@knowttl/mg-axi 0.1.2 → 0.1.3

package/dist/api.js

@@ -11,7 +11,9 @@ import { KNOWN_DATA_POLICY_FIELDS } from "./entra-data-policy-operations.js";
 import { KNOWN_FRAUD_FIELDS, KNOWN_WAF_FIELDS, KNOWN_VERIFICATION_FIELDS } from "./entra-risk-prevention.js";
 import { KNOWN_FEDERATION_FIELDS } from "./entra-federation-configurations.js";
 import { KNOWN_CA_FIELDS, KNOWN_PKI_FIELDS } from "./entra-certificate-auth.js";
+import { KNOWN_AUTH_CONTEXT_FIELDS, KNOWN_COMBO_FIELDS, KNOWN_DELETED_LOCATION_FIELDS, KNOWN_DELETED_POLICY_FIELDS, KNOWN_MODE_FIELDS, KNOWN_STRENGTH_FIELDS, KNOWN_TEMPLATE_FIELDS as KNOWN_CA_TEMPLATE_FIELDS } from "./entra-conditional-access.js";
 import { KNOWN_SUBSCRIPTION_FIELDS } from "./entra-subscriptions.js";
+import { KNOWN_TEMPLATE_FIELDS as KNOWN_ROLE_TEMPLATE_FIELDS, KNOWN_ROLE_MEMBER_FIELDS, KNOWN_SCOPED_MEMBER_FIELDS } from "./entra-roles.js";
 import { KNOWN_ASSIGNMENT_INSTANCE_FIELDS, KNOWN_ASSIGNMENT_SCHEDULE_FIELDS, KNOWN_ELIGIBILITY_INSTANCE_FIELDS, KNOWN_ELIGIBILITY_REQUEST_FIELDS, KNOWN_ELIGIBILITY_SCHEDULE_FIELDS } from "./entra-group-pim.js";
 import { KNOWN_SYNC_FIELDS } from "./entra-on-premises-synchronization.js";
 import { KNOWN_ACCEPTANCE_FIELDS, KNOWN_AGREEMENT_FIELDS } from "./entra-terms-of-use.js";
@@ -59,6 +61,7 @@ const AUTH_METHOD_FIELDS = ["id", "createdDateTime", "displayName", "phoneNumber
 const REGISTRATION_FIELDS = ["id", "userPrincipalName", "userDisplayName", "userType", "isAdmin", "isMfaRegistered", "isMfaCapable", "isPasswordlessCapable", "isSsprRegistered", "isSsprEnabled", "isSsprCapable", "userPreferredMethodForSecondaryAuthentication", "lastUpdatedDateTime"];
 const SIGNIN_FIELDS = ["id", "createdDateTime", "userId", "userPrincipalName", "userDisplayName", "appDisplayName", "appId", "ipAddress", "location", "status", "conditionalAccessStatus", "riskDetail", "riskLevelAggregated", "riskLevelDuringSignIn", "riskState", "resourceDisplayName", "resourceId", "clientAppUsed"];
 const AUDIT_FIELDS = ["id", "activityDateTime", "activityDisplayName", "category", "loggedByService", "operationType", "result", "resultReason", "correlationId", "initiatedBy", "targetResources"];
+const PROVISIONING_FIELDS = ["id", "activityDateTime", "tenantId", "jobId", "cycleId", "changeId", "action", "durationInMilliseconds", "sourceSystem", "sourceIdentity", "targetSystem", "targetIdentity", "provisioningStatusInfo", "provisioningSteps", "modifiedProperties", "servicePrincipal", "initiatedBy"];
 const RISKY_USER_FIELDS = ["id", "userPrincipalName", "userDisplayName", "riskDetail", "riskLastUpdatedDateTime", "riskLevel", "riskState"];
 const RISK_DETECTION_FIELDS = ["id", "detectedDateTime", "activityDateTime", "userId", "userPrincipalName", "userDisplayName", "ipAddress", "location", "riskDetail", "riskLevel", "riskState", "riskEventType", "detectionTimingType", "lastUpdatedDateTime", "source"];
 const RISKY_SP_FIELDS = ["id", "displayName", "appId", "servicePrincipalType", "riskDetail", "riskLastUpdatedDateTime", "riskLevel", "riskState", "isEnabled", "isProcessing"];
@@ -68,6 +71,7 @@ const APP_FIELDS = ["id", "appId", "displayName", "createdDateTime", "signInAudi
 const SP_FIELDS = ["id", "appId", "displayName", "servicePrincipalType", "accountEnabled", "appOwnerOrganizationId", "appRoleAssignmentRequired", "preferredSingleSignOnMode", "loginUrl"];
 const GRANT_FIELDS = ["id", "clientId", "consentType", "principalId", "resourceId", "scope", "startTime", "expiryTime"];
 const APP_ROLE_FIELDS = ["id", "appRoleId", "principalId", "principalDisplayName", "principalType", "resourceId", "resourceDisplayName", "createdDateTime"];
+const FEDERATED_FIELDS = ["id", "name", "issuer", "subject", "description", "audiences"];
 const ROLE_ASSIGNMENT_FIELDS = ["id", "principalId", "roleDefinitionId", "directoryScopeId", "appScopeId", "createdDateTime"];
 const PIM_INSTANCE_FIELDS = ["id", "roleDefinitionId", "principalId", "assignmentType", "memberType", "startDateTime", "endDateTime", "activatedUsing"];
 const DEVICE_FIELDS = ["id", "deviceId", "displayName", "operatingSystem", "operatingSystemVersion", "trustType", "isCompliant", "isManaged", "accountEnabled", "createdDateTime", "approximateLastSignInDateTime", "manufacturer", "model"];
@@ -109,6 +113,62 @@ export const REVIEWED_ROUTES = [
     { id: "v1.0:GET:/identity/conditionalAccess/namedLocations/{namedLocation-id}", kind: "single", query: SINGLE_QUERY, fields: NAMED_LOCATION_FIELDS,
         access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (for example Security Reader) is also required.",
         sources: ["https://learn.microsoft.com/graph/api/countrynamedlocation-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_STRENGTH_FIELDS,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/authenticationstrengthroot-list-policies?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_STRENGTH_FIELDS,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/authenticationstrengthpolicy-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}/combinationConfigurations", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_COMBO_FIELDS, keepODataType: true,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1. Rows are polymorphic: the @odata.type discriminator rides along automatically to name the configuration kind.",
+        sources: ["https://learn.microsoft.com/graph/api/authenticationstrengthpolicy-list-combinationconfigurations?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}/combinationConfigurations/{authenticationCombinationConfiguration-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_COMBO_FIELDS, keepODataType: true,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1. Rows are polymorphic: the @odata.type discriminator rides along automatically to name the configuration kind.",
+        sources: ["https://learn.microsoft.com/graph/api/authenticationcombinationconfiguration-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/authenticationMethodModes", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_MODE_FIELDS,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/graph/api/authenticationstrengthroot-list-authenticationmethodmodes?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/authenticationMethodModes/{authenticationMethodModeDetail-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_MODE_FIELDS,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/authenticationmethodmodedetail-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/templates", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_CA_TEMPLATE_FIELDS,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (for example Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/conditionalaccessroot-list-templates?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/templates/{conditionalAccessTemplate-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_CA_TEMPLATE_FIELDS,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (for example Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/conditionalaccesstemplate-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationContextClassReferences", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_AUTH_CONTEXT_FIELDS,
+        access: "D/A AuthenticationContext.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/graph/api/conditionalaccessroot-list-authenticationcontextclassreferences?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationContextClassReferences/{authenticationContextClassReference-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_AUTH_CONTEXT_FIELDS,
+        access: "D/A AuthenticationContext.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "The get page documents no optional query parameters; $select travels as the standard single-object projection. Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/graph/api/authenticationcontextclassreference-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/deletedItems/policies", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_DELETED_POLICY_FIELDS,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "No v1.0 operation-level documentation page; access follows the beta policyDeletableItem contract for conditional-access objects with the conditionalAccessPolicy resource reference. Soft-deleted policies restore within 30 days; restore is beta-only and out of scope. Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/policydeletableitem-list?view=graph-rest-beta", "https://learn.microsoft.com/en-us/graph/api/resources/policydeletableitem?view=graph-rest-beta"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/deletedItems/policies/{conditionalAccessPolicy-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_DELETED_POLICY_FIELDS,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "No v1.0 operation-level documentation page; access follows the beta policyDeletableItem contract for conditional-access objects with the conditionalAccessPolicy resource reference. Soft-deleted policies restore within 30 days; restore is beta-only and out of scope. Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/policydeletableitem-get?view=graph-rest-beta", "https://learn.microsoft.com/en-us/graph/api/resources/policydeletableitem?view=graph-rest-beta"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/deletedItems/namedLocations", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_DELETED_LOCATION_FIELDS, keepODataType: true,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "No v1.0 operation-level documentation page; access follows the beta policyDeletableItem contract for conditional-access objects with the namedLocation resource reference. Rows are polymorphic: the @odata.type discriminator rides along automatically to name the location kind. Soft-deleted locations restore within 30 days; restore is beta-only and out of scope. Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/policydeletableitem-list?view=graph-rest-beta", "https://learn.microsoft.com/en-us/graph/api/resources/policydeletableitem?view=graph-rest-beta"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/deletedItems/namedLocations/{namedLocation-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_DELETED_LOCATION_FIELDS, keepODataType: true,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "No v1.0 operation-level documentation page; access follows the beta policyDeletableItem contract for conditional-access objects with the namedLocation resource reference. Soft-deleted locations restore within 30 days; restore is beta-only and out of scope. Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/policydeletableitem-get?view=graph-rest-beta", "https://learn.microsoft.com/en-us/graph/api/resources/policydeletableitem?view=graph-rest-beta"] },
     { id: "v1.0:GET:/users/{user-id}/authentication/methods", kind: "collection", query: ["$select"], fields: AUTH_METHOD_FIELDS,
         access: "D/A UserAuthenticationMethod.Read.All for other users; delegated self UserAuthenticationMethod.Read. Dedicated administrator roles also apply.",
         note: "Targeted per-user inspection only; aggregate coverage belongs to the registration report, never to a scan across users.",
@@ -127,6 +187,10 @@ export const REVIEWED_ROUTES = [
     { id: "v1.0:GET:/auditLogs/directoryAudits", kind: "collection", query: COLLECTION_QUERY, fields: AUDIT_FIELDS,
         access: "D/A AuditLog.Read.All. Delegated callers pass it as --scopes.",
         sources: ["https://learn.microsoft.com/graph/api/directoryaudit-list?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/auditLogs/provisioning", kind: "collection", query: COLLECTION_QUERY, fields: PROVISIONING_FIELDS,
+        access: "D/A AuditLog.Read.All and Directory.Read.All. Delegated callers pass both as --scopes; Reports Reader is the least privileged directory role.",
+        note: "Entra ID P1/P2 licence prerequisite; retention is 30 days on premium and 7 days on free.",
+        sources: ["https://learn.microsoft.com/graph/api/provisioningobjectsummary-list?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/identityProtection/riskyUsers", kind: "collection", query: COLLECTION_QUERY, fields: RISKY_USER_FIELDS,
         access: "D/A IdentityRiskyUser.Read.All. Delegated callers pass it as --scopes.",
         note: "Full investigation needs P2/Suite; limited results stay limited, never reinterpreted as empty.",
@@ -183,6 +247,34 @@ export const REVIEWED_ROUTES = [
         access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
         note: "Actual granted assignments; requested permissions are a separate contract.",
         sources: ["https://learn.microsoft.com/graph/api/serviceprincipal-list-approleassignments?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignments/{appRoleAssignment-id}", kind: "single", query: SINGLE_QUERY, fields: APP_ROLE_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "One granted assignment on the client service principal; requested permissions are a separate contract.",
+        sources: ["https://learn.microsoft.com/graph/api/approleassignment-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo", kind: "collection", query: COLLECTION_QUERY, fields: APP_ROLE_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "Principals assigned to this resource service principal; the reverse view of appRoleAssignments.",
+        sources: ["https://learn.microsoft.com/graph/api/serviceprincipal-list-approleassignedto?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo/{appRoleAssignment-id}", kind: "single", query: SINGLE_QUERY, fields: APP_ROLE_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "One principal assignment on the resource service principal; the reverse view of appRoleAssignments.",
+        sources: ["https://learn.microsoft.com/graph/api/approleassignment-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/applications/{application-id}/federatedIdentityCredentials", kind: "collection", query: COLLECTION_QUERY, fields: FEDERATED_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "Workload-identity trust metadata only; GET never returns secret values and success redaction still applies.",
+        sources: ["https://learn.microsoft.com/graph/api/federatedidentitycredential-list?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/applications/{application-id}/federatedIdentityCredentials/{federatedIdentityCredential-id}", kind: "single", query: SINGLE_QUERY, fields: FEDERATED_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "One workload-identity trust entry; metadata only, never secret values.",
+        sources: ["https://learn.microsoft.com/graph/api/federatedidentitycredential-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/servicePrincipals/{servicePrincipal-id}/federatedIdentityCredentials", kind: "collection", query: COLLECTION_QUERY, fields: FEDERATED_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "Same federatedIdentityCredential resource contract as the application navigation; metadata only, never secret values.",
+        sources: ["https://learn.microsoft.com/graph/api/federatedidentitycredential-list?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/federatedidentitycredential?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/servicePrincipals/{servicePrincipal-id}/federatedIdentityCredentials/{federatedIdentityCredential-id}", kind: "single", query: SINGLE_QUERY, fields: FEDERATED_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "Same federatedIdentityCredential resource contract as the application navigation; metadata only, never secret values.",
+        sources: ["https://learn.microsoft.com/graph/api/federatedidentitycredential-get?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/federatedidentitycredential?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/oauth2PermissionGrants", kind: "collection", query: COLLECTION_QUERY, fields: GRANT_FIELDS,
         access: "D/A Directory.Read.All as the read choice. Delegated callers pass it as --scopes.",
         note: "Actual granted consent; requested permissions are a separate contract.",
@@ -202,6 +294,33 @@ export const REVIEWED_ROUTES = [
         access: "D/A RoleAssignmentSchedule.Read.Directory. Delegated callers pass it as --scopes.",
         note: "Active (including activated eligible) assignments; PIM needs P2 or ID Governance.",
         sources: ["https://learn.microsoft.com/graph/api/rbacapplication-list-roleassignmentscheduleinstances?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/directoryRoleTemplates", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ROLE_TEMPLATE_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Templates describe every role; activation state lives on directoryRoles.",
+        sources: ["https://learn.microsoft.com/graph/api/directoryroletemplate-list?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/directoryRoleTemplates/{directoryRoleTemplate-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_ROLE_TEMPLATE_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        sources: ["https://learn.microsoft.com/graph/api/directoryroletemplate-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/directoryRoles/{directoryRole-id}/members", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ROLE_MEMBER_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Members are the assigned principals; @odata.type names each member kind.",
+        sources: ["https://learn.microsoft.com/graph/api/directoryrole-list-members?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/directoryRoles/{directoryRole-id}/scopedMembers", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Scoped members bind one role to one principal within one directory scope; administrative-unit scopes need P1.",
+        sources: ["https://learn.microsoft.com/graph/api/directoryrole-list-scopedmembers?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/directoryRoles/{directoryRole-id}/scopedMembers/{scopedRoleMembership-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Administrative-unit scopes need P1.",
+        sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/scopedRoleMemberships", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Administrative-unit-scoped admin assignments; directory-wide assignments live on roleAssignments. Administrative-unit scopes need P1.",
+        sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-list?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/scopedRoleMemberships/{scopedRoleMembership-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Administrative-unit scopes need P1.",
+        sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-get?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/assignmentSchedules", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ASSIGNMENT_SCHEDULE_FIELDS,
         access: "D/A PrivilegedAssignmentSchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
         note: "Assignment schedules govern group membership or ownership over time; PIM for Groups needs P2 or ID Governance; lists require $filter on groupId or principalId. AssignmentScheduleRequests stay out: their least privilege is the write scope PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup.",

package/dist/catalogue.js

@@ -91,6 +91,14 @@ const appRoleGrantRead = {
     cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
     scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Application.Read.All; reads never request write-consent scopes" },
 };
+const federatedRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties from id, name, issuer, subject, description, audiences; rows carry metadata only, never secret material" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor", description: "Resume a capped collection losslessly; repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Application.Read.All" },
+};
 const roleRead = {
     filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
     select: { value: "comma-separated-properties", description: "Request server properties from the reviewed role property set" },
@@ -327,6 +335,22 @@ const caRead = {
     cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
     scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Policy.Read.All" },
 };
+const caStrengthRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; authentication-strength detail needs Policy.Read.AuthenticationMethod in both modes plus a supported Conditional Access role for delegated access" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to Policy.Read.AuthenticationMethod" },
+};
+const caAuthContextRead = {
+    filter: { value: "odata-filter", description: "OData $filter passed to Graph; unsupported combinations fail before credentials" },
+    select: { value: "comma-separated-properties", description: "Request server properties; authentication-context detail needs AuthenticationContext.Read.All in both modes plus a supported Conditional Access role for delegated access" },
+    fields: { value: "comma-separated-properties", description: "Project returned rows locally; every field must be fetched via the default or --select set" },
+    full: { description: "Show complete text values without truncation; never lifts redaction or row caps" },
+    cursor: { value: "opaque-cursor|-", description: "Resume a capped collection losslessly; - reads the token from stdin (16 MB ceiling for either input); repeat the original query flags or omit them" },
+    scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AuthenticationContext.Read.All" },
+};
 const providerRead = {
     filter: { value: "odata-filter", description: "OData $filter passed to Graph as plain $filter; unsupported combinations fail before credentials" },
     select: { value: "comma-separated-properties", description: "Request server properties from the reviewed identity-provider set; secret-bearing fields (clientSecret, certificateData) are never selectable" },
@@ -619,6 +643,72 @@ export const LEAVES = [
             full: roleRead.full,
             scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
         }, examples: ["mg-axi entra directory-role show --id <role-id> --profile soc", "mg-axi entra directory-role show --id <role-id> --profile soc --full"] },
+    { path: "entra directory-role-template list", description: "List directory-role templates (id, displayName, description); templates exist whether or not the role is activated", operation: "GET:/directoryRoleTemplates", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
+        }, examples: ["mg-axi entra directory-role-template list --profile soc", "mg-axi entra directory-role-template list --profile soc --filter \"displayName eq 'Helpdesk Administrator'\""] },
+    { path: "entra directory-role-template show", description: "Show one directory-role template with richer default properties", operation: "GET:/directoryRoleTemplates/{directoryRoleTemplate-id}", flags: {
+            ...common, id: { value: "template-id", required: true, description: "Directory-role template object ID" },
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
+        }, examples: ["mg-axi entra directory-role-template show --id <template-id> --profile soc", "mg-axi entra directory-role-template show --id <template-id> --profile soc --full"] },
+    { path: "entra directory-role member list", description: "List the members of one activated directory role (id, displayName); @odata.type names each member kind", operation: "GET:/directoryRoles/{directoryRole-id}/members", flags: {
+            ...common, role: { value: "role-id", required: true, description: "Activated directory-role object ID whose members are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role" },
+        }, examples: ["mg-axi entra directory-role member list --role <role-id> --profile soc", "mg-axi entra directory-role member list --role <role-id> --profile soc --filter \"displayName eq 'Adele Vance'\""] },
+    { path: "entra directory-role scoped-member list", description: "List the scoped members of one activated directory role (id, principalId, roleId, directoryScopeId); administrative-unit scopes need P1", operation: "GET:/directoryRoles/{directoryRole-id}/scopedMembers", flags: {
+            ...common, role: { value: "role-id", required: true, description: "Activated directory-role object ID whose scoped members are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
+        }, examples: ["mg-axi entra directory-role scoped-member list --role <role-id> --profile soc", "mg-axi entra directory-role scoped-member list --role <role-id> --profile soc --filter \"principalId eq '<principal-id>'\""] },
+    { path: "entra directory-role scoped-member show", description: "Show one scoped member of an activated directory role with richer default properties", operation: "GET:/directoryRoles/{directoryRole-id}/scopedMembers/{scopedRoleMembership-id}", flags: {
+            ...common, role: { value: "role-id", required: true, description: "Activated directory-role object ID owning the scoped member" },
+            id: { value: "scoped-membership-id", required: true, description: "Scoped membership object ID" },
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
+        }, examples: ["mg-axi entra directory-role scoped-member show --role <role-id> --id <scoped-membership-id> --profile soc", "mg-axi entra directory-role scoped-member show --role <role-id> --id <scoped-membership-id> --profile soc --full"] },
+    { path: "entra scoped-role-membership list", description: "List administrative-unit-scoped role memberships (id, principalId, roleId, directoryScopeId); directory-wide assignments live on roleAssignments", operation: "GET:/scopedRoleMemberships", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: roleRead.filter,
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            cursor: roleRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
+        }, examples: ["mg-axi entra scoped-role-membership list --profile soc", "mg-axi entra scoped-role-membership list --profile soc --filter \"roleId eq '<role-id>'\""] },
+    { path: "entra scoped-role-membership show", description: "Show one administrative-unit-scoped role membership with richer default properties", operation: "GET:/scopedRoleMemberships/{scopedRoleMembership-id}", flags: {
+            ...common, id: { value: "scoped-membership-id", required: true, description: "Scoped membership object ID" },
+            select: roleRead.select,
+            fields: roleRead.fields,
+            full: roleRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to RoleManagement.Read.Directory; delegated callers also need a supported directory role; administrative-unit scopes need P1" },
+        }, examples: ["mg-axi entra scoped-role-membership show --id <scoped-membership-id> --profile soc", "mg-axi entra scoped-role-membership show --id <scoped-membership-id> --profile soc --full"] },
     { path: "entra role-assignment list", description: "List current role assignments (id, principalId, roleDefinitionId, directoryScopeId), including direct and PIM-activated assignments; use pim active list for assignmentType Assigned versus Activated", operation: "GET:/roleManagement/directory/roleAssignments", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -1497,6 +1587,26 @@ export const LEAVES = [
             full: logRead.full,
             scopes: logRead.scopes,
         }, examples: ["mg-axi entra directory-audit show --id <directory-audit-id> --profile soc", "mg-axi entra directory-audit show --id <directory-audit-id> --profile soc --full"] },
+    { path: "entra provisioning list", description: "List provisioning-log events in a bounded time window (AuditLog.Read.All and Directory.Read.All; delegated callers also need Global Reader, Reports Reader, Security Administrator, Security Operator or Security Reader; Entra ID P1/P2 licence prerequisite)", operation: "GET:/auditLogs/provisioning", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            since: { ...logRead.since, description: "Required for a new query (resume with --cursor instead): earliest activityDateTime bounding the server time range" },
+            until: logRead.until,
+            filter: logRead.filter,
+            select: { value: "comma-separated-properties", description: "Request server properties from the supported provisioning-log property set" },
+            fields: logRead.fields,
+            full: logRead.full,
+            cursor: logRead.cursor,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AuditLog.Read.All,Directory.Read.All" },
+        }, examples: ["mg-axi entra provisioning list --profile soc --since 2026-09-01T00:00:00Z", "mg-axi entra provisioning list --profile soc --since 2026-09-01T00:00:00Z --filter \"provisioningStatusInfo/status eq 'failure'\" --limit 10", "mg-axi entra provisioning list --profile soc --since 2026-09-01T00:00:00Z --until 2026-09-08T00:00:00Z --all"] },
+    { path: "entra provisioning show", description: "Show one provisioning-log event with the full reviewed property set", operation: "GET:/auditLogs/provisioning/{provisioningObjectSummary-id}", flags: {
+            ...common, id: { value: "provisioning-id", required: true, description: "Provisioning-log event object ID" },
+            select: { value: "comma-separated-properties", description: "Request server properties from the supported provisioning-log property set" },
+            fields: logRead.fields,
+            full: logRead.full,
+            scopes: { value: "comma-separated-Graph-scopes", description: "Delegated only: explicit Graph scopes using full https://graph.microsoft.com/ names; defaults to AuditLog.Read.All,Directory.Read.All" },
+        }, examples: ["mg-axi entra provisioning show --id <provisioning-id> --profile soc", "mg-axi entra provisioning show --id <provisioning-id> --profile soc --full"] },
     { path: "entra application list", description: "List applications with compact properties (id, appId, displayName); appId is the client ID, distinct from the object id", operation: "GET:/applications", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -1577,6 +1687,71 @@ export const LEAVES = [
             cursor: appRoleGrantRead.cursor,
             scopes: appRoleGrantRead.scopes,
         }, examples: ["mg-axi entra service-principal app-role-assignment list --service-principal <service-principal-object-id> --profile soc"] },
+    { path: "entra service-principal app-role-assignment show", description: "Show one app-only role assignment granted to a client service principal", operation: "GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignments/{appRoleAssignment-id}", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Client service-principal object ID holding the assignment" },
+            id: { value: "assignment-object-id", required: true, description: "App role assignment object ID" },
+            select: appRoleGrantRead.select,
+            fields: appRoleGrantRead.fields,
+            full: appRoleGrantRead.full,
+            scopes: appRoleGrantRead.scopes,
+        }, examples: ["mg-axi entra service-principal app-role-assignment show --service-principal <service-principal-object-id> --id <assignment-object-id> --profile soc"] },
+    { path: "entra service-principal app-role-assigned-to list", description: "List principals assigned to one resource service principal; rows are granted assignments, distinct from the application's requested permissions", operation: "GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Resource service-principal object ID whose assignees are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: appRoleGrantRead.filter,
+            select: appRoleGrantRead.select,
+            fields: appRoleGrantRead.fields,
+            full: appRoleGrantRead.full,
+            cursor: appRoleGrantRead.cursor,
+            scopes: appRoleGrantRead.scopes,
+        }, examples: ["mg-axi entra service-principal app-role-assigned-to list --service-principal <service-principal-object-id> --profile soc"] },
+    { path: "entra service-principal app-role-assigned-to show", description: "Show one principal assignment on a resource service principal", operation: "GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo/{appRoleAssignment-id}", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Resource service-principal object ID holding the assignment" },
+            id: { value: "assignment-object-id", required: true, description: "App role assignment object ID" },
+            select: appRoleGrantRead.select,
+            fields: appRoleGrantRead.fields,
+            full: appRoleGrantRead.full,
+            scopes: appRoleGrantRead.scopes,
+        }, examples: ["mg-axi entra service-principal app-role-assigned-to show --service-principal <service-principal-object-id> --id <assignment-object-id> --profile soc"] },
+    { path: "entra application federated-credential list", description: "List federated identity credentials of one application; rows carry issuer, subject and audience metadata only, never secret material", operation: "GET:/applications/{application-id}/federatedIdentityCredentials", flags: {
+            ...common, application: { value: "application-object-id", required: true, description: "Application object ID whose federated credentials are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: federatedRead.filter,
+            select: federatedRead.select,
+            fields: federatedRead.fields,
+            full: federatedRead.full,
+            cursor: federatedRead.cursor,
+            scopes: federatedRead.scopes,
+        }, examples: ["mg-axi entra application federated-credential list --application <application-object-id> --profile soc"] },
+    { path: "entra application federated-credential show", description: "Show one federated identity credential of an application; metadata only, never secret material", operation: "GET:/applications/{application-id}/federatedIdentityCredentials/{federatedIdentityCredential-id}", flags: {
+            ...common, application: { value: "application-object-id", required: true, description: "Application object ID holding the credential" },
+            id: { value: "credential-object-id", required: true, description: "Federated identity credential object ID" },
+            select: federatedRead.select,
+            fields: federatedRead.fields,
+            full: federatedRead.full,
+            scopes: federatedRead.scopes,
+        }, examples: ["mg-axi entra application federated-credential show --application <application-object-id> --id <credential-object-id> --profile soc"] },
+    { path: "entra service-principal federated-credential list", description: "List federated identity credentials of one service principal; rows carry issuer, subject and audience metadata only, never secret material", operation: "GET:/servicePrincipals/{servicePrincipal-id}/federatedIdentityCredentials", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Service-principal object ID whose federated credentials are listed" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: federatedRead.filter,
+            select: federatedRead.select,
+            fields: federatedRead.fields,
+            full: federatedRead.full,
+            cursor: federatedRead.cursor,
+            scopes: federatedRead.scopes,
+        }, examples: ["mg-axi entra service-principal federated-credential list --service-principal <service-principal-object-id> --profile soc"] },
+    { path: "entra service-principal federated-credential show", description: "Show one federated identity credential of a service principal; metadata only, never secret material", operation: "GET:/servicePrincipals/{servicePrincipal-id}/federatedIdentityCredentials/{federatedIdentityCredential-id}", flags: {
+            ...common, "service-principal": { value: "service-principal-object-id", required: true, description: "Service-principal object ID holding the credential" },
+            id: { value: "credential-object-id", required: true, description: "Federated identity credential object ID" },
+            select: federatedRead.select,
+            fields: federatedRead.fields,
+            full: federatedRead.full,
+            scopes: federatedRead.scopes,
+        }, examples: ["mg-axi entra service-principal federated-credential show --service-principal <service-principal-object-id> --id <credential-object-id> --profile soc"] },
     { path: "entra risky-user list", description: "List at-risk users with compact risk state (IdentityRiskyUser.Read.All; delegated callers also need Global Reader, Security Operator, Security Reader or Security Administrator; the riskyUsers API requires P2)", operation: "GET:/identityProtection/riskyUsers", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
@@ -1728,6 +1903,134 @@ export const LEAVES = [
             full: caRead.full,
             scopes: caRead.scopes,
         }, examples: ["mg-axi entra conditional-access named-location show --id <named-location-id> --profile soc", "mg-axi entra conditional-access named-location show --id <named-location-id> --profile soc --full"] },
+    { path: "entra conditional-access auth-strength-policy list", description: "List authentication-strength policies with compact properties (id, displayName, policyType)", operation: "GET:/identity/conditionalAccess/authenticationStrength/policies", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caStrengthRead.filter,
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            cursor: caStrengthRead.cursor,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-strength-policy list --profile soc", "mg-axi entra conditional-access auth-strength-policy list --profile soc --limit 10", "mg-axi entra conditional-access auth-strength-policy list --profile soc --filter \"policyType eq 'builtIn'\" --select id,displayName,policyType"] },
+    { path: "entra conditional-access auth-strength-policy show", description: "Show one authentication-strength policy with the full reviewed property set", operation: "GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}", flags: {
+            ...common, id: { value: "auth-strength-policy-id", required: true, description: "Authentication-strength policy object ID" },
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-strength-policy show --id <auth-strength-policy-id> --profile soc", "mg-axi entra conditional-access auth-strength-policy show --id <auth-strength-policy-id> --profile soc --full"] },
+    { path: "entra conditional-access combination-configuration list", description: "List the combination configurations of one authentication-strength policy", operation: "GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}/combinationConfigurations", flags: {
+            ...common,
+            policy: { value: "auth-strength-policy-id", required: true, description: "Authentication-strength policy object ID owning the combination configurations" },
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caStrengthRead.filter,
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            cursor: caStrengthRead.cursor,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access combination-configuration list --policy <auth-strength-policy-id> --profile soc", "mg-axi entra conditional-access combination-configuration list --policy <auth-strength-policy-id> --profile soc --limit 10"] },
+    { path: "entra conditional-access combination-configuration show", description: "Show one combination configuration of an authentication-strength policy; @odata.type names the configuration kind", operation: "GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}/combinationConfigurations/{authenticationCombinationConfiguration-id}", flags: {
+            ...common, policy: { value: "auth-strength-policy-id", required: true, description: "Authentication-strength policy object ID owning the combination configuration" },
+            id: { value: "combination-configuration-id", required: true, description: "Combination configuration object ID" },
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access combination-configuration show --policy <auth-strength-policy-id> --id <combination-configuration-id> --profile soc", "mg-axi entra conditional-access combination-configuration show --policy <auth-strength-policy-id> --id <combination-configuration-id> --profile soc --full"] },
+    { path: "entra conditional-access auth-method-mode list", description: "List authentication method modes with compact properties (id, displayName)", operation: "GET:/identity/conditionalAccess/authenticationStrength/authenticationMethodModes", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caStrengthRead.filter,
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            cursor: caStrengthRead.cursor,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-method-mode list --profile soc", "mg-axi entra conditional-access auth-method-mode list --profile soc --limit 10"] },
+    { path: "entra conditional-access auth-method-mode show", description: "Show one authentication method mode with the full reviewed property set", operation: "GET:/identity/conditionalAccess/authenticationStrength/authenticationMethodModes/{authenticationMethodModeDetail-id}", flags: {
+            ...common, id: { value: "auth-method-mode-id", required: true, description: "Authentication method mode object ID" },
+            select: caStrengthRead.select,
+            fields: caStrengthRead.fields,
+            full: caStrengthRead.full,
+            scopes: caStrengthRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-method-mode show --id <auth-method-mode-id> --profile soc", "mg-axi entra conditional-access auth-method-mode show --id <auth-method-mode-id> --profile soc --full"] },
+    { path: "entra conditional-access template list", description: "List Conditional Access templates with compact properties (id, name)", operation: "GET:/identity/conditionalAccess/templates", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caRead.filter,
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            cursor: caRead.cursor,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access template list --profile soc", "mg-axi entra conditional-access template list --profile soc --limit 10"] },
+    { path: "entra conditional-access template show", description: "Show one Conditional Access template with the full reviewed property set", operation: "GET:/identity/conditionalAccess/templates/{conditionalAccessTemplate-id}", flags: {
+            ...common, id: { value: "template-id", required: true, description: "Conditional Access template object ID" },
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access template show --id <template-id> --profile soc", "mg-axi entra conditional-access template show --id <template-id> --profile soc --full"] },
+    { path: "entra conditional-access auth-context list", description: "List authentication context class references with compact properties (id, displayName)", operation: "GET:/identity/conditionalAccess/authenticationContextClassReferences", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caAuthContextRead.filter,
+            select: caAuthContextRead.select,
+            fields: caAuthContextRead.fields,
+            full: caAuthContextRead.full,
+            cursor: caAuthContextRead.cursor,
+            scopes: caAuthContextRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-context list --profile soc", "mg-axi entra conditional-access auth-context list --profile soc --limit 10"] },
+    { path: "entra conditional-access auth-context show", description: "Show one authentication context class reference with the full reviewed property set", operation: "GET:/identity/conditionalAccess/authenticationContextClassReferences/{authenticationContextClassReference-id}", flags: {
+            ...common, id: { value: "auth-context-id", required: true, description: "Authentication context class reference object ID" },
+            select: caAuthContextRead.select,
+            fields: caAuthContextRead.fields,
+            full: caAuthContextRead.full,
+            scopes: caAuthContextRead.scopes,
+        }, examples: ["mg-axi entra conditional-access auth-context show --id <auth-context-id> --profile soc", "mg-axi entra conditional-access auth-context show --id <auth-context-id> --profile soc --full"] },
+    { path: "entra conditional-access deleted-policy list", description: "List soft-deleted Conditional Access policies with compact properties (id, displayName, state, deletedDateTime); restore stays out of scope", operation: "GET:/identity/conditionalAccess/deletedItems/policies", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caRead.filter,
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            cursor: caRead.cursor,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access deleted-policy list --profile soc", "mg-axi entra conditional-access deleted-policy list --profile soc --limit 10"] },
+    { path: "entra conditional-access deleted-policy show", description: "Show one soft-deleted Conditional Access policy with the full reviewed property set; restore stays out of scope", operation: "GET:/identity/conditionalAccess/deletedItems/policies/{conditionalAccessPolicy-id}", flags: {
+            ...common, id: { value: "deleted-policy-id", required: true, description: "Soft-deleted Conditional Access policy object ID" },
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access deleted-policy show --id <deleted-policy-id> --profile soc", "mg-axi entra conditional-access deleted-policy show --id <deleted-policy-id> --profile soc --full"] },
+    { path: "entra conditional-access deleted-named-location list", description: "List soft-deleted Conditional Access named locations with compact properties (id, displayName, deletedDateTime); restore stays out of scope", operation: "GET:/identity/conditionalAccess/deletedItems/namedLocations", flags: {
+            ...common,
+            limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },
+            all: { description: "Follow pages within request, byte and deadline budgets" },
+            filter: caRead.filter,
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            cursor: caRead.cursor,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access deleted-named-location list --profile soc", "mg-axi entra conditional-access deleted-named-location list --profile soc --limit 10"] },
+    { path: "entra conditional-access deleted-named-location show", description: "Show one soft-deleted Conditional Access named location with the full reviewed property set; restore stays out of scope", operation: "GET:/identity/conditionalAccess/deletedItems/namedLocations/{namedLocation-id}", flags: {
+            ...common, id: { value: "deleted-named-location-id", required: true, description: "Soft-deleted named location object ID" },
+            select: caRead.select,
+            fields: caRead.fields,
+            full: caRead.full,
+            scopes: caRead.scopes,
+        }, examples: ["mg-axi entra conditional-access deleted-named-location show --id <deleted-named-location-id> --profile soc", "mg-axi entra conditional-access deleted-named-location show --id <deleted-named-location-id> --profile soc --full"] },
     { path: "entra identity-provider list", description: "List workforce identity providers with compact properties (id, displayName); rows carry @odata.type naming the provider kind; client secrets and key material are never returned", operation: "GET:/identity/identityProviders", flags: {
             ...common,
             limit: { value: "positive-integer", default: "100", description: "Cap returned rows; the remainder is buffered into an opaque cursor, never discarded; incompatible with --all" },