@microsoft/typespec-msgraph-reference 1.0.2 → 1.0.4

package/lib/Mooncake/Beta/main.tsp

@@ -11,6 +11,8 @@ scalar binary; //TODO: Enables support for Edm.Binary
 @privatePreviewDefinition("photoEditPolicy", "2024-02-16", "2025-02-16", "<theOwner>")
 @deprecatedDefinition("Reporting", "<ChangeLogCategory>", "2021-04-11", "2021-12-31", "The action property is deprecated. The provisioningAction holds the same information as this. This only exists in the beta api.")
 // Metadata item DeprecatedDefinition_Reporting was already defined with a different value.
+@deprecatedDefinition("SynchronizationSecret_Deprecation", "<ChangeLogCategory>", "2026-02-06", "2027-07-06", "Use connectivityParameters for oauth flows and scim endpoint connectivity. Use SynchronizationJobSettings for job-specific settings This property will be removed.")
+// Metadata item DeprecatedDefinition_SynchronizationSecret_Deprecation was already defined with a different value.
 @deprecatedDefinition("AccessReviewReportBreakingChanges", "<ChangeLogCategory>", "2021-07-30", "2022-01-30", "This property is being deprecated. Use the fulfilledDateTime value in the individual report instance instead")
 // Metadata item DeprecatedDefinition_AccessReviewReportBreakingChanges was already defined with a different value.
 @deprecatedDefinition("identityProvider", "<ChangeLogCategory>", "2021-08-24", "2023-03-15", "The identityProvider API is deprecated and will stop returning data on March 2023. Please use the new identityProviderBase API.")
@@ -644,35 +646,13 @@ namespace reference.`microsoft.graph` {
   }
 
   /**
-   * Describes deployment security group to assign a deployment to. The backend will expand the security Group ID to extract device serial numbers prior sending a create deployment request to Zebra.
+   * The request parameter for requesting Android LOB app configuration schema.
    */
-  @complex model androidFotaDeploymentAssignment {
+  @complex model androidLobAppConfigurationSchemaRequestDetail extends appConfigurationSchemaRequestDetail {
     /**
-     * The Azure Active Directory (Azure AD) we are deploying firmware updates to (e.g.: d93c8f48-bd42-4514-ba40-bc6b84780930). NOTE: Use this property moving forward because the existing property, target, is deprecated.
+     * The application policy ID of the Android LOB app
      */
-    assignmentTarget: deviceAndAppManagementAssignmentTarget | null;
-    /**
-     * The display name of the Azure AD security group used for the assignment.
-     */
-    displayName: string;
-    /**
-     * A unique identifier assigned to each Android FOTA Assignment entity
-     */
-    id: string | null;
-    /**
-     * NOTE: This entity is deprecated; use assignmentTarget. The Azure Active Directory (Azure AD) we are deploying firmware updates to (e.g.: d93c8f48-bd42-4514-ba40-bc6b84780930).
-     */
-    target: androidFotaDeploymentAssignmentTarget | null;
-  }
-
-  /**
-   * The AAD Group we are deploying firmware updates to
-   */
-  @complex model androidFotaDeploymentAssignmentTarget extends deviceAndAppManagementAssignmentTarget {
-    /**
-     * AAD Group Id.
-     */
-    groupId: string;
+    appId: string | null;
   }
 
   /**
@@ -879,6 +859,120 @@ namespace reference.`microsoft.graph` {
     resourceSpecificApplicationPermissions: resourceSpecificPermission[];
   }
 
+  /**
+   * Boolean configuration item inside an Android application's custom configuration schema.
+   */
+  @complex model appConfigurationSchemaItemBooleanType extends appConfigurationSchemaItemType {
+    /**
+     * Default value, if specified by the app developer
+     */
+    defaultValue: boolean | null;
+  }
+
+  /**
+   * Bundle array configuration item inside an Android application's custom configuration schema.
+   */
+  @complex model appConfigurationSchemaItemBundleArray extends appConfigurationSchemaItemType {
+  }
+
+  /**
+   * Bundle configuration item inside an Android application's custom configuration schema.
+   */
+  @complex model appConfigurationSchemaItemBundleType extends appConfigurationSchemaItemType {
+  }
+
+  /**
+   * Choice configuration item inside an Android application's custom configuration schema.
+   */
+  @complex model appConfigurationSchemaItemChoiceType extends appConfigurationSchemaItemType {
+    /**
+     * Default value, if specified by the app developer
+     */
+    defaultValue: string | null;
+    /**
+     * List of human readable name/value pairs for the valid values that can be set for this item
+     */
+    selections: keyValuePair[] | null;
+  }
+
+  /**
+   * Hidden configuration item inside an Android application's custom configuration schema.
+   */
+  @complex model appConfigurationSchemaItemHiddenType extends appConfigurationSchemaItemType {
+    /**
+     * Default value, if specified by the app developer
+     */
+    defaultValue: string | null;
+  }
+
+  /**
+   * Integer configuration item inside an Android application's custom configuration schema.
+   */
+  @complex model appConfigurationSchemaItemIntegerType extends appConfigurationSchemaItemType {
+    /**
+     * Default value, if specified by the app developer. Valid values 0 to 2147483647
+     */
+    defaultValue: int32 | null;
+  }
+
+  /**
+   * Multiselect configuration item inside an Android application's custom configuration schema.
+   */
+  @complex model appConfigurationSchemaItemMultiselectType extends appConfigurationSchemaItemType {
+    /**
+     * Default value, if specified by the app developer
+     */
+    defaultValue: string[] | null;
+    /**
+     * List of human readable name/value pairs for the valid values that can be set for this item
+     */
+    selections: keyValuePair[] | null;
+  }
+
+  /**
+   * String configuration item inside an Android application's custom configuration schema.
+   */
+  @complex model appConfigurationSchemaItemStringType extends appConfigurationSchemaItemType {
+    /**
+     * Default value, if specified by the app developer
+     */
+    defaultValue: string | null;
+  }
+
+  /**
+   * Single configuration item inside an Android application's configuration schema.
+   */
+  @abstract
+  @complex model appConfigurationSchemaItemType {
+    /**
+     * Description of what the item controls within the application
+     */
+    description: string | null;
+    /**
+     * Human readable name
+     */
+    displayName: string | null;
+    /**
+     * Unique index the application uses to maintain nested schema items. Valid values 0 to 2147483647
+     */
+    index: int32;
+    /**
+     * Index of parent schema item to track nested schema items. Valid values 0 to 2147483647
+     */
+    parentIndex: int32 | null;
+    /**
+     * Unique key the application uses to identify the item
+     */
+    schemaItemKey: string | null;
+  }
+
+  /**
+   * Base type for the request parameters that identifies the requested app configuration schema.
+   */
+  @abstract
+  @complex model appConfigurationSchemaRequestDetail {
+  }
+
   /**
    * Contains properties for App configuration setting item.
    */
@@ -1052,7 +1146,7 @@ namespace reference.`microsoft.graph` {
   }
 
   @complex model appManagementPolicyActorExemptions {
-    @contains customSecurityAttributes: customSecurityAttributeExemption[];
+    customSecurityAttributes: customSecurityAttributeExemption[] | null;
   }
 
   @complex model appManagementServicePrincipalConfiguration extends appManagementConfiguration {
@@ -2200,6 +2294,16 @@ namespace reference.`microsoft.graph` {
     cloudAppSecurityType: cloudAppSecuritySessionControlType | null;
   }
 
+  /**
+   * Complex type that represents usage details associated with a certification authority version. This type provides reporting data such as the number of leaf certificates issued during specific lifecycle phases.
+   */
+  @complex model cloudCertificationAuthorityVersionUsage {
+    /**
+     * The number of leaf certificates issued by the certification authority version when it was in the staged status. Only applicable for staged certification authority versions. Nullable. Read-only.
+     */
+    issuedStagedLeafCertificateCount: int32 | null;
+  }
+
   @complex model cloudRealtimeCommunicationInfo {
     isSipEnabled: boolean | null;
   }
@@ -2607,6 +2711,10 @@ namespace reference.`microsoft.graph` {
     url: string | null;
   }
 
+  @complex model connectivityParameterEntry {
+    value: string | null;
+  }
+
   /**
    * Represent connector status
    */
@@ -2882,6 +2990,16 @@ namespace reference.`microsoft.graph` {
     clientConfiguration: customExtensionClientConfiguration | null;
   }
 
+  @abstract
+  @complex model customSecurityAttributeExemption {
+    id: string;
+    operator: customSecurityAttributeComparisonOperator;
+  }
+
+  @complex model customSecurityAttributeStringValueExemption extends customSecurityAttributeExemption {
+    value: string | null;
+  }
+
   @open
   @complex model customSecurityAttributeValue {
   }
@@ -3314,11 +3432,11 @@ namespace reference.`microsoft.graph` {
 
   @complex model deviceCompliancePolicyScript {
     /**
-     * Device compliance script Id.
+     * Identifier of the device compliance script used to evaluate custom compliance. When deviceCompliancePolicyScript is set, this identifies which script to run. Default is null, when set to default it is not evaluated.
      */
     deviceComplianceScriptId: string | null;
     /**
-     * Json of the rules.
+     * base64-encoded JSON rules content that defines compliance rules to evaluate on the device. When deviceCompliancePolicyScript is set, the rule conditions defined in the JSON are evaluated to determine compliance and the device is marked noncompliant when any rule evaluates to noncompliant. Default is null, when set to default it is not evaluated.
      */
     rulesContent: binary | null;
   }
@@ -5790,6 +5908,10 @@ namespace reference.`microsoft.graph` {
      * The number of days after installation that forced reboot will happen.
      */
     daysUntilForcedReboot: int32;
+    /**
+     * The unique identifier for the quality update catalog item targeted by the expedite.
+     */
+    qualityUpdateCatalogItemId: string | null;
     /**
      * The release date to identify a quality update.
      */
@@ -6028,129 +6150,6 @@ namespace reference.`microsoft.graph` {
     targetChatId: string | null;
   }
 
-  /**
-   * The settings for a FOTA deployment. Is an abstract type.
-   */
-  @abstract
-  @complex model fotaDeploymentSetting {
-    /**
-     * The minimum battery level percentage allowed for installation. Must range between 0%-100%. Default is 0%. For Samsung, the value must range between 20%-80%, and the default is 20%. Returned by default.
-     */
-    batteryRuleMinimumBatteryLevelPercentage: int32 | null;
-    /**
-     * When 'True', indicates that the devices are required to be charging during installation. When 'false', indicates that the devices are not required to be charging during installation. Default is 'false'. Returned by default.
-     */
-    batteryRulePowerAdaptorRequired: boolean | null;
-    /**
-     * The end time of day during which firmware can install. Default is 11:59:59 PM or '23:59:59'. For Samsung, the default is 5 AM which is '05:00:00' and the window needs to be at least 3 hours. Returned by default.
-     */
-    installRuleWindowEndTime: offsetDateTime | null;
-    /**
-     * The start time of day during which firmware can install. Default is 12 AM which is '00:00:00'. For Samsung, the default is 2 AM which is '02:00:00'.
-     */
-    installRuleWindowStartTime: offsetDateTime | null;
-    /**
-     * The network type required on the device for the update. Possible values are 'any', 'wifi', and 'cellular'. Default is 'any'. See 'graph.fotaNetworkType' enum for possible values. Returned by default.
-     */
-    networkType: fotaNetworkType;
-    /**
-     * The time offset (time zone) when the update is deployed and installed on the devices (e.g.'180' represents an offset of '+03:00', and '-270' represents an offset of '-04:30'). Default is 0. Returned by default.
-     */
-    timeZoneOffsetInMinutes: int32 | null;
-  }
-
-  /**
-   * Describes the status of a FOTA deployment. The status is a high level status of the deployment as opposed to being a detailed status per device with information about the deployment state like request to the OEM is pending, the error code if the deployment failed to create, and device counts for different stages of the deployment.
-   */
-  @complex model fotaDeploymentStatus {
-    /**
-     * Indicates the number of devices where firmware update was cancelled. Default is 0. Returned by default.
-     */
-    cancelledDeviceCount: int32;
-    /**
-     * 'True' indicates that a cancellation was requested on the deployment. Otherwise 'false'. A cancellation request does not guarantee that the deployment was cancelled. Default is 'false'. Returned by default.
-     */
-    cancelRequested: boolean;
-    /**
-     * Indicates the number of devices where firmware update was completed. Default is 0. Returned by default
-     */
-    completedDeviceCount: int32;
-    /**
-     * The date and time when this deployment ended. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. If the state is cancelled, this property holds the cancellation date/time. If the the state is completed, this property holds the completion date/time. For example, midnight UTC on Jan 1, 2024 would look like this: '2024-01-01T00:00:00Z'. Default value: null.
-     */
-    deploymentEndDateTime: offsetDateTime | null;
-    /**
-     * FOTA deployment state. Possible values are 'pending', 'failed', 'created', 'inProgress', 'completed', 'pendingCancel', and 'cancelled'. Default is 'pending'. See 'graph.fotaDeploymentState' enum for details. The deployment state is determined by looking at the status of all the devices in the deployment. If any device is in the created state, the overall deployment state becomes created. If any device is in progress, the overall deployment state becomes in progress. Once all the devices are completed, the overall deployment state becomes completed. If the IT Admin requests cancellation, the deployment state becomes pending cancel and then cancelled. Returned by default.
-     */
-    deploymentState: fotaDeploymentState;
-    /**
-     * An error code indicating the failure reason, when the deployment failed to create or complete. Possible values are 'noDevicesFoundInSelectedEntraGroups', 'noIntuneDevicesFoundInSelectedEntraGroups', 'noFotaEnrolledDevicesFoundForCurrentTenant', 'noFotaEnrolledDevicesFoundInSelectedEntraGroups', 'noFotaDevicesFoundForSelectedDeviceModel', and 'fotaCreateDeploymentRequestFailure'. Default is 'noDevicesFoundInSelectedEntraGroups'. See 'graph.fotaDeploymentErrorCode' enum for possible values. Returned by default.
-     */
-    errorCode: fotaDeploymentErrorCode;
-    /**
-     *  Indicates the number of devices where firmware update failed. Default is 0. Returned by default.
-     */
-    failedDeviceCount: int32;
-    /**
-     *  Indicates the number of devices where firmware update is in progress. Default is 0. Returned by default.
-     */
-    inProgressDeviceCount: int32;
-    /**
-     * Date and time when the deployment status was updated from the OEM's cloud services. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2024 would look like this: '2024-01-01T00:00:00Z'. Default value: null.
-     */
-    @computed lastModifiedDateTime: offsetDateTime | null;
-    /**
-     * Indicates the number of devices where the deployment was not applicable. Default is 0. Returned by default.
-     */
-    notApplicableDeviceCount: int32;
-    /**
-     * Indicates the total number of devices in the FOTA deployment. Default is 0. Returned by default.
-     */
-    totalDeviceCount: int32;
-    /**
-     * Indicates the number of devices where no deployment status or end state was received from the OEM's cloud services. Default is 0. Returned by default.
-     */
-    unknownDeviceCount: int32;
-  }
-
-  /**
-   * High level status of a tenant's FOTA registered devices with information about the registration state like request is pending, the error code if registration failed, and device counts for different stages of registration.
-   */
-  @complex model fotaDeviceRegistrationStatus {
-    /**
-     * Indicates the number of devices where FOTA registration completed. Default is 0. Returned by default.
-     */
-    completedDeviceCount: int32;
-    /**
-     * An error code indicating the failure reason, when a device failed to register for the OEM's FOTA functionality. Possible values are 'noDevicesFoundInSelectedEntraGroups', 'noIntuneDevicesFoundInSelectedEntraGroups', and 'fotaRegistrationRequestFailure'. Default is 'noDevicesFoundInSelectedEntraGroups'. See 'graph.fotaRegistrationErrorCode' enum for possible values. Returned by default.
-     */
-    errorCode: fotaRegistrationErrorCode;
-    /**
-     * Indicates the number of devices where FOTA registration failed. Default is 0. Returned by default.
-     */
-    failedDeviceCount: int32;
-    /**
-     * Indicates the number of devices where FOTA registration is in progress. Default is 0. Returned by default.
-     */
-    inProgressDeviceCount: int32;
-    /**
-     * Indicates the number of devices where FOTA registration is not applicable. Default is 0. Returned by default.
-     */
-    notApplicableDeviceCount: int32;
-    /**
-     * FOTA registration state. Possible values are 'pending', 'failed', 'requested', 'inProgress', and 'completed'. Default is 'pending'. See 'graph.fotaRegistrationState' enum for details. The registration state is determined by looking at the status of all devices targeted for registration. If any device has not yet started registration, the overall registration state becomes registration requested. If any device is still in progress, the overall deployment state becomes in progress. Once all the devices are completed, the overall registration state becomes completed. Returned by default.
-     */
-    registrationState: fotaRegistrationState;
-    /**
-     * Indicates the total number of devices targeted for FOTA registration. Default is 0. Returned by default.
-     */
-    totalDeviceCount: int32;
-    /**
-     * Indicates the number of devices where FOTA registration status is unknown. Default is 0. Returned by default.
-     */
-    unknownDeviceCount: int32;
-  }
-
   @complex model freeBusyError {
     message: string | null;
     responseCode: string | null;
@@ -7661,6 +7660,7 @@ namespace reference.`microsoft.graph` {
     usage: string | null;
   }
 
+
   /**
    * A key-value pair with a string key and an integer value.
    */
@@ -7883,6 +7883,21 @@ namespace reference.`microsoft.graph` {
     primaryLookupColumnId: string | null;
   }
 
+  @complex model m365CapabilityInboundAccess {
+    isAllowed: boolean | null;
+    resourceScopes: m365CapabilityResourceScopes | null;
+  }
+
+  @complex model m365CapabilityResourceScope {
+    resourceId: string | null;
+    resourceType: m365ResourceType;
+  }
+
+  @complex model m365CapabilityResourceScopes {
+    excluded: m365CapabilityResourceScope[];
+    included: m365CapabilityResourceScope[];
+  }
+
   /**
    * The identifier for a Mac app.
    */
@@ -8745,6 +8760,16 @@ namespace reference.`microsoft.graph` {
     msiType: msiType | null;
   }
 
+  /**
+   * The request parameter for requesting Android Managed Play Store app configuration schema.
+   */
+  @complex model managedStoreAppConfigurationSchemaRequestDetail extends appConfigurationSchemaRequestDetail {
+    /**
+     * The package name of the Android Managed Play Store app
+     */
+    packageName: string | null;
+  }
+
   @complex model managementCertificateWithThumbprint {
     /**
      * The Base 64 encoded management certificate
@@ -9490,6 +9515,7 @@ namespace reference.`microsoft.graph` {
     onPremisesApplicationSegments: onPremisesApplicationSegment[] | null;
     segmentsConfiguration: segmentConfiguration | null;
     singleSignOnSettings: onPremisesPublishingSingleSignOn | null;
+    trafficRoutingMethod: trafficRoutingMethod;
     useAlternateUrlForTranslationAndRedirect: boolean | null;
     verifiedCustomDomainCertificatesMetadata: verifiedCustomDomainCertificatesMetadata | null;
     verifiedCustomDomainKeyCredential: keyCredential | null;
@@ -9721,6 +9747,7 @@ namespace reference.`microsoft.graph` {
     startDateTime: offsetDateTime | null;
   }
 
+
   @complex model passwordProfile {
     forceChangePasswordNextSignIn: boolean | null;
     forceChangePasswordNextSignInWithMfa: boolean | null;
@@ -9824,6 +9851,11 @@ namespace reference.`microsoft.graph` {
     displayAs: string | null;
   }
 
+  @complex model perTenantTrafficSegmentsOverride {
+    percentage: int32;
+    tenantId: guid;
+  }
+
   @complex model phone {
     number: string | null;
     type: phoneType | null;
@@ -10031,6 +10063,12 @@ namespace reference.`microsoft.graph` {
     localizations: displayNameLocalization[] | null;
   }
 
+  @complex model profileSourceLocalization {
+    displayName: string | null;
+    languageTag: string | null;
+    webUrl: string | null;
+  }
+
   @open
   @complex model programResource extends identity {
     type: string | null;
@@ -10602,41 +10640,67 @@ namespace reference.`microsoft.graph` {
   }
 
   /**
-   * The settings for a Samsung Knox E-FOTA campaign (deployment). Inherits from 'graph.fotaDeploymentSetting'.
+   * The firmware version from Samsung for a specific device model, sales code, and CSC (Consumer Software Customization). Used to create Samsung E-FOTA deployments.
    */
-  @complex model samsungEFotaDeploymentSetting extends fotaDeploymentSetting {
+  @complex model samsungEFotaFirmwareVersion {
     /**
-     * Determines how long in minutes the end user is warned before the firmware auto installs. The value must range between 5-360 minutes. Default is 5 minutes. Returned by default.
+     * The Android Processor version name. This property is populated by Samsung. Eg. 'G960U1UES9FVD1'. Default value: null. Read-only.
+     */
+    androidProcessorVersionName: string | null;
+    /**
+     * The Consumer Software Customization which is a specific code associated with the region or carrier customization of a Samsung device. This property is populated by Samsung. Eg. 'OYM'. Read-only. Returned by default.
      */
-    autoFirmwareInstallationReminderMessageDurationInMinutes: int32;
+    consumerSoftwareCustomizationCode: string;
     /**
-     * Campaign (deployment) end date and time. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Returned by default.
+     * The firmware description. This property is populated by Samsung. Default value: null. Read-only.
+     */
+    description: string | null;
+    /**
+     * Samsung device model. This property is populated by Samsung. Eg. 'SM-960F'. Read-only. Returned by default.
      */
-    campaignEndDateTime: offsetDateTime;
+    deviceModelName: string;
     /**
-     * Campaign (deployment) installation schedule mode. Default is StartAndEndDateSchedule.
+     * The firmware version. This property is populated by Samsung Eg. 'T575XXU4EAAA/T575OXM4EAAA/T575XXU4EAAA'. Default value: null. Read-only.
      */
-    campaignScheduleMode: samsungEFotaScheduleMode;
+    firmwareVersion: string | null;
     /**
-     * Campaign (deployment) start date and time. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Returned by default.
+     * Firmware ID from Samsung. This property is populated by Samsung. Eg. 'FW2022033111797487'. Read-only. Returned by default.
      */
-    campaignStartDateTime: offsetDateTime;
+    id: string | null;
     /**
-     * The time offset (time zone) when the campaign is deployed (e.g.'180' represents an offset of '+03:00', and '-270' represents an offset of '-04:30'). Default is 0. Returned by default.
+     * The OS version name. This property is populated by Samsung. Eg. 'Pie(Android 9)'. Default value: null. Read-only.
      */
-    campaignTimeZoneOffsetInMinutes: int32 | null;
+    osVersionName: string | null;
     /**
-     * The time of day for a firmware download. Possible values are 'any' (default) and 'matchFirmwareInstallPeriod'. See 'graph.fotaDownloadPeriodType' enum for details. Returned by default.
+     * Firmware release date. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. This property is populated by Samsung. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Default value: null. Read-only.
      */
-    downloadPeriod: fotaDownloadPeriodType | null;
+    releaseDateTime: offsetDateTime;
     /**
-     * Determines how long in hours before the end user is reminded to install the firmware after postponing. The value must range between 1-24 hrs. Default is 1hr. Returned by default.
+     * The firmware request type. This property is populated by Samsung Eg. 'NORMAL'. Default value: null. Read-only.
      */
-    postponedInstallationReminderMessageDuration: int32;
+    requestFirmwareTypeName: string | null;
     /**
-     * Number of times the end user is allowed to postpone firmware installation. Default is 0. The value must range between 0-3. Returned by default.
+     * Sales code of a Samsung device that corresponds to its georgraphic area or carrier network. This property is populated by Samsung. Eg. 'TMB'. Read-only. Returned by default.
      */
-    postponeInstallation: int32;
+    salesCode: string;
+    /**
+     * The firmware security patch. This property is populated by Samsung Eg. '2023-09-07 07:50:57'. Default value: null. Read-only.
+     */
+    securityPatchVersion: string | null;
+  }
+
+  /**
+   * The targeted firmware version for an E-FOTA deployment. Used while creating E-FOTA deployments.
+   */
+  @complex model samsungEFotaFirmwareVersionTarget {
+    /**
+     * Describes the firmware version for a specific device model, sales code, and CSC. See 'graph.samsungEFotaFirmwareVersion' entity for details. Returned by default.
+     */
+    firmwareVersion: samsungEFotaFirmwareVersion;
+    /**
+     * A unique identifier assigned to each Samsung Knox E-FOTA firmware version target entity. Returned by default.
+     */
+    id: string | null;
   }
 
   @complex model scheduleInformation {
@@ -11323,6 +11387,7 @@ namespace reference.`microsoft.graph` {
     state: synchronizationScheduleState;
   }
 
+  @graphDeprecated("SynchronizationSecret_Deprecation")
   @complex model synchronizationSecretKeyStringValuePair {
     key: synchronizationSecret;
     value: string | null;
@@ -13315,6 +13380,78 @@ namespace reference.`microsoft.graph` {
     useDeviceContext: boolean;
   }
 
+  /**
+   * Contains per-group deployment configuration for a windowsAutoUpdateCatalogApp. These settings control the end-user experience when the app is deployed to a specific group—including whether notifications are shown, how delivery bandwidth is used, when the app must be installed by, and how the device coordinates restarts afterward.
+   */
+  @complex model windowsAutoUpdateCatalogAppAssignmentSettings extends mobileAppAssignmentSettings {
+    /**
+     * Indicates the priority level for downloading the app content using Delivery Optimization. foreground prioritizes the download over background tasks, which may result in faster installation but higher bandwidth usage. Defaults to notConfigured (background priority) if not specified. When omitted from the request, the service applies notConfigured and the device downloads app content using normal background priority. In National Cloud environments (e.g., US Government, China), Delivery Optimization is not available; the service accepts and stores any value provided, but the device agent ignores it at runtime and delivers content via CDN using background priority regardless of the configured value. Possible values are: notConfigured, foreground, unknownFutureValue.
+     */
+    deliveryOptimizationPriority: windowsAutoUpdateCatalogAppDeliveryOptimizationPriority;
+    /**
+     * Specifies the deadline by which the app must be installed on the device. When null, the app is offered for immediate installation with no enforced deadline.
+     */
+    installTimeSettings: windowsAutoUpdateCatalogAppInstallTimeSettings | null;
+    /**
+     * Indicates which notifications the Intune management extension displays to the end user during app installation and restart. Defaults to showAll if not specified. Possible values are: showAll, showReboot, hideAll, unknownFutureValue.
+     */
+    notificationType: windowsAutoUpdateCatalogAppNotificationType;
+    /**
+     * Specifies the restart coordination behavior after the app is installed—including how long to wait before restarting, when to show a countdown, and how long the user can snooze. When null, no restart coordination is applied (the device may still restart based on the app's deviceRestartBehavior setting). Note: the service accepts restart settings regardless of the app's deviceRestartBehavior value; the device agent determines which settings are actually honored at runtime.
+     */
+    restartSettings: windowsAutoUpdateCatalogAppRestartSettings | null;
+  }
+
+  /**
+   * Describes how the app installer runs on target devices, including which account context it runs under and how the device handles restarts after installation. When omitted, the service applies default values (runAsAccount = system, deviceRestartBehavior = basedOnReturnCode).
+   */
+  @complex model windowsAutoUpdateCatalogAppInstallExperience {
+    /**
+     * Indicates how the device handles restarts after the app installation completes. This controls whether the Intune management extension initiates, suppresses, or forces a device restart based on the installer's exit code. Defaults to basedOnReturnCode if not specified. Possible values are: basedOnReturnCode, allow, suppress, force, unknownFutureValue.
+     */
+    deviceRestartBehavior: windowsAutoUpdateCatalogAppRestartBehavior;
+    /**
+     * Indicates the account context under which the app installer runs on the device. When set to system, the installer runs with elevated privileges in the SYSTEM account context. When set to user, the installer runs in the context of the currently logged-in user. Defaults to system if not specified. Possible values are: system, user.
+     */
+    runAsAccount: runAsAccountType;
+  }
+
+  /**
+   * Specifies when the app should be installed on target devices. When null or is omitted from the assignment, the app is offered for immediate installation with no enforced deadline.
+   */
+  @complex model windowsAutoUpdateCatalogAppInstallTimeSettings {
+    /**
+     * The maximum allowed date and time by which the app must be installed on the device. After this deadline, the Intune management extension enforces installation automatically. When null, there is no enforced deadline.
+     */
+    deadlineDateTime: offsetDateTime | null;
+    /**
+     * The time at which the app should be available for installation on the device. When null, the app is available immediately.
+     */
+    startDateTime: offsetDateTime | null;
+    /**
+     * Indicates whether the startDateTime and deadlineDateTime values should be interpreted using the device's local time zone. When false, the values are interpreted as UTC. Defaults to false if not specified.
+     */
+    useLocalTime: boolean;
+  }
+
+  /**
+   * Specifies how the device coordinates a restart after the app is installed. These settings control the grace period before a restart is initiated, when the user sees a countdown notification, and how long the user can defer the restart by snoozing. When null, no restart coordination is applied (the device may still restart based on the app's deviceRestartBehavior setting).
+   */
+  @complex model windowsAutoUpdateCatalogAppRestartSettings {
+    /**
+     * The number of minutes before the scheduled restart at which a countdown notification is displayed to the user. Must be between 1 and the value of gracePeriodInMinutes. This countdown is non-dismissible and warns the user that a restart is imminent. For example, a value of 15 means the countdown appears 15 minutes before the restart.
+     */
+    countdownDisplayBeforeRestartInMinutes: int32;
+    /**
+     * The number of minutes the device waits after app installation before initiating a restart. During this period, the user can continue working and save their documents. For example, a value of 1440 means the device waits 24 hours before restarting.
+     */
+    gracePeriodInMinutes: int32;
+    /**
+     * The number of minutes by which the user can defer (snooze) the restart notification each time they press the snooze button. When null, the snooze option is not available and the user cannot defer the restart. For example, a value of 240 allows the user to defer the restart by 4 hours each time.
+     */
+    restartNotificationSnoozeDurationInMinutes: int32 | null;
+  }
+
   /**
    * Windows Defender last scan result
    */
@@ -15328,6 +15465,24 @@ namespace reference.`microsoft.graph` {
     isActive: boolean | null;
   }
 
+  /**
+   * Schema describing an Android application's custom configurations.
+   */
+  @entity model androidAppConfigurationSchema extends entity {
+    /**
+     * UTF8 encoded byte array containing example JSON string conforming to this schema that demonstrates how to set the configuration for this app
+     */
+    exampleJson: binary | null;
+    /**
+     * Collection of items each representing a named configuration option in the schema. It contains a flat list of all configuration.
+     */
+    nestedSchemaItems: appConfigurationSchemaItemType[] | null;
+    /**
+     * Collection of items each representing a named configuration option in the schema. It only contains the root-level configuration.
+     */
+    schemaItems: appConfigurationSchemaItemType[] | null;
+  }
+
   /**
    * Android certificate profile base.
    */
@@ -15921,6 +16076,10 @@ namespace reference.`microsoft.graph` {
      * Indicates whether or not google accounts will be blocked.
      */
     googleAccountsBlocked: boolean | null;
+    /**
+     * Exit code to allow a user to escape from Kiosk Mode when the device is in Kiosk Mode.
+     */
+    isKioskModeExitCodeSet: boolean;
     /**
      * Indicates whether a user can access the device's Settings app while in Kiosk Mode.
      */
@@ -16543,6 +16702,10 @@ namespace reference.`microsoft.graph` {
      * Custom data to define key/value pairs specific to a VPN provider. This collection can contain a maximum of 25 elements.
      */
     customKeyValueData: keyValuePair[] | null;
+    /**
+     * List of app package names that will be able to access the network directly when VPN is in lockdown mode but not connected.
+     */
+    lockdownExclusionList: string[] | null;
     /**
      * Microsoft Tunnel site ID.
      */
@@ -17311,6 +17474,10 @@ namespace reference.`microsoft.graph` {
      * Setting to specify whether to allow ConnectedApps experience for this app.
      */
     connectedAppsEnabled: boolean;
+    /**
+     * Indicates whether the app is allowed to act as a credential provider. Applies to Android 14 and above. The default value is 'notConfigured'. Possible values are: 'notConfigured' and 'allowed'. When set to 'notConfigured', the Android OS will determine whether the app is allowed to act as a credential provider or not.
+     */
+    credentialProviderRoleState: androidAppCredentialProviderRoleState;
     /**
      * Android For Work app configuration package id.
      */
@@ -18097,6 +18264,10 @@ namespace reference.`microsoft.graph` {
      * Setting to specify whether to allow ConnectedApps experience for this app.
      */
     connectedAppsEnabled: boolean;
+    /**
+     * Indicates whether the app is allowed to act as a credential provider. Applies to Android 14 and above. The default value is 'notConfigured'. Possible values are: 'notConfigured' and 'allowed'. When set to 'notConfigured', the Android OS will determine whether the app is allowed to act as a credential provider or not.
+     */
+    credentialProviderRoleState: androidAppCredentialProviderRoleState;
     /**
      * Android Enterprise app configuration package id.
      */
@@ -18917,6 +19088,10 @@ namespace reference.`microsoft.graph` {
      * Fingerprint is a string that will be used to verify the VPN server can be trusted, which is only applicable when connection type is Check Point Capsule VPN.
      */
     fingerprint: string | null;
+    /**
+     * List of app package names that will be able to access the network directly when VPN is in lockdown mode but not connected.
+     */
+    lockdownExclusionList: string[] | null;
     /**
      * Microsoft Tunnel site ID.
      */
@@ -19583,9 +19758,11 @@ namespace reference.`microsoft.graph` {
     identifierUris: string[];
     info: informationalUrl | null;
     isDeviceOnlyAuthSupported: boolean | null;
+    isDisabled: boolean | null;
     isFallbackPublicClient: boolean | null;
     keyCredentials: keyCredential[];
     logo: stream;
+    managerApplications: guid;
     notes: string | null;
     onPremisesPublishing: onPremisesPublishing | null;
     optionalClaims: optionalClaims | null;
@@ -19914,6 +20091,7 @@ namespace reference.`microsoft.graph` {
     requirements: strongAuthenticationRequirements | null;
     signInPreferences: signInPreferences | null;
     @contains emailMethods: emailAuthenticationMethod[];
+    @contains externalAuthenticationMethods: externalAuthenticationMethod[];
     @contains fido2Methods: fido2AuthenticationMethod[];
     @contains methods: authenticationMethod[];
     @contains microsoftAuthenticatorMethods: microsoftAuthenticatorAuthenticationMethod[];
@@ -20194,6 +20372,11 @@ namespace reference.`microsoft.graph` {
     @contains verticalSection: verticalSection | null;
   }
 
+  @entity model caPoliciesDeletableRoot extends entity {
+    @contains namedLocations: namedLocation[];
+    @contains policies: conditionalAccessPolicy[];
+  }
+
   /**
    * CartToClassAssociation for associating device carts with classrooms.
    */
@@ -20408,7 +20591,7 @@ namespace reference.`microsoft.graph` {
    */
   @entity model cloudCertificationAuthority extends entity {
     /**
-     * The URL to download the certification authority certificate. Read-only.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.certificateDownloadUrl instead.
      */
     certificateDownloadUrl: string | null;
     /**
@@ -20416,11 +20599,11 @@ namespace reference.`microsoft.graph` {
      */
     certificateKeySize: cloudCertificationAuthorityCertificateKeySize;
     /**
-     * The cloud certification authority's Certificate Revocation List URL that can be used to determine revocation status. Read-only.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.certificateRevocationListUrl instead.
      */
     certificateRevocationListUrl: string | null;
     /**
-     * The certificate signing request used to create an issuing certification authority with a root certification authority external to Microsoft Cloud PKI. The based-64 encoded certificate signing request can be downloaded through this property. After downloading the certificate signing request, it must be signed by the external root certifcation authority. Read-only.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.certificateSigningRequest instead.
      */
     certificateSigningRequest: string | null;
     /**
@@ -20428,7 +20611,7 @@ namespace reference.`microsoft.graph` {
      */
     certificationAuthorityIssuerId: string | null;
     /**
-     * The URI of the issuing certification authority of a subordinate certification authority. Returns null if a root certification authority. Nullable. Read-only.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.certificationAuthorityIssuerUri instead.
      */
     certificationAuthorityIssuerUri: string | null;
     /**
@@ -20468,9 +20651,13 @@ namespace reference.`microsoft.graph` {
      */
     eTag: string | null;
     extendedKeyUsages: extendedKeyUsage[] | null;
+    /**
+     * The geographic region where a cloud certification authority (CA) is hosted. Read-only.
+     */
+    geographicRegion: string | null;
     issuerCommonName: string | null;
     /**
-     * The key platform used to store the certification authority keys. Read-only.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.keyPlatform instead.
      */
     keyPlatform: cloudCertificationAuthorityKeyPlatformType;
     /**
@@ -20482,7 +20669,7 @@ namespace reference.`microsoft.graph` {
      */
     localityName: string | null;
     /**
-     * The Online Certificate Status Protocol (OCSP) responder URI that can be used to determine certificate status. Read-only.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.ocspResponderUri instead.
      */
     ocspResponderUri: string | null;
     /**
@@ -20502,11 +20689,11 @@ namespace reference.`microsoft.graph` {
      */
     rootCertificateCommonName: string | null;
     /**
-     * The SCEP server URL for device SCEP connections to request certificates. Read-only.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.scepServerUrl instead.
      */
     scepServerUrl: string | null;
     /**
-     * The serial number used to uniquely identify a certificate with its issuing certification authority. Read-only. Supports $select.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.serialNumber instead.
      */
     serialNumber: string | null;
     /**
@@ -20514,15 +20701,15 @@ namespace reference.`microsoft.graph` {
      */
     stateName: string | null;
     /**
-     * The subject name of the certificate. The subject is the target or intended beneficiary of the security being provided, such as a company or government entity. Read-only. Supports $orderby and $select.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.subjectName instead.
      */
     subjectName: string | null;
     /**
-     * Secure Hash Algorithm 1 digest of the certificate that can be used to identify it. Read-only. Supports $select.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.thumbprint instead.
      */
     thumbprint: string | null;
     /**
-     * The end date time of the validity period of a certification authority certificate. Certificates cannot be used after this date time as they are longer valid. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Nullable. Read-only. Supports $orderby.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.validityEndDateTime instead.
      */
     validityEndDateTime: offsetDateTime | null;
     /**
@@ -20530,17 +20717,25 @@ namespace reference.`microsoft.graph` {
      */
     validityPeriodInYears: int32;
     /**
-     * The start date time of the validity period of a certification authority certificate. Certificates cannot be used before this date time as they are not yet valid. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Nullable. Read-only. Supports $orderby.
+     * Deprecated: Starting May 2026, use cloudCertificationAuthorityVersion.validityStartDateTime instead.
      */
     validityStartDateTime: offsetDateTime | null;
     /**
-     * The certification authority version, which is incremented each time the certification authority is renewed. Read-only.
+     * Deprecated: Starting May 2026, use activeVersion.versionNumber instead.
      */
     versionNumber: int32;
+    /**
+     * The currently active certification authority version. This navigation property provides direct access to the active version's details including certificate information, URLs, and validity periods. The active version is automatically included in the default response when retrieving a certification authority entity without requiring $expand. Read-only.
+     */
+    @references activeVersion: cloudCertificationAuthorityVersion | null;
     /**
      * Required OData property to expose leaf certificate API.
      */
     @references cloudCertificationAuthorityLeafCertificate: cloudCertificationAuthorityLeafCertificate[];
+    /**
+     * The collection of all certification authority versions, including active, staged, retired, and expired versions. This navigation property provides access to the full version history of the certification authority. Use $expand=versions to include this collection in the response. Read-only.
+     */
+    @references versions: cloudCertificationAuthorityVersion[];
   }
 
   /**
@@ -20555,6 +20750,10 @@ namespace reference.`microsoft.graph` {
      * The URI of the certification authority that issued the certificate. Read-only.
      */
     certificationAuthorityIssuerUri: string | null;
+    /**
+     * The version number of the certification authority that issued this leaf certificate. Read-only.
+     */
+    certificationAuthorityVersionNumber: int32;
     /**
      * URL to find the relevant Certificate Revocation List for this certificate. Read-only.
      */
@@ -20620,6 +20819,88 @@ namespace reference.`microsoft.graph` {
      * The start date time of the validity period of a certificate. Certificates cannot be used before this date time as they are not yet valid. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Nullable. Read-only. Supports $orderby.
      */
     validityStartDateTime: offsetDateTime | null;
+    /**
+     * The certification authority version that issued this leaf certificate. Read-only.
+     */
+    @references cloudCertificationAuthorityVersion: cloudCertificationAuthorityVersion | null;
+  }
+
+  /**
+   * Entity that represents version-specific properties of a cloud certification authority.
+   */
+  @entity model cloudCertificationAuthorityVersion extends entity {
+    /**
+     * The URL to download the certification authority certificate. Read-only.
+     */
+    certificateDownloadUrl: string | null;
+    /**
+     * The cloud certification authority's Certificate Revocation List URL that can be used to determine revocation status. Read-only.
+     */
+    certificateRevocationListUrl: string | null;
+    /**
+     * The certificate signing request used to create an issuing certification authority with a root certification authority external to Microsoft Cloud PKI. The based-64 encoded certificate signing request can be downloaded through this property. After downloading the certificate signing request, it must be signed by the external root certifcation authority. Read-only.
+     */
+    certificateSigningRequest: string | null;
+    /**
+     * The certification authority identifier. Read-only.
+     */
+    certificationAuthorityId: string;
+    /**
+     * The URI of the issuing certification authority of a subordinate certification authority. Returns null if a root certification authority. Nullable. Read-only.
+     */
+    certificationAuthorityIssuerUri: string | null;
+    /**
+     * The current status of this certification authority version. Possible values are: unknown, active, staged, paused, retired, expired, revoked, unknownFutureValue. Read-only.
+     */
+    certificationAuthorityVersionStatus: cloudCertificationAuthorityVersionStatus;
+    /**
+     * The date and time when the certification authority version is scheduled to be decommissioned. Only applicable for staged certification authority versions. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Nullable. Read-only.
+     */
+    decommissionDateTime: offsetDateTime | null;
+    /**
+     * The key platform used to store the certification authority keys. Read-only.
+     */
+    keyPlatform: cloudCertificationAuthorityKeyPlatformType;
+    /**
+     * Last modification date and time of this certification authority entity instance. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Nullable. Read-only.
+     */
+    @computed lastModifiedDateTime: offsetDateTime | null;
+    /**
+     * The Online Certificate Status Protocol (OCSP) responder URI that can be used to determine certificate status. Read-only.
+     */
+    ocspResponderUri: string | null;
+    /**
+     * The SCEP server URL for device SCEP connections to request certificates. Read-only.
+     */
+    scepServerUrl: string | null;
+    /**
+     * The serial number used to uniquely identify a certificate with its issuing certification authority. Read-only.
+     */
+    serialNumber: string | null;
+    /**
+     * The subject name of the certificate. The subject is the target or intended beneficiary of the security being provided, such as a company or government entity. Read-only.
+     */
+    subjectName: string | null;
+    /**
+     * Secure Hash Algorithm 1 digest of the certificate that can be used to identify it. Read-only.
+     */
+    thumbprint: string | null;
+    /**
+     * The usage details associated with this certification authority version, including reporting data such as the number of leaf certificates issued during the staged period. Read-only.
+     */
+    usage: cloudCertificationAuthorityVersionUsage | null;
+    /**
+     * The end date time of the validity period of a certification authority certificate. Certificates cannot be used after this date time as they are longer valid. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Nullable. Read-only.
+     */
+    validityEndDateTime: offsetDateTime | null;
+    /**
+     * The start date time of the validity period of a certification authority certificate. Certificates cannot be used before this date time as they are not yet valid. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Nullable. Read-only.
+     */
+    validityStartDateTime: offsetDateTime | null;
+    /**
+     * The version number assigned to this specific certification authority version entity. Read-only.
+     */
+    versionNumber: int32;
   }
 
   /**
@@ -20838,12 +21119,13 @@ namespace reference.`microsoft.graph` {
     partnerState: deviceManagementPartnerTenantState;
   }
 
-  @entity model conditionalAccessPolicy extends entity {
+  @entity model conditionalAccessPolicy extends policyDeletableItem {
     conditions: conditionalAccessConditionSet;
     @computed createdDateTime: offsetDateTime | null;
     description: string | null;
     displayName: string;
     grantControls: conditionalAccessGrantControls | null;
+    @computed @key id: string;
     modifiedDateTime: offsetDateTime | null;
     sessionControls: conditionalAccessSessionControls | null;
     state: conditionalAccessPolicyState;
@@ -20852,6 +21134,7 @@ namespace reference.`microsoft.graph` {
 
   @entity model conditionalAccessRoot extends entity {
     @contains authenticationContextClassReferences: authenticationContextClassReference[];
+    @contains deletedItems: caPoliciesDeletableRoot | null;
     @contains namedLocations: namedLocation[];
     @contains policies: conditionalAccessPolicy[];
     @contains templates: conditionalAccessTemplate[];
@@ -21069,6 +21352,7 @@ namespace reference.`microsoft.graph` {
     inboundTrust: crossTenantAccessPolicyInboundTrust | null;
     invitationRedemptionIdentityProviderConfiguration: defaultInvitationRedemptionIdentityProviderConfiguration | null;
     isServiceDefault: boolean | null;
+    @contains m365Capabilities: m365CapabilityBase[];
   }
 
   @entity model crossTenantAccessPolicyConfigurationPartner extends MsGraph.SharedModels.entity {
@@ -21080,6 +21364,22 @@ namespace reference.`microsoft.graph` {
     isServiceProvider: boolean | null;
     @computed @key tenantId: string;
     @contains identitySynchronization: crossTenantIdentitySyncPolicyPartner | null;
+    @contains m365Capabilities: m365CapabilityBase[];
+  }
+
+  @entity model crossTenantCalendarAvailabilityBasic extends m365CapabilityBase {
+  }
+
+  @entity model crossTenantCalendarAvailabilityLimitedDetails extends m365CapabilityBase {
+  }
+
+  @entity model crossTenantCalendarSharingFreeBusyDetail extends m365CapabilityBase {
+  }
+
+  @entity model crossTenantCalendarSharingFreeBusyReviewer extends m365CapabilityBase {
+  }
+
+  @entity model crossTenantCalendarSharingFreeBusySimple extends m365CapabilityBase {
   }
 
   @entity model crossTenantIdentitySyncPolicyPartner extends MsGraph.SharedModels.entity {
@@ -21090,6 +21390,24 @@ namespace reference.`microsoft.graph` {
     userSyncInbound: crossTenantUserSyncInbound | null;
   }
 
+  @entity model crossTenantMailTipsAll extends m365CapabilityBase {
+  }
+
+  @entity model crossTenantMailTipsLimited extends m365CapabilityBase {
+  }
+
+  @entity model crossTenantMigration extends m365CapabilityBase {
+  }
+
+  @entity model crossTenantOpenProfileCard extends m365CapabilityBase {
+  }
+
+  @entity model crossTenantPlacesDeskBooking extends m365CapabilityBase {
+  }
+
+  @entity model crossTenantPlacesRoomBooking extends m365CapabilityBase {
+  }
+
   @privatePreview("MicrosofEntitlementManagementCustomextensions")
   @entity model customAccessPackageWorkflowExtension extends customCalloutExtension {
     @computed createdDateTime: offsetDateTime | null;
@@ -21151,15 +21469,6 @@ namespace reference.`microsoft.graph` {
     @contains allowedValues: allowedValue[];
   }
 
-  @abstract
-  @entity model customSecurityAttributeExemption extends entity {
-    operator: customSecurityAttributeComparisonOperator | null;
-  }
-
-  @entity model customSecurityAttributeStringValueExemption extends customSecurityAttributeExemption {
-    value: string | null;
-  }
-
   @entity model dailyInactiveUsersMetric extends inactiveUsersMetricBase {
     inactive1DayCount: int64 | null;
   }
@@ -21886,6 +22195,10 @@ namespace reference.`microsoft.graph` {
      * Indicates whether Setup Assistant will skip the user interface for primary account setup
      */
     skipPrimarySetupAccountCreation: boolean;
+    /**
+     * Indicates whether Platform SSO is used as part of device enrollment during Setup Assistant. When TRUE, Platform SSO is used in device enrollment during Setup Assistant. When FALSE Platform SSO is not used in enrollment during Setup Assistant. Note: This value cannot be TRUE when configurationWebUrl is TRUE.
+     */
+    usePlatformSSODuringSetupAssistant: boolean;
     /**
      * Indicates if zoom setup pane is disabled
      */
@@ -22699,6 +23012,10 @@ namespace reference.`microsoft.graph` {
      * The timestamp of when the device compliance script was modified. This property is read-only.
      */
     @computed lastModifiedDateTime: offsetDateTime;
+    /**
+     * Indicates the operating system platform type that this compliance script targets.
+     */
+    platform: deviceComplianceScriptPlatformType | null;
     /**
      * Name of the device compliance script publisher
      */
@@ -23924,6 +24241,9 @@ namespace reference.`microsoft.graph` {
     status: appLogUploadState;
   }
 
+  /**
+   * Singleton that acts as container for a collection of Resource Access entities.
+   */
   @entity model deviceManagement extends entity {
     /**
      * The date & time when tenant data moved between scaleunits.
@@ -23973,6 +24293,10 @@ namespace reference.`microsoft.graph` {
      * Maximum number of dep tokens allowed per-tenant.
      */
     maximumDepTokens: int32;
+    /**
+     * The collection of Samsung EFOTA firmware versions.
+     */
+    samsungEFotaFirmwareVersions: samsungEFotaFirmwareVersion[] | null;
     /**
      * Account level settings.
      */
@@ -24005,6 +24329,10 @@ namespace reference.`microsoft.graph` {
      * The summary state of ATP onboarding state for this account.
      */
     @contains advancedThreatProtectionOnboardingStateSummary: advancedThreatProtectionOnboardingStateSummary | null;
+    /**
+     * Android App Configurations Schema entity.
+     */
+    @contains androidAppConfigurationSchema: androidAppConfigurationSchema | null;
     /**
      * Android device owner enrollment profile entities.
      */
@@ -24237,18 +24565,6 @@ namespace reference.`microsoft.graph` {
      * The policy which controls mobile device access to Exchange On Premises
      */
     @contains exchangeOnPremisesPolicy: deviceManagementExchangeOnPremisesPolicy | null;
-    /**
-     * The FOTA connector entity that represents the tenant's authorization status for Intune and an OEM. Is an abstract type. To get all connectors, use the Get operation. To get a specific OEM connector, use the oem query parameter to specify the OEM type. To create an OEM connector, refer to the derived connector entity like graph.samsungEFotaConnector.
-     */
-    @contains fotaConnector: fotaConnector | null;
-    /**
-     * The collection of FOTA connector entity that represents the tenant's authorization status for Intune
-     */
-    @contains fotaConnectors: fotaConnector[];
-    /**
-     * The collection of FOTA deployment for an OEM.
-     */
-    @contains fotaDeployments: fotaDeployment[];
     /**
      * The available group policy categories for this account.
      */
@@ -24418,14 +24734,6 @@ namespace reference.`microsoft.graph` {
      * The Role Scope Tags.
      */
     @contains roleScopeTags: roleScopeTag[];
-    /**
-     * The collection of FOTA deployment for Samsung OEM.
-     */
-    @contains samsungEFotaDeployments: samsungEFotaDeployment[];
-    /**
-     * The collection of Samsung EFOTA firmware versions.
-     */
-    @contains samsungEFotaFirmwareVersions: samsungEFotaFirmwareVersion[];
     /**
      * A list of ServiceNowConnections
      */
@@ -27125,6 +27433,11 @@ namespace reference.`microsoft.graph` {
     targetObjects: string[];
   }
 
+  @entity model externalAuthenticationMethod extends authenticationMethod {
+    configurationId: string;
+    displayName: string;
+  }
+
   @entity model externalAuthenticationMethodConfiguration extends authenticationMethodConfiguration {
     appId: string;
     displayName: string;
@@ -27253,75 +27566,6 @@ namespace reference.`microsoft.graph` {
     supportedAttributeTypes: attributeType[];
   }
 
-  /**
-   * The FOTA connector entity that represents the tenant's authorization status for Intune and an OEM. To get all connectors, use the 'Get' operation. To get a specific OEM connector, use the 'retrieveFotaConnector' function and specify the OEM type. To create, use 'graph.fotaConnector' 'connect' action and specify the 'oem' like 'samsung' or 'zebra'. To add or remove Entra security groups for device registration, use the 'register' or 'deregister' actions. To get the authorization URL, use the 'retrieveFotaAuthorizationUrl' function.
-   */
-  @entity model fotaConnector extends entity {
-    /**
-     * The authorization URL used by IT Admin to authorize Intune to call the OEM APIs on their behalf. Default value: null. If the authorization URL exists, it is returned as an empty string. To retrieve it, specific 'GET' function 'retrieveFotaAuthorizationUrl' has to be used.
-     */
-    authorizationUrl: string | null;
-    /**
-     * High level status of the tenant's registered devices. Used to get the number of registered devices and the error if registration failed. See 'graph.fotaDeviceRegistrationStatus' for more details. Default value: null.
-     */
-    deviceRegistrationStatus: fotaDeviceRegistrationStatus | null;
-    /**
-     * System generated friendly name for the connector based on the OEM like 'Samsung E-FOTA Connector'. Populated during creation of the OEM connector. Read-only. Returned by default.
-     */
-    displayName: string | null;
-    /**
-     * The date and time when the FOTA connector was last synced with the OEM's cloud service to establish connection. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Read-only. Returned by default.
-     */
-    @computed lastSyncDateTime: offsetDateTime | null;
-    /**
-     * OEM (Original Equipment Manufacturer) type that has onboarded to Intune FOTA functionality. Possible values are 'unknown', 'zebra' and 'samsung'. Default is 'unknown'. See 'graph.fotaOemType' enum for details. Populated during creation of the OEM connector. Returned by default.
-     */
-    oem: fotaOemType;
-    /**
-     * The Entra security groups targeted for device registration. See 'graph.deviceAndAppManagementAssignmentTarget' entity for details. Default value: null.
-     */
-    registrationAssignments: deviceAndAppManagementAssignmentTarget[] | null;
-    /**
-     * The state of the FOTA connector. Possible values are 'none', 'pending', 'connected', and 'disconnected'. Default is 'none'. See 'graph.fotaConnectorState' enum for detailed state definitions. Returned by default.
-     */
-    state: fotaConnectorState;
-    /**
-     * Tenant's total Samsung licenses count. Default value: null.
-     */
-    totalLicensesCount: int32 | null;
-  }
-
-  /**
-   * The FOTA deployment for an OEM. Is an abstract type. To get all deployments for an OEM, use the 'retrieveDeployments' function and specify the OEM. To get a specific OEM deployment, use the 'retrieveDeployment' function and specify the OEM type and deployment ID. To create a FOTA deployment for an OEM, refer to the derived deployment entity like 'graph.samsungEFotaDeployment'
-   */
-  @abstract
-  @entity model fotaDeployment extends entity {
-    /**
-     * The deployment's targeted security groups(s). See 'graph.deviceAndAppManagementAssignmentTarget' for more details. Returned by default.
-     */
-    deploymentAssignments: deviceAndAppManagementAssignmentTarget[];
-    /**
-     * The deployment status from the OEM (Original Equipment Manufacturer). See 'graph.fotaDeploymentStatus' complex type for details. Default value: null.
-     */
-    deploymentStatus: fotaDeploymentStatus | null;
-    /**
-     * The description of the FOTA deployment.  Max allowed length is 1500 chars. Default value: null.
-     */
-    description: string | null;
-    /**
-     * The deployment name associated with FOTA deployment. Returned by default. Max allowed length is 200 chars.
-     */
-    displayName: string;
-    /**
-     * OEM (Original Equipment Manufacturer) type that has onboarded to Intune FOTA functionality. Populated during creation of the OEM deployment. Possible values are 'unknown', 'zebra' and 'samsung'. Default is 'unknown'. See 'graph.fotaOemType' enum for details. Returned by default.
-     */
-    oem: fotaOemType;
-    /**
-     * List of Scope Tags for the deployment. Default value: null.
-     */
-    roleScopeTagIds: string[] | null;
-  }
-
   @abstract
   @entity model governanceInsight extends entity {
     insightCreatedDateTime: offsetDateTime | null;
@@ -27351,6 +27595,7 @@ namespace reference.`microsoft.graph` {
     groupTypes: string[];
     hasMembersWithLicenseErrors: boolean | null;
     hideFromAddressLists: boolean | null;
+    hideFromOutlookClients: boolean | null;
     infoCatalogs: string[];
     isArchived: boolean | null;
     isAssignableToRole: boolean | null;
@@ -27365,12 +27610,14 @@ namespace reference.`microsoft.graph` {
     membershipRuleProcessingState: string | null;
     membershipRuleProcessingStatus: membershipRuleProcessingStatus | null;
     onPremisesDomainName: string | null;
+    onPremisesExtensionAttributes: onPremisesExtensionAttributes | null;
     onPremisesLastSyncDateTime: offsetDateTime | null;
     onPremisesNetBiosName: string | null;
     onPremisesProvisioningErrors: onPremisesProvisioningError[] | null;
     onPremisesSamAccountName: string | null;
     onPremisesSecurityIdentifier: string | null;
     onPremisesSyncEnabled: boolean | null;
+    organizationId: string | null;
     preferredDataLocation: string | null;
     preferredLanguage: string | null;
     proxyAddresses: string[];
@@ -27382,8 +27629,11 @@ namespace reference.`microsoft.graph` {
     serviceProvisioningErrors: serviceProvisioningError[] | null;
     theme: string | null;
     uniqueName: string | null;
+    unseenConversationsCount: int32 | null;
     unseenCount: int32 | null;
+    unseenMessagesCount: int32 | null;
     visibility: string | null;
+    welcomeMessageEnabled: boolean | null;
     writebackConfiguration: groupWritebackConfiguration | null;
     @contains acceptedSenders: directoryObject[];
     @contains appRoleAssignments: appRoleAssignment[];
@@ -28723,7 +28973,7 @@ namespace reference.`microsoft.graph` {
   }
 
   @entity model inheritablePermission extends MsGraph.SharedModels.entity {
-    inheritableScopes: inheritableScopes;
+    inheritableScopes: inheritableScopes | null;
     @computed @key resourceAppId: string;
   }
 
@@ -31078,7 +31328,6 @@ namespace reference.`microsoft.graph` {
     retentionSettings: retentionLabelSettings | null;
   }
 
-
   @entity model languageProficiency extends itemFacet {
     displayName: string | null;
     proficiency: languageProficiencyLevel | null;
@@ -31097,6 +31346,7 @@ namespace reference.`microsoft.graph` {
 
   @entity model list extends baseItem {
     displayName: string | null;
+    itemCount: int32 | null;
     list: listInfo | null;
     sharepointIds: sharepointIds | null;
     system: systemFacet | null;
@@ -31161,6 +31411,13 @@ namespace reference.`microsoft.graph` {
     statusDetail: string | null;
   }
 
+  @abstract
+  @entity model m365CapabilityBase extends MsGraph.SharedModels.entity {
+    inboundAccess: m365CapabilityInboundAccess | null;
+    @computed lastModifiedDateTime: offsetDateTime;
+    @computed @key name: string;
+  }
+
   /**
    * Mac OS certificate profile.
    */
@@ -31193,87 +31450,91 @@ namespace reference.`microsoft.graph` {
    */
   @entity model macOSCompliancePolicy extends deviceCompliancePolicy {
     /**
-     * MDATP Require Mobile Threat Protection minimum risk level to report noncompliance.
+     * Specifies the Microsoft Defender for Endpoint (MDE) risk level threshold used to report noncompliance (for example, secured, medium, or high). When set to a value other than unavailable, the device is marked noncompliant if the reported risk level doesn't meet the configured requirement. Default is unavailable.
      */
     advancedThreatProtectionRequiredSecurityLevel: deviceThreatProtectionLevel;
     /**
-     * Require that devices have enabled device threat protection.
+     * Custom compliance configuration for the policy (script identifier and rules content). When set, custom compliance rules are evaluated and the device is marked noncompliant when any rule evaluates to noncompliant. When not set, no custom compliance rules are evaluated. Default is null, when set to default it is not evaluated.
+     */
+    deviceCompliancePolicyScript: deviceCompliancePolicyScript | null;
+    /**
+     * Specifies whether Mobile Threat Defense (MTD) must be enabled. When set to true, the device is marked noncompliant if MTD isn't enabled or doesn't report a threat level. When false, threat protection level requirements aren't enforced. Default is false.
      */
     deviceThreatProtectionEnabled: boolean;
     /**
-     * Require Mobile Threat Protection minimum risk level to report noncompliance.
+     * Specifies the Mobile Threat Defense risk level threshold used to report noncompliance (for example, secured, medium, or high). When set to a value other than unavailable, the device is marked noncompliant if the reported risk level doesn't meet the configured requirement. Default is unavailable.
      */
     deviceThreatProtectionRequiredSecurityLevel: deviceThreatProtectionLevel;
     /**
-     * Corresponds to the “Block all incoming connections” option.
+     * Specifies whether Block all incoming connections must be enabled. When set to true, the device is marked noncompliant if the setting is disabled. Default is false.
      */
     firewallBlockAllIncoming: boolean;
     /**
-     * Whether the firewall should be enabled or not.
+     * Specifies whether the macOS application firewall must be enabled. When set to true, the device is marked noncompliant if the firewall is disabled. Default is false.
      */
     firewallEnabled: boolean;
     /**
-     * Corresponds to “Enable stealth mode.”
+     * Specifies whether Enable stealth mode must be enabled. When set to true, the device is marked noncompliant if the setting is disabled. Default is false.
      */
     firewallEnableStealthMode: boolean;
     /**
-     * System and Privacy setting that determines which download locations apps can be run from on a macOS device.
+     * Specifies the Gatekeeper app source policy (System Settings > Privacy & Security) that determines which app download locations are allowed (for example, macAppStore or anywhere). When set to a value other than notConfigured, the device is marked noncompliant if its Gatekeeper setting allows apps from sources not permitted by this value. Default is notConfigured.
      */
     gatekeeperAllowedAppSource: macOSGatekeeperAppSources;
     /**
-     * Maximum MacOS build version.
+     * Specifies the maximum allowed macOS build version. When set, the device is marked noncompliant if its build version is higher than this value. Default is null, when set to default it is not evaluated.
      */
     osMaximumBuildVersion: string | null;
     /**
-     * Maximum MacOS version.
+     * Specifies the maximum allowed macOS version. When set, the device is marked noncompliant if its OS version is higher than this value. Default is null, when set to default it is not evaluated.
      */
     osMaximumVersion: string | null;
     /**
-     * Minimum MacOS build version.
+     * Specifies the minimum allowed macOS build version. When set, the device is marked noncompliant if its build version is lower than this value. Default is null, when set to default it is not evaluated.
      */
     osMinimumBuildVersion: string | null;
     /**
-     * Minimum MacOS version.
+     * Specifies the minimum allowed macOS version. When set, the device is marked noncompliant if its OS version is lower than this value. Default is null, when set to default it is not evaluated.
      */
     osMinimumVersion: string | null;
     /**
-     * Indicates whether or not to block simple passwords.
+     * Specifies whether simple passwords such as 1111 or 1234 are allowed. When set to true, the device is marked noncompliant if it allows simple passwords. Default is false.
      */
     passwordBlockSimple: boolean;
     /**
-     * Number of days before the password expires. Valid values 1 to 65535
+     * Specifies the maximum password age in days. When set, the device is marked noncompliant if the password age exceeds this value. Valid values are 1 to 65535. Default is null, when set to default it is not evaluated. Valid values 1 to 65535
      */
     passwordExpirationDays: int32 | null;
     /**
-     * The number of character sets required in the password.
+     * Specifies the minimum number of character sets required in the password. When set, the device is marked noncompliant if the password doesn't meet this requirement. Default is null, when set to default it is not evaluated.
      */
     passwordMinimumCharacterSetCount: int32 | null;
     /**
-     * Minimum length of password. Valid values 4 to 14
+     * Specifies the minimum password length. When set, the device is marked noncompliant if the password length is less than this value. Valid values are 4 to 14. Default is null, when set to default it is not evaluated. Valid values 4 to 14
      */
     passwordMinimumLength: int32 | null;
     /**
-     * Minutes of inactivity before a password is required.
+     * Specifies the maximum minutes of inactivity before a password is required to unlock the device. When set, the device is marked noncompliant if it allows a longer inactivity period. Default is null, when set to default it is not evaluated.
      */
     passwordMinutesOfInactivityBeforeLock: int32 | null;
     /**
-     * Number of previous passwords to block. Valid values 1 to 24
+     * Specifies the number of previous passwords that can't be reused. When set, the device is marked noncompliant if it doesn't enforce this history count. Valid values are 1 to 24. Default is null, when set to default it is not evaluated. Valid values 1 to 24
      */
     passwordPreviousPasswordBlockCount: int32 | null;
     /**
-     * Whether or not to require a password.
+     * Specifies whether a device password is required. When set to true, the device is marked noncompliant if a password isn't configured. Default is false.
      */
     passwordRequired: boolean;
     /**
-     * The required password type.
+     * Specifies the required password type (for example, deviceDefault or alphanumeric). When set to a value other than deviceDefault, the device is marked noncompliant if the password type doesn't match. Default is deviceDefault.
      */
     passwordRequiredType: requiredPasswordType;
     /**
-     * Require encryption on Mac OS devices.
+     * Specifies whether storage encryption is required on macOS devices. When set to true, the device is marked noncompliant if storage isn't encrypted. Default is false.
      */
     storageRequireEncryption: boolean;
     /**
-     * Require that devices have enabled system integrity protection.
+     * Specifies whether System Integrity Protection must be enabled. When set to true, the device is marked noncompliant if System Integrity Protection is disabled. Default is false.
      */
     systemIntegrityProtectionEnabled: boolean;
   }
@@ -35135,6 +35396,10 @@ namespace reference.`microsoft.graph` {
      * When TRUE, indicates that data from the Mobile Threat Defense partner can be used during Mobile Application Management (MAM) evaluations for Android devices. When FALSE, indicates that data from the Mobile Threat Defense partner should not be used during Mobile Application Management (MAM) evaluations for Android devices. Only one partner per platform may be enabled for Mobile Application Management (MAM) evaluation. Default value is FALSE.
      */
     androidMobileApplicationManagementEnabled: boolean;
+    /**
+     * When TRUE, indicates that the Mobile Threat Defense partner is granted the Mobile Threat Defense role on enrolled Android Corporate Owned Business Only and Corporate Owned Personally Enabled devices. When FALSE, indicates that the Mobile Threat Defense partner is not granted the Mobile Threat Defense role. Default value is FALSE.
+     */
+    grantMobileThreatDefensePartnerRole: boolean;
     /**
      * When TRUE, indicates that Intune must receive data from the Mobile Threat Defense partner prior to marking a device compliant. When FALSE, indicates that Intune may not recieve data from Mobile Threat Defense partner prior to making device compliant. Default value is FALSE.
      */
@@ -35151,6 +35416,10 @@ namespace reference.`microsoft.graph` {
      * DateTime of last Heartbeat recieved from the Mobile Threat Defense partner
      */
     @computed lastHeartbeatDateTime: offsetDateTime;
+    /**
+     * When TRUE, indicates that the Mobile Threat Defense partner will be automatically launched during Android Corporate Owned Business Only and Corporate Owned Personally Enabled device setup. When FALSE, indicates that the Mobile Threat Defense partner will not be automatically launched during setup. Default value is FALSE.
+     */
+    launchMobileThreatDefensePartnerOnSetupEnabled: boolean;
     /**
      * When TRUE, indicates that Intune must receive data from the Mobile Threat Defense partner prior to marking a Mac device compliant. When FALSE, indicates that Intune may mark a Mac device compliant prior to receiving data from the Mobile Threat Defense partner. Default value is FALSE.
      */
@@ -35219,12 +35488,17 @@ namespace reference.`microsoft.graph` {
     value: string[] | null;
   }
 
-  @entity model namedLocation extends entity {
+  @entity model namedLocation extends policyDeletableItem {
     @computed createdDateTime: offsetDateTime | null;
     displayName: string;
+    @computed @key id: string;
     modifiedDateTime: offsetDateTime | null;
   }
 
+  @entity model namePronunciationSettings extends entity {
+    isEnabledInOrganization: boolean;
+  }
+
   /**
    * Entity which represents an OnPrem Ndes connector.
    */
@@ -35861,7 +36135,6 @@ namespace reference.`microsoft.graph` {
     password: string | null;
   }
 
-
   @entity model passwordlessMicrosoftAuthenticatorAuthenticationMethod extends authenticationMethod {
 
     @graphDeprecated("CreationDateTime")
@@ -35882,7 +36155,11 @@ namespace reference.`microsoft.graph` {
 
   @entity model peopleAdminSettings extends entity {
     @contains itemInsights: insightsSettings | null;
+    @contains namePronunciation: namePronunciationSettings | null;
+    @contains photoUpdateSettings: photoUpdateSettings | null;
     @contains profileCardProperties: profileCardProperty[];
+    @contains profilePropertySettings: profilePropertySetting[];
+    @contains profileSources: profileSource[];
     @contains pronouns: pronounsSettings | null;
   }
 
@@ -36037,6 +36314,11 @@ namespace reference.`microsoft.graph` {
     phoneNumber: string | null;
   }
 
+  @entity model photoUpdateSettings extends entity {
+    allowedRoles: string[] | null;
+    source: photoUpdateSource | null;
+  }
+
   @entity model pinnedChatMessageInfo extends entity {
     @references message: chatMessage | null;
   }
@@ -36077,6 +36359,11 @@ namespace reference.`microsoft.graph` {
     displayName: string;
   }
 
+  @abstract
+  @entity model policyDeletableItem extends MsGraph.SharedModels.entity {
+    deletedDateTime: offsetDateTime | null;
+  }
+
   @entity model policyRoot extends entity {
     @contains accessReviewPolicy: accessReviewPolicy | null;
     @contains activityBasedTimeoutPolicies: activityBasedTimeoutPolicy[];
@@ -36515,6 +36802,7 @@ namespace reference.`microsoft.graph` {
   @entity model profileCardProperty extends entity {
     annotations: profileCardAnnotation[] | null;
     directoryPropertyName: string | null;
+    isVisible: boolean;
   }
 
   @entity model profilePhoto extends entity {
@@ -36522,6 +36810,20 @@ namespace reference.`microsoft.graph` {
     width: int32 | null;
   }
 
+  @entity model profilePropertySetting extends entity {
+    displayName: string | null;
+    name: string | null;
+    prioritizedSourceUrls: string[] | null;
+  }
+
+  @entity model profileSource extends entity {
+    displayName: string | null;
+    kind: string | null;
+    localizations: profileSourceLocalization[];
+    sourceId: string | null;
+    webUrl: string | null;
+  }
+
   @entity model program extends entity {
     description: string;
     displayName: string;
@@ -37057,80 +37359,6 @@ namespace reference.`microsoft.graph` {
     signingCertificate: string | null;
   }
 
-  /**
-   * The settings and targeted firmware versions for a Samsung Knox E-FOTA deployment. Inherits from 'graph.fotaDeployment'. To create, update and delete, use the 'graph.fotaDeployment' 'Post', 'Patch', and 'Delete' operations and specify 'oem' as 'Samsung'. To get, use the 'graph.fotaDeployment' 'Get' operation and specify 'oem' as 'Samsung'
-   */
-  @entity model samsungEFotaDeployment extends fotaDeployment {
-    /**
-     * The setting required to create a deployment such as deployment update type, download and installation time, network type, etc. See 'graph.samsungEFotaDeploymentSetting' complex type for more details. Returned by default.
-     */
-    deploymentSetting: samsungEFotaDeploymentSetting;
-    /**
-     * The E-FOTA deployment's firmware version targets like the device model, sales code, CSC, and update type. See 'graph.samsungEFotaFirmwareVersionTarget' entity for more details. Returned by default
-     */
-    @references firmwareVersionTargets: samsungEFotaFirmwareVersionTarget[];
-  }
-
-  /**
-   * The firmware version from Samsung for a specific device model, sales code, and CSC (Consumer Software Customization). Used to create Samsung E-FOTA deployments.
-   */
-  @entity model samsungEFotaFirmwareVersion extends entity {
-    /**
-     * The Android Processor version name. This property is populated by Samsung. Eg. 'G960U1UES9FVD1'. Default value: null. Read-only.
-     */
-    androidProcessorVersionName: string | null;
-    /**
-     * The Consumer Software Customization which is a specific code associated with the region or carrier customization of a Samsung device. This property is populated by Samsung. Eg. 'OYM'. Read-only. Returned by default.
-     */
-    consumerSoftwareCustomizationCode: string;
-    /**
-     * The firmware description. This property is populated by Samsung. Default value: null. Read-only.
-     */
-    description: string | null;
-    /**
-     * Samsung device model. This property is populated by Samsung. Eg. 'SM-960F'. Read-only. Returned by default.
-     */
-    deviceModelName: string;
-    /**
-     * The firmware version. This property is populated by Samsung Eg. 'T575XXU4EAAA/T575OXM4EAAA/T575XXU4EAAA'. Default value: null. Read-only.
-     */
-    firmwareVersion: string | null;
-    /**
-     * The OS version name. This property is populated by Samsung. Eg. 'Pie(Android 9)'. Default value: null. Read-only.
-     */
-    osVersionName: string | null;
-    /**
-     * Firmware release date. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. This property is populated by Samsung. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Default value: null. Read-only.
-     */
-    releaseDateTime: offsetDateTime;
-    /**
-     * The firmware request type. This property is populated by Samsung Eg. 'NORMAL'. Default value: null. Read-only.
-     */
-    requestFirmwareType: string | null;
-    /**
-     * Sales code of a Samsung device that corresponds to its georgraphic area or carrier network. This property is populated by Samsung. Eg. 'TMB'. Read-only. Returned by default.
-     */
-    salesCode: string;
-    /**
-     * The firmware security patch. This property is populated by Samsung Eg. '2023-09-07 07:50:57'. Default value: null. Read-only.
-     */
-    securityPatch: string | null;
-  }
-
-  /**
-   * The targeted firmware version for an E-FOTA deployment. Used while creating E-FOTA deployments.
-   */
-  @entity model samsungEFotaFirmwareVersionTarget extends entity {
-    /**
-     * The E-FOTA deployment's firmware update type. Possible values are 'custom', 'latestMajorVersion', 'auto', 'latestMinorVersion', and 'locked'. Default is 'custom'. See 'graph.fotaFirmwareUpdateType' enum for more details. Returned by default.
-     */
-    updateType: fotaFirmwareUpdateType;
-    /**
-     * Describes the firmware version for a specific device model, sales code, and CSC. See 'graph.samsungEFotaFirmwareVersion' entity for details. Returned by default.
-     */
-    @references firmwareVersion: samsungEFotaFirmwareVersion;
-  }
-
   @entity model schemaExtension extends entity {
     description: string | null;
     owner: string;
@@ -37454,6 +37682,7 @@ namespace reference.`microsoft.graph` {
     errorUrl: string | null;
     homepage: string | null;
     info: informationalUrl | null;
+    isDisabled: boolean | null;
     keyCredentials: keyCredential[];
     loginUrl: string | null;
     logoutUrl: string | null;
@@ -37818,6 +38047,7 @@ namespace reference.`microsoft.graph` {
     azureResourceId: string | null;
     clientAppUsed: string | null;
     clientCredentialType: clientCredentialType | null;
+    clientSessionId: string | null;
     conditionalAccessAudiences: string[] | null;
     conditionalAccessStatus: conditionalAccessStatus | null;
     correlationId: string | null;
@@ -38117,6 +38347,7 @@ namespace reference.`microsoft.graph` {
     signInCount: int64 | null;
     status: signInStatus | null;
     tenantId: string | null;
+    tokenIssuerType: tokenIssuerType;
     userPrincipalName: string | null;
   }
 
@@ -38160,6 +38391,8 @@ namespace reference.`microsoft.graph` {
   }
 
   @entity model synchronization extends entity {
+
+    @graphDeprecated("SynchronizationSecret_Deprecation")
     secrets: synchronizationSecretKeyStringValuePair[] | null;
     @contains jobs: synchronizationJob[];
     @contains templates: synchronizationTemplate[];
@@ -45087,6 +45320,14 @@ namespace reference.`microsoft.graph` {
    * A mobileApp that is based on a referenced branch in a Win32CatalogApp repository
    */
   @entity model windowsAutoUpdateCatalogApp extends mobileApp {
+    /**
+     * Indicates the set of CPU architectures on which this application is allowed to be installed. When null, the app is eligible for installation on all the supported architectures. Possible values are: x86, x64, arm64, or a combination of them.
+     */
+    allowedArchitectures: windowsArchitecture | null;
+    /**
+     * Describes how the app installer executes on the target device, including the account context (system or user) under which the installer runs and how the device handles restarts after installation completes. When omitted, the service applies default values (runAsAccount = system, deviceRestartBehavior = basedOnReturnCode).
+     */
+    installExperience: windowsAutoUpdateCatalogAppInstallExperience | null;
     /**
      * The identifier of a specific branch in a product, which is a specific subset of product functionality as defined by the publisher . This is run-time resolved to be the latest MobileAppCatalogPackage in the branch. (example:'31a4c766-f23d-8d41-4803-35e155be7389'). Read-Only
      */
@@ -46731,6 +46972,10 @@ namespace reference.`microsoft.graph` {
      * Current anti malware version
      */
     antiMalwareVersion: string | null;
+    /**
+     * When TRUE indicates the Windows Defender controlled configuration feature is enabled, when FALSE indicates the Windows Defender controlled configuration feature is not enabled. Defaults to setting on client device.
+     */
+    controlledConfigurationEnabled: boolean | null;
     /**
      * Indicates device's health state. Possible values are: clean, fullScanPending, rebootPending, manualStepsPending, offlineScanPending, critical.
      */
@@ -47679,10 +47924,6 @@ namespace reference.`microsoft.graph` {
    * The Zebra FOTA deployment entity that describes settings, deployment device groups required to create a FOTA deployment, and deployment status.
    */
   @entity model zebraFotaDeployment extends entity {
-    /**
-     * Collection of Android FOTA Assignment
-     */
-    deploymentAssignments: androidFotaDeploymentAssignment[] | null;
     /**
      * Represents settings required to create a deployment such as deployment type, artifact info, download and installation
      */
@@ -48011,6 +48252,21 @@ namespace reference.`microsoft.graph` {
     unknownFutureValue: 4,
   }
 
+  /**
+   * The Android credential provider role state for apps.
+   */
+  enum androidAppCredentialProviderRoleState {
+    /**
+     * Default. Indicates the app's ability to act as a credential provider has not been configured. When set to 'notConfigured', the Android OS will determine whether the app is allowed to act as a credential provider or not.
+     */
+    notConfigured: 0,
+    /**
+     * Indicates the app is allowed to act as a credential provider.
+     */
+    allowed: 1,
+    unknownFutureValue: 2,
+  }
+
   /**
    * Android Device Owner possible values for states of the device's app auto update policy.
    */
@@ -50814,7 +51070,7 @@ namespace reference.`microsoft.graph` {
   }
 
   /**
-   * Enum type of possible certification authority statuses. These statuses indicate whether a certification authority is currently able to issue certificates or temporarily paused or permanently revoked.
+   * Enum type of possible certification authority statuses. These statuses indicate whether a certification authority is currently able to issue certificates, temporarily paused, pending signing, revoked, or expired.
    */
   enum cloudCertificationAuthorityStatus {
     /**
@@ -50838,6 +51094,10 @@ namespace reference.`microsoft.graph` {
      */
     signingPending: 4,
     unknownFutureValue: 5,
+    /**
+     * Indicates certification authority has expired and cannot issue certificates until renewed and activated.
+     */
+    expired: 6,
   }
 
   /**
@@ -50863,6 +51123,49 @@ namespace reference.`microsoft.graph` {
     unknownFutureValue: 4,
   }
 
+  /**
+   * Enum type of possible certification authority version statuses. These statuses indicate the lifecycle state of a certification authority version, including whether it is currently active, staged for renewal, retired, or in other states.
+   */
+  enum cloudCertificationAuthorityVersionStatus {
+    /**
+     * Default. Indicates certification authority version has an unknown or invalid status.
+     */
+    `unknown`: 0,
+    /**
+     * Indicates certification authority version is active and can issue leaf certificates.
+     */
+    active: 1,
+    /**
+     * Indicates certification authority version was created during the renewal process and is currently in the staged phase. Upon activation, it becomes the new active certification authority version.
+     */
+    staged: 2,
+    /**
+     * Indicates certification authority version has been paused from issuing certificates. The paused state is supported only for active certification authority versions. Staged certification authority versions cannot be paused and may only be revoked.
+     */
+    paused: 3,
+    /**
+     * Indicates certification authority version has been retired after renewal. The retired certification authority version is not expired and continues to validate certificates it previously issued.
+     */
+    retired: 4,
+    /**
+     * Indicates certification authority version has exceeded its validity period.
+     */
+    expired: 5,
+    /**
+     * Indicates certification authority version has been revoked. This is a permanent state that cannot be changed.
+     */
+    revoked: 6,
+    /**
+     * Indicates certification authority version has been decommissioned. Only applicable for staged certification authority versions. Decommissioned certification authority versions cannot issue or validate leaf certificates. This is a permanent state that cannot be changed.
+     */
+    decommissioned: 7,
+    /**
+     * Indicates certification authority version was created with a Bring Your Own CA (BYOCA) root and requires external signing.
+     */
+    signingPending: 8,
+    unknownFutureValue: 9,
+  }
+
   /**
    * Error code for rule validation.
    */
@@ -52340,6 +52643,25 @@ namespace reference.`microsoft.graph` {
     remoteLock: 10,
   }
 
+  /**
+   * Indicates the platform that a device compliance script targets for evaluation.
+   */
+  enum deviceComplianceScriptPlatformType {
+    /**
+     * Default. Indicates that the compliance script targets devices running Windows 10 and later.
+     */
+    windows10: 0,
+    /**
+     * Indicates that the compliance script targets devices running Linux.
+     */
+    linux: 1,
+    /**
+     * Indicates that the compliance script targets devices running macOS.
+     */
+    macOS: 2,
+    unknownFutureValue: 3,
+  }
+
   /**
    * Data types for rules.
    */
@@ -56248,206 +56570,6 @@ namespace reference.`microsoft.graph` {
     flagged: 2,
   }
 
-  /**
-   * An OEM's FOTA connector state for the tenant
-   */
-  enum fotaConnectorState {
-    /**
-     * Default value when the connector has not been setup (the feature has not been used yet).
-     */
-    none: 0,
-    /**
-     * Indicates that Intune is linked to the OEM for the current tenant.
-     */
-    connected: 1,
-    /**
-     * Indicates that the tenant was connected in the past and later disconnected.
-     */
-    disconnected: 2,
-    /**
-     * Indicates that the IT Pro has not yet authorized Intune to call the OEM on their behalf.
-     */
-    pending: 3,
-    unknownFutureValue: 4,
-  }
-
-  /**
-   * An error code indicating the failure reason, when a FOTA deployment failed to create or complete.
-   */
-  enum fotaDeploymentErrorCode {
-    /**
-     * This error indicates that the deployment failed to create because no devices were found in the selected Entra security group(s) when creating a deployment. E.g.: a user selects one or more security groups that doesn't include any devices.
-     */
-    noDevicesFoundInSelectedEntraGroups: 0,
-    /**
-     * This error indicates that the deployment failed to create because no Intune managed devices were found in the selected Entra security groups when creating a deployment. E.g.: a user selects a group that includes devices that are no longer managed in Intune.
-     */
-    noIntuneDevicesFoundInSelectedEntraGroups: 1,
-    /**
-     * This error indicates that the deployment failed to create because no FOTA enrolled/registered devices were found in the selected Entra Groups when creating a deployment. E.g.: a user has registered one or more devices in Samsung Knox E-FOTA, but attempts to create a deployment targeting security groups that don't include any registered devices.
-     */
-    noFotaEnrolledDevicesFoundForCurrentTenant: 2,
-    /**
-     * This error indicates that no FOTA enrolled/registered devices were found in the selected Entra (Azure Active Directory - Azure AD) Groups when creating a deployment. E.g.: a user has registered one or more devices in Samsung Knox E-FOTA, but attempts to create a deployment targeting security groups that don't include any registered devices.
-     */
-    noFotaEnrolledDevicesFoundInSelectedEntraGroups: 3,
-    /**
-     * This error indicates that the deployment failed to create because no FOTA devices were found that match the selected device model(s) when creating a deployment. E.g.: a user selects 'TC8300' Zebra device model, but no Zebra devices with the same device model were found in the deployment's targeted Entra security groups.
-     */
-    noFotaDevicesFoundForSelectedDeviceModel: 4,
-    /**
-     * This error indicates that the deployment failed to create because the external request to the OEM to create a deployment failed. The failure can be caused by a transient issue (e.g.: Network is down) or caused by a permanent server error.
-     */
-    fotaCreateDeploymentRequestFailure: 5,
-    unknownFutureValue: 6,
-  }
-
-  /**
-   * The overall state of the FOTA deployment. The deployment state is determined by looking at the status of all devices in the deployment. If any device is in the created state, the overall deployment state becomes created. If any device is in progress, the overall deployment state becomes in progress. Once all the devices are completed, the overall deployment state becomes completed. If the IT Admin requests cancellation, the deployment state becomes pending cancel and then cancelled.
-   */
-  enum fotaDeploymentState {
-    /**
-     * Default. Deployment is created but the OEM has not confirmed its creation.
-     */
-    pendingCreation: 0,
-    /**
-     * Deployment was not successfully created with the OEM or failed to complete.
-     */
-    createFailed: 1,
-    /**
-     * Deployment has been created but has not been deployed yet.
-     */
-    created: 2,
-    /**
-     * Deployment has started but not completed.
-     */
-    inProgress: 3,
-    /**
-     * Deployment has completed or end date has passed.
-     */
-    completed: 4,
-    /**
-     * IT Admin has requested to cancel a deployment but the OEM has not confirmed cancellation.
-     */
-    pendingCancel: 5,
-    /**
-     * Deployment was not successfully cancelled by the OEM.
-     */
-    cancelFailed: 6,
-    /**
-     * Deployment has been successfully cancelled by the OEM.
-     */
-    cancelled: 7,
-    /**
-     * Default. Deployment is updated but the OEM has not confirmed its update.
-     */
-    pendingUpdate: 8,
-    /**
-     * Deployment was not successfully updated with the OEM.
-     */
-    updateFailed: 9,
-    /**
-     * Deployment has been updated but has not been deployed yet.
-     */
-    updated: 10,
-    unknownFutureValue: 11,
-  }
-
-  /**
-   * The time of day for E-FOTA devices to download firmware.
-   */
-  enum fotaDownloadPeriodType {
-    /**
-     * Default. The firmware can be downloaded at any time of day.
-     */
-    any: 0,
-    /**
-     * The time of day for downloading firmware matches the firmware installation period set in 'graph.fotaDeploymentSetting' 'installRuleWindowStartTime' and 'installRuleWindowEndTime'.
-     */
-    matchFirmwareInstallPeriod: 1,
-    unknownFutureValue: 2,
-  }
-
-  /**
-   * The FOTA deployment's firmware update type.
-   */
-  enum fotaFirmwareUpdateType {
-    /**
-     * Default. The FOTA deployment targets a custom firwmare version selected by the IT Admin.
-     */
-    custom: 0,
-    /**
-     * The FOTA deployment targets the latest major firmware version available. Latest may update the device to a new OS version. For eg. a device on Android 13 will update to the latest available version Android 14.
-     */
-    latestMajorVersion: 1,
-    /**
-     * The device always looks for the latest package available in the repo and tries to update whenever a new package is available. This continues until the admin cancels the auto update.
-     */
-    auto: 2,
-    /**
-     * The FOTA deployment targets the latest minor firmware version within a particular OS version. For eg. a device on Android 13 will update to the latest available minor version Android 13.x.
-     */
-    latestMinorVersion: 3,
-    /**
-     * The FOTA deployment targets locking the firmware to prevent any firmware from being installed on the devices.
-     */
-    locked: 4,
-    unknownFutureValue: 5,
-  }
-
-  /**
-   * The device's network type required to download and install the FOTA update.
-   */
-  enum fotaNetworkType {
-    /**
-     * Default. The device will install the update regardless of current network type.
-     */
-    any: 0,
-    /**
-     * The device will install the update only when connected to a wifi network.
-     */
-    wifi: 1,
-    /**
-     * The device will install the update only when connected to a cellular network.
-     */
-    cellular: 2,
-    unknownFutureValue: 3,
-  }
-
-  /**
-   * OEM (Original Equipment Manufacturer) type that have integrated with Intune's FOTA functionality. For example, a FOTA connector can have an OEM type as 'zebra' or 'samsung'. If not OEM type is assigned, the type defaults to 'unknown'
-   */
-  enum fotaOemType {
-    /**
-     * Indicates that the FOTA OEM (Original Equipment Manufacturer) type is Zebra.
-     */
-    zebra: 1,
-    /**
-     * Indicates that the FOTA OEM (Original Equipment Manufacturer) type is Samsung.
-     */
-    samsung: 2,
-    unknownFutureValue: 3,
-  }
-
-  /**
-   * An error code indicating the failure reason, when a device failed to register for FOTA.
-   */
-  enum fotaRegistrationErrorCode {
-    /**
-     * This error indicates that no devices were found in the selected Entra security group(s) when registering for FOTA. E.g.: a user selects one or more security groups that doesn't include any devices.
-     */
-    noDevicesFoundInSelectedEntraGroups: 0,
-    /**
-     * This error indicates that no Intune managed devices were found in the selected Entra (Azure Active Directory - Azure AD) security groups when registering for FOTA. E.g.: a user selects a group that includes devices that are no longer managed in Intune.
-     */
-    noIntuneDevicesFoundInSelectedEntraGroups: 1,
-    /**
-     * This error indicates that the external request to the OEM to register devices failed. The failure can be caused by a transient issue (e.g.: Network is down) or caused by a permanent server error.
-     */
-    fotaRegistrationRequestFailure: 2,
-    unknownFutureValue: 3,
-  }
-
   /**
    * The overall state of the FOTA devices' registration. The registration state is determined by looking at the status of all devices. If any device has not yet started registration, the overall registration state becomes registration requested. If any device is still in progress, the overall deployment state becomes in progress. Once all the devices are completed, the overall registration state becomes completed.
    */
@@ -57877,6 +57999,13 @@ namespace reference.`microsoft.graph` {
     enabled: 1,
   }
 
+  enum m365ResourceType {
+    none: 0,
+    group: 1,
+    user: 2,
+    unknownFutureValue: 3,
+  }
+
   /**
    * An enum representing the possible values of Android MAC Address Randomization Mode.
    */
@@ -60425,6 +60554,12 @@ namespace reference.`microsoft.graph` {
     radio: 9,
   }
 
+  enum photoUpdateSource {
+    cloud: 0,
+    onPremises: 1,
+    unknownFutureValue: 2,
+  }
+
   #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum physicalAddressType {
     `unknown`: 0,
@@ -62272,21 +62407,6 @@ namespace reference.`microsoft.graph` {
     moderate: 2,
   }
 
-  /**
-   * Represents various schedule modes for Samsung FOTA deployment.
-   */
-  enum samsungEFotaScheduleMode {
-    /**
-     * Schedule an update to be installed between start and end date time.
-     */
-    startAndEndDateSchedule: 0,
-    /**
-     * Schedule an update to be installed on or after start date time.
-     */
-    startDateOnlySchedule: 1,
-    unknownFutureValue: 2,
-  }
-
   /**
    * Cancel or confirm scheduled retire 
    */
@@ -63315,6 +63435,14 @@ namespace reference.`microsoft.graph` {
     unknownFutureValue: 3,
   }
 
+  enum trafficRoutingMethod {
+    none: 0,
+    random: 1,
+    sessionPersistence: 2,
+    performance: 3,
+    unknownFutureValue: 4,
+  }
+
   #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum translationBehavior {
     Ask: 0,
@@ -64531,32 +64659,36 @@ namespace reference.`microsoft.graph` {
   /**
    * Wi-Fi Security Types.
    */
-  #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum wiFiSecurityType {
     /**
-     * Open (No Authentication).
+     * Default. Indicates Wi-Fi security type is associated with Open (No Authentication).
      */
     open: 0,
     /**
-     * WPA-Personal.
+     * Indicates Wi-Fi security type is associated with WPA-Personal.
      */
     wpaPersonal: 1,
     /**
-     * WPA-Enterprise. Must use IOSEnterpriseWifiConfiguration type to configure enterprise options.
+     * Indicates Wi-Fi security type is associated with WPA-Enterprise. Must use IOSEnterpriseWifiConfiguration type to configure enterprise options.
      */
     wpaEnterprise: 2,
     /**
-     * WEP Encryption.
+     * Indicates Wi-Fi security type is associated with WEP Encryption.
      */
     wep: 3,
     /**
-     * WPA2-Personal.
+     * Indicates Wi-Fi security type is associated with WPA2-Personal.
      */
     wpa2Personal: 4,
     /**
-     * WPA2-Enterprise. Must use WindowsWifiEnterpriseEAPConfiguration type to configure enterprise options.
+     * Indicates Wi-Fi security type is associated with WPA2-Enterprise. Must use WindowsWifiEnterpriseEAPConfiguration type to configure enterprise options.
      */
     wpa2Enterprise: 5,
+    unknownFutureValue: 6,
+    /**
+     * Indicates Wi-Fi security type is associated with WPA3-Personal. Provides stronger encryption using Simultaneous Authentication of Equals (SAE).
+     */
+    wpa3Personal: 7,
   }
 
   /**
@@ -65471,6 +65603,63 @@ namespace reference.`microsoft.graph` {
     unknownFutureValue: 3,
   }
 
+  /**
+   * Indicates the delivery optimization download priority level for app content. This controls whether the download uses background bandwidth (minimal impact on other network activity) or foreground bandwidth (prioritized download at the expense of other network traffic).
+   */
+  enum windowsAutoUpdateCatalogAppDeliveryOptimizationPriority {
+    /**
+     * Indicates that no delivery optimization priority is configured. The download uses normal background priority, which minimizes impact on other network activity. This is the default value when the property is omitted.
+     */
+    notConfigured: 0,
+    /**
+     * Indicates that the app content download uses foreground priority, which prioritizes the download over background network tasks. This may result in faster installation but increased network bandwidth consumption. In National Cloud environments, this value is accepted and stored but has no effect on device behavior.
+     */
+    foreground: 1,
+    unknownFutureValue: 2,
+  }
+
+  /**
+   * Indicates which notifications the Intune management extension displays to the end user during the app installation and restart lifecycle on managed devices.
+   */
+  enum windowsAutoUpdateCatalogAppNotificationType {
+    /**
+     * Indicates that all notifications related to app installation and restart are displayed to the end user.
+     */
+    showAll: 0,
+    /**
+     * Indicates that only restart notifications are displayed to the end user; other installation progress notifications are suppressed.
+     */
+    showReboot: 1,
+    /**
+     * Indicates that all notifications related to app installation and restart are suppressed. The end user is not informed of the installation or pending restarts.
+     */
+    hideAll: 2,
+    unknownFutureValue: 3,
+  }
+
+  /**
+   * Indicates how the device handles restarts after the app installer finishes executing. This setting, configured on the app's installExperience, determines whether the Intune management extension initiates, suppresses, or forces a restart based on the installer's exit code.
+   */
+  enum windowsAutoUpdateCatalogAppRestartBehavior {
+    /**
+     * Indicates that the Intune management extension restarts the device only if the app installer returns an exit code that signals a reboot is required (e.g., exit code 3010).
+     */
+    basedOnReturnCode: 0,
+    /**
+     * Indicates that the Intune management extension does not take any specific action to control restarts. If the app installer initiates a restart (e.g., an MSI with ForceReboot action), it is allowed to proceed.
+     */
+    allow: 1,
+    /**
+     * Indicates that the Intune management extension attempts to suppress restarts initiated by the installer. For MSI-based installations, this passes the REBOOT=ReallySuppress property to msiexec. Not all installers honor suppression.
+     */
+    suppress: 2,
+    /**
+     * Indicates that the Intune management extension forces an immediate device restart after the app installation completes, regardless of the installer's exit code.
+     */
+    force: 3,
+    unknownFutureValue: 4,
+  }
+
   /**
    * Enum values for the various WindowsDefenderApplicationControl supplemental policy deployment statuses.
    */
@@ -67155,6 +67344,7 @@ namespace reference.`microsoft.graph.cloudLicensing` {
   }
 
 }
+@privatePreviewDefinition("organizationalUnit", "2025-08-12", "2025-11-30", "<theOwner>")
 @publicNamespace("microsoft.graph.identitygovernance")
 namespace reference.`microsoft.graph.identityGovernance` {
   @complex model activateGroupScope extends activationScope {
@@ -67216,6 +67406,13 @@ namespace reference.`microsoft.graph.identityGovernance` {
     valueType: valueType;
   }
 
+  @complex model previewFailedTask {
+    definitionId: string;
+    failureReason: string;
+    name: string;
+    taskId: string;
+  }
+
   @complex model ruleBasedSubjectSet extends reference.`microsoft.graph`.subjectSet {
     rule: string;
   }
@@ -67438,6 +67635,9 @@ namespace reference.`microsoft.graph.identityGovernance` {
     nextScheduleRunDateTime: offsetDateTime | null;
     version: int32 | null;
     @references executionScope: userProcessingResult[];
+
+    @privatePreview("organizationalUnit")
+    @references previewScope: reference.`microsoft.graph`.directoryObject[];
     @contains runs: run[];
     @contains taskReports: taskReport[];
     @contains userProcessingResults: userProcessingResult[];
@@ -67534,6 +67734,8 @@ namespace reference.`microsoft.graph.identityGovernance` {
     onDemand: 1,
     unknownFutureValue: 2,
     activatedWithScope: 3,
+    @privatePreview("organizationalUnit")
+    preview: 4,
   }
 
   enum workflowTriggerTimeBasedAttribute {