTargetedDomainsProtection","type":"\u0004","is_mandatory":true,"title":"Whether protected-domain impersonation protection is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableTargetedUserProtection":{"name":"enableTargetedUserProtection","type":"\u0004","is_mandatory":true,"title":"Whether protected-user impersonation protection is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableUnauthenticatedSender":{"name":"enableUnauthenticatedSender","type":"\u0004","is_mandatory":true,"title":"Whether unauthenticated-sender indicators are shown in Outlook","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableUnusualCharactersSafetyTips":{"name":"enableUnusualCharactersSafetyTips","type":"\u0004","is_mandatory":true,"title":"Whether unusual-characters safety tips are shown","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableViaTag":{"name":"enableViaTag","type":"\u0004","is_mandatory":true,"title":"Whether the \"via\" tag is shown when the sending domain differs from the From domain","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the policy is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"honorDmarcPolicy":{"name":"honorDmarcPolicy","type":"\u0004","is_mandatory":true,"title":"Whether the sender's published DMARC policy is honored","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"impersonationProtectionState":{"name":"impersonationProtectionState","type":"\u0007","is_mandatory":true,"title":"Impersonation protection mode (for example Automatic, Manual, or Off)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mailboxIntelligenceProtectionAction":{"name":"mailboxIntelligenceProtectionAction","type":"\u0007","is_mandatory":true,"title":"Action for messages flagged by mailbox intelligence impersonation protection","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"phishThresholdLevel":{"name":"phishThresholdLevel","type":"\u0005","is_mandatory":true,"title":"Phishing detection aggressiveness (1-4, higher is more aggressive)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"targetedDomainProtectionAction":{"name":"targetedDomainProtectionAction","type":"\u0007","is_mandatory":true,"title":"Action for detected domain impersonation (for example Quarantine or MoveToJmf)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"targetedUserProtectionAction":{"name":"targetedUserProtectionAction","type":"\u0007","is_mandatory":true,"title":"Action for detected user impersonation (for example Quarantine or MoveToJmf)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online anti-phishing policy","desc":"Single anti-phishing policy returned by Get-AntiPhishPolicy, selected by `name`. Each policy reports whether it is `enabled`, the `phishThresholdLevel` (1-4, where higher is more aggressive), the mailbox-intelligence, spoof-intelligence, and impersonation-protection toggles, and the actions taken when impersonation is detected or sender authentication fails.","private":true,"min_provider_version":"13.3.1","defaults":"name enabled phishThresholdLevel","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.atpPolicyForO365Entry":{"id":"ms365.exchangeonline.atpPolicyForO365Entry","name":"ms365.exchangeonline.atpPolicyForO365Entry","fields":{"allowSafeDocsOpen":{"name":"allowSafeDocsOpen","type":"\u0004","is_mandatory":true,"title":"Whether users can bypass Safe Documents and open the file","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableATPForSPOTeamsODB":{"name":"enableATPForSPOTeamsODB","type":"\u0004","is_mandatory":true,"title":"Whether ATP is enabled for SharePoint, OneDrive, and Teams","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableSafeDocs":{"name":"enableSafeDocs","type":"\u0004","is_mandatory":true,"title":"Whether Safe Documents is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online Defender for Office 365 ATP policy","desc":"Defender for Office 365 advanced threat protection policy returned by Get-AtpPolicyForO365, selected by `name`. It reports whether Safe Documents is enabled, whether users may bypass it to open a file, and whether ATP protection is enabled for SharePoint, OneDrive, and Teams.","private":true,"min_provider_version":"13.3.1","defaults":"name enableSafeDocs","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.authenticationPolicyEntry":{"id":"ms365.exchangeonline.authenticationPolicyEntry","name":"ms365.exchangeonline.authenticationPolicyEntry","fields":{"allowBasicAuthActiveSync":{"name":"allowBasicAuthActiveSync","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for Exchange ActiveSync","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowBasicAuthAutodiscover":{"name":"allowBasicAuthAutodiscover","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for Autodiscover","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowBasicAuthImap":{"name":"allowBasicAuthImap","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for IMAP","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowBasicAuthMapi":{"name":"allowBasicAuthMapi","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for MAPI","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowBasicAuthOfflineAddressBook":{"name":"allowBasicAuthOfflineAddressBook","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for the offline address book","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowBasicAuthOutlookService":{"name":"allowBasicAuthOutlookService","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for the Outlook service","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowBasicAuthPop":{"name":"allowBasicAuthPop","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for POP3","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowBasicAuthPowershell":{"name":"allowBasicAuthPowershell","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for remote PowerShell","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowBasicAuthReportingWebServices":{"name":"allowBasicAuthReportingWebServices","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for reporting web services","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowBasicAuthRpc":{"name":"allowBasicAuthRpc","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for Outlook RPC","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowBasicAuthSmtp":{"name":"allowBasicAuthSmtp","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for authenticated SMTP","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowBasicAuthWebServices":{"name":"allowBasicAuthWebServices","type":"\u0004","is_mandatory":true,"title":"Whether basic authentication is allowed for Exchange Web Services","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online authentication policy","desc":"Single authentication policy returned by Get-AuthenticationPolicy, selected by `name`. Each policy exposes one boolean per connection protocol (ActiveSync, Autodiscover, IMAP, MAPI, offline address book, the Outlook service, POP, remote PowerShell, reporting web services, Outlook RPC, authenticated SMTP, and Exchange Web Services) indicating whether legacy basic authentication is still allowed for it.","private":true,"min_provider_version":"13.3.1","defaults":"name allowBasicAuthSmtp","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.dkimSigningConfigEntry":{"id":"ms365.exchangeonline.dkimSigningConfigEntry","name":"ms365.exchangeonline.dkimSigningConfigEntry","fields":{"domain":{"name":"domain","type":"\u0007","is_mandatory":true,"title":"The domain the configuration applies to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether DKIM signing is enabled for the domain","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The configuration identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"The configuration status","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online DKIM signing configuration","desc":"DKIM signing configuration for one accepted domain, returned by Get-DkimSigningConfig and selected by `domain`. The `enabled` field reports whether outbound DKIM signing is on for the domain, and `status` reports its current state.","private":true,"min_provider_version":"13.3.1","defaults":"domain enabled status","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.dlpCompliancePolicy":{"id":"ms365.exchangeonline.dlpCompliancePolicy","name":"ms365.exchangeonline.dlpCompliancePolicy","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Administrator comment","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"copilot":{"name":"copilot","type":"\n","is_mandatory":true,"title":"Microsoft 365 Copilot location scope","desc":"Inclusion and exclusion scoping for the Microsoft 365 Copilot location the policy covers, or null when the policy doesn't apply to Copilot.","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"Account that created the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"distributionStatus":{"name":"distributionStatus","type":"\u0007","is_mandatory":true,"title":"Distribution status of the policy across its workloads","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the policy is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enforcementPlanes":{"name":"enforcementPlanes","type":"\u0019\u0007","is_mandatory":true,"title":"Enforcement planes","desc":"Layers where the policy's actions run. Values include Browser (unmanaged cloud apps in Microsoft Edge for Business), CopilotExperiences (Microsoft 365 Copilot interactions), Application (Entra-registered enterprise applications), and Network.","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"guid":{"name":"guid","type":"\u0007","is_mandatory":true,"title":"Policy GUID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isValid":{"name":"isValid","type":"\u0004","is_mandatory":true,"title":"Whether the policy is valid","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Enforcement mode (Enable, TestWithNotifications, TestWithoutNotifications, Disable, PendingDeletion)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Policy priority; lower numbers are evaluated first","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"whenChanged":{"name":"whenChanged","type":"\t","is_mandatory":true,"title":"Date and time the policy was last changed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"whenCreated":{"name":"whenCreated","type":"\t","is_mandatory":true,"title":"Date and time the policy was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"workload":{"name":"workload","type":"\u0007","is_mandatory":true,"title":"Workloads the policy applies to (for example Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Data Loss Prevention compliance policy","desc":"Data Loss Prevention (DLP) compliance policy, selected by its `name`. `mode` reports the enforcement level (Enable, TestWithNotifications, TestWithoutNotifications, or Disable) and `enabled` whether it is on. The `workload` lists which services it covers — Exchange, SharePoint, OneDriveForBusiness, Teams, or EndpointDevices — and `priority` orders policy evaluation. `distributionStatus` reports whether the policy has rolled out to the workloads, and `whenCreated` / `whenChanged` frame its history.","private":true,"min_provider_version":"13.3.1","defaults":"name mode enabled workload","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.dlpComplianceRule":{"id":"ms365.exchangeonline.dlpComplianceRule","name":"ms365.exchangeonline.dlpComplianceRule","fields":{"accessScope":{"name":"accessScope","type":"\u0007","is_mandatory":true,"title":"Access scope the rule applies to (InOrganization, NotInOrganization, ...)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"blockAccess":{"name":"blockAccess","type":"\u0004","is_mandatory":true,"title":"Whether the rule blocks access to matching content","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"blockAccessScope":{"name":"blockAccessScope","type":"\u0007","is_mandatory":true,"title":"Scope of the block action (All, PerUser)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"disabled":{"name":"disabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is disabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"generateIncidentReport":{"name":"generateIncidentReport","type":"\u0019\u0007","is_mandatory":true,"title":"Recipients of the incident report when the rule matches","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"guid":{"name":"guid","type":"\u0007","is_mandatory":true,"title":"Rule GUID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isAdvancedRule":{"name":"isAdvancedRule","type":"\u0004","is_mandatory":true,"title":"Whether the rule uses the advanced (JSON) condition builder","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Enforcement mode (Enable, TestWithNotifications, TestWithoutNotifications, Disable)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notifyUser":{"name":"notifyUser","type":"\u0019\u0007","is_mandatory":true,"title":"Recipients notified when the rule matches (for example LastModifier, Owner, SiteAdmin, or addresses)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notifyUserType":{"name":"notifyUserType","type":"\u0007","is_mandatory":true,"title":"Notification delivery type (Email, PolicyTip, or both)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"parentPolicy":{"name":"parentPolicy","type":"\u001bms365.exchangeonline.dlpCompliancePolicy","title":"DLP policy the rule belongs to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"parentPolicyName":{"name":"parentPolicyName","type":"\u0007","is_mandatory":true,"title":"Name of the DLP policy the rule belongs to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Rule priority; lower numbers are evaluated first","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reportSeverityLevel":{"name":"reportSeverityLevel","type":"\u0007","is_mandatory":true,"title":"Severity level reported for matches (Low, Medium, High)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sensitiveInformationTypes":{"name":"sensitiveInformationTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Sensitive information types the rule detects","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Data Loss Prevention compliance rule","desc":"Data Loss Prevention (DLP) rule holding the conditions and actions that make up a DLP policy, selected by its `name`. `parentPolicyName` links the rule to its policy. The rule detects the sensitive information types listed in `sensitiveInformationTypes`, and when matched it can block access (`blockAccess`, `blockAccessScope`), notify users (`notifyUser`, `notifyUserType`), and raise alerts at `reportSeverityLevel`. `disabled` reports whether the rule is turned off, `mode` its enforcement level, and `isAdvancedRule` whether it uses the advanced (JSON) condition builder.","private":true,"min_provider_version":"13.3.1","defaults":"name parentPolicyName disabled blockAccess","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.exoMailbox":{"id":"ms365.exchangeonline.exoMailbox","name":"ms365.exchangeonline.exoMailbox","fields":{"externalDirectoryObjectId":{"name":"externalDirectoryObjectId","type":"\u0007","is_mandatory":true,"title":"The identity of the external object linked to this mailbox","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The identity of the mailbox","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"user":{"name":"user","type":"\u001bmicrosoft.user","title":"The user linked to this mailbox","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Exchange Online Mailbox","private":true,"min_provider_version":"9.2.14","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.externalSender":{"id":"ms365.exchangeonline.externalSender","name":"ms365.exchangeonline.externalSender","fields":{"allowList":{"name":"allowList","type":"\u0019\u0007","is_mandatory":true,"title":"The list of specified senders that do not receive the external icon in the area of subject line","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the feature is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The identity of the external sender","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Exchange Online External Sender","private":true,"min_provider_version":"9.2.9","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.hostedContentFilterPolicyEntry":{"id":"ms365.exchangeonline.hostedContentFilterPolicyEntry","name":"ms365.exchangeonline.hostedContentFilterPolicyEntry","fields":{"allowedSenderDomains":{"name":"allowedSenderDomains","type":"\u0019\u0007","is_mandatory":true,"title":"Sender domains always treated as allowed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"blockedSenderDomains":{"name":"blockedSenderDomains","type":"\u0019\u0007","is_mandatory":true,"title":"Sender domains always treated as blocked","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"bulkSpamAction":{"name":"bulkSpamAction","type":"\u0007","is_mandatory":true,"title":"Action applied to bulk mail","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"bulkThreshold":{"name":"bulkThreshold","type":"\u0005","is_mandatory":true,"title":"Bulk complaint level threshold (1-9)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableEndUserSpamNotifications":{"name":"enableEndUserSpamNotifications","type":"\u0004","is_mandatory":true,"title":"Whether end-user spam notifications are enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"highConfidencePhishAction":{"name":"highConfidencePhishAction","type":"\u0007","is_mandatory":true,"title":"Action applied to high-confidence phishing","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"highConfidenceSpamAction":{"name":"highConfidenceSpamAction","type":"\u0007","is_mandatory":true,"title":"Action applied to high-confidence spam","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"phishSpamAction":{"name":"phishSpamAction","type":"\u0007","is_mandatory":true,"title":"Action applied to phishing","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"spamAction":{"name":"spamAction","type":"\u0007","is_mandatory":true,"title":"Action applied to spam","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online hosted content (anti-spam) filter policy","desc":"Single inbound anti-spam policy returned by Get-HostedContentFilterPolicy, selected by `name`. Each policy reports the actions taken on spam, high-confidence spam, phishing, high-confidence phishing, and bulk mail, the `bulkThreshold` (1-9), whether end-user spam notifications are sent, and the always-allowed and always-blocked sender domains.","private":true,"min_provider_version":"13.3.1","defaults":"name spamAction highConfidenceSpamAction","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.hostedOutboundSpamFilterPolicyEntry":{"id":"ms365.exchangeonline.hostedOutboundSpamFilterPolicyEntry","name":"ms365.exchangeonline.hostedOutboundSpamFilterPolicyEntry","fields":{"actionWhenThresholdReached":{"name":"actionWhenThresholdReached","type":"\u0007","is_mandatory":true,"title":"Action taken when a sending limit is reached","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"autoForwardingMode":{"name":"autoForwardingMode","type":"\u0007","is_mandatory":true,"title":"Automatic external email forwarding mode (Automatic, On, or Off)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"bccSuspiciousOutboundAdditionalRecipients":{"name":"bccSuspiciousOutboundAdditionalRecipients","type":"\u0019\u0007","is_mandatory":true,"title":"Additional recipients blind-copied on suspicious outbound mail","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"bccSuspiciousOutboundMail":{"name":"bccSuspiciousOutboundMail","type":"\u0004","is_mandatory":true,"title":"Whether suspicious outbound mail is blind-copied to a designated address","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the policy is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notifyOutboundSpam":{"name":"notifyOutboundSpam","type":"\u0004","is_mandatory":true,"title":"Whether notifications are sent for outbound spam","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notifyOutboundSpamRecipients":{"name":"notifyOutboundSpamRecipients","type":"\u0019\u0007","is_mandatory":true,"title":"Recipients notified when outbound spam is detected","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"recipientLimitExternalPerHour":{"name":"recipientLimitExternalPerHour","type":"\u0005","is_mandatory":true,"title":"External recipient limit per hour","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"recipientLimitInternalPerHour":{"name":"recipientLimitInternalPerHour","type":"\u0005","is_mandatory":true,"title":"Internal recipient limit per hour","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"recipientLimitPerDay":{"name":"recipientLimitPerDay","type":"\u0005","is_mandatory":true,"title":"Recipient limit per day","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online hosted outbound spam filter policy","desc":"Single outbound spam policy returned by Get-HostedOutboundSpamFilterPolicy, selected by `name`. Each policy reports the external, internal, and daily recipient limits, the action taken when a limit is reached, the automatic email-forwarding mode (Automatic, On, or Off), and whether suspicious outbound mail is bcc'd and notified.","private":true,"min_provider_version":"13.3.1","defaults":"name autoForwardingMode","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.journalRule":{"id":"ms365.exchangeonline.journalRule","name":"ms365.exchangeonline.journalRule","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the rule is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"journalEmailAddress":{"name":"journalEmailAddress","type":"\u0007","is_mandatory":true,"title":"Journal recipient email address","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Rule scope","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Journal Rule","private":true,"min_provider_version":"11.1.73","defaults":"name enabled journalEmailAddress scope","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.mailbox":{"id":"ms365.exchangeonline.mailbox","name":"ms365.exchangeonline.mailbox","fields":{"auditAdmin":{"name":"auditAdmin","type":"\u0019\u0007","is_mandatory":true,"title":"Admin audit actions","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"auditDelegate":{"name":"auditDelegate","type":"\u0019\u0007","is_mandatory":true,"title":"Delegate audit actions","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"auditEnabled":{"name":"auditEnabled","type":"\u0004","is_mandatory":true,"title":"Whether audit logging is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"auditLogAgeLimit":{"name":"auditLogAgeLimit","type":"\u0007","is_mandatory":true,"title":"Audit log age limit","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"auditOwner":{"name":"auditOwner","type":"\u0019\u0007","is_mandatory":true,"title":"Owner audit actions","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"Mailbox identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"primarySmtpAddress":{"name":"primarySmtpAddress","type":"\u0007","is_mandatory":true,"title":"Primary SMTP address","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"recipientTypeDetails":{"name":"recipientTypeDetails","type":"\u0007","is_mandatory":true,"title":"Recipient type details","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Exchange Online Mailbox with Audit Settings","private":true,"min_provider_version":"11.1.41","defaults":"identity displayName auditEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.mailboxPlan":{"id":"ms365.exchangeonline.mailboxPlan","name":"ms365.exchangeonline.mailboxPlan","fields":{"alias":{"name":"alias","type":"\u0007","is_mandatory":true,"title":"Plan alias","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"maxReceiveSize":{"name":"maxReceiveSize","type":"\u0007","is_mandatory":true,"title":"Maximum receive size","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"maxSendSize":{"name":"maxSendSize","type":"\u0007","is_mandatory":true,"title":"Maximum send size","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Plan name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"prohibitSendQuota":{"name":"prohibitSendQuota","type":"\u0007","is_mandatory":true,"title":"Prohibit send quota","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Mailbox Plan","private":true,"min_provider_version":"11.1.73","defaults":"name alias prohibitSendQuota maxSendSize maxReceiveSize","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.malwareFilterPolicyEntry":{"id":"ms365.exchangeonline.malwareFilterPolicyEntry","name":"ms365.exchangeonline.malwareFilterPolicyEntry","fields":{"customNotifications":{"name":"customNotifications","type":"\u0004","is_mandatory":true,"title":"Whether custom administrator notification text is used","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableExternalSenderAdminNotifications":{"name":"enableExternalSenderAdminNotifications","type":"\u0004","is_mandatory":true,"title":"Whether external-sender admin notifications are enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableFileFilter":{"name":"enableFileFilter","type":"\u0004","is_mandatory":true,"title":"Whether the common attachment file filter is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableInternalSenderAdminNotifications":{"name":"enableInternalSenderAdminNotifications","type":"\u0004","is_mandatory":true,"title":"Whether internal-sender admin notifications are enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"externalSenderAdminAddress":{"name":"externalSenderAdminAddress","type":"\u0007","is_mandatory":true,"title":"Address external-sender admin notifications are sent to","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"fileTypeAction":{"name":"fileTypeAction","type":"\u0007","is_mandatory":true,"title":"Action taken on messages matching the common attachment filter","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"fileTypes":{"name":"fileTypes","type":"\u0019\u0007","is_mandatory":true,"title":"File extensions blocked by the common attachment filter","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"internalSenderAdminAddress":{"name":"internalSenderAdminAddress","type":"\u0007","is_mandatory":true,"title":"Address internal-sender admin notifications are sent to","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"quarantineTag":{"name":"quarantineTag","type":"\u0007","is_mandatory":true,"title":"Quarantine policy applied to detected malware","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"zapEnabled":{"name":"zapEnabled","type":"\u0004","is_mandatory":true,"title":"Whether zero-hour auto purge (ZAP) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online malware filter policy","desc":"Single malware filter policy returned by Get-MalwareFilterPolicy, selected by `name`. Each policy reports whether the common-attachment file filter is enabled and the `fileTypes` it blocks, whether zero-hour auto purge is on, and whether internal- and external-sender admin notifications are sent.","private":true,"min_provider_version":"13.3.1","defaults":"name enableFileFilter zapEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.owaMailboxPolicyEntry":{"id":"ms365.exchangeonline.owaMailboxPolicyEntry","name":"ms365.exchangeonline.owaMailboxPolicyEntry","fields":{"activeSyncIntegrationEnabled":{"name":"activeSyncIntegrationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Exchange ActiveSync integration is enabled in Outlook on the web","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"additionalStorageProvidersAvailable":{"name":"additionalStorageProvidersAvailable","type":"\u0004","is_mandatory":true,"title":"Whether third-party storage providers are available in Outlook on the web","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allAddressListsEnabled":{"name":"allAddressListsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether all address lists are available","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowCopyContactsToDeviceAddressBook":{"name":"allowCopyContactsToDeviceAddressBook","type":"\u0004","is_mandatory":true,"title":"Whether copying contacts to a device address book is allowed","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowedFileTypes":{"name":"allowedFileTypes","type":"\u0019\u0007","is_mandatory":true,"title":"File types users are allowed to open or save","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"blockedFileTypes":{"name":"blockedFileTypes","type":"\u0019\u0007","is_mandatory":true,"title":"File types users are blocked from opening or saving","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"bookingsEnabled":{"name":"bookingsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Bookings is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"bookingsMailboxCreationEnabled":{"name":"bookingsMailboxCreationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether users can create Bookings mailboxes","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"calendarEnabled":{"name":"calendarEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the calendar is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"changePasswordEnabled":{"name":"changePasswordEnabled","type":"\u0004","is_mandatory":true,"title":"Whether users can change their password","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"contactsEnabled":{"name":"contactsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether contacts are enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"directFileAccessOnPrivateComputersEnabled":{"name":"directFileAccessOnPrivateComputersEnabled","type":"\u0004","is_mandatory":true,"title":"Whether direct file access is enabled on private computers","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"directFileAccessOnPublicComputersEnabled":{"name":"directFileAccessOnPublicComputersEnabled","type":"\u0004","is_mandatory":true,"title":"Whether direct file access is enabled on public computers","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"facebookEnabled":{"name":"facebookEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Facebook integration is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"forceSaveAttachmentFilteringEnabled":{"name":"forceSaveAttachmentFilteringEnabled","type":"\u0004","is_mandatory":true,"title":"Whether forced save is applied to filtered attachments","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"groupCreationEnabled":{"name":"groupCreationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether users can create Microsoft 365 groups","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"instantMessagingEnabled":{"name":"instantMessagingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether instant messaging is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"interestingCalendarsEnabled":{"name":"interestingCalendarsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether interesting calendars are enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"journalEnabled":{"name":"journalEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the journal is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"linkedInEnabled":{"name":"linkedInEnabled","type":"\u0004","is_mandatory":true,"title":"Whether LinkedIn integration is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"localEventsEnabled":{"name":"localEventsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether local events are enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notesEnabled":{"name":"notesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether notes are enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"offlineEnabledWeb":{"name":"offlineEnabledWeb","type":"\u0004","is_mandatory":true,"title":"Whether offline mode is enabled in the web client","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"offlineEnabledWin":{"name":"offlineEnabledWin","type":"\u0004","is_mandatory":true,"title":"Whether offline mode is enabled in the Windows client","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"oneWinNativeOutlookEnabled":{"name":"oneWinNativeOutlookEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the new Outlook for Windows native client is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"placesEnabled":{"name":"placesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Places is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"premiumClientEnabled":{"name":"premiumClientEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the premium (full-featured) client is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"recoverDeletedItemsEnabled":{"name":"recoverDeletedItemsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether users can recover deleted items","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"remindersAndNotificationsEnabled":{"name":"remindersAndNotificationsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether reminders and notifications are enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"signaturesEnabled":{"name":"signaturesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether email signatures are enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"tasksEnabled":{"name":"tasksEnabled","type":"\u0004","is_mandatory":true,"title":"Whether tasks are enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"textMessagingEnabled":{"name":"textMessagingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether text messaging is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"themeSelectionEnabled":{"name":"themeSelectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether users can select a theme","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"weatherEnabled":{"name":"weatherEnabled","type":"\u0004","is_mandatory":true,"title":"Whether weather is enabled","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"wssAccessOnPrivateComputersEnabled":{"name":"wssAccessOnPrivateComputersEnabled","type":"\u0004","is_mandatory":true,"title":"Whether SharePoint/WSS document access is allowed on private computers","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"wssAccessOnPublicComputersEnabled":{"name":"wssAccessOnPublicComputersEnabled","type":"\u0004","is_mandatory":true,"title":"Whether SharePoint/WSS document access is allowed on public computers","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online Outlook on the web mailbox policy","desc":"Single Outlook on the web mailbox policy returned by Get-OwaMailboxPolicy, selected by `name`. Each policy reports whether third-party storage providers are available, whether direct file access is enabled on public and private computers, whether forced save applies to filtered attachments, and the allowed and blocked attachment file types.","private":true,"min_provider_version":"13.3.1","defaults":"name additionalStorageProvidersAvailable","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.quarantinePolicyEntry":{"id":"ms365.exchangeonline.quarantinePolicyEntry","name":"ms365.exchangeonline.quarantinePolicyEntry","fields":{"endUserQuarantinePermissionsValue":{"name":"endUserQuarantinePermissionsValue","type":"\u0005","is_mandatory":true,"title":"Bitmask of end-user permissions granted for quarantined messages","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"esnEnabled":{"name":"esnEnabled","type":"\u0004","is_mandatory":true,"title":"Whether end-user spam notifications (quarantine notifications) are enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online quarantine policy","desc":"Single quarantine policy returned by Get-QuarantinePolicy, selected by `name`. Each policy reports the `endUserQuarantinePermissionsValue` bitmask that controls what recipients may do with their quarantined messages, and whether end-user spam (quarantine) notifications are enabled.","private":true,"min_provider_version":"13.3.1","defaults":"name esnEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.remoteDomainEntry":{"id":"ms365.exchangeonline.remoteDomainEntry","name":"ms365.exchangeonline.remoteDomainEntry","fields":{"allowedOOFType":{"name":"allowedOOFType","type":"\u0007","is_mandatory":true,"title":"Out-of-office reply type allowed to the domain (External, ExternalLegacy, or InternalLegacy)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"autoForwardEnabled":{"name":"autoForwardEnabled","type":"\u0004","is_mandatory":true,"title":"Whether automatic forwarding is allowed to the domain","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"autoReplyEnabled":{"name":"autoReplyEnabled","type":"\u0004","is_mandatory":true,"title":"Whether automatic replies are allowed to the domain","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"contentType":{"name":"contentType","type":"\u0007","is_mandatory":true,"title":"Message content type allowed to the domain (for example MimeHtmlText, MimeText, or MimeHtml)","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deliveryReportEnabled":{"name":"deliveryReportEnabled","type":"\u0004","is_mandatory":true,"title":"Whether delivery reports are allowed to the domain","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"domainName":{"name":"domainName","type":"\u0007","is_mandatory":true,"title":"The domain the configuration applies to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The remote domain identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isInternal":{"name":"isInternal","type":"\u0004","is_mandatory":true,"title":"Whether the domain is treated as internal","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"meetingForwardNotificationEnabled":{"name":"meetingForwardNotificationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether meeting forward notifications are sent to the domain","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The remote domain name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ndrEnabled":{"name":"ndrEnabled","type":"\u0004","is_mandatory":true,"title":"Whether non-delivery reports are allowed to the domain","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online remote domain configuration","desc":"Mail-handling configuration for one remote domain returned by Get-RemoteDomain, selected by `name`. The `domainName` field reports the domain it applies to, and further fields report the out-of-office reply type allowed and whether automatic replies, automatic forwarding, delivery reports, and non-delivery reports are permitted to that domain.","private":true,"min_provider_version":"13.3.1","defaults":"name domainName autoForwardEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.reportSubmissionPolicy":{"id":"ms365.exchangeonline.reportSubmissionPolicy","name":"ms365.exchangeonline.reportSubmissionPolicy","fields":{"disableQuarantineReportingOption":{"name":"disableQuarantineReportingOption","type":"\u0004","is_mandatory":true,"title":"Disable the quarantine reporting option","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableCustomNotificationSender":{"name":"enableCustomNotificationSender","type":"\u0004","is_mandatory":true,"title":"Whether to use a custom notification sender","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableOrganizationBranding":{"name":"enableOrganizationBranding","type":"\u0004","is_mandatory":true,"title":"Whether to use organization branding in notifications","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableReportToMicrosoft":{"name":"enableReportToMicrosoft","type":"\u0004","is_mandatory":true,"title":"Whether to send reports to Microsoft","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableThirdPartyAddress":{"name":"enableThirdPartyAddress","type":"\u0004","is_mandatory":true,"title":"Whether to enable third-party reporting address","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"junkReviewResultMessage":{"name":"junkReviewResultMessage","type":"\u0007","is_mandatory":true,"title":"Custom message shown for junk review result","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notJunkReviewResultMessage":{"name":"notJunkReviewResultMessage","type":"\u0007","is_mandatory":true,"title":"Custom message shown for not junk review result","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notificationFooterMessage":{"name":"notificationFooterMessage","type":"\u0007","is_mandatory":true,"title":"Footer message for notifications","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notificationSenderAddresses":{"name":"notificationSenderAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Sender addresses for notifications","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"phishingReviewResultMessage":{"name":"phishingReviewResultMessage","type":"\u0007","is_mandatory":true,"title":"Custom message shown for phishing review result","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"postSubmitMessageEnabled":{"name":"postSubmitMessageEnabled","type":"\u0004","is_mandatory":true,"title":"Whether to show a message after submission","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"preSubmitMessageEnabled":{"name":"preSubmitMessageEnabled","type":"\u0004","is_mandatory":true,"title":"Whether to show a message before submission","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reportChatMessageEnabled":{"name":"reportChatMessageEnabled","type":"\u0004","is_mandatory":true,"title":"Whether chat message reporting is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reportChatMessageToCustomizedAddressEnabled":{"name":"reportChatMessageToCustomizedAddressEnabled","type":"\u0004","is_mandatory":true,"title":"Whether to report chat messages to a customized address","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reportJunkAddresses":{"name":"reportJunkAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Addresses to report junk","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reportJunkToCustomizedAddress":{"name":"reportJunkToCustomizedAddress","type":"\u0004","is_mandatory":true,"title":"Whether to report junk to a customized address","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reportNotJunkAddresses":{"name":"reportNotJunkAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Addresses to report not junk","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reportNotJunkToCustomizedAddress":{"name":"reportNotJunkToCustomizedAddress","type":"\u0004","is_mandatory":true,"title":"Whether to report not junk to a customized address","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reportPhishAddresses":{"name":"reportPhishAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"Addresses to report phish","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"reportPhishToCustomizedAddress":{"name":"reportPhishToCustomizedAddress","type":"\u0004","is_mandatory":true,"title":"Whether to report phish to a customized address","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Report Submission Policy configuration","private":true,"min_provider_version":"11.0.10","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.retentionPolicy":{"id":"ms365.exchangeonline.retentionPolicy","name":"ms365.exchangeonline.retentionPolicy","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"retentionId":{"name":"retentionId","type":"\u0007","is_mandatory":true,"title":"Retention ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"retentionPolicyTagLinks":{"name":"retentionPolicyTagLinks","type":"\u0019\u0007","is_mandatory":true,"title":"Retention policy tag links","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Retention Policy","private":true,"min_provider_version":"11.1.73","defaults":"name retentionPolicyTagLinks retentionId","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.roleAssignmentPolicyEntry":{"id":"ms365.exchangeonline.roleAssignmentPolicyEntry","name":"ms365.exchangeonline.roleAssignmentPolicyEntry","fields":{"assignedRoles":{"name":"assignedRoles","type":"\u0019\u0007","is_mandatory":true,"title":"Management roles assigned by the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"The policy description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether this is the default role assignment policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online role assignment policy","desc":"Single role assignment policy returned by Get-RoleAssignmentPolicy, selected by `name`. Each policy reports whether it is the tenant default, its `description`, and the management roles it assigns to mailboxes (for example MyProfileInformation or MyBaseOptions), which govern the self-service capabilities users have over their own mailbox.","private":true,"min_provider_version":"13.3.1","defaults":"name isDefault","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.safeAttachmentPolicyEntry":{"id":"ms365.exchangeonline.safeAttachmentPolicyEntry","name":"ms365.exchangeonline.safeAttachmentPolicyEntry","fields":{"action":{"name":"action","type":"\u0007","is_mandatory":true,"title":"Action for detected malware (Allow, Block, Replace, or DynamicDelivery)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enable":{"name":"enable","type":"\u0004","is_mandatory":true,"title":"Whether the policy is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"quarantineTag":{"name":"quarantineTag","type":"\u0007","is_mandatory":true,"title":"Quarantine policy applied to detected attachments","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"redirect":{"name":"redirect","type":"\u0004","is_mandatory":true,"title":"Whether detected messages are redirected","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"redirectAddress":{"name":"redirectAddress","type":"\u0007","is_mandatory":true,"title":"Address detected messages are redirected to","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online Safe Attachments policy","desc":"Single Defender for Office 365 Safe Attachments policy returned by Get-SafeAttachmentPolicy, selected by `name`. Each policy reports whether it is enabled, the `action` taken on detected malware (Allow, Block, Replace, or DynamicDelivery), and whether and where detected messages are redirected.","private":true,"min_provider_version":"13.3.1","defaults":"name enable action","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.safeLinksPolicyEntry":{"id":"ms365.exchangeonline.safeLinksPolicyEntry","name":"ms365.exchangeonline.safeLinksPolicyEntry","fields":{"allowClickThrough":{"name":"allowClickThrough","type":"\u0004","is_mandatory":true,"title":"Whether users can click through to the original URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"deliverMessageAfterScan":{"name":"deliverMessageAfterScan","type":"\u0004","is_mandatory":true,"title":"Whether messages are held until scanning completes","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"disableUrlRewrite":{"name":"disableUrlRewrite","type":"\u0004","is_mandatory":true,"title":"Whether URL rewriting is disabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableForInternalSenders":{"name":"enableForInternalSenders","type":"\u0004","is_mandatory":true,"title":"Whether scanning applies to internal senders","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableSafeLinksForEmail":{"name":"enableSafeLinksForEmail","type":"\u0004","is_mandatory":true,"title":"Whether Safe Links scanning applies to email","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableSafeLinksForOffice":{"name":"enableSafeLinksForOffice","type":"\u0004","is_mandatory":true,"title":"Whether Safe Links scanning applies to Office apps","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enableSafeLinksForTeams":{"name":"enableSafeLinksForTeams","type":"\u0004","is_mandatory":true,"title":"Whether Safe Links scanning applies to Microsoft Teams","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"scanUrls":{"name":"scanUrls","type":"\u0004","is_mandatory":true,"title":"Whether URLs are scanned in real time","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"trackClicks":{"name":"trackClicks","type":"\u0004","is_mandatory":true,"title":"Whether user clicks are tracked","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online Safe Links policy","desc":"Single Defender for Office 365 Safe Links policy returned by Get-SafeLinksPolicy, selected by `name`. Each policy reports which workloads URL scanning covers (email, Teams, and Office apps), whether clicks are tracked, whether users may click through to the original URL, and whether URL rewriting is disabled.","private":true,"min_provider_version":"13.3.1","defaults":"name enableSafeLinksForEmail","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.securityAndCompliance":{"id":"ms365.exchangeonline.securityAndCompliance","name":"ms365.exchangeonline.securityAndCompliance","fields":{"dlpCompliancePolicies":{"name":"dlpCompliancePolicies","type":"\u0019\n","title":"Data Loss Prevention (DLP) compliance policies as raw dictionaries","desc":"Deprecated in favor of dlpPolicies, which models the same policies as typed resources.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"dlpPolicies":{"name":"dlpPolicies","type":"\u0019\u001bms365.exchangeonline.dlpCompliancePolicy","title":"Data Loss Prevention (DLP) compliance policies","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"dlpRules":{"name":"dlpRules","type":"\u0019\u001bms365.exchangeonline.dlpComplianceRule","title":"Data Loss Prevention (DLP) compliance rules","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Exchange Online Security and Compliance","private":true,"min_provider_version":"11.1.41","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.sharingPolicyEntry":{"id":"ms365.exchangeonline.sharingPolicyEntry","name":"ms365.exchangeonline.sharingPolicyEntry","fields":{"domains":{"name":"domains","type":"\u0019\u0007","is_mandatory":true,"title":"Domains and sharing actions defined by the policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the policy is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The policy identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether this is the default sharing policy","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The policy name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online sharing policy","desc":"Single calendar and contact sharing policy returned by Get-SharingPolicy, selected by `name`. The `enabled` field reports whether the policy is active, `isDefault` reports whether it is the tenant default, and the `domains` field lists which external domains may be shared with and at what level.","private":true,"min_provider_version":"13.3.1","defaults":"name enabled isDefault","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.teamsProtectionPolicy":{"id":"ms365.exchangeonline.teamsProtectionPolicy","name":"ms365.exchangeonline.teamsProtectionPolicy","fields":{"isValid":{"name":"isValid","type":"\u0004","is_mandatory":true,"title":"Whether the policy configuration is considered valid","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"zapEnabled":{"name":"zapEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Zero-hour Auto Purge (ZAP) is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Teams Protection Policy configuration","private":true,"min_provider_version":"11.0.8","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonline.transportRuleEntry":{"id":"ms365.exchangeonline.transportRuleEntry","name":"ms365.exchangeonline.transportRuleEntry","fields":{"comments":{"name":"comments","type":"\u0007","is_mandatory":true,"title":"Administrator comments on the rule","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"The rule identity","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"mode":{"name":"mode","type":"\u0007","is_mandatory":true,"title":"Rule operating mode (Enforce, Audit, or AuditAndNotify)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The rule name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Rule evaluation priority (lower runs first)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"routeMessageOutboundRequireTls":{"name":"routeMessageOutboundRequireTls","type":"\u0004","is_mandatory":true,"title":"Whether the rule forces matching messages to be routed outbound over TLS","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"senderDomainIs":{"name":"senderDomainIs","type":"\u0019\u0007","is_mandatory":true,"title":"Sender domains the rule matches on","min_provider_version":"13.5.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether the rule is enabled or disabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Exchange Online mail flow transport rule","desc":"Single mail flow rule returned by Get-TransportRule, selected by `name`. Each rule reports its evaluation `priority` (lower numbers run first), enablement `state`, operating `mode`, administrator `comments`, and whether it forces outbound TLS via `routeMessageOutboundRequireTls`. The full condition and action set of a rule remains available through the deprecated `transportRule` dictionary.","private":true,"min_provider_version":"13.3.1","defaults":"name state priority","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.exchangeonlineMailboxAuditBypassAssociation":{"id":"ms365.exchangeonlineMailboxAuditBypassAssociation","name":"ms365.exchangeonlineMailboxAuditBypassAssociation","fields":{"auditBypassEnabled":{"name":"auditBypassEnabled","type":"\u0004","is_mandatory":true,"title":"Whether mailbox audit logging is bypassed for this account","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"The name of the user or computer account","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Mailbox audit bypass association","desc":"User or computer account that is exempted from mailbox audit logging in Exchange Online. When auditBypassEnabled is true, the account's mailbox access and actions are excluded from the mailbox audit log, so its activity leaves no audit trail. Review these associations to confirm that no account has been silently exempted from auditing, since bypass entries can conceal privileged or malicious mailbox access. The account is identified by name.","private":true,"min_provider_version":"11.1.43","defaults":"name auditBypassEnabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.sharepointonline":{"id":"ms365.sharepointonline","name":"ms365.sharepointonline","fields":{"defaultLinkPermission":{"name":"defaultLinkPermission","type":"\u0007","title":"The default link permission for the tenant","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"site":{"name":"site","type":"\u001bms365.sharepointonline.site","title":"Microsoft 365 SharePoint Site","desc":"SharePoint Online site collection with its external-sharing capability, custom-script permission, conditional access restrictions, and lock state. Query the collection to find sites that permit external sharing or allow custom script execution, both of which widen the tenant's exposure.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"spoSites":{"name":"spoSites","type":"\u0019\u001bms365.sharepointonline.site","title":"SharePoint Online tenant sites","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"spoTenant":{"name":"spoTenant","type":"\n","title":"SharePoint Online tenant settings as a raw dictionary","desc":"Deprecated in favor of tenantConfiguration, which models the security-relevant settings as individual fields.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"spoTenantSyncClientRestriction":{"name":"spoTenantSyncClientRestriction","type":"\n","title":"OneDrive sync client access restrictions for the tenant","desc":"Raw configuration governing which machines may sync SharePoint and OneDrive content. Keys include `TenantRestrictionEnabled` (whether syncing is limited to domain-joined machines on the safe recipient list), `AllowedDomainList` (the safe recipient domain GUIDs), `BlockMacSync` (whether Mac clients are blocked from syncing), and `GrooveBlockOption` (whether the legacy OneDrive for Business sync client is allowed).","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"tenantConfig":{"name":"tenantConfig","type":"\u001bms365.sharepointonline.tenantConfig","title":"Microsoft 365 SharePoint Online tenant configuration","desc":"Tenant-wide SharePoint Online and OneDrive sharing and security settings, including external sharing capability, domain restrictions, anonymous link controls, guest expiration, and access protections that apply across all sites in the tenant.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"tenantConfiguration":{"name":"tenantConfiguration","type":"\u001bms365.sharepointonline.tenantConfig","title":"SharePoint Online tenant configuration","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 SharePoint Online","desc":"SharePoint Online and OneDrive governance for the tenant, spanning the tenant-wide sharing and security configuration, OneDrive sync client access controls, and the inventory of site collections with their external-sharing and custom-script settings. Query it to audit how broadly content can be shared outside the organization and whether device and script protections are enforced.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.sharepointonline.site":{"id":"ms365.sharepointonline.site","name":"ms365.sharepointonline.site","fields":{"allowSelfServiceUpgrade":{"name":"allowSelfServiceUpgrade","type":"\u0004","is_mandatory":true,"title":"Whether site collection administrators can upgrade the site","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"conditionalAccessPolicy":{"name":"conditionalAccessPolicy","type":"\u0007","is_mandatory":true,"title":"Access control for unmanaged devices","desc":"One of AllowFullAccess, AllowLimitedAccess, BlockAccess, or AuthenticationContext, set when the site is governed by a conditional access policy that restricts access from unmanaged devices.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"denyAddAndCustomizePages":{"name":"denyAddAndCustomizePages","type":"\u0004","is_mandatory":true,"title":"Whether adding and customizing pages is denied on the site","desc":"When true, users cannot run custom script on the site, which is the secure setting. A false value permits custom script, which can be used to inject malicious code into pages.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"lockState":{"name":"lockState","type":"\u0007","is_mandatory":true,"title":"The site lock state","desc":"One of Unlock, ReadOnly, or NoAccess.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"The site owner","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharingCapability":{"name":"sharingCapability","type":"\u0007","is_mandatory":true,"title":"External sharing capability for the site","desc":"One of Disabled, ExistingExternalUserSharingOnly, ExternalUserSharingOnly, or ExternalUserAndGuestSharing, controlling whether and how content can be shared with users outside the organization.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"The site status","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"template":{"name":"template","type":"\u0007","is_mandatory":true,"title":"The site template identifier","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"The site title","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"The site URL","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 SharePoint Site","desc":"SharePoint Online site collection with its external-sharing capability, custom-script permission, conditional access restrictions, and lock state. Query the collection to find sites that permit external sharing or allow custom script execution, both of which widen the tenant's exposure.","private":true,"min_provider_version":"9.2.10","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.sharepointonline.tenantConfig":{"id":"ms365.sharepointonline.tenantConfig","name":"ms365.sharepointonline.tenantConfig","fields":{"conditionalAccessPolicy":{"name":"conditionalAccessPolicy","type":"\u0007","is_mandatory":true,"title":"Conditional access policy applied to SharePoint and OneDrive","desc":"One of AllowFullAccess, AllowLimitedAccess, BlockAccess, or AuthenticationContext.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"defaultLinkPermission":{"name":"defaultLinkPermission","type":"\u0007","is_mandatory":true,"title":"Default permission granted by sharing links","desc":"One of None, View, or Edit.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"defaultSharingLinkType":{"name":"defaultSharingLinkType","type":"\u0007","is_mandatory":true,"title":"Default type of sharing link created by users","desc":"One of None, Direct, Internal, or AnonymousAccess.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"disallowInfectedFileDownload":{"name":"disallowInfectedFileDownload","type":"\u0004","is_mandatory":true,"title":"Whether downloading files detected as infected is blocked","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"emailAttestationReAuthDays":{"name":"emailAttestationReAuthDays","type":"\u0005","is_mandatory":true,"title":"Number of days before guests must reattest their email","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"emailAttestationRequired":{"name":"emailAttestationRequired","type":"\u0004","is_mandatory":true,"title":"Whether guests must reconfirm their email after a period","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"externalUserExpirationRequired":{"name":"externalUserExpirationRequired","type":"\u0004","is_mandatory":true,"title":"Whether guest access expires automatically","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"externalUserExpireInDays":{"name":"externalUserExpireInDays","type":"\u0005","is_mandatory":true,"title":"Number of days before guest access expires","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isUnmanagedSyncClientForTenantRestricted":{"name":"isUnmanagedSyncClientForTenantRestricted","type":"\u0004","is_mandatory":true,"title":"Whether unmanaged devices are restricted from using the sync client","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"legacyAuthProtocolsEnabled":{"name":"legacyAuthProtocolsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether legacy authentication protocols are enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"notifyOwnersWhenItemsReshared":{"name":"notifyOwnersWhenItemsReshared","type":"\u0004","is_mandatory":true,"title":"Whether owners are notified when items are reshared","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"preventExternalUsersFromResharing":{"name":"preventExternalUsersFromResharing","type":"\u0004","is_mandatory":true,"title":"Whether external users are prevented from resharing content","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"requireAcceptingAccountMatchInvitedAccount":{"name":"requireAcceptingAccountMatchInvitedAccount","type":"\u0004","is_mandatory":true,"title":"Whether external users must accept invitations with the account they were invited as","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"requireAnonymousLinksExpireInDays":{"name":"requireAnonymousLinksExpireInDays","type":"\u0005","is_mandatory":true,"title":"Number of days after which anonymous links expire","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharingAllowedDomainList":{"name":"sharingAllowedDomainList","type":"\u0007","is_mandatory":true,"title":"Space-delimited list of domains allowed for external sharing","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharingBlockedDomainList":{"name":"sharingBlockedDomainList","type":"\u0007","is_mandatory":true,"title":"Space-delimited list of domains blocked from external sharing","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharingCapability":{"name":"sharingCapability","type":"\u0007","is_mandatory":true,"title":"External sharing capability for the tenant","desc":"One of Disabled, ExistingExternalUserSharingOnly, ExternalUserSharingOnly, or ExternalUserAndGuestSharing, setting the most permissive sharing allowed across the tenant.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharingDomainRestrictionMode":{"name":"sharingDomainRestrictionMode","type":"\u0007","is_mandatory":true,"title":"Domain restriction mode for external sharing","desc":"One of None, AllowList, or BlockList, controlling whether external sharing is limited by the allowed or blocked domain lists.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"showAllUsersClaim":{"name":"showAllUsersClaim","type":"\u0004","is_mandatory":true,"title":"Whether the \"All Users\" claim is shown in people pickers","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"showEveryoneClaim":{"name":"showEveryoneClaim","type":"\u0004","is_mandatory":true,"title":"Whether the \"Everyone\" claim is shown in people pickers","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"showEveryoneExceptExternalUsersClaim":{"name":"showEveryoneExceptExternalUsersClaim","type":"\u0004","is_mandatory":true,"title":"Whether the \"Everyone except external users\" claim is shown in people pickers","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 SharePoint Online tenant configuration","desc":"Tenant-wide SharePoint Online and OneDrive sharing and security settings, including external sharing capability, domain restrictions, anonymous link controls, guest expiration, and access protections that apply across all sites in the tenant.","private":true,"min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.teams":{"id":"ms365.teams","name":"ms365.teams","fields":{"channel":{"name":"channel","type":"\u001bms365.teams.channel","title":"Microsoft Teams channel","desc":"A single channel within a team, covering the channel display name, description, email address, web URL, creation time, and archived state. The membershipType field (standard, private, or shared) is a key governance signal because private and shared channels narrow who can participate.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"clientConfig":{"name":"clientConfig","type":"\u001bms365.teams.clientConfig","title":"Microsoft 365 Teams client configuration","desc":"Tenant-wide Teams client feature controls, including which third-party cloud storage providers (Dropbox, Box, Google Drive, ShareFile, Egnyte) users can attach, whether guest access and Skype for Business interoperability are permitted, and email-into-channel behavior. Audit these to confirm data-egress paths and guest access match policy.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"clientConfiguration":{"name":"clientConfiguration","type":"\u001bms365.teams.clientConfig","title":"Teams client configuration","desc":"Tenant-wide Teams client feature controls covering third-party cloud storage providers (Dropbox, Box, Google Drive, ShareFile, Egnyte), guest access, and Skype for Business interoperability.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"csTeamsClientConfiguration":{"name":"csTeamsClientConfiguration","type":"\n","title":"Teams client configuration as a raw dictionary","desc":"Deprecated in favor of clientConfiguration, which models the same settings as individual fields.","provider":"go.mondoo.com/cnquery/v9/providers/ms365","maturity":"deprecated"},"csTeamsMeetingPolicy":{"name":"csTeamsMeetingPolicy","type":"\u001bms365.teams.teamsMeetingPolicyConfig","title":"Teams meeting policy configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"csTeamsMessagingPolicy":{"name":"csTeamsMessagingPolicy","type":"\u001bms365.teams.teamsMessagingPolicyConfig","title":"Teams message policy configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"csTenantFederationConfiguration":{"name":"csTenantFederationConfiguration","type":"\u001bms365.teams.tenantFederationConfig","title":"Teams tenant federated configuration","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"team":{"name":"team","type":"\u001bms365.teams.team","title":"Microsoft Teams team","desc":"A single team provisioned in the tenant, selected by its group id (for example ms365.teams.teams.where(id == \"...\")). Beyond identity and lifecycle (display name, visibility, classification, archived state) it exposes the team's governance settings: whether members and guests can create, update, or delete channels, create private channels, and add apps, tabs, and connectors, along with the message-deletion and mention controls and the Giphy, stickers, and custom-meme content settings. Use channels to enumerate the team's channels.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"teams":{"name":"teams","type":"\u0019\u001bms365.teams.team","title":"Teams (group-backed) provisioned in the tenant","min_provider_version":"13.3.1","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"teamsMeetingPolicyConfig":{"name":"teamsMeetingPolicyConfig","type":"\u001bms365.teams.teamsMeetingPolicyConfig","title":"Microsoft 365 Teams meeting policy configuration","desc":"Meeting controls that govern who can join and start meetings, lobby admission for anonymous and external participants, presenter roles, chat, cloud recording and its storage region, transcription, and toll-bypass. Audit these to enforce lobby screening and to control meeting recording.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"teamsMessagingPolicyConfig":{"name":"teamsMessagingPolicyConfig","type":"\u001bms365.teams.teamsMessagingPolicyConfig","title":"Microsoft 365 Teams messaging policy configuration","desc":"Chat and messaging controls covering whether users can chat, edit or delete their own messages, whether owners can delete others' messages, read-receipt behavior, and end-user security reporting of malicious messages.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true},"tenantFederationConfig":{"name":"tenantFederationConfig","type":"\u001bms365.teams.tenantFederationConfig","title":"Microsoft 365 Teams tenant federation configuration","desc":"External access and federation settings that determine which outside organizations and consumer (personal) Teams accounts users can communicate with. The allowedDomains and blockedDomains lists, allowFederatedUsers, and allowTeamsConsumer settings define the tenant's external-communication boundary, a key control against data exfiltration.","is_private":true,"provider":"go.mondoo.com/cnquery/v9/providers/ms365","is_implicit_resource":true}},"title":"Microsoft 365 Teams","desc":"Tenant-wide Microsoft Teams configuration and inventory. Covers the client feature controls, external access and federation settings, meeting policy (lobby admission, recording, and participant controls), and messaging policy (chat and security reporting), plus the teams provisioned in the tenant and their channels. Audit these to verify guest access, external federation, meeting recording, and lobby screening are governed to policy.","min_provider_version":"9.0.0","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.teams.channel":{"id":"ms365.teams.channel","name":"ms365.teams.channel","fields":{"createdDateTime":{"name":"createdDateTime","type":"\t","is_mandatory":true,"title":"Date and time the channel was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Channel description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Channel display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Email address for sending messages to the channel","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Channel ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isArchived":{"name":"isArchived","type":"\u0004","is_mandatory":true,"title":"Whether the channel is archived","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"membershipType":{"name":"membershipType","type":"\u0007","is_mandatory":true,"title":"Channel membership type (standard, private, shared, unknownFutureValue)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"webUrl":{"name":"webUrl","type":"\u0007","is_mandatory":true,"title":"URL that opens the channel in the Teams client","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Teams channel","desc":"A single channel within a team, covering the channel display name, description, email address, web URL, creation time, and archived state. The membershipType field (standard, private, or shared) is a key governance signal because private and shared channels narrow who can participate.","private":true,"min_provider_version":"13.3.1","defaults":"displayName membershipType","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.teams.clientConfig":{"id":"ms365.teams.clientConfig","name":"ms365.teams.clientConfig","fields":{"allowBox":{"name":"allowBox","type":"\u0004","is_mandatory":true,"title":"Whether Box is allowed as a third-party cloud storage provider","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowDropBox":{"name":"allowDropBox","type":"\u0004","is_mandatory":true,"title":"Whether Dropbox is allowed as a third-party cloud storage provider","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowEgnyte":{"name":"allowEgnyte","type":"\u0004","is_mandatory":true,"title":"Whether Egnyte is allowed as a third-party cloud storage provider","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowEmailIntoChannel":{"name":"allowEmailIntoChannel","type":"\u0004","is_mandatory":true,"title":"Whether users can send email to a channel email address","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowGoogleDrive":{"name":"allowGoogleDrive","type":"\u0004","is_mandatory":true,"title":"Whether Google Drive is allowed as a third-party cloud storage provider","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowGuestUser":{"name":"allowGuestUser","type":"\u0004","is_mandatory":true,"title":"Whether guest users are allowed in Teams","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowOrganizationTab":{"name":"allowOrganizationTab","type":"\u0004","is_mandatory":true,"title":"Whether the organization tab is allowed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowResourceAccountSendMessage":{"name":"allowResourceAccountSendMessage","type":"\u0004","is_mandatory":true,"title":"Whether resource accounts can send messages","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowScopedPeopleSearchandAccess":{"name":"allowScopedPeopleSearchandAccess","type":"\u0004","is_mandatory":true,"title":"Whether scoped people search and access is allowed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowShareFile":{"name":"allowShareFile","type":"\u0004","is_mandatory":true,"title":"Whether ShareFile is allowed as a third-party cloud storage provider","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowSkypeBusinessInterop":{"name":"allowSkypeBusinessInterop","type":"\u0004","is_mandatory":true,"title":"Whether Skype for Business interoperability is allowed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"contentPin":{"name":"contentPin","type":"\u0007","is_mandatory":true,"title":"PIN requirement for accessing meeting content","desc":"One of NotRequired, RequiredOutsideScheduleMeeting, or AlwaysRequired.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Teams client configuration","desc":"Tenant-wide Teams client feature controls, including which third-party cloud storage providers (Dropbox, Box, Google Drive, ShareFile, Egnyte) users can attach, whether guest access and Skype for Business interoperability are permitted, and email-into-channel behavior. Audit these to confirm data-egress paths and guest access match policy.","private":true,"min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.teams.team":{"id":"ms365.teams.team","name":"ms365.teams.team","fields":{"allowAddRemoveApps":{"name":"allowAddRemoveApps","type":"\u0004","title":"Whether members can add and remove apps","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowChannelMentions":{"name":"allowChannelMentions","type":"\u0004","title":"Whether @channel mentions are allowed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowCreatePrivateChannels":{"name":"allowCreatePrivateChannels","type":"\u0004","title":"Whether members can create private channels","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowCreateUpdateChannels":{"name":"allowCreateUpdateChannels","type":"\u0004","title":"Whether members can create and update channels","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowCreateUpdateRemoveConnectors":{"name":"allowCreateUpdateRemoveConnectors","type":"\u0004","title":"Whether members can create, update, and remove connectors","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowCreateUpdateRemoveTabs":{"name":"allowCreateUpdateRemoveTabs","type":"\u0004","title":"Whether members can create, update, and remove tabs","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowCustomMemes":{"name":"allowCustomMemes","type":"\u0004","title":"Whether custom memes can be uploaded and used","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowDeleteChannels":{"name":"allowDeleteChannels","type":"\u0004","title":"Whether members can delete channels","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowGiphy":{"name":"allowGiphy","type":"\u0004","title":"Whether Giphy can be used in conversations","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowOwnerDeleteMessages":{"name":"allowOwnerDeleteMessages","type":"\u0004","title":"Whether team owners can delete messages sent by others","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowStickersAndMemes":{"name":"allowStickersAndMemes","type":"\u0004","title":"Whether stickers and memes can be used","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowTeamMentions":{"name":"allowTeamMentions","type":"\u0004","title":"Whether @team mentions are allowed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowUserDeleteMessages":{"name":"allowUserDeleteMessages","type":"\u0004","title":"Whether users can delete their own sent messages","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowUserEditMessages":{"name":"allowUserEditMessages","type":"\u0004","title":"Whether users can edit their own sent messages","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"channels":{"name":"channels","type":"\u0019\u001bms365.teams.channel","title":"Channels in the team","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"classification":{"name":"classification","type":"\u0007","title":"Team data classification","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"createdDateTime":{"name":"createdDateTime","type":"\t","title":"Date and time the team was created","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Team description","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Team display name","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"giphyContentRating":{"name":"giphyContentRating","type":"\u0007","title":"Giphy content rating (moderate, strict)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"guestAllowCreateUpdateChannels":{"name":"guestAllowCreateUpdateChannels","type":"\u0004","title":"Whether guests can create and update channels","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"guestAllowDeleteChannels":{"name":"guestAllowDeleteChannels","type":"\u0004","title":"Whether guests can delete channels","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Team (group) ID","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"isArchived":{"name":"isArchived","type":"\u0004","title":"Whether the team is archived","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"specialization":{"name":"specialization","type":"\u0007","title":"Team specialization","desc":"One of none, educationStandard, educationClass, educationProfessionalLearningCommunity, educationStaff, healthcareStandard, or healthcareCareCoordination.","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"visibility":{"name":"visibility","type":"\u0007","title":"Team visibility (public, private, hiddenMembership)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"webUrl":{"name":"webUrl","type":"\u0007","title":"URL that opens the team in the Teams client","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft Teams team","desc":"A single team provisioned in the tenant, selected by its group id (for example ms365.teams.teams.where(id == \"...\")). Beyond identity and lifecycle (display name, visibility, classification, archived state) it exposes the team's governance settings: whether members and guests can create, update, or delete channels, create private channels, and add apps, tabs, and connectors, along with the message-deletion and mention controls and the Giphy, stickers, and custom-meme content settings. Use channels to enumerate the team's channels.","private":true,"min_provider_version":"13.3.1","defaults":"displayName description visibility","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.teams.teamsMeetingPolicyConfig":{"id":"ms365.teams.teamsMeetingPolicyConfig","name":"ms365.teams.teamsMeetingPolicyConfig","fields":{"allowAnonymousUsersToJoinMeeting":{"name":"allowAnonymousUsersToJoinMeeting","type":"\u0004","is_mandatory":true,"title":"Whether anonymous users are allowed to join","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowAnonymousUsersToStartMeeting":{"name":"allowAnonymousUsersToStartMeeting","type":"\u0004","is_mandatory":true,"title":"Whether anonymous users are allowed to start the meeting","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowCloudRecording":{"name":"allowCloudRecording","type":"\u0004","is_mandatory":true,"title":"Whether cloud recording is allowed for meetings","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowCloudRecordingForCalls":{"name":"allowCloudRecordingForCalls","type":"\u0004","is_mandatory":true,"title":"Whether cloud recording is allowed for calls","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowExternalNonTrustedMeetingChat":{"name":"allowExternalNonTrustedMeetingChat","type":"\u0004","is_mandatory":true,"title":"Whether external meeting chat is allowed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowExternalParticipantGiveRequestControl":{"name":"allowExternalParticipantGiveRequestControl","type":"\u0004","is_mandatory":true,"title":"Whether external participants can give or request control of the meeting","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowPSTNUsersToBypassLobby":{"name":"allowPSTNUsersToBypassLobby","type":"\u0004","is_mandatory":true,"title":"Whether public switched telephone network (PSTN) users can bypass the lobby","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowParticipantGiveRequestControl":{"name":"allowParticipantGiveRequestControl","type":"\u0004","is_mandatory":true,"title":"Whether internal participants can give or request control of the meeting","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowRecordingStorageOutsideRegion":{"name":"allowRecordingStorageOutsideRegion","type":"\u0004","is_mandatory":true,"title":"Whether meeting recordings can be stored outside the data residency region","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowSecurityEndUserReporting":{"name":"allowSecurityEndUserReporting","type":"\u0004","is_mandatory":true,"title":"Whether users can report security concerns","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowTranscription":{"name":"allowTranscription","type":"\u0004","is_mandatory":true,"title":"Whether live transcription is allowed in meetings","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"autoAdmittedUsers":{"name":"autoAdmittedUsers","type":"\u0007","is_mandatory":true,"title":"Who can bypass the lobby","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"designatedPresenterRoleMode":{"name":"designatedPresenterRoleMode","type":"\u0007","is_mandatory":true,"title":"Designated presenter role mode","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"meetingChatEnabledType":{"name":"meetingChatEnabledType","type":"\u0007","is_mandatory":true,"title":"Whether meeting chat is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"preventTollBypass":{"name":"preventTollBypass","type":"\u0004","is_mandatory":true,"title":"Whether dial-in callers are forced to use the conferencing toll number","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Teams meeting policy configuration","desc":"Meeting controls that govern who can join and start meetings, lobby admission for anonymous and external participants, presenter roles, chat, cloud recording and its storage region, transcription, and toll-bypass. Audit these to enforce lobby screening and to control meeting recording.","private":true,"min_provider_version":"9.2.9","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.teams.teamsMessagingPolicyConfig":{"id":"ms365.teams.teamsMessagingPolicyConfig","name":"ms365.teams.teamsMessagingPolicyConfig","fields":{"allowOwnerDeleteMessage":{"name":"allowOwnerDeleteMessage","type":"\u0004","is_mandatory":true,"title":"Whether team owners can delete messages sent by others","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowSecurityEndUserReporting":{"name":"allowSecurityEndUserReporting","type":"\u0004","is_mandatory":true,"title":"Whether users can report security concerns","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowUserChat":{"name":"allowUserChat","type":"\u0004","is_mandatory":true,"title":"Whether users can use chat","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowUserDeleteChat":{"name":"allowUserDeleteChat","type":"\u0004","is_mandatory":true,"title":"Whether users can delete chats they participate in","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowUserDeleteMessage":{"name":"allowUserDeleteMessage","type":"\u0004","is_mandatory":true,"title":"Whether users can delete their own sent messages","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"readReceiptsEnabledType":{"name":"readReceiptsEnabledType","type":"\u0007","is_mandatory":true,"title":"Read receipt control mode","desc":"One of UserPreference, Everyone, or None, indicating whether read receipts are user-controlled, forced on, or forced off.","min_provider_version":"13.2.2","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Teams messaging policy configuration","desc":"Chat and messaging controls covering whether users can chat, edit or delete their own messages, whether owners can delete others' messages, read-receipt behavior, and end-user security reporting of malicious messages.","private":true,"min_provider_version":"11.0.10","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"ms365.teams.tenantFederationConfig":{"id":"ms365.teams.tenantFederationConfig","name":"ms365.teams.tenantFederationConfig","fields":{"allowFederatedUsers":{"name":"allowFederatedUsers","type":"\u0004","is_mandatory":true,"title":"Whether federated users are allowed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowPublicUsers":{"name":"allowPublicUsers","type":"\u0004","is_mandatory":true,"title":"Whether public users are allowed","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowTeamsConsumer":{"name":"allowTeamsConsumer","type":"\u0004","is_mandatory":true,"title":"Whether to allow external Teams consumers","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowTeamsConsumerInbound":{"name":"allowTeamsConsumerInbound","type":"\u0004","is_mandatory":true,"title":"Whether to allow inbound communication with external Teams consumers","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"allowedDomains":{"name":"allowedDomains","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed domains","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"blockedDomains":{"name":"blockedDomains","type":"\u0019\u0007","is_mandatory":true,"title":"Blocked domains","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"externalAccessWithTrialTenants":{"name":"externalAccessWithTrialTenants","type":"\u0007","is_mandatory":true,"title":"Whether external access with trial tenants is allowed (Allowed or Blocked)","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"ID of the collection of tenant federation configuration settings","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"restrictTeamsConsumerToExternalUserProfiles":{"name":"restrictTeamsConsumerToExternalUserProfiles","type":"\u0004","is_mandatory":true,"title":"Whether to restrict Teams consumer to external user profiles","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"sharedSipAddressSpace":{"name":"sharedSipAddressSpace","type":"\u0004","is_mandatory":true,"title":"Whether shared SIP address space is enabled","provider":"go.mondoo.com/cnquery/v9/providers/ms365"},"treatDiscoveredPartnersAsUnverified":{"name":"treatDiscoveredPartnersAsUnverified","type":"\u0004","is_mandatory":true,"title":"Whether to treat discovered partners as unverified","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}},"title":"Microsoft 365 Teams tenant federation configuration","desc":"External access and federation settings that determine which outside organizations and consumer (personal) Teams accounts users can communicate with. The allowedDomains and blockedDomains lists, allowFederatedUsers, and allowTeamsConsumer settings define the tenant's external-communication boundary, a key control against data exfiltration.","private":true,"min_provider_version":"9.2.9","provider":"go.mondoo.com/cnquery/v9/providers/ms365"}}}