@@ -196,7 +196,9 @@ export type RiskDetail =
196196 | "adminConfirmedSigninCompromised"
197197 | "hidden"
198198 | "adminConfirmedUserCompromised"
199- | "unknownFutureValue";
199+ | "unknownFutureValue"
200+ | "adminConfirmedServicePrincipalCompromised"
201+ | "adminDismissedAllRiskForServicePrincipal";
200202export type RiskLevel = "low" | "medium" | "high" | "hidden" | "none" | "unknownFutureValue";
201203export type RiskState =
202204 | "none"
@@ -499,6 +501,7 @@ export type AppCredentialRestrictionType =
499501 | "passwordLifetime"
500502 | "symmetricKeyAddition"
501503 | "symmetricKeyLifetime"
504+ | "customPasswordAddition"
502505 | "unknownFutureValue";
503506export type AppKeyCredentialRestrictionType = "asymmetricKeyLifetime" | "unknownFutureValue";
504507export type AuthenticationProtocol = "wsFed" | "saml" | "unknownFutureValue";
@@ -896,7 +899,7 @@ export type ConsentRequestFilterByCurrentUserOptions = "reviewer" | "unknownFutu
896899export type DecisionItemPrincipalResourceMembershipType = "direct" | "indirect" | "unknownFutureValue";
897900export type UserSignInRecommendationScope = "tenant" | "application" | "unknownFutureValue";
898901export type AgreementAcceptanceState = "accepted" | "declined" | "unknownFutureValue";
899- export type ActivityType = "signin" | "user" | "unknownFutureValue";
902+ export type ActivityType = "signin" | "user" | "unknownFutureValue" | "servicePrincipal" ;
900903export type CloudAppSecuritySessionControlType =
901904 | "mcasConfigured"
902905 | "monitorOnly"
@@ -8806,6 +8809,8 @@ export interface PolicyRoot {
88068809 * application.
88078810 */
88088811 claimsMappingPolicies?: NullableOption<ClaimsMappingPolicy[]>;
8812+ // The custom rules that define an access scenario when interacting with external Azure AD tenants.
8813+ crossTenantAccessPolicy?: NullableOption<CrossTenantAccessPolicy>;
88098814 // The tenant-wide policy that enforces app management restrictions for all applications and service principals.
88108815 defaultAppManagementPolicy?: NullableOption<TenantAppManagementPolicy>;
88118816 externalIdentitiesPolicy?: NullableOption<ExternalIdentitiesPolicy>;
@@ -8900,6 +8905,18 @@ export interface AuthorizationPolicy extends PolicyBase {
89008905 permissionGrantPolicyIdsAssignedToDefaultUserRole?: NullableOption<string[]>;
89018906 defaultUserRoleOverrides?: NullableOption<DefaultUserRoleOverride[]>;
89028907}
8908+ export interface TenantRelationshipAccessPolicyBase extends PolicyBase {
8909+ definition?: string[];
8910+ }
8911+ export interface CrossTenantAccessPolicy extends TenantRelationshipAccessPolicyBase {
8912+ /**
8913+ * Defines the default configuration for how your organization interacts with external Azure Active Directory
8914+ * organizations.
8915+ */
8916+ default?: NullableOption<CrossTenantAccessPolicyConfigurationDefault>;
8917+ // Defines partner-specific configurations for external Azure Active Directory organizations.
8918+ partners?: NullableOption<CrossTenantAccessPolicyConfigurationPartner[]>;
8919+ }
89038920export interface TenantAppManagementPolicy extends PolicyBase {
89048921 // Restrictions that apply as default to all application objects in the tenant.
89058922 applicationRestrictions?: NullableOption<AppManagementConfiguration>;
@@ -18439,8 +18456,12 @@ export interface CountryNamedLocation extends NamedLocation {
1843918456export interface IdentityProtectionRoot {
1844018457 // Risk detection in Azure AD Identity Protection and the associated information about the detection.
1844118458 riskDetections?: NullableOption<RiskDetection[]>;
18459+ // Azure AD service principals that are at risk.
18460+ riskyServicePrincipals?: NullableOption<RiskyServicePrincipal[]>;
1844218461 // Users that are flagged as at-risk by Azure AD Identity Protection.
1844318462 riskyUsers?: NullableOption<RiskyUser[]>;
18463+ // Represents information about detected at-risk service principals in an Azure AD tenant.
18464+ servicePrincipalRiskDetections?: NullableOption<ServicePrincipalRiskDetection[]>;
1844418465}
1844518466export interface RiskDetection extends Entity {
1844618467 // Indicates the activity type the detected risk is linked to. . Possible values are: signin, user, unknownFutureValue.
@@ -18494,7 +18515,8 @@ export interface RiskDetection extends Entity {
1849418515 * unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence,
1849518516 * generic,adminConfirmedUserCompromised, mcasImpossibleTravel, mcasSuspiciousInboxManipulationRules,
1849618517 * investigationsThreatIntelligenceSigninLinked, maliciousIPAddressValidCredentialsBlockedIP, and unknownFutureValue. If
18497- * the risk detection is a premium detection, will show generic
18518+ * the risk detection is a premium detection, will show generic. For more information about each value, see riskEventType
18519+ * values.
1849818520 */
1849918521 riskEventType?: NullableOption<string>;
1850018522 // Level of the detected risk. Possible values are: low, medium, high, hidden, none, unknownFutureValue.
@@ -18519,6 +18541,49 @@ export interface RiskDetection extends Entity {
1851918541 // The user principal name (UPN) of the user.
1852018542 userPrincipalName?: NullableOption<string>;
1852118543}
18544+ export interface RiskyServicePrincipal extends Entity {
18545+ // true if the service principal account is enabled; otherwise, false.
18546+ accountEnabled?: NullableOption<boolean>;
18547+ // The globally unique identifier for the associated application (its appId property), if any.
18548+ appId?: NullableOption<string>;
18549+ // The display name for the service principal.
18550+ displayName?: NullableOption<string>;
18551+ // Indicates whether Azure AD is currently processing the service principal's risky state.
18552+ isProcessing?: NullableOption<boolean>;
18553+ /**
18554+ * Details of the detected risk. Note: Details for this property are only available for Azure AD Premium P2 customers. P1
18555+ * customers will be returned hidden. The possible values are: none, adminGeneratedTemporaryPassword,
18556+ * userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe,
18557+ * userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden,
18558+ * adminConfirmedUserCompromised, unknownFutureValue, adminConfirmedServicePrincipalCompromised,
18559+ * adminDismissedAllRiskForServicePrincipal. Note that you must use the Prefer: include-unknown-enum-members request
18560+ * header to get the following value(s) in this evolvable enum: adminConfirmedServicePrincipalCompromised ,
18561+ * adminDismissedAllRiskForServicePrincipal.
18562+ */
18563+ riskDetail?: NullableOption<RiskDetail>;
18564+ /**
18565+ * The date and time that the risk state was last updated. The DateTimeOffset type represents date and time information
18566+ * using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2021 is 2021-01-01T00:00:00Z.
18567+ * Supports $filter (eq).
18568+ */
18569+ riskLastUpdatedDateTime?: NullableOption<string>;
18570+ /**
18571+ * Level of the detected risky workload identity. The possible values are: low, medium, high, hidden, none,
18572+ * unknownFutureValue. Supports $filter (eq).
18573+ */
18574+ riskLevel?: NullableOption<RiskLevel>;
18575+ /**
18576+ * State of the service principal's risk. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk,
18577+ * confirmedCompromised, unknownFutureValue.
18578+ */
18579+ riskState?: NullableOption<RiskState>;
18580+ /**
18581+ * Identifies whether the service principal represents an Application, a ManagedIdentity, or a legacy application
18582+ * (socialIdp). This is set by Azure AD internally and is inherited from servicePrincipal.
18583+ */
18584+ servicePrincipalType?: NullableOption<string>;
18585+ history?: NullableOption<RiskyServicePrincipalHistoryItem[]>;
18586+ }
1852218587export interface RiskyUser extends Entity {
1852318588 // Indicates whether the user is deleted. Possible values are: true, false.
1852418589 isDeleted?: NullableOption<boolean>;
@@ -18550,6 +18615,86 @@ export interface RiskyUser extends Entity {
1855018615 // The activity related to user risk level change
1855118616 history?: NullableOption<RiskyUserHistoryItem[]>;
1855218617}
18618+ export interface ServicePrincipalRiskDetection extends Entity {
18619+ /**
18620+ * Indicates the activity type the detected risk is linked to. The possible values are: signin, unknownFutureValue,
18621+ * servicePrincipal. Note that you must use the Prefer: include-unknown-enum-members request header to get the following
18622+ * value(s) in this evolvable enum: servicePrincipal.
18623+ */
18624+ activity?: NullableOption<ActivityType>;
18625+ /**
18626+ * Date and time when the risky activity occurred. The DateTimeOffset type represents date and time information using ISO
18627+ * 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z
18628+ */
18629+ activityDateTime?: NullableOption<string>;
18630+ /**
18631+ * Additional information associated with the risk detection. This string value is represented as a JSON object with the
18632+ * quotations escaped.
18633+ */
18634+ additionalInfo?: NullableOption<string>;
18635+ // The unique identifier for the associated application.
18636+ appId?: NullableOption<string>;
18637+ /**
18638+ * Correlation ID of the sign-in activity associated with the risk detection. This property is null if the risk detection
18639+ * is not associated with a sign-in activity.
18640+ */
18641+ correlationId?: NullableOption<string>;
18642+ /**
18643+ * Date and time when the risk was detected. The DateTimeOffset type represents date and time information using ISO 8601
18644+ * format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
18645+ */
18646+ detectedDateTime?: NullableOption<string>;
18647+ /**
18648+ * Timing of the detected risk , whether real-time or offline). The possible values are: notDefined, realtime,
18649+ * nearRealtime, offline, unknownFutureValue.
18650+ */
18651+ detectionTimingType?: NullableOption<RiskDetectionTimingType>;
18652+ // Provides the IP address of the client from where the risk occurred.
18653+ ipAddress?: NullableOption<string>;
18654+ // The unique identifier (GUID) for the key credential associated with the risk detection.
18655+ keyIds?: NullableOption<string[]>;
18656+ // Date and time when the risk detection was last updated.
18657+ lastUpdatedDateTime?: NullableOption<string>;
18658+ // Location from where the sign-in was initiated.
18659+ location?: NullableOption<SignInLocation>;
18660+ /**
18661+ * Request identifier of the sign-in activity associated with the risk detection. This property is null if the risk
18662+ * detection is not associated with a sign-in activity. Supports $filter (eq).
18663+ */
18664+ requestId?: NullableOption<string>;
18665+ /**
18666+ * Details of the detected risk. Note: Details for this property are only available for Azure AD Premium P2 customers. P1
18667+ * customers will be returned hidden. The possible values are: none, hidden, unknownFutureValue,
18668+ * adminConfirmedServicePrincipalCompromised, adminDismissedAllRiskForServicePrincipal. Note that you must use the Prefer:
18669+ * include-unknown-enum-members request header to get the following value(s) in this evolvable enum:
18670+ * adminConfirmedServicePrincipalCompromised , adminDismissedAllRiskForServicePrincipal.
18671+ */
18672+ riskDetail?: NullableOption<RiskDetail>;
18673+ /**
18674+ * The type of risk event detected. The possible values are: investigationsThreatIntelligence, generic,
18675+ * adminConfirmedServicePrincipalCompromised, suspiciousSignins, leakedCredentials, unknownFutureValue. Supports $filter
18676+ * (eq).
18677+ */
18678+ riskEventType?: NullableOption<string>;
18679+ /**
18680+ * Level of the detected risk. Note: Details for this property are only available for Azure AD Premium P2 customers. P1
18681+ * customers will be returned hidden. The possible values are: low, medium, high, hidden, none, unknownFutureValue.
18682+ */
18683+ riskLevel?: NullableOption<RiskLevel>;
18684+ /**
18685+ * The state of a detected risky service principal or sign-in activity. The possible values are: none, dismissed, atRisk,
18686+ * confirmedCompromised, unknownFutureValue.
18687+ */
18688+ riskState?: NullableOption<RiskState>;
18689+ // The display name for the service principal.
18690+ servicePrincipalDisplayName?: NullableOption<string>;
18691+ // The unique identifier for the service principal. Supports $filter (eq).
18692+ servicePrincipalId?: NullableOption<string>;
18693+ // Source of the risk detection. For example, identityProtection.
18694+ source?: NullableOption<string>;
18695+ // Indicates the type of token issuer for the detected sign-in risk. The possible values are: AzureAD, UnknownFutureValue.
18696+ tokenIssuerType?: NullableOption<TokenIssuerType>;
18697+ }
1855318698// tslint:disable-next-line: interface-name
1855418699export interface IpNamedLocation extends NamedLocation {
1855518700 /**
@@ -18560,6 +18705,14 @@ export interface IpNamedLocation extends NamedLocation {
1856018705 // true if this location is explicitly trusted. Optional. Default value is false.
1856118706 isTrusted?: boolean;
1856218707}
18708+ export interface RiskyServicePrincipalHistoryItem extends RiskyServicePrincipal {
18709+ // The activity related to service principal risk level change.
18710+ activity?: NullableOption<RiskServicePrincipalActivity>;
18711+ // The identifier of the actor of the operation.
18712+ initiatedBy?: NullableOption<string>;
18713+ // The identifier of the service principal.
18714+ servicePrincipalId?: NullableOption<string>;
18715+ }
1856318716export interface RiskyUserHistoryItem extends RiskyUser {
1856418717 // The activity related to user risk level change.
1856518718 activity?: NullableOption<RiskUserActivity>;
@@ -39144,6 +39297,20 @@ export interface IPv6CidrRange extends IpRange {
3914439297 // IPv6 address in CIDR notation. Not nullable.
3914539298 cidrAddress?: string;
3914639299}
39300+ export interface RiskServicePrincipalActivity {
39301+ /**
39302+ * Details of the detected risk. Note: Details for this property are only available for Azure AD Premium P2 customers. P1
39303+ * customers will be returned hidden. The possible values are: none, adminGeneratedTemporaryPassword,
39304+ * userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe,
39305+ * userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden,
39306+ * adminConfirmedUserCompromised, unknownFutureValue, adminConfirmedServicePrincipalCompromised,
39307+ * adminDismissedAllRiskForServicePrincipal. Note that you must use the Prefer: include-unknown-enum-members request
39308+ * header to get the following value(s) in this evolvable enum: adminConfirmedServicePrincipalCompromised ,
39309+ * adminDismissedAllRiskForServicePrincipal.
39310+ */
39311+ detail?: NullableOption<RiskDetail>;
39312+ riskEventTypes?: NullableOption<string[]>;
39313+ }
3914739314export interface RiskUserActivity {
3914839315 /**
3914939316 * Details of the detected risk. Possible values are: none, adminGeneratedTemporaryPassword,
@@ -39300,7 +39467,9 @@ export interface ApprovalStage {
3930039467 /**
3930139468 * If escalation is enabled and the primary approvers do not respond before the escalation time, the escalationApprovers
3930239469 * are the users who will be asked to approve requests. This can be a collection of singleUser, groupMembers,
39303- * requestorManager, internalSponsors and externalSponsors.
39470+ * requestorManager, internalSponsors and externalSponsors. When creating or updating a policy, if there are no escalation
39471+ * approvers, or escalation approvers are not required for the stage, the value of this property should be an empty
39472+ * collection.
3930439473 */
3930539474 escalationApprovers?: NullableOption<UserSet[]>;
3930639475 // If escalation is required, the time a request can be pending a response from a primary approver.
@@ -39311,7 +39480,8 @@ export interface ApprovalStage {
3931139480 isEscalationEnabled?: NullableOption<boolean>;
3931239481 /**
3931339482 * The users who will be asked to approve requests. A collection of singleUser, groupMembers, requestorManager,
39314- * internalSponsors and externalSponsors.
39483+ * internalSponsors and externalSponsors. When creating or updating a policy, include at least one userSet in this
39484+ * collection.
3931539485 */
3931639486 primaryApprovers?: NullableOption<UserSet[]>;
3931739487}
0 commit comments