microsoftgraph · gavinbarron · Jan 22, 2026 · Jan 20, 2026
@@ -772700,6 +772700,8 @@ components:
               type: string
               description: The name of the policy to be created.
               nullable: true
+            isEnabled:
+              type: boolean
             lastModifiedBy:
               anyOf:
                 - $ref: '#/components/schemas/microsoft.graph.identitySet'
@@ -772712,6 +772714,11 @@ components:
               description: The timestamp of the last modification of the policy.
               format: date-time
               nullable: true
+            protectionPolicyArtifactCount:
+              anyOf:
+                - $ref: '#/components/schemas/microsoft.graph.protectionPolicyArtifactCount'
+                - type: object
+                  nullable: true
             retentionSettings:
               type: array
               items:
@@ -775213,7 +775220,7 @@ components:
               description: 'Contains the list of identifiersUris, copied over from the associated application. Additional values can be added to hybrid applications. These values can be used to identify the permissions exposed by this app within Microsoft Entra ID. For example,Client apps can specify a resource URI that is based on the values of this property to acquire an access token, which is the URI returned in the ''aud'' claim.The any operator is required for filter expressions on multi-valued properties. Not nullable.  Supports $filter (eq, not, ge, le, startsWith).'
             servicePrincipalType:
               type: string
-              description: 'Identifies whether the service principal represents an application, a managed identity, or a legacy application. This is set by Microsoft Entra ID internally. The servicePrincipalType property can be set to three different values: Application - A service principal that represents an application or service. The appId property identifies the associated app registration, and matches the appId of an application, possibly from a different tenant. If the associated app registration is missing, tokens aren''t issued for the service principal.ManagedIdentity - A service principal that represents a managed identity. Service principals representing managed identities can be granted access and permissions, but can''t be updated or modified directly.Legacy - A service principal that represents an app created before app registrations, or through legacy experiences. A legacy service principal can have credentials, service principal names, reply URLs, and other properties that are editable by an authorized user, but doesn''t have an associated app registration. The appId value doesn''t associate the service principal with an app registration. The service principal can only be used in the tenant where it was created.SocialIdp - For internal use.'
+              description: 'Identifies whether the service principal represents an application, a managed identity, or a legacy application. This property is set by Microsoft Entra ID internally. The servicePrincipalType property can be set to three different values: Application - A service principal that represents an application or service. The appId property identifies the associated app registration, and matches the appId of an application, possibly from a different tenant. If the associated app registration is missing, tokens aren''t issued for the service principal.ManagedIdentity - A service principal that represents a managed identity. Service principals representing managed identities can be granted access and permissions, but can''t be updated or modified directly.Legacy - A service principal that represents an app created before app registrations, or through legacy experiences. A legacy service principal can have credentials, service principal names, reply URLs, and other properties that are editable by an authorized user, but doesn''t have an associated app registration. The appId value doesn''t associate the service principal with an app registration. The service principal can only be used in the tenant where it was created.ServiceIdentity - A service principal that represents an agent identity.SocialIdp - For internal use.'
               nullable: true
             signInAudience:
               type: string
@@ -799950,6 +799957,34 @@ components:
         labelId:
           type: string
           description: The unique identifier for the sensitivity label applied to the content.
+    microsoft.graph.protectionPolicyArtifactCount:
+      title: protectionPolicyArtifactCount
+      type: object
+      properties:
+        completed:
+          maximum: 2147483647
+          minimum: -2147483648
+          type: number
+          format: int32
+          nullable: true
+        failed:
+          maximum: 2147483647
+          minimum: -2147483648
+          type: number
+          format: int32
+          nullable: true
+        inProgress:
+          maximum: 2147483647
+          minimum: -2147483648
+          type: number
+          format: int32
+          nullable: true
+        total:
+          maximum: 2147483647
+          minimum: -2147483648
+          type: number
+          format: int32
+          nullable: true
     microsoft.graph.provisionChannelEmailResult:
       title: provisionChannelEmailResult
       type: object
@@ -821413,7 +821448,7 @@ components:
                 - $ref: '#/components/schemas/microsoft.graph.security.detectionSource'
                 - type: object
                   nullable: true
-              description: 'Detection technology or sensor that identified the notable component or activity. The possible values are: unknown, microsoftDefenderForEndpoint, antivirus, smartScreen, customTi, microsoftDefenderForOffice365, automatedInvestigation, microsoftThreatExperts, customDetection, microsoftDefenderForIdentity, cloudAppSecurity, microsoft365Defender, azureAdIdentityProtection, manual, microsoftDataLossPrevention, appGovernancePolicy, appGovernanceDetection, unknownFutureValue, microsoftDefenderForCloud, microsoftDefenderForIoT, microsoftDefenderForServers, microsoftDefenderForStorage, microsoftDefenderForDNS, microsoftDefenderForDatabases, microsoftDefenderForContainers, microsoftDefenderForNetwork, microsoftDefenderForAppService, microsoftDefenderForKeyVault, microsoftDefenderForResourceManager, microsoftDefenderForApiManagement, microsoftSentinel, nrtAlerts, scheduledAlerts, microsoftDefenderThreatIntelligenceAnalytics, builtInMl, microsoftThreatIntelligence, microsoftDefenderForAIServices, securityCopilot. Use the Prefer: include-unknown-enum-members request header to get the following values in this evolvable enum: microsoftDefenderForCloud, microsoftDefenderForIoT, microsoftDefenderForServers, microsoftDefenderForStorage, microsoftDefenderForDNS, microsoftDefenderForDatabases, microsoftDefenderForContainers, microsoftDefenderForNetwork, microsoftDefenderForAppService, microsoftDefenderForKeyVault, microsoftDefenderForResourceManager, microsoftDefenderForApiManagement, microsoftSentinel, nrtAlerts, scheduledAlerts, microsoftDefenderThreatIntelligenceAnalytics, builtInMl, microsoftThreatIntelligence, microsoftDefenderForAIServices, securityCopilot.'
+              description: Detection technology or sensor that identified the notable component or activity.
             detectorId:
               type: string
               description: The ID of the detector that triggered the alert.
@@ -822954,6 +822989,12 @@ components:
               type: string
               description: Time when the incident was last updated.
               format: date-time
+            priorityScore:
+              maximum: 2147483647
+              minimum: -2147483648
+              type: number
+              format: int32
+              nullable: true
             redirectIncidentId:
               type: string
               description: 'Only populated in case an incident is grouped with another incident, as part of the logic that processes incidents. In such a case, the status property is redirected.'
@@ -823443,6 +823484,8 @@ components:
               format: int64
             sensorType:
               $ref: '#/components/schemas/microsoft.graph.security.sensorType'
+            serviceStatus:
+              $ref: '#/components/schemas/microsoft.graph.security.serviceStatus'
             settings:
               $ref: '#/components/schemas/microsoft.graph.security.sensorSettings'
             version:
@@ -823463,6 +823506,9 @@ components:
             computerDnsName:
               type: string
               description: The DNS name of the computer associated with the sensor.
+            domainName:
+              type: string
+              description: The domain name of the sensor.
             lastSeenDateTime:
               pattern: '^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$'
               type: string
@@ -827248,6 +827294,17 @@ components:
         - microsoftInsiderRiskManagement
         - microsoftThreatIntelligence
       type: string
+    microsoft.graph.security.serviceStatus:
+      title: serviceStatus
+      enum:
+        - stopped
+        - starting
+        - running
+        - disabled
+        - onboarding
+        - unknown
+        - unknownFutureValue
+      type: string
     microsoft.graph.security.sourceType:
       title: sourceType
       enum:
@@ -854238,9 +854295,12 @@ components:
           '@odata.type': microsoft.graph.identitySet
         createdDateTime: '0001-01-01T00:00:00.0000000+00:00'
         displayName: String
+        isEnabled: 'true'
         lastModifiedBy:
           '@odata.type': microsoft.graph.identitySet
         lastModifiedDateTime: '0001-01-01T00:00:00.0000000+00:00'
+        protectionPolicyArtifactCount:
+          '@odata.type': microsoft.graph.protectionPolicyArtifactCount
         retentionSettings:
           - '@odata.type': microsoft.graph.retentionSetting
         status:
@@ -862554,6 +862614,12 @@ components:
         cid: String
         format: String
         labelId: String
+    microsoft.graph.protectionPolicyArtifactCount:
+      value:
+        completed: '0'
+        failed: '0'
+        inProgress: '0'
+        total: '0'
     microsoft.graph.provisionChannelEmailResult:
       value:
         email: String
@@ -866090,6 +866156,7 @@ components:
         incidentWebUrl: String
         lastModifiedBy: String
         lastUpdateDateTime: '0001-01-01T00:00:00.0000000+00:00'
+        priorityScore: '0'
         redirectIncidentId: String
         resolvingComment: String
         severity:
@@ -866249,12 +866316,15 @@ components:
         openHealthIssuesCount: '0'
         sensorType:
           '@odata.type': microsoft.graph.security.sensorType
+        serviceStatus:
+          '@odata.type': microsoft.graph.security.serviceStatus
         settings:
           '@odata.type': microsoft.graph.security.sensorSettings
         version: String
     microsoft.graph.security.sensorCandidate:
       value:
         computerDnsName: String
+        domainName: String
         lastSeenDateTime: '0001-01-01T00:00:00.0000000+00:00'
         senseClientVersion: String
     microsoft.graph.security.sensorCandidateActivationConfiguration: