@microsoft/typespec-msgraph-reference 1.0.4 → 1.0.6

package/lib/Prod/V1.0/main.tsp

@@ -48,6 +48,7 @@ namespace reference.`microsoft.graph` {
   }
 
   @complex model accessPackageApprovalStage {
+    approverInformationVisibility: approverInformationVisibility;
     durationBeforeAutomaticDenial: duration | null;
     durationBeforeEscalation: duration | null;
     escalationApprovers: subjectSet[] | null;
@@ -147,6 +148,20 @@ namespace reference.`microsoft.graph` {
   @complex model accessPackageResourceAttributeSource {
   }
 
+  @abstract
+  @complex model accessPackageSuggestionReason {
+  }
+
+  @complex model accessPackageSuggestionRelatedPeopleBased extends accessPackageSuggestionReason {
+    relatedPeople: identity[];
+    relatedPeopleAssignmentCount: int32;
+  }
+
+  @complex model accessPackageSuggestionSelfAssignmentHistoryBased extends accessPackageSuggestionReason {
+    @computed lastAssignmentDateTime: offsetDateTime;
+    pastAssignmentCount: int32;
+  }
+
   @complex model accessPackageUserDirectoryAttributeStore extends accessPackageResourceAttributeDestination {
   }
 
@@ -398,6 +413,9 @@ namespace reference.`microsoft.graph` {
   @complex model allDevicesAssignmentTarget extends deviceAndAppManagementAssignmentTarget {
   }
 
+  @complex model allDomains extends validatingDomains {
+  }
+
   /**
    * Represents an assignment to all licensed users in the tenant.
    */
@@ -3470,6 +3488,10 @@ namespace reference.`microsoft.graph` {
     users: string[] | null;
   }
 
+  @complex model enumeratedDomains extends validatingDomains {
+    domainNames: string[];
+  }
+
   @complex model enumeratedScopes extends inheritableScopes {
     scopes: string[];
   }
@@ -4355,6 +4377,9 @@ namespace reference.`microsoft.graph` {
     passcode: string | null;
   }
 
+  /**
+   * Standard way to represent a Json blob on Graph.
+   */
   @complex model Json {
   }
 
@@ -5092,6 +5117,11 @@ namespace reference.`microsoft.graph` {
     oneNoteWebUrl: externalLink | null;
   }
 
+  @complex model notificationRecipients {
+    customRecipients: emailIdentity[];
+    role: notificationRecipientsType;
+  }
+
   @complex model noTrainingNotificationSetting extends endUserNotificationSetting {
     simulationNotification: simulationNotification | null;
   }
@@ -5572,6 +5602,21 @@ namespace reference.`microsoft.graph` {
     type: string | null;
   }
 
+  @complex model packageAccessEntity {
+    resourceId: string;
+    resourceType: accessEntityType;
+  }
+
+  @complex model packageElement {
+    definition: Json | null;
+    id: string | null;
+  }
+
+  @complex model packageElementDetail {
+    elements: packageElement[];
+    elementType: string | null;
+  }
+
   @complex model pageLinks {
     oneNoteClientUrl: externalLink | null;
     oneNoteWebUrl: externalLink | null;
@@ -8116,6 +8161,11 @@ namespace reference.`microsoft.graph` {
     workLocationType: workLocationType;
   }
 
+  @abstract
+  @complex model validatingDomains {
+    rootDomains: rootDomains;
+  }
+
   @complex model verifiedDomain {
     capabilities: string | null;
     isDefault: boolean | null;
@@ -9273,6 +9323,7 @@ namespace reference.`microsoft.graph` {
     displayName: string | null;
     originId: string | null;
     originSystem: string | null;
+    type: roleType | null;
     @contains resource: accessPackageResource | null;
   }
 
@@ -9302,6 +9353,11 @@ namespace reference.`microsoft.graph` {
     @references connectedOrganization: connectedOrganization | null;
   }
 
+  @entity model accessPackageSuggestion extends entity {
+    reasons: accessPackageSuggestionReason[];
+    @references accessPackage: availableAccessPackage | null;
+  }
+
   @entity model accessPackageTextInputQuestion extends accessPackageQuestion {
     isSingleLineQuestion: boolean | null;
     regexPattern: string | null;
@@ -9486,9 +9542,6 @@ namespace reference.`microsoft.graph` {
     @references sponsors: directoryObject[];
   }
 
-  /**
-   * Represents a Microsoft Entra user account.
-   */
   @open
   @entity model agentUser extends user {
   }
@@ -10715,6 +10768,12 @@ namespace reference.`microsoft.graph` {
     guestUserRoleId: guid | null;
   }
 
+  @entity model availableAccessPackage extends entity {
+    description: string | null;
+    displayName: string | null;
+    @references resourceRoleScopes: accessPackageResourceRoleScope[];
+  }
+
   @entity model azureCommunicationServicesUserConversationMember extends conversationMember {
     azureCommunicationServicesId: string | null;
   }
@@ -10735,6 +10794,7 @@ namespace reference.`microsoft.graph` {
     @contains driveInclusionRules: driveProtectionRule[];
     @contains driveProtectionUnits: driveProtectionUnit[];
     @contains driveProtectionUnitsBulkAdditionJobs: driveProtectionUnitsBulkAdditionJob[];
+    @contains emailNotificationsSetting: emailNotificationsSetting | null;
     @contains exchangeProtectionPolicies: exchangeProtectionPolicy[];
     @contains exchangeRestoreSessions: exchangeRestoreSession[];
     @contains mailboxInclusionRules: mailboxProtectionRule[];
@@ -11937,6 +11997,15 @@ files, events, and updates for people sharing a common interest or goal.
     displayName: string | null;
   }
 
+  @abstract
+  @entity model controlConfiguration extends entity {
+    createdBy: string | null;
+    @computed createdDateTime: offsetDateTime | null;
+    isEnabled: boolean;
+    modifiedBy: string | null;
+    modifiedDateTime: offsetDateTime | null;
+  }
+
   @entity model conversation extends entity {
     hasAttachments: boolean;
     @computed lastDeliveredDateTime: offsetDateTime;
@@ -11966,9 +12035,14 @@ files, events, and updates for people sharing a common interest or goal.
   }
 
   @entity model copilotAdmin extends entity {
+    @contains catalog: copilotAdminCatalog | null;
     @contains settings: copilotAdminSetting | null;
   }
 
+  @entity model copilotAdminCatalog extends entity {
+    @contains packages: copilotPackageDetail[];
+  }
+
   @entity model copilotAdminLimitedMode extends entity {
     groupId: string | null;
     isEnabledForGroup: boolean | null;
@@ -11978,6 +12052,38 @@ files, events, and updates for people sharing a common interest or goal.
     @contains limitedMode: copilotAdminLimitedMode | null;
   }
 
+  @entity model copilotPackage extends entity {
+    appId: string | null;
+    assetId: string | null;
+    availableTo: packageStatus;
+    @computed createdDateTime: offsetDateTime | null;
+    deployedTo: packageStatus;
+    displayName: string | null;
+    elementTypes: string[];
+    isBlocked: boolean;
+    @computed lastModifiedDateTime: offsetDateTime | null;
+    manifestId: string | null;
+    manifestVersion: string | null;
+    ownerId: string | null;
+    platform: string | null;
+    publisher: string | null;
+    shortDescription: string | null;
+    supportedHosts: string[];
+    type: packageType;
+    version: string | null;
+    zipFile: stream | null;
+  }
+
+  @entity model copilotPackageDetail extends copilotPackage {
+    acquireUsersAndGroups: packageAccessEntity[];
+    allowedUsersAndGroups: packageAccessEntity[];
+    categories: string[];
+    elementDetails: packageElementDetail[];
+    longDescription: string | null;
+    sensitivity: string | null;
+    sharedWithUsersAndGroups: packageAccessEntity[];
+  }
+
   @entity model copilotReportRoot extends entity {
   }
 
@@ -13663,6 +13769,7 @@ files, events, and updates for people sharing a common interest or goal.
     @contains federationConfigurations: identityProviderBase[];
     @contains onPremisesSynchronization: onPremisesDirectorySynchronization[];
     @contains publicKeyInfrastructure: publicKeyInfrastructureRoot | null;
+    @contains recovery: reference.`microsoft.graph.entraRecoveryServices`.recovery | null;
     @contains subscriptions: companySubscription[];
   }
 
@@ -14184,15 +14291,18 @@ files, events, and updates for people sharing a common interest or goal.
     recipientEmail: string;
   }
 
+  @entity model emailNotificationsSetting extends entity {
+    additionalEvents: notificationEventsType;
+    isEnabled: boolean;
+    recipients: notificationRecipients;
+  }
+
   @entity model emergencyCallEvent extends callEvent {
     callerInfo: emergencyCallerInfo | null;
     emergencyNumberDialed: string | null;
     policyName: string | null;
   }
 
-  /**
-   * Represents a container that exposes navigation properties for employee experience resources.
-   */
   @entity model employeeExperience extends MsGraph.SharedModels.entity {
     /**
      * A collection of communities in Viva Engage.
@@ -14250,6 +14360,11 @@ files, events, and updates for people sharing a common interest or goal.
     subject: string;
   }
 
+  @entity model endUserSettings extends controlConfiguration {
+    relatedPeopleInsightLevel: accessPackageSuggestionRelatedPeopleInsightLevel | null;
+    showApproverDetailsToMembers: boolean;
+  }
+
   /**
    * Represents the status of a Viva Engage async operation that is an operation that transcends the
 lifetime of a single API request. These operations are long-running or too expensive to complete
@@ -14493,11 +14608,14 @@ within the time frame of their original request.
   @entity model entitlementManagement extends entity {
     @contains accessPackageAssignmentApprovals: approval[];
     @contains accessPackages: accessPackage[];
+    @contains accessPackageSuggestions: accessPackageSuggestion[];
     @contains assignmentPolicies: accessPackageAssignmentPolicy[];
     @contains assignmentRequests: accessPackageAssignmentRequest[];
     @contains assignments: accessPackageAssignment[];
+    @contains availableAccessPackages: availableAccessPackage[];
     @contains catalogs: accessPackageCatalog[];
     @contains connectedOrganizations: connectedOrganization[];
+    @contains controlConfigurations: controlConfiguration[];
     @contains resourceEnvironments: accessPackageResourceEnvironment[];
     @contains resourceRequests: accessPackageResourceRequest[];
     @contains resourceRoleScopes: accessPackageResourceRoleScope[];
@@ -14686,7 +14804,11 @@ within the time frame of their original request.
     description: string | null;
     issuer: string;
     name: string;
-    subject: string;
+    subject: string | null;
+  }
+
+  @entity model federatedTokenValidationPolicy extends directoryObject {
+    validatingDomains: validatingDomains;
   }
 
   @entity model fido2AuthenticationMethod extends authenticationMethod {
@@ -14838,11 +14960,9 @@ within the time frame of their original request.
     siteId: string | null;
   }
 
-  /**
-   * Represents a Microsoft Entra group.
-   */
   @open
   @entity model group extends directoryObject {
+    accessType: groupAccessType | null;
     allowExternalSenders: boolean | null;
     assignedLabels: assignedLabel[] | null;
     assignedLicenses: assignedLicense[] | null;
@@ -14859,6 +14979,7 @@ within the time frame of their original request.
     infoCatalogs: string[];
     isArchived: boolean | null;
     isAssignableToRole: boolean | null;
+    isFavorite: boolean | null;
     isManagementRestricted: boolean | null;
     isSubscribedByMail: boolean | null;
     licenseProcessingState: licenseProcessingState | null;
@@ -14868,6 +14989,7 @@ within the time frame of their original request.
     membershipRule: string | null;
     membershipRuleProcessingState: string | null;
     onPremisesDomainName: string | null;
+    onPremisesExtensionAttributes: onPremisesExtensionAttributes | null;
     onPremisesLastSyncDateTime: offsetDateTime | null;
     onPremisesNetBiosName: string | null;
     onPremisesProvisioningErrors: onPremisesProvisioningError[] | null;
@@ -14885,7 +15007,9 @@ within the time frame of their original request.
     serviceProvisioningErrors: serviceProvisioningError[] | null;
     theme: string | null;
     uniqueName: string | null;
+    unseenConversationsCount: int32 | null;
     unseenCount: int32 | null;
+    unseenMessagesCount: int32 | null;
     visibility: string | null;
     welcomeMessageEnabled: boolean | null;
     @contains acceptedSenders: directoryObject[];
@@ -18291,9 +18415,6 @@ within the time frame of their original request.
     handler: onInteractiveAuthFlowStartHandler | null;
   }
 
-  /**
-   * Represents a Microsoft online meeting.
-   */
   @open
   @entity model onlineMeeting extends onlineMeetingBase {
     attendeeReport: stream | null;
@@ -18862,6 +18983,7 @@ within the time frame of their original request.
     @contains defaultAppManagementPolicy: tenantAppManagementPolicy | null;
     @contains deviceRegistrationPolicy: deviceRegistrationPolicy | null;
     @contains featureRolloutPolicies: featureRolloutPolicy[];
+    @contains federatedTokenValidationPolicy: federatedTokenValidationPolicy | null;
     @contains homeRealmDiscoveryPolicies: homeRealmDiscoveryPolicy[];
     @contains identitySecurityDefaultsEnforcementPolicy: identitySecurityDefaultsEnforcementPolicy | null;
     @contains ownerlessGroupPolicy: ownerlessGroupPolicy | null;
@@ -19148,6 +19270,7 @@ within the time frame of their original request.
   @entity model profileCardProperty extends entity {
     annotations: profileCardAnnotation[] | null;
     directoryPropertyName: string | null;
+    isVisible: boolean;
   }
 
   @entity model profilePhoto extends entity {
@@ -19779,11 +19902,16 @@ within the time frame of their original request.
     vendorInformation: securityVendorInformation | null;
   }
 
+  /**
+   * Security singleton providing access to audit log resources.
+   */
   @entity model security extends MsGraph.SharedModels.entity {
     @contains alerts: alert[];
     @contains alerts_v2: reference.`microsoft.graph.security`.alert[];
     @contains attackSimulation: attackSimulationRoot | null;
+    @contains auditLog: reference.`microsoft.graph.security`.auditCoreRoot | null;
     @contains cases: reference.`microsoft.graph.security`.casesRoot | null;
+    @contains collaboration: reference.`microsoft.graph.security`.collaborationRoot | null;
     @contains dataSecurityAndGovernance: tenantDataSecurityAndGovernance | null;
     @contains identities: reference.`microsoft.graph.security`.identityContainer | null;
     @contains incidents: reference.`microsoft.graph.security`.incident[];
@@ -21303,9 +21431,6 @@ within the time frame of their original request.
     @references resource: entity | null;
   }
 
-  /**
-   * Represents a Microsoft Entra user account.
-   */
   @open
   @entity model user extends directoryObject {
     aboutMe: string | null;
@@ -25649,6 +25774,12 @@ within the time frame of their original request.
     allowedPolicyOIDs: string[];
   }
 
+  enum accessEntityType {
+    user: 0,
+    group: 1,
+    unknownFutureValue: 2,
+  }
+
   enum accessPackageAssignmentFilterByCurrentUserOptions {
     target: 1,
     createdBy: 2,
@@ -25755,6 +25886,21 @@ within the time frame of their original request.
     unknownFutureValue: 3,
   }
 
+  @graphFlags
+  enum accessPackageSuggestionFilterByCurrentUserOptions {
+    none: 0,
+    relatedPeopleAssignments: 1,
+    assignmentHistory: 2,
+    unknownFutureValue: 4,
+  }
+
+  enum accessPackageSuggestionRelatedPeopleInsightLevel {
+    disabled: 0,
+    count: 1,
+    countAndNames: 2,
+    unknownFutureValue: 3,
+  }
+
   enum accessReviewExpirationBehavior {
     keepAccess: 0,
     removeAccess: 1,
@@ -26252,6 +26398,13 @@ within the time frame of their original request.
     unknownFutureValue: 3,
   }
 
+  enum approverInformationVisibility {
+    default: 0,
+    notVisible: 1,
+    visible: 2,
+    unknownFutureValue: 3,
+  }
+
   enum appsUpdateChannelType {
     current: 0,
     monthlyEnterprise: 1,
@@ -29334,6 +29487,14 @@ within the time frame of their original request.
     unknownFutureValue: 2,
   }
 
+  enum groupAccessType {
+    none: 0,
+    private: 1,
+    secret: 2,
+    public: 3,
+    unknownFutureValue: 4,
+  }
+
   enum groupType {
     unifiedGroups: 0,
     azureAD: 1,
@@ -30476,6 +30637,23 @@ within the time frame of their original request.
     unknownFutureValue: 3,
   }
 
+  @graphFlags
+  enum notificationEventsType {
+    none: 1,
+    restoreAndPolicyUpdates: 2,
+    unknownFutureValue: 4,
+  }
+
+  @graphFlags
+  enum notificationRecipientsType {
+    none: 0,
+    globalAdmins: 1,
+    backupAdmins: 2,
+    custom: 4,
+    allAdmins: 8,
+    unknownFutureValue: 16,
+  }
+
   /**
    * Branding Options for the Message Template. Branding is defined in the Intune Admin Console.
    */
@@ -30711,6 +30889,21 @@ within the time frame of their original request.
     unknownFutureValue: 1,
   }
 
+  enum packageStatus {
+    none: 0,
+    some: 1,
+    all: 2,
+    unknownFutureValue: 3,
+  }
+
+  enum packageType {
+    microsoft: 0,
+    external: 1,
+    shared: 2,
+    custom: 3,
+    unknownFutureValue: 4,
+  }
+
   enum pageLayoutType {
     microsoftReserved: 0,
     article: 1,
@@ -33212,6 +33405,24 @@ within the time frame of their original request.
     unknownFutureValue: 4,
   }
 
+  enum roleType {
+    active: 0,
+    eligible: 1,
+    application: 2,
+    delegated: 3,
+    unknownFutureValue: 99,
+  }
+
+  enum rootDomains {
+    none: 0,
+    all: 1,
+    allFederated: 2,
+    allManaged: 3,
+    enumerated: 4,
+    allManagedAndEnumeratedFederated: 5,
+    unknownFutureValue: 6,
+  }
+
   enum routingMode {
     oneToOne: 0,
     multicast: 1,
@@ -36541,6 +36752,165 @@ namespace reference.`microsoft.graph.callRecords` {
     unknownFutureValue: 7,
   }
 
+}
+@publicNamespace("microsoft.graph.entrarecoveryservices")
+namespace reference.`microsoft.graph.entraRecoveryServices` {
+  @complex model entityTypeAndIds {
+    entityIds: string[];
+    entityType: resourceTypeName;
+  }
+
+  @complex model recoveryJobEntityNameAndIdsFilter extends recoveryJobFilteringCriteriaBase {
+    filterValues: entityTypeAndIds[];
+  }
+
+  @complex model recoveryJobEntityNamesFilter extends recoveryJobFilteringCriteriaBase {
+    entityTypes: resourceTypeName[];
+  }
+
+  @complex model recoveryJobFilteringCriteriaBase {
+  }
+
+  @entity model recovery extends reference.`microsoft.graph`.entity {
+    @contains jobs: recoveryJobBase[];
+    @contains snapshots: snapshot[];
+  }
+
+  @open
+  @entity model recoveryChangeObjectBase extends reference.`microsoft.graph`.entity {
+    displayName: string | null;
+    entityTypeName: resourceTypeName;
+    failureMessage: string | null;
+    recoveryAction: recoveryAction;
+  }
+
+  @entity model recoveryJob extends recoveryJobBase {
+    totalFailedChanges: int32 | null;
+    totalLinksModified: int32 | null;
+    totalObjectsModified: int32 | null;
+  }
+
+  @abstract
+  @entity model recoveryJobBase extends reference.`microsoft.graph`.entity {
+    filteringCriteria: recoveryJobFilteringCriteriaBase | null;
+    jobCompletionDateTime: offsetDateTime | null;
+    jobStartDateTime: offsetDateTime;
+    status: recoveryStatus;
+    targetStateDateTime: offsetDateTime;
+    totalChangedLinksCalculated: int32 | null;
+    totalChangedObjectsCalculated: int32 | null;
+  }
+
+  @entity model recoveryPreviewJob extends recoveryJobBase {
+  }
+
+  @entity model snapshot extends reference.`microsoft.graph`.entity {
+    @computed createdDateTime: offsetDateTime;
+    totalChangedObjects: int32 | null;
+    @references recoveryJobs: recoveryJob[];
+    @references recoveryPreviewJobs: recoveryPreviewJob[];
+  }
+
+  enum recoveryAction {
+    /**
+     * Represents a soft delete action during recovery
+     */
+    softDelete: 0,
+    /**
+     * Represents an update action during recovery
+     */
+    update: 1,
+    /**
+     * Represents a restore action during recovery
+     */
+    restore: 2,
+    unknownFutureValue: 3,
+  }
+
+  enum recoveryStatus {
+    /**
+     * Represents a job that has been initialized but has not been started yet
+     */
+    initialized: 0,
+    /**
+     * Represents a job that is in progress
+     */
+    running: 1,
+    /**
+     * Represents a job that ran successfully and is now complete
+     */
+    successful: 2,
+    /**
+     * Represents a job that we were not able to run successfully
+     */
+    failed: 3,
+    /**
+     * Represents a job that was abandoned by the user
+     */
+    abandoned: 4,
+    unknownFutureValue: 5,
+    /**
+     * Represents a job for which we have started calculating the diff/preview.
+     */
+    calculating: 6,
+    /**
+     * Represents a job for which we have started loading data of the snapshot.
+     */
+    loadingData: 7,
+  }
+
+  enum resourceTypeName {
+    /**
+     * Represents the user entity
+     */
+    user: 0,
+    /**
+     * Represents the group entity
+     */
+    group: 1,
+    /**
+     * Represents the conditional access policy entity
+     */
+    conditionalAccessPolicy: 2,
+    /**
+     * Represents the named location policy entity
+     */
+    namedLocationPolicy: 3,
+    /**
+     * Represents the authentication method policy entity
+     */
+    authenticationMethodPolicy: 4,
+    /**
+     * Represents the authorization policy entity
+     */
+    authorizationPolicy: 5,
+    /**
+     * Represents the authentication strength policy entity
+     */
+    authenticationStrengthPolicy: 6,
+    /**
+     * Represents the application entity
+     */
+    application: 7,
+    /**
+     * Represents the service principal entity
+     */
+    servicePrincipal: 8,
+    unknownFutureValue: 9,
+    /**
+     * Represents the oAuth2PermissionGrant entity.
+     */
+    oAuth2PermissionGrant: 10,
+    /**
+     * Represents the appRoleAssignment entity.
+     */
+    appRoleAssignment: 11,
+    /**
+     * Represents the organization entity.
+     */
+    organization: 12,
+  }
+
 }
 @publicNamespace("microsoft.graph.externalconnectors")
 namespace reference.`microsoft.graph.externalConnectors` {
@@ -36804,6 +37174,7 @@ namespace reference.`microsoft.graph.externalConnectors` {
     personLanguages: 54,
     personPublications: 55,
     personPatents: 56,
+    personWorkPositions: 57,
   }
 
   enum propertyType {
@@ -36863,6 +37234,18 @@ namespace reference.`microsoft.graph.identityGovernance` {
     triggerAttributes: triggerAttribute[];
   }
 
+  @complex model cancelRunsScope extends cancelScope {
+    @references runs: run[];
+  }
+
+  @abstract
+  @complex model cancelScope {
+  }
+
+  @complex model countBasedQuarantineCondition extends quarantineCondition {
+    threshold: int64;
+  }
+
   @complex model customTaskExtensionCallbackConfiguration extends reference.`microsoft.graph`.customExtensionCallbackConfiguration {
     @references authorizedApps: reference.`microsoft.graph`.application[];
   }
@@ -36895,6 +37278,32 @@ namespace reference.`microsoft.graph.identityGovernance` {
     valueType: valueType;
   }
 
+  @complex model percentageBasedQuarantineCondition extends quarantineCondition {
+    percentage: int32;
+  }
+
+  @complex model previewFailedTask {
+    definitionId: string;
+    failureReason: string;
+    name: string;
+    taskId: string;
+  }
+
+  @abstract
+  @complex model quarantineCondition {
+  }
+
+  @complex model quarantineConfiguration {
+    conditions: quarantineCondition[];
+    matchMode: matchMode;
+  }
+
+  @complex model quarantineDetails {
+    quarantinedDateTime: offsetDateTime | null;
+    quarantineReason: string | null;
+    quarantineType: quarantineType;
+  }
+
   @complex model ruleBasedSubjectSet extends reference.`microsoft.graph`.subjectSet {
     rule: string;
   }
@@ -36981,6 +37390,10 @@ namespace reference.`microsoft.graph.identityGovernance` {
   @complex model workflowExecutionTrigger {
   }
 
+  @complex model workflowSetting {
+    quarantineConfiguration: quarantineConfiguration | null;
+  }
+
   @complex model workflowsInsightsByCategory {
     failedJoinerRuns: int32;
     failedLeaverRuns: int32;
@@ -37018,6 +37431,7 @@ namespace reference.`microsoft.graph.identityGovernance` {
 
   @entity model lifecycleManagementSettings extends reference.`microsoft.graph`.entity {
     emailSettings: reference.`microsoft.graph`.emailSettings;
+    quarantineConfiguration: quarantineConfiguration | null;
     workflowScheduleIntervalInHours: int32;
   }
 
@@ -37116,8 +37530,11 @@ namespace reference.`microsoft.graph.identityGovernance` {
     deletedDateTime: offsetDateTime | null;
     @computed @key id: string;
     nextScheduleRunDateTime: offsetDateTime | null;
+    quarantineDetails: quarantineDetails;
+    settings: workflowSetting;
     version: int32 | null;
     @references executionScope: userProcessingResult[];
+    @references previewScope: reference.`microsoft.graph`.directoryObject[];
     @contains runs: run[];
     @contains taskReports: taskReport[];
     @contains userProcessingResults: userProcessingResult[];
@@ -37149,6 +37566,7 @@ namespace reference.`microsoft.graph.identityGovernance` {
   }
 
   @entity model workflowVersion extends workflowBase {
+    settings: workflowSetting;
     @computed @key versionNumber: int32;
   }
 
@@ -37193,6 +37611,14 @@ namespace reference.`microsoft.graph.identityGovernance` {
     canceled: 4,
     failed: 5,
     unknownFutureValue: 6,
+    canceling: 7,
+    quarantined: 8,
+  }
+
+  enum matchMode {
+    any: 0,
+    all: 1,
+    unknownFutureValue: 2,
   }
 
   enum membershipChangeType {
@@ -37201,6 +37627,14 @@ namespace reference.`microsoft.graph.identityGovernance` {
     unknownFutureValue: 3,
   }
 
+  enum quarantineType {
+    notQuarantined: 0,
+    countBasedThresholdExceeded: 1,
+    percentageBasedThresholdExceeded: 2,
+    multipleConditionsExceeded: 3,
+    unknownFutureValue: 4,
+  }
+
   enum valueType {
     `enum`: 0,
     `string`: 1,
@@ -37214,6 +37648,7 @@ namespace reference.`microsoft.graph.identityGovernance` {
     onDemand: 1,
     unknownFutureValue: 2,
     activatedWithScope: 3,
+    preview: 4,
   }
 
   enum workflowTriggerTimeBasedAttribute {
@@ -37380,8 +37815,51 @@ namespace reference.`microsoft.graph.search` {
 
 }
 @deprecatedDefinition("Tasks_And_Plans", "<ChangeLogCategory>", "2026-03-18", "2028-03-18", "Alert category property is deprecated and replaced with alert categories")
+// Metadata item DeprecatedDefinition_Tasks_And_Plans was already defined with a different value.
 @publicNamespace("microsoft.graph.security")
 namespace reference.`microsoft.graph.security` {
+  /**
+   * Audit data for A365 AI Execute Tool events.
+   */
+  @open
+  @complex model a365AiExecuteTool extends auditData {
+  }
+
+  /**
+   * Audit data for A365 AI Inference Call events.
+   */
+  @open
+  @complex model a365AiInferenceCall extends auditData {
+  }
+
+  /**
+   * Audit data for A365 AI Invoke Agent events.
+   */
+  @open
+  @complex model a365AiInvokeAgent extends auditData {
+  }
+
+  /**
+   * Audit data for A365 AI Run Summary events.
+   */
+  @open
+  @complex model a365AiRunSummary extends auditData {
+  }
+
+  /**
+   * Audit data for A365 Span Outputs events.
+   */
+  @open
+  @complex model a365SpanOutputs extends auditData {
+  }
+
+  /**
+   * Audit data for AAD Risk Detection events.
+   */
+  @open
+  @complex model aadRiskDetectionAuditRecord extends auditData {
+  }
+
   @complex model account {
     actions: action[];
     identifier: string;
@@ -37393,6 +37871,27 @@ namespace reference.`microsoft.graph.security` {
     trustedDomains: activeDirectoryDomainEvidence[];
   }
 
+  /**
+   * Audit data for Advanced eDiscovery events.
+   */
+  @open
+  @complex model aedAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Agent Admin Activity events.
+   */
+  @open
+  @complex model agentAdminActivityRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Agent Setting Admin Activity events.
+   */
+  @open
+  @complex model agentSettingAdminActivity extends auditData {
+  }
+
   @complex model aiAgentEvidence extends alertEvidence {
     agentId: string | null;
     agentName: string | null;
@@ -37400,6 +37899,118 @@ namespace reference.`microsoft.graph.security` {
     instructions: string | null;
   }
 
+  /**
+   * Audit data for AI App Interaction events.
+   */
+  @open
+  @complex model aiAppInteractionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for AI Execute Tool events.
+   */
+  @open
+  @complex model aiExecuteToolAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for AI Interactions Change Notification events.
+   */
+  @open
+  @complex model aiInteractionsChangeNotificationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for AI Interactions Export events.
+   */
+  @open
+  @complex model aiInteractionsExportAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for AI Interactions Subscription events.
+   */
+  @open
+  @complex model aiInteractionsSubscriptionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for AI Invoke Agent events.
+   */
+  @open
+  @complex model aiInvokeAgentAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for AIP Discover events.
+   */
+  @open
+  @complex model aipDiscover extends auditData {
+  }
+
+  /**
+   * Audit data for AIP File Deleted events.
+   */
+  @open
+  @complex model aipFileDeleted extends auditData {
+  }
+
+  /**
+   * Audit data for AIP Heart Beat events.
+   */
+  @open
+  @complex model aipHeartBeat extends auditData {
+  }
+
+  /**
+   * Audit data for AIP Protection Action log request events.
+   */
+  @open
+  @complex model aipProtectionActionLogRequest extends auditData {
+  }
+
+  /**
+   * Audit data for AIP Scanner Discover Event events.
+   */
+  @open
+  @complex model aipScannerDiscoverEvent extends auditData {
+  }
+
+  /**
+   * Audit data for AIP Sensitivity Label Action log request events.
+   */
+  @open
+  @complex model aipSensitivityLabelActionLogRequest extends auditData {
+  }
+
+  /**
+   * Audit data for AIR Admin Action Investigation events.
+   */
+  @open
+  @complex model airAdminActionInvestigationData extends auditData {
+  }
+
+  /**
+   * Audit data for AIR Investigation events.
+   */
+  @open
+  @complex model airInvestigationData extends auditData {
+  }
+
+  /**
+   * Audit data for AIR Manual Investigation events.
+   */
+  @open
+  @complex model airManualInvestigationData extends auditData {
+  }
+
+  /**
+   * Audit data for AI Span Outputs events.
+   */
+  @open
+  @complex model aISpanOutputsAuditRecord extends auditData {
+  }
+
   @complex model alertComment {
     comment: string | null;
     createdByDisplayName: string | null;
@@ -37416,6 +38027,20 @@ namespace reference.`microsoft.graph.security` {
     verdict: evidenceVerdict;
   }
 
+  /**
+   * Audit data for Alert Submission events.
+   */
+  @open
+  @complex model alertSubmissionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Alert Submission Result Detail events.
+   */
+  @open
+  @complex model alertSubmissionResultDetailAuditRecord extends auditData {
+  }
+
   @complex model amazonResourceEvidence extends alertEvidence {
     amazonAccountId: string | null;
     amazonResourceId: string | null;
@@ -37423,6 +38048,67 @@ namespace reference.`microsoft.graph.security` {
     resourceType: string | null;
   }
 
+  @complex model analyzedEmailAttachment {
+    detonationDetails: detonationDetails | null;
+    fileExtension: string | null;
+    fileName: string | null;
+    fileSize: int32 | null;
+    fileType: string | null;
+    malwareFamily: string | null;
+    sha256: string | null;
+    tenantAllowBlockListDetailInfo: string | null;
+    threatType: threatType | null;
+  }
+
+  @complex model analyzedEmailAuthenticationDetail {
+    compositeAuthentication: string | null;
+    dkim: string | null;
+    dmarc: string | null;
+    senderPolicyFramework: string | null;
+  }
+
+  @complex model analyzedEmailDeliveryDetail {
+    action: deliveryAction | null;
+    latestThreats: string | null;
+    location: deliveryLocation | null;
+    originalThreats: string | null;
+  }
+
+  @complex model analyzedEmailDlpRuleInfo {
+    name: string | null;
+    ruleId: string | null;
+  }
+
+  @complex model analyzedEmailExchangeTransportRuleInfo {
+    name: string | null;
+    ruleId: string | null;
+  }
+
+  @complex model analyzedEmailRecipientDetail {
+    ccRecipients: string[] | null;
+    domainName: string | null;
+  }
+
+  @complex model analyzedEmailSenderDetail {
+    displayName: string | null;
+    domainCreationDateTime: offsetDateTime | null;
+    domainName: string | null;
+    domainOwner: string | null;
+    fromAddress: string | null;
+    ipv4: string | null;
+    location: string | null;
+    mailFromAddress: string | null;
+    mailFromDomainName: string | null;
+  }
+
+  @complex model analyzedEmailUrl {
+    detectionMethod: string | null;
+    detonationDetails: detonationDetails | null;
+    tenantAllowBlockListDetailInfo: string | null;
+    threatType: threatType | null;
+    url: string | null;
+  }
+
   @complex model analyzedMessageEvidence extends alertEvidence {
     antiSpamDirection: string | null;
     attachmentsCount: int64 | null;
@@ -37444,6 +38130,49 @@ namespace reference.`microsoft.graph.security` {
     urn: string | null;
   }
 
+  /**
+   * Audit data for Attack Sim Admin events.
+   */
+  @open
+  @complex model attackSimAdminAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Attack Sim events.
+   */
+  @open
+  @complex model attackSimAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Audit Config events.
+   */
+  @open
+  @complex model auditConfigAuditRecord extends auditData {
+  }
+
+  /**
+   * Abstract base type for audit event data.
+   */
+  @abstract
+  @complex model auditData {
+    dynamicProperties: auditRecordTypeDictionary | null;
+  }
+
+  /**
+   * A dictionary of name-value pairs for dynamic audit event properties.
+   */
+  @open
+  @complex model auditRecordTypeDictionary {
+  }
+
+  /**
+   * Audit data for Audit Search events.
+   */
+  @open
+  @complex model auditSearchAuditRecord extends auditData {
+  }
+
   @complex model autonomousSystem {
     name: string;
     number: int32;
@@ -37451,6 +38180,55 @@ namespace reference.`microsoft.graph.security` {
     value: string;
   }
 
+  /**
+   * Audit data for Azfw Application Rule Aggregation Event events.
+   */
+  @open
+  @complex model azfwApplicationRuleAggregationEventRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azfw Dns Query Event events.
+   */
+  @open
+  @complex model azfwDnsQueryEventRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azfw Network Rule Event events.
+   */
+  @open
+  @complex model azfwNetworkRuleEventRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azure Active Directory Account Logon events.
+   */
+  @open
+  @complex model azureActiveDirectoryAccountLogonAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azure Active Directory events.
+   */
+  @open
+  @complex model azureActiveDirectoryAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azure Active Directory STS Logon events.
+   */
+  @open
+  @complex model azureActiveDirectoryStsLogonAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Azure AI Search Audit events.
+   */
+  @open
+  @complex model azureAISearchAuditRecord extends auditData {
+  }
+
   @complex model azureResourceEvidence extends alertEvidence {
     resourceId: string | null;
     resourceName: string | null;
@@ -37471,6 +38249,83 @@ namespace reference.`microsoft.graph.security` {
     url: string | null;
   }
 
+  /**
+   * Audit data for threat campaign events.
+   */
+  @open
+  @complex model campaignAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CCRAI Policy Violation events.
+   */
+  @open
+  @complex model ccraiPolicyViolationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Classifier Health events.
+   */
+  @open
+  @complex model cdpClassifierHealthRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Cold Crawl Status events.
+   */
+  @open
+  @complex model cdpColdCrawlStatusRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Consumption Resource events.
+   */
+  @open
+  @complex model cdpConsumptionResourceRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Content Explorer Aggregate events.
+   */
+  @open
+  @complex model cdpContentExplorerAggregateRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Cdpdlmai Interaction Insights events.
+   */
+  @open
+  @complex model cdpdlmaiInteractionInsightsRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP DLP Sensitive Endpoint events.
+   */
+  @open
+  @complex model cdpDlpSensitiveEndpointAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Log events.
+   */
+  @open
+  @complex model cdpLogRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP OCR Billing events.
+   */
+  @open
+  @complex model cdpOcrBillingRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CDP Resource Scope Change Event events.
+   */
+  @open
+  @complex model cdpResourceScopeChangeEventRecord extends auditData {
+  }
+
   @complex model cloudApplicationEvidence extends alertEvidence {
     appId: int64 | null;
     displayName: string | null;
@@ -37496,6 +38351,200 @@ namespace reference.`microsoft.graph.security` {
     userAgent: string | null;
   }
 
+  /**
+   * Audit data for Cloud Update Device Config events.
+   */
+  @open
+  @complex model cloudUpdateDeviceConfigAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Cloud Update Profile Config events.
+   */
+  @open
+  @complex model cloudUpdateProfileConfigAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Cloud Update Tenant Config events.
+   */
+  @open
+  @complex model cloudUpdateTenantConfigAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance Connector events.
+   */
+  @open
+  @complex model complianceConnectorAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLM Exchange events.
+   */
+  @open
+  @complex model complianceDLMExchangeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLM SharePoint events.
+   */
+  @open
+  @complex model complianceDLMSharePointAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP Applications events.
+   */
+  @open
+  @complex model complianceDLPApplicationsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP Applications Classification events.
+   */
+  @open
+  @complex model complianceDLPApplicationsClassificationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP Endpoint events.
+   */
+  @open
+  @complex model complianceDLPEndpointAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP Endpoint Discovery events.
+   */
+  @open
+  @complex model complianceDLPEndpointDiscoveryAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP Enforcement events.
+   */
+  @open
+  @complex model complianceDLPEnforcementAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP Exchange events.
+   */
+  @open
+  @complex model complianceDLPExchangeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP Exchange Classification events.
+   */
+  @open
+  @complex model complianceDLPExchangeClassificationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP Exchange Classification CDP events.
+   */
+  @open
+  @complex model complianceDLPExchangeClassificationCdpRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP Exchange Discovery events.
+   */
+  @open
+  @complex model complianceDLPExchangeDiscoveryAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP SharePoint events.
+   */
+  @open
+  @complex model complianceDLPSharePointAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP SharePoint Classification events.
+   */
+  @open
+  @complex model complianceDLPSharePointClassificationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP SharePoint Classification CDP events.
+   */
+  @open
+  @complex model complianceDLPSharePointClassificationCdpRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance DLP SharePoint Classification Extended events.
+   */
+  @open
+  @complex model complianceDLPSharePointClassificationExtendedAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance Exchange OCR events.
+   */
+  @open
+  @complex model complianceExchangeOcrAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance Manager Action events.
+   */
+  @open
+  @complex model complianceManagerActionRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance Policy Grading SharePoint events.
+   */
+  @open
+  @complex model compliancePolicyGradingSharePointAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance Settings Change events.
+   */
+  @open
+  @complex model complianceSettingsChangeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance SIT Grading SharePoint events.
+   */
+  @open
+  @complex model complianceSitGradingSharePointAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Compliance Supervision Exchange events.
+   */
+  @open
+  @complex model complianceSupervisionExchangeAuditRecord extends auditData {
+  }
+
+  @complex model compromiseIndicator {
+    value: string | null;
+    verdict: verdictCategory | null;
+  }
+
+  /**
+   * Audit data for Connected AI App Interaction events.
+   */
+  @open
+  @complex model connectedAIAppInteractionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Consumption Resource events.
+   */
+  @open
+  @complex model consumptionResourceAuditRecord extends auditData {
+  }
+
   @complex model containerEvidence extends alertEvidence {
     args: string[] | null;
     command: string[] | null;
@@ -37516,16 +38565,266 @@ namespace reference.`microsoft.graph.security` {
     registry: string | null;
   }
 
+  /**
+   * Audit data for Content Store Meta events.
+   */
+  @open
+  @complex model contentStoreMetadataRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Copilot Agent Management events.
+   */
+  @open
+  @complex model copilotAgentManagementAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Copilot for Security Logging events.
+   */
+  @open
+  @complex model copilotForSecurityLoggingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Copilot for Security Trigger events.
+   */
+  @open
+  @complex model copilotForSecurityTriggerAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Copilot Interaction events.
+   */
+  @open
+  @complex model copilotInteractionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Copilot Plugin Setting events.
+   */
+  @open
+  @complex model copilotPluginSettingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Copilot Prompt Book Setting events.
+   */
+  @open
+  @complex model copilotPromptBookSettingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Copilot Session Sharing events.
+   */
+  @open
+  @complex model copilotSessionSharingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Copilot Setting events.
+   */
+  @open
+  @complex model copilotSettingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Copilot Workspace Setting events.
+   */
+  @open
+  @complex model copilotWorkspaceSettingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Core Reporting Settings events.
+   */
+  @open
+  @complex model coreReportingSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Cortana Briefing events.
+   */
+  @open
+  @complex model cortanaBriefingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Critical Asset Management Classification events.
+   */
+  @open
+  @complex model criticalAssetManagementClassificationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for CRM Entity Operation events.
+   */
+  @open
+  @complex model crmEntityOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Cross Tenant Access Policy events.
+   */
+  @open
+  @complex model crossTenantAccessPolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Customer Key Service Encryption events.
+   */
+  @open
+  @complex model customerKeyServiceEncryptionAuditRecord extends auditData {
+  }
+
   @complex model cvssSummary {
     score: float64;
     severity: vulnerabilitySeverity | null;
     vectorString: string | null;
   }
 
+  /**
+   * Audit data for Data Center Security cmdlet events.
+   */
+  @open
+  @complex model dataCenterSecurityCmdletAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Data Governance events.
+   */
+  @open
+  @complex model dataGovernanceAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Data Insights Rest Api events.
+   */
+  @open
+  @complex model dataInsightsRestApiAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Data Lake Export Operation events.
+   */
+  @open
+  @complex model dataLakeExportOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Data Security Investigation events.
+   */
+  @open
+  @complex model dataSecurityInvestigationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Data Share Operation events.
+   */
+  @open
+  @complex model dataShareOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Default open-type audit data when no specific subtype applies.
+   */
+  @open
+  @complex model defaultAuditData extends auditData {
+  }
+
+  /**
+   * Audit data for Defender Case Management events.
+   */
+  @open
+  @complex model defenderCaseManagementAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Defender Preview Features events.
+   */
+  @open
+  @complex model defenderPreviewFeaturesRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Defender Security for AI Configuration events.
+   */
+  @open
+  @complex model defenderSecurityForAIConfigurationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Deploy Feature Activity events.
+   */
+  @open
+  @complex model deployFeatureActivityRecord extends auditData {
+  }
+
   @complex model deploymentAccessKeyType {
     deploymentAccessKey: string;
   }
 
+  @graphDeprecated("Tasks_And_Plans")
+  @complex model detonationBehaviourDetails {
+    actionStatus: string | null;
+    behaviourCapability: string | null;
+    behaviourGroup: string | null;
+    details: string | null;
+    eventDateTime: offsetDateTime | null;
+    operation: string | null;
+    processId: string | null;
+    processName: string | null;
+    target: string | null;
+  }
+
+  @complex model detonationChain {
+    childNodes: detonationChain[] | null;
+    value: string | null;
+  }
+
+  @complex model detonationDetails {
+    analysisDateTime: offsetDateTime | null;
+    compromiseIndicators: compromiseIndicator[] | null;
+    detonationBehaviourDetails: detonationBehaviourDetails | null;
+    detonationBehaviourDetailsV2: string | null;
+    detonationChain: detonationChain | null;
+    detonationObservables: detonationObservables | null;
+    detonationScreenshotUri: string | null;
+    detonationVerdict: string | null;
+    detonationVerdictReason: string | null;
+    entityMetadata: string | null;
+    mitreTechniques: string | null;
+    staticAnalysis: string | null;
+    submissionSource: string | null;
+  }
+
+  @complex model detonationObservables {
+    contactedIps: string[] | null;
+    contactedUrls: string[] | null;
+    droppedfiles: string[] | null;
+  }
+
+  /**
+   * Audit data for Device Discovery Settings Authenticated Scans events.
+   */
+  @open
+  @complex model deviceDiscoverySettingsAuthenticatedScansRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Device Discovery Settings Exclusion events.
+   */
+  @open
+  @complex model deviceDiscoverySettingsExclusionRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Device Discovery Settings events.
+   */
+  @open
+  @complex model deviceDiscoverySettingsRecord extends auditData {
+  }
+
   @complex model deviceEvidence extends alertEvidence {
     azureAdDeviceId: string | null;
     defenderAvStatus: defenderAvStatus | null;
@@ -37555,6 +38854,34 @@ namespace reference.`microsoft.graph.security` {
   @complex model dictionary {
   }
 
+  /**
+   * Audit data for eDiscovery events.
+   */
+  @open
+  @complex model discoveryAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for DLP Endpoint events.
+   */
+  @open
+  @complex model dlpEndpointAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for DLP Import Result events.
+   */
+  @open
+  @complex model dlpImportResultAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for DLP Sensitive Information Type Rule Package cmdlet events.
+   */
+  @open
+  @complex model dlpSensitiveInformationTypeRulePackageCmdletRecord extends auditData {
+  }
+
   @complex model dnsEvidence extends alertEvidence {
     dnsServerIp: ipEvidence | null;
     domainName: string | null;
@@ -37562,16 +38889,65 @@ namespace reference.`microsoft.graph.security` {
     ipAddresses: ipEvidence[] | null;
   }
 
+  /**
+   * Audit data for Dragon Copilot Access events.
+   */
+  @open
+  @complex model dragonCopilotAccessRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Dragon Copilot Admin events.
+   */
+  @open
+  @complex model dragonCopilotAdminRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Dragon Copilot Clinical Data events.
+   */
+  @open
+  @complex model dragonCopilotClinicalDataRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Dragon Copilot Session events.
+   */
+  @open
+  @complex model dragonCopilotSessionRecord extends auditData {
+  }
+
   @open
   @complex model dynamicColumnValue {
   }
 
+  /**
+   * Audit data for Dynamics365 Business Central events.
+   */
+  @open
+  @complex model dynamics365BusinessCentralAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for EHR Connector events.
+   */
+  @open
+  @complex model ehrConnectorAuditBaseRecord extends auditData {
+  }
+
   @complex model emailSender {
     displayName: string | null;
     domainName: string | null;
     emailAddress: string | null;
   }
 
+  /**
+   * Audit data for EOP Submission Feed Entity events.
+   */
+  @open
+  @complex model eopSubmissionFeedEntityAuditRecord extends auditData {
+  }
+
   @complex model eventPropagationResult {
     location: string | null;
     serviceName: string | null;
@@ -37584,12 +38960,61 @@ namespace reference.`microsoft.graph.security` {
     queryType: queryType | null;
   }
 
+  /**
+   * Audit data for Exchange Admin events.
+   */
+  @open
+  @complex model exchangeAdminAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Exchange Aggregated Mailbox events.
+   */
+  @open
+  @complex model exchangeAggregatedMailboxAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Exchange Aggregated Operation events.
+   */
+  @open
+  @complex model exchangeAggregatedOperationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Exchange Mailbox Audit Group events.
+   */
+  @open
+  @complex model exchangeMailboxAuditGroupRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Exchange Mailbox events.
+   */
+  @open
+  @complex model exchangeMailboxAuditRecord extends auditData {
+  }
+
   @complex model exportFileMetadata {
     downloadUrl: string | null;
     fileName: string | null;
     size: int64 | null;
   }
 
+  /**
+   * Audit data for Microsoft Fabric events.
+   */
+  @open
+  @complex model fabricAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Fabric Policy events.
+   */
+  @open
+  @complex model fabricPolicyRecord extends auditData {
+  }
+
   @complex model fileDetails {
     fileName: string | null;
     filePath: string | null;
@@ -37692,6 +39117,20 @@ namespace reference.`microsoft.graph.security` {
     resourceType: string | null;
   }
 
+  /**
+   * Audit data for Healthcare Signal events.
+   */
+  @open
+  @complex model healthcareSignalRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Hosted RPA events.
+   */
+  @open
+  @complex model hostedRpaAuditRecord extends auditData {
+  }
+
   @complex model hostLogonSessionEvidence extends alertEvidence {
     account: userEvidence | null;
     endUtcDateTime: offsetDateTime | null;
@@ -37728,6 +39167,13 @@ namespace reference.`microsoft.graph.security` {
     port: int32 | null;
   }
 
+  /**
+   * Audit data for HR Signal events.
+   */
+  @open
+  @complex model hrSignalAuditRecord extends auditData {
+  }
+
   @complex model huntingQueryResults {
     results: huntingRowResult[] | null;
     schema: singlePropertySchema[] | null;
@@ -37737,11 +39183,60 @@ namespace reference.`microsoft.graph.security` {
   @complex model huntingRowResult {
   }
 
+  /**
+   * Audit data for Hygiene Event events.
+   */
+  @open
+  @complex model hygieneEventRecord extends auditData {
+  }
+
   @complex model hyperlink {
     name: string;
     url: string;
   }
 
+  /**
+   * Audit data for Information Barrier Policy Application events.
+   */
+  @open
+  @complex model informationBarrierPolicyApplicationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Information Worker Protection events.
+   */
+  @open
+  @complex model informationWorkerProtectionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Insider Risk Scoped User Insights events.
+   */
+  @open
+  @complex model insiderRiskScopedUserInsightsRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Insider Risk Scoped Users events.
+   */
+  @open
+  @complex model insiderRiskScopedUsersRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Integrated Apps App Admin Activity events.
+   */
+  @open
+  @complex model integratedAppsAppAdminActivityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Integrated Apps App Settings Admin Activity events.
+   */
+  @open
+  @complex model integratedAppsAppSettingsAdminActivityAuditRecord extends auditData {
+  }
+
   @complex model intelligenceProfileCountryOrRegionOfOrigin {
     code: string;
     label: string;
@@ -37790,6 +39285,27 @@ namespace reference.`microsoft.graph.security` {
     stream: stream | null;
   }
 
+  /**
+   * Audit data for IRM Activity Audit Trail events.
+   */
+  @open
+  @complex model irmActivityAuditTrailRecord extends auditData {
+  }
+
+  /**
+   * Audit data for IRM User Defined Detection events.
+   */
+  @open
+  @complex model irmUserDefinedDetectionRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Kaizala events.
+   */
+  @open
+  @complex model kaizalaAuditRecord extends auditData {
+  }
+
   @complex model kubernetesClusterEvidence extends alertEvidence {
     cloudResource: alertEvidence | null;
     distribution: string | null;
@@ -37854,11 +39370,60 @@ namespace reference.`microsoft.graph.security` {
     targetPort: string | null;
   }
 
+  /**
+   * Audit data for Label Analytics Aggregate events.
+   */
+  @open
+  @complex model labelAnalyticsAggregateAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Label Content Explorer events.
+   */
+  @open
+  @complex model labelContentExplorerAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Large Content Meta events.
+   */
+  @open
+  @complex model largeContentMetadataAuditRecord extends auditData {
+  }
+
   @complex model loggedOnUser {
     accountName: string | null;
     domainName: string | null;
   }
 
+  /**
+   * Audit data for M365 Compliance Connector events.
+   */
+  @open
+  @complex model m365ComplianceConnectorAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for M365daad events.
+   */
+  @open
+  @complex model m365daadAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for M365odsp Asset Meta events.
+   */
+  @open
+  @complex model m365odspAssetMetadataRecord extends auditData {
+  }
+
+  /**
+   * Audit data for M365 Search Sections events.
+   */
+  @open
+  @complex model m365SearchSectionsRecord extends auditData {
+  }
+
   @complex model mailboxConfigurationEvidence extends alertEvidence {
     configurationId: string | null;
     configurationType: mailboxConfigurationType | null;
@@ -37884,6 +39449,13 @@ namespace reference.`microsoft.graph.security` {
     urn: string | null;
   }
 
+  /**
+   * Audit data for Mail Submission events.
+   */
+  @open
+  @complex model mailSubmissionData extends auditData {
+  }
+
   @complex model malwareEvidence extends alertEvidence {
     category: string | null;
     files: fileEvidence[] | null;
@@ -37891,212 +39463,1711 @@ namespace reference.`microsoft.graph.security` {
     processes: processEvidence[] | null;
   }
 
+  /**
+   * Audit data for Managed Services events.
+   */
+  @open
+  @complex model managedServicesAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Managed Tenants events.
+   */
+  @open
+  @complex model managedTenantsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MAPG Alerts events.
+   */
+  @open
+  @complex model mapgAlertsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MAPG Onboard events.
+   */
+  @open
+  @complex model mapgOnboardAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MAPG Policy events.
+   */
+  @open
+  @complex model mapgPolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MAPG Remediation events.
+   */
+  @open
+  @complex model mapgRemediationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MCAS Alerts events.
+   */
+  @open
+  @complex model mcasAlertsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDA events.
+   */
+  @open
+  @complex model mdaAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDA Data Security Signal events.
+   */
+  @open
+  @complex model mdaDataSecuritySignalRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDASH events.
+   */
+  @open
+  @complex model mDASHAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDATP events.
+   */
+  @open
+  @complex model mdatpAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDC Events events.
+   */
+  @open
+  @complex model mdcEventsRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MDI events.
+   */
+  @open
+  @complex model mdiAuditRecord extends auditData {
+  }
+
   @complex model mergeResponse {
     targetIncidentId: string;
   }
 
-  @complex model networkConnectionEvidence extends alertEvidence {
-    destinationAddress: ipEvidence | null;
-    destinationPort: int32 | null;
-    protocol: protocolType | null;
-    sourceAddress: ipEvidence | null;
-    sourcePort: int32 | null;
+  /**
+   * Audit data for Mesh Worlds events.
+   */
+  @open
+  @complex model meshWorldsAuditRecord extends auditData {
   }
 
-  @complex model nicEvidence extends alertEvidence {
-    ipAddress: ipEvidence | null;
-    macAddress: string | null;
-    vlans: string[] | null;
+  /**
+   * Audit data for Microsoft365 Backup Backup Item events.
+   */
+  @open
+  @complex model microsoft365BackupBackupItemAuditRecord extends auditData {
   }
 
-  @complex model oauthApplicationEvidence extends alertEvidence {
-    appId: string | null;
-    displayName: string | null;
-    objectId: string | null;
-    publisher: string | null;
+  /**
+   * Audit data for Microsoft365 Backup Backup Policy events.
+   */
+  @open
+  @complex model microsoft365BackupBackupPolicyAuditRecord extends auditData {
   }
 
-  @complex model ocrSettings {
-    isEnabled: boolean | null;
-    maxImageSize: int32 | null;
-    timeout: duration | null;
+  /**
+   * Audit data for Microsoft365 Backup Granular Browse Task events.
+   */
+  @open
+  @complex model microsoft365BackupGranularBrowseTaskAuditRecord extends auditData {
   }
 
-  @complex model processEvidence extends alertEvidence {
-    detectionStatus: detectionStatus | null;
-    imageFile: fileDetails | null;
-    mdeDeviceId: string | null;
-    parentProcessCreationDateTime: offsetDateTime | null;
-    parentProcessId: int64 | null;
-    parentProcessImageFile: fileDetails | null;
-    processCommandLine: string | null;
-    processCreationDateTime: offsetDateTime | null;
-    processId: int64 | null;
-    userAccount: userAccount | null;
+  /**
+   * Audit data for Microsoft365 Backup Restore Item events.
+   */
+  @open
+  @complex model microsoft365BackupRestoreItemAuditRecord extends auditData {
   }
 
-  @complex model redundancyDetectionSettings {
-    isEnabled: boolean | null;
-    maxWords: int32 | null;
-    minWords: int32 | null;
-    similarityThreshold: int32 | null;
+  /**
+   * Audit data for Microsoft365 Backup Restore Task events.
+   */
+  @open
+  @complex model microsoft365BackupRestoreTaskAuditRecord extends auditData {
   }
 
-  @complex model registryKeyEvidence extends alertEvidence {
-    registryHive: string | null;
-    registryKey: string | null;
+  /**
+   * Audit data for Microsoft365 Copilot Scheduled Prompt events.
+   */
+  @open
+  @complex model microsoft365CopilotScheduledPromptAuditRecord extends auditData {
   }
 
-  @complex model registryValueEvidence extends alertEvidence {
-    mdeDeviceId: string | null;
-    registryHive: string | null;
-    registryKey: string | null;
-    registryValue: string | null;
-    registryValueName: string | null;
-    registryValueType: string | null;
+  /**
+   * Audit data for Microsoft Defender Experts XDR events.
+   */
+  @open
+  @complex model microsoftDefenderExpertsXDRAuditRecord extends auditData {
   }
 
-  @complex model reportFileMetadata {
-    downloadUrl: string | null;
-    fileName: string | null;
-    size: int64 | null;
+  /**
+   * Audit data for Microsoft Flow events.
+   */
+  @open
+  @complex model microsoftFlowAuditRecord extends auditData {
   }
 
-  @complex model resourceAccessEvent {
-    accessDateTime: offsetDateTime | null;
-    accountId: string | null;
-    ipAddress: string | null;
-    resourceIdentifier: string | null;
+  /**
+   * Audit data for Microsoft Forms events.
+   */
+  @open
+  @complex model microsoftFormsAuditRecord extends auditData {
   }
 
-  @abstract
-  @complex model retentionDuration {
+  /**
+   * Audit data for Microsoft Graph Data Connect Consent events.
+   */
+  @open
+  @complex model microsoftGraphDataConnectConsent extends auditData {
   }
 
-  @complex model retentionDurationForever extends retentionDuration {
+  /**
+   * Audit data for Microsoft Graph Data Connect Operation events.
+   */
+  @open
+  @complex model microsoftGraphDataConnectOperation extends auditData {
   }
 
-  @complex model retentionDurationInDays extends retentionDuration {
-    days: int32 | null;
+  /**
+   * Audit data for Microsoft Purview Data Catalog Operation events.
+   */
+  @open
+  @complex model microsoftPurviewDataCatalogOperationRecord extends auditData {
   }
 
-  @complex model retentionEventStatus {
-    error: reference.`microsoft.graph`.publicError | null;
-    status: eventStatusType | null;
+  /**
+   * Audit data for Microsoft Purview Data Map Operation events.
+   */
+  @open
+  @complex model microsoftPurviewDataMapOperationRecord extends auditData {
   }
 
-  @complex model sasTokenEvidence extends alertEvidence {
-    allowedIpAddresses: string | null;
-    allowedResourceTypes: string[] | null;
-    allowedServices: string[] | null;
-    expiryDateTime: offsetDateTime | null;
-    permissions: string[] | null;
-    protocol: string | null;
-    signatureHash: string | null;
-    signedWith: string | null;
-    startDateTime: offsetDateTime | null;
-    storageResource: azureResourceEvidence | null;
+  /**
+   * Audit data for Microsoft Purview Metadata Policy Operation events.
+   */
+  @open
+  @complex model microsoftPurviewMetadataPolicyOperationRecord extends auditData {
   }
 
-  @complex model securityGroupEvidence extends alertEvidence {
-    activeDirectoryObjectGuid: guid | null;
-    displayName: string | null;
-    distinguishedName: string | null;
-    friendlyName: string | null;
-    securityGroupId: string | null;
-    sid: string | null;
+  /**
+   * Audit data for Microsoft Purview Policy Operation events.
+   */
+  @open
+  @complex model microsoftPurviewPolicyOperationRecord extends auditData {
   }
 
-  @complex model sensorDeploymentPackage {
-    downloadUrl: string;
-    version: string;
+  /**
+   * Audit data for Microsoft Purview Privacy Audit Event events.
+   */
+  @open
+  @complex model microsoftPurviewPrivacyAuditEvent extends auditData {
   }
 
-  @complex model sensorSettings {
-    description: string;
-    domainControllerDnsNames: string[] | null;
-    isDelayedDeploymentEnabled: boolean | null;
-    @contains networkAdapters: networkAdapter[];
+  /**
+   * Audit data for Microsoft Purview Unified Catalog Operation events.
+   */
+  @open
+  @complex model microsoftPurviewUnifiedCatalogOperationRecord extends auditData {
   }
 
-  @complex model servicePrincipalEvidence extends alertEvidence {
-    appId: string | null;
-    appOwnerTenantId: string | null;
-    servicePrincipalName: string | null;
-    servicePrincipalObjectId: string | null;
-    servicePrincipalType: servicePrincipalType | null;
-    tenantId: string | null;
+  /**
+   * Audit data for Microsoft Stream events.
+   */
+  @open
+  @complex model microsoftStreamAuditRecord extends auditData {
   }
 
-  @complex model singlePropertySchema {
-    name: string | null;
-    type: string | null;
+  /**
+   * Audit data for Microsoft Teams Admin events.
+   */
+  @open
+  @complex model microsoftTeamsAdminAuditRecord extends auditData {
   }
 
-  @complex model sslCertificateEntity {
-    address: reference.`microsoft.graph`.physicalAddress | null;
-    alternateNames: string[] | null;
-    commonName: string | null;
-    email: string | null;
-    givenName: string | null;
-    organizationName: string | null;
-    organizationUnitName: string | null;
-    serialNumber: string | null;
-    surname: string | null;
+  /**
+   * Audit data for Microsoft Teams Analytics events.
+   */
+  @open
+  @complex model microsoftTeamsAnalyticsAuditRecord extends auditData {
   }
 
-  @complex model stream {
-    name: string | null;
+  /**
+   * Audit data for Microsoft Teams events.
+   */
+  @open
+  @complex model microsoftTeamsAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Microsoft Teams Device events.
+   */
   @open
-  @complex model stringValueDictionary {
+  @complex model microsoftTeamsDeviceAuditRecord extends auditData {
   }
 
-  @complex model submissionMailEvidence extends alertEvidence {
-    networkMessageId: string | null;
-    recipient: string | null;
-    reportType: string | null;
-    sender: string | null;
-    senderIp: string | null;
-    subject: string | null;
-    submissionDateTime: offsetDateTime | null;
-    submissionId: string | null;
-    submitter: string | null;
+  /**
+   * Audit data for Microsoft Teams Retention Label Action events.
+   */
+  @open
+  @complex model microsoftTeamsRetentionLabelActionAuditRecord extends auditData {
   }
 
-  @complex model teamsMessageEvidence extends alertEvidence {
-    campaignId: string | null;
-    channelId: string | null;
-    deliveryAction: teamsMessageDeliveryAction | null;
-    deliveryLocation: teamsDeliveryLocation | null;
-    files: fileEvidence[] | null;
-    groupId: string | null;
-    isExternal: boolean | null;
-    isOwned: boolean | null;
-    @computed lastModifiedDateTime: offsetDateTime | null;
-    messageDirection: antispamTeamsDirection | null;
-    messageId: string | null;
-    owningTenantId: guid | null;
-    parentMessageId: string | null;
-    receivedDateTime: offsetDateTime | null;
-    recipients: string[] | null;
-    senderFromAddress: string | null;
-    senderIP: string | null;
-    sourceAppName: string | null;
-    sourceId: string | null;
-    subject: string | null;
-    suspiciousRecipients: string[] | null;
-    threadId: string | null;
-    threadType: string | null;
-    urls: urlEvidence[] | null;
+  /**
+   * Audit data for Microsoft Teams Sensitivity Label Action events.
+   */
+  @open
+  @complex model microsoftTeamsSensitivityLabelActionAuditRecord extends auditData {
   }
 
-  @complex model topicModelingSettings {
-    dynamicallyAdjustTopicCount: boolean | null;
-    ignoreNumbers: boolean | null;
-    isEnabled: boolean | null;
-    topicCount: int32 | null;
+  /**
+   * Audit data for Microsoft Teams Shifts events.
+   */
+  @open
+  @complex model microsoftTeamsShiftsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Microsoft Teams User Concern events.
+   */
+  @open
+  @complex model microsoftTeamsUserConcernAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label Exchange Item events.
+   */
+  @open
+  @complex model mipAutoLabelExchangeItemAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label Progress Feedback events.
+   */
+  @open
+  @complex model mipAutoLabelProgressFeedbackAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label SharePoint Item events.
+   */
+  @open
+  @complex model mipAutoLabelSharePointItemAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label SharePoint Policy Location events.
+   */
+  @open
+  @complex model mipAutoLabelSharePointPolicyLocationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label Simulation SharePoint Completion events.
+   */
+  @open
+  @complex model mipAutoLabelSimulationSharePointCompletionRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label Simulation SharePoint Progress events.
+   */
+  @open
+  @complex model mipAutoLabelSimulationSharePointProgressRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Auto Label Simulation Statistics events.
+   */
+  @open
+  @complex model mipAutoLabelSimulationStatisticsRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Exact Data Match events.
+   */
+  @open
+  @complex model mipExactDataMatchAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Label Analytics events.
+   */
+  @open
+  @complex model mipLabelAnalyticsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MIP Label events.
+   */
+  @open
+  @complex model mipLabelAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MOS Agent Info events.
+   */
+  @open
+  @complex model mosAgentInfoRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MOS Agent Info V2 events.
+   */
+  @open
+  @complex model mosAgentInfoRecordV2 extends auditData {
+  }
+
+  /**
+   * Audit data for MS365D Custom Detection events.
+   */
+  @open
+  @complex model ms365dCustomDetectionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MS365D Incident events.
+   */
+  @open
+  @complex model ms365dIncidentAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MS365D Suppression Rule events.
+   */
+  @open
+  @complex model ms365dSuppressionRuleAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSDE Custom Collection events.
+   */
+  @open
+  @complex model msdeCustomCollectionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSDE General Settings events.
+   */
+  @open
+  @complex model msdeGeneralSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSDE Indicators Settings events.
+   */
+  @open
+  @complex model msdeIndicatorsSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSDE Response Actions events.
+   */
+  @open
+  @complex model msdeResponseActionsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSDE Roles Settings events.
+   */
+  @open
+  @complex model msdeRolesSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSP Vector Search Content Metadata events.
+   */
+  @open
+  @complex model mspVectorSearchContentMetadataAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for MSTIC Nation State Notification events.
+   */
+  @open
+  @complex model msticNationStateNotificationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Multi Stage Disposition events.
+   */
+  @open
+  @complex model multiStageDispositionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for My Analytics Settings events.
+   */
+  @open
+  @complex model myAnalyticsSettingsAuditRecord extends auditData {
+  }
+
+  @complex model networkConnectionEvidence extends alertEvidence {
+    destinationAddress: ipEvidence | null;
+    destinationPort: int32 | null;
+    protocol: protocolType | null;
+    sourceAddress: ipEvidence | null;
+    sourcePort: int32 | null;
+  }
+
+  @complex model nicEvidence extends alertEvidence {
+    ipAddress: ipEvidence | null;
+    macAddress: string | null;
+    vlans: string[] | null;
+  }
+
+  /**
+   * Audit data for Noisy Alert Policy events.
+   */
+  @open
+  @complex model noisyAlertPolicyAuditRecord extends auditData {
+  }
+
+  @complex model oauthApplicationEvidence extends alertEvidence {
+    appId: string | null;
+    displayName: string | null;
+    objectId: string | null;
+    publisher: string | null;
+  }
+
+  @complex model ocrSettings {
+    isEnabled: boolean | null;
+    maxImageSize: int32 | null;
+    timeout: duration | null;
+  }
+
+  /**
+   * Audit data for Office Native events.
+   */
+  @open
+  @complex model officeNativeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for OME Portal events.
+   */
+  @open
+  @complex model omePortalAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for On Demand SharePoint Classification events.
+   */
+  @open
+  @complex model onDemandSharePointClassificationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for OneDrive events.
+   */
+  @open
+  @complex model oneDriveAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for On Premises File Share Scanner DLP events.
+   */
+  @open
+  @complex model onPremisesFileShareScannerDLPAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for On Premises SharePoint Scanner DLP events.
+   */
+  @open
+  @complex model onPremisesSharePointScannerDLPAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Organizational Data In M365 events.
+   */
+  @open
+  @complex model organizationalDataInM365AuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Outlook Copilot Automation events.
+   */
+  @open
+  @complex model outlookCopilotAutomationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for OWA Get Access Token For Resource events.
+   */
+  @open
+  @complex model owaGetAccessTokenForResourceAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for P4AI Assessment Category events.
+   */
+  @open
+  @complex model p4aiAssessmentCategoryRecord extends auditData {
+  }
+
+  /**
+   * Audit data for P4AI Assessment Fabric Scanner events.
+   */
+  @open
+  @complex model p4aiAssessmentFabricScannerRecord extends auditData {
+  }
+
+  /**
+   * Audit data for P4AI Assessment Location Result events.
+   */
+  @open
+  @complex model p4aiAssessmentLocationResultRecord extends auditData {
+  }
+
+  /**
+   * Audit data for P4AI Assessment events.
+   */
+  @open
+  @complex model p4aiAssessmentRecord extends auditData {
+  }
+
+  /**
+   * Audit data for P4 AI Risk Score events.
+   */
+  @open
+  @complex model p4AIRiskScoreRecord extends auditData {
+  }
+
+  /**
+   * Audit data for People Admin Settings events.
+   */
+  @open
+  @complex model peopleAdminSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Physical Badging Signal events.
+   */
+  @open
+  @complex model physicalBadgingSignalAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Places Directory events.
+   */
+  @open
+  @complex model placesDirectoryAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Chat Message events.
+   */
+  @open
+  @complex model plannerChatMessageAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Chat Message List events.
+   */
+  @open
+  @complex model plannerChatMessageListAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Copy Plan events.
+   */
+  @open
+  @complex model plannerCopyPlanAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Goal events.
+   */
+  @open
+  @complex model plannerGoalAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Goal List events.
+   */
+  @open
+  @complex model plannerGoalListAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Plan events.
+   */
+  @open
+  @complex model plannerPlanAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Plan List events.
+   */
+  @open
+  @complex model plannerPlanListAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Plan Sensitivity Label events.
+   */
+  @open
+  @complex model plannerPlanSensitivityLabelAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Roster events.
+   */
+  @open
+  @complex model plannerRosterAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Roster Sensitivity Label events.
+   */
+  @open
+  @complex model plannerRosterSensitivityLabelAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Task events.
+   */
+  @open
+  @complex model plannerTaskAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Task List events.
+   */
+  @open
+  @complex model plannerTaskListAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Planner Tenant Settings events.
+   */
+  @open
+  @complex model plannerTenantSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Policy Config Change events.
+   */
+  @open
+  @complex model policyConfigChangeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for PowerApps Audit App events.
+   */
+  @open
+  @complex model powerAppsAuditAppRecord extends auditData {
+  }
+
+  /**
+   * Audit data for PowerApps Audit Plan events.
+   */
+  @open
+  @complex model powerAppsAuditPlanRecord extends auditData {
+  }
+
+  /**
+   * Audit data for PowerApps Audit Resource events.
+   */
+  @open
+  @complex model powerAppsAuditResourceRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power BI events.
+   */
+  @open
+  @complex model powerBIAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power BI DLP events.
+   */
+  @open
+  @complex model powerBIDlpAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Pages Site events.
+   */
+  @open
+  @complex model powerPagesSiteAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Admin DLP events.
+   */
+  @open
+  @complex model powerPlatformAdminDlpAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Admin Environment events.
+   */
+  @open
+  @complex model powerPlatformAdminEnvironmentAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Administrator Activity events.
+   */
+  @open
+  @complex model powerPlatformAdministratorActivityRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Lockbox Resource Access Request events.
+   */
+  @open
+  @complex model powerPlatformLockboxResourceAccessRequestAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Lockbox Resource Command events.
+   */
+  @open
+  @complex model powerPlatformLockboxResourceCommandAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Service Activity events.
+   */
+  @open
+  @complex model powerPlatformServiceActivityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Power Platform Tenant Isolation events.
+   */
+  @open
+  @complex model powerPlatformTenantIsolationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Data Match events.
+   */
+  @open
+  @complex model privacyDataMatchAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Data Minimization events.
+   */
+  @open
+  @complex model privacyDataMinimizationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Digest Email events.
+   */
+  @open
+  @complex model privacyDigestEmailRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Open Access events.
+   */
+  @open
+  @complex model privacyOpenAccessAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Portal events.
+   */
+  @open
+  @complex model privacyPortalAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Remediation Action events.
+   */
+  @open
+  @complex model privacyRemediationActionRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Privacy Remediation events.
+   */
+  @open
+  @complex model privacyRemediationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Priva Privacy Assessment Operation events.
+   */
+  @open
+  @complex model privaPrivacyAssessmentOperationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Priva Privacy Consent Operation events.
+   */
+  @open
+  @complex model privaPrivacyConsentOperationRecord extends auditData {
+  }
+
+  @complex model processEvidence extends alertEvidence {
+    detectionStatus: detectionStatus | null;
+    imageFile: fileDetails | null;
+    mdeDeviceId: string | null;
+    parentProcessCreationDateTime: offsetDateTime | null;
+    parentProcessId: int64 | null;
+    parentProcessImageFile: fileDetails | null;
+    processCommandLine: string | null;
+    processCreationDateTime: offsetDateTime | null;
+    processId: int64 | null;
+    userAccount: userAccount | null;
+  }
+
+  /**
+   * Audit data for Microsoft Project events.
+   */
+  @open
+  @complex model projectAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Assigned To Me Settings events.
+   */
+  @open
+  @complex model projectForTheWebAssignedToMeSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Project events.
+   */
+  @open
+  @complex model projectForTheWebProjectAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Project Settings events.
+   */
+  @open
+  @complex model projectForTheWebProjectSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Roadmap events.
+   */
+  @open
+  @complex model projectForTheWebRoadmapAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Roadmap Item events.
+   */
+  @open
+  @complex model projectForTheWebRoadmapItemAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Roadmap Settings events.
+   */
+  @open
+  @complex model projectForTheWebRoadmapSettingsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Project for the Web Task events.
+   */
+  @open
+  @complex model projectForTheWebTaskAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Exchange public folder events.
+   */
+  @open
+  @complex model publicFolderAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Purview Insider Risk Alerts events.
+   */
+  @open
+  @complex model purviewInsiderRiskAlertsRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Purview Insider Risk Cases events.
+   */
+  @open
+  @complex model purviewInsiderRiskCasesRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Purview MC Recommendation events.
+   */
+  @open
+  @complex model purviewMCRecommendationRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Purview Posture Agent events.
+   */
+  @open
+  @complex model purviewPostureAgentAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for quarantine events.
+   */
+  @open
+  @complex model quarantineAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Records Management events.
+   */
+  @open
+  @complex model recordsManagementAuditRecord extends auditData {
+  }
+
+  @complex model redundancyDetectionSettings {
+    isEnabled: boolean | null;
+    maxWords: int32 | null;
+    minWords: int32 | null;
+    similarityThreshold: int32 | null;
+  }
+
+  @complex model registryKeyEvidence extends alertEvidence {
+    registryHive: string | null;
+    registryKey: string | null;
+  }
+
+  @complex model registryValueEvidence extends alertEvidence {
+    mdeDeviceId: string | null;
+    registryHive: string | null;
+    registryKey: string | null;
+    registryValue: string | null;
+    registryValueName: string | null;
+    registryValueType: string | null;
+  }
+
+  @complex model reportFileMetadata {
+    downloadUrl: string | null;
+    fileName: string | null;
+    size: int64 | null;
+  }
+
+  /**
+   * Audit data for Report Submission events.
+   */
+  @open
+  @complex model reportSubmission extends auditData {
+  }
+
+  /**
+   * Audit data for Report Submission Result Detail events.
+   */
+  @open
+  @complex model reportSubmissionResultDetail extends auditData {
+  }
+
+  @complex model resourceAccessEvent {
+    accessDateTime: offsetDateTime | null;
+    accountId: string | null;
+    ipAddress: string | null;
+    resourceIdentifier: string | null;
+  }
+
+  /**
+   * Audit data for Restricted Mode events.
+   */
+  @open
+  @complex model restrictedModeAuditRecord extends auditData {
+  }
+
+  @abstract
+  @complex model retentionDuration {
+  }
+
+  @complex model retentionDurationForever extends retentionDuration {
+  }
+
+  @complex model retentionDurationInDays extends retentionDuration {
+    days: int32 | null;
+  }
+
+  @complex model retentionEventStatus {
+    error: reference.`microsoft.graph`.publicError | null;
+    status: eventStatusType | null;
+  }
+
+  /**
+   * Audit data for Retention Policy events.
+   */
+  @open
+  @complex model retentionPolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for RTI Operations Agent events.
+   */
+  @open
+  @complex model rtiOperationsAgentAuditRecord extends auditData {
+  }
+
+  @complex model sasTokenEvidence extends alertEvidence {
+    allowedIpAddresses: string | null;
+    allowedResourceTypes: string[] | null;
+    allowedServices: string[] | null;
+    expiryDateTime: offsetDateTime | null;
+    permissions: string[] | null;
+    protocol: string | null;
+    signatureHash: string | null;
+    signedWith: string | null;
+    startDateTime: offsetDateTime | null;
+    storageResource: azureResourceEvidence | null;
+  }
+
+  /**
+   * Audit data for SBP Configuration Event events.
+   */
+  @open
+  @complex model sbpConfigurationEventRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SBP Usage Event events.
+   */
+  @open
+  @complex model sbpUsageEventRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Secure Score evidence events.
+   */
+  @open
+  @complex model scoreEvidence extends auditData {
+  }
+
+  /**
+   * Audit data for Score Platform Generic events.
+   */
+  @open
+  @complex model scorePlatformGenericAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Script Run events.
+   */
+  @open
+  @complex model scriptRunAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for search events.
+   */
+  @open
+  @complex model searchAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Compliance Alert events.
+   */
+  @open
+  @complex model securityComplianceAlertRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Compliance Center EOP cmdlet events.
+   */
+  @open
+  @complex model securityComplianceCenterEOPCmdletAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Compliance Insights events.
+   */
+  @open
+  @complex model securityComplianceInsightsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Compliance RBAC events.
+   */
+  @open
+  @complex model securityComplianceRBACAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Compliance User Change events.
+   */
+  @open
+  @complex model securityComplianceUserChangeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Copilot Identity Management events.
+   */
+  @open
+  @complex model securityCopilotIdentityManagementAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Development Lifecycle AI Log events.
+   */
+  @open
+  @complex model securityDevelopmentLifecycleAILogAuditRecord extends auditData {
+  }
+
+  @complex model securityGroupEvidence extends alertEvidence {
+    activeDirectoryObjectGuid: guid | null;
+    displayName: string | null;
+    distinguishedName: string | null;
+    friendlyName: string | null;
+    securityGroupId: string | null;
+    sid: string | null;
+  }
+
+  /**
+   * Audit data for Sensitive Info Remediation Agent events.
+   */
+  @open
+  @complex model sensitiveInfoRemediationAgentDataRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sensitivity Label Action events.
+   */
+  @open
+  @complex model sensitivityLabelActionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sensitivity Labeled File Action events.
+   */
+  @open
+  @complex model sensitivityLabeledFileActionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sensitivity Label Policy Match events.
+   */
+  @open
+  @complex model sensitivityLabelPolicyMatchAuditRecord extends auditData {
+  }
+
+  @complex model sensorDeploymentPackage {
+    downloadUrl: string;
+    version: string;
+  }
+
+  @complex model sensorSettings {
+    description: string;
+    domainControllerDnsNames: string[] | null;
+    isDelayedDeploymentEnabled: boolean | null;
+    @contains networkAdapters: networkAdapter[];
+  }
+
+  /**
+   * Audit data for Sentinel AI Tool events.
+   */
+  @open
+  @complex model sentinelAIToolAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Graph events.
+   */
+  @open
+  @complex model sentinelGraphAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Job events.
+   */
+  @open
+  @complex model sentinelJobAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel KQL On Lake events.
+   */
+  @open
+  @complex model sentinelKQLOnLakeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Lake Data Onboarding events.
+   */
+  @open
+  @complex model sentinelLakeDataOnboardingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Lake Encryption events.
+   */
+  @open
+  @complex model sentinelLakeEncryptionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Lake Onboarding events.
+   */
+  @open
+  @complex model sentinelLakeOnboardingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Notebook On Lake events.
+   */
+  @open
+  @complex model sentinelNotebookOnLakeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sentinel Package events.
+   */
+  @open
+  @complex model sentinelPackageAuditRecord extends auditData {
+  }
+
+  @complex model servicePrincipalEvidence extends alertEvidence {
+    appId: string | null;
+    appOwnerTenantId: string | null;
+    servicePrincipalName: string | null;
+    servicePrincipalObjectId: string | null;
+    servicePrincipalType: servicePrincipalType | null;
+    tenantId: string | null;
+  }
+
+  /**
+   * Audit data for SharePoint App Permission Operation events.
+   */
+  @open
+  @complex model sharePointAppPermissionOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint events.
+   */
+  @open
+  @complex model sharePointAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint Comment Operation events.
+   */
+  @open
+  @complex model sharePointCommentOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint Content Security Policy events.
+   */
+  @open
+  @complex model sharePointContentSecurityPolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint Content Type Operation events.
+   */
+  @open
+  @complex model sharePointContentTypeOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint E Signature events.
+   */
+  @open
+  @complex model sharePointESignatureAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint Field Operation events.
+   */
+  @open
+  @complex model sharePointFieldOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint File Operation events.
+   */
+  @open
+  @complex model sharePointFileOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint List Item Operation events.
+   */
+  @open
+  @complex model sharePointListItemOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint List Operation events.
+   */
+  @open
+  @complex model sharePointListOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for SharePoint Sharing Operation events.
+   */
+  @open
+  @complex model sharePointSharingOperationAuditRecord extends auditData {
+  }
+
+  @complex model singlePropertySchema {
+    name: string | null;
+    type: string | null;
+  }
+
+  /**
+   * Audit data for Skype for Business cmdlets events.
+   */
+  @open
+  @complex model skypeForBusinessCmdletsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Skype for Business PSTN Usage events.
+   */
+  @open
+  @complex model skypeForBusinessPSTNUsageAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Skype for Business Users Blocked events.
+   */
+  @open
+  @complex model skypeForBusinessUsersBlockedAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar Detonation Content Meta events.
+   */
+  @open
+  @complex model sonarDetonationContentMetadata extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar Detonation Entity events.
+   */
+  @open
+  @complex model sonarDetonationEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar File Detonation Entity events.
+   */
+  @open
+  @complex model sonarFileDetonationEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar Submission Entity events.
+   */
+  @open
+  @complex model sonarSubmissionEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar URL Detonation Entity events.
+   */
+  @open
+  @complex model sonarUrlDetonationEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Spark Core Custom Live Pool events.
+   */
+  @open
+  @complex model sparkCoreCustomLivePoolRecord extends auditData {
+  }
+
+  @complex model sslCertificateEntity {
+    address: reference.`microsoft.graph`.physicalAddress | null;
+    alternateNames: string[] | null;
+    commonName: string | null;
+    email: string | null;
+    givenName: string | null;
+    organizationName: string | null;
+    organizationUnitName: string | null;
+    serialNumber: string | null;
+    surname: string | null;
+  }
+
+  @complex model stream {
+    name: string | null;
+  }
+
+  @open
+  @complex model stringValueDictionary {
+  }
+
+  /**
+   * Audit data for Submission Entity events.
+   */
+  @open
+  @complex model submissionEntityAuditRecord extends auditData {
+  }
+
+  @complex model submissionMailEvidence extends alertEvidence {
+    networkMessageId: string | null;
+    recipient: string | null;
+    reportType: string | null;
+    sender: string | null;
+    senderIp: string | null;
+    subject: string | null;
+    submissionDateTime: offsetDateTime | null;
+    submissionId: string | null;
+    submitter: string | null;
+  }
+
+  /**
+   * Audit data for Supervisory Review Day X Insights events.
+   */
+  @open
+  @complex model supervisoryReviewDayXInsightsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Synthetic Probe events.
+   */
+  @open
+  @complex model syntheticProbeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Team Copilot Interaction events.
+   */
+  @open
+  @complex model teamCopilotInteractionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Teams Easy Approvals events.
+   */
+  @open
+  @complex model teamsEasyApprovalsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Teams Eval Data Hub Admin Operation events.
+   */
+  @open
+  @complex model teamsEvalDataHubAdminOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Teams Eval Data Hub Data Access events.
+   */
+  @open
+  @complex model teamsEvalDataHubDataAccessAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Teams Eval Data Hub Permission Change events.
+   */
+  @open
+  @complex model teamsEvalDataHubPermissionChangeAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Teams Healthcare events.
+   */
+  @open
+  @complex model teamsHealthcareAuditRecord extends auditData {
+  }
+
+  @complex model teamsMessageEvidence extends alertEvidence {
+    campaignId: string | null;
+    channelId: string | null;
+    deliveryAction: teamsMessageDeliveryAction | null;
+    deliveryLocation: teamsDeliveryLocation | null;
+    files: fileEvidence[] | null;
+    groupId: string | null;
+    isExternal: boolean | null;
+    isOwned: boolean | null;
+    @computed lastModifiedDateTime: offsetDateTime | null;
+    messageDirection: antispamTeamsDirection | null;
+    messageId: string | null;
+    owningTenantId: guid | null;
+    parentMessageId: string | null;
+    receivedDateTime: offsetDateTime | null;
+    recipients: string[] | null;
+    senderFromAddress: string | null;
+    senderIP: string | null;
+    sourceAppName: string | null;
+    sourceId: string | null;
+    subject: string | null;
+    suspiciousRecipients: string[] | null;
+    threadId: string | null;
+    threadType: string | null;
+    urls: urlEvidence[] | null;
+  }
+
+  /**
+   * Audit data for Teams Updates events.
+   */
+  @open
+  @complex model teamsUpdatesAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Tenant Allow Block List events.
+   */
+  @open
+  @complex model tenantAllowBlockListAuditRecord extends auditData {
+  }
+
+  @complex model threatDetectionDetail {
+    confidenceLevel: string | null;
+    priorityAccountProtection: string | null;
+    threats: string | null;
+  }
+
+  /**
+   * Audit data for Threat Finder events.
+   */
+  @open
+  @complex model threatFinderAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Threat Intelligence Atp Content events.
+   */
+  @open
+  @complex model threatIntelligenceAtpContentData extends auditData {
+  }
+
+  /**
+   * Audit data for Threat Intelligence Export events.
+   */
+  @open
+  @complex model threatIntelligenceExportAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Threat Intelligence Mail events.
+   */
+  @open
+  @complex model threatIntelligenceMailData extends auditData {
+  }
+
+  /**
+   * Audit data for Threat Intelligence Object events.
+   */
+  @open
+  @complex model threatIntelligenceObjectAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Threat Intelligence Url Click events.
+   */
+  @open
+  @complex model threatIntelligenceUrlClickData extends auditData {
+  }
+
+  @complex model timelineEvent {
+    eventDateTime: offsetDateTime | null;
+    eventDetails: string | null;
+    eventResult: string | null;
+    eventSource: eventSource | null;
+    eventThreats: string[] | null;
+    eventType: timelineEventType | null;
+  }
+
+  /**
+   * Audit data for Microsoft To Do events.
+   */
+  @open
+  @complex model todoAuditRecord extends auditData {
+  }
+
+  @complex model topicModelingSettings {
+    dynamicallyAdjustTopicCount: boolean | null;
+    ignoreNumbers: boolean | null;
+    isEnabled: boolean | null;
+    topicCount: int32 | null;
+  }
+
+  /**
+   * Audit data for Trainable Classifier events.
+   */
+  @open
+  @complex model trainableClassifierAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for UAM Operation events.
+   */
+  @open
+  @complex model uamOperationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Unified Group events.
+   */
+  @open
+  @complex model unifiedGroupAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Unified Simulation Matched Item events.
+   */
+  @open
+  @complex model unifiedSimulationMatchedItemAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Unified Simulation Summary events.
+   */
+  @open
+  @complex model unifiedSimulationSummaryAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Universal Print Management events.
+   */
+  @open
+  @complex model universalPrintManagementAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Universal Print Print Job events.
+   */
+  @open
+  @complex model universalPrintPrintJobAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for URBAC Assignment events.
+   */
+  @open
+  @complex model urbacAssignmentAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for URBAC Enable State events.
+   */
+  @open
+  @complex model urbacEnableStateAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for URBAC Role events.
+   */
+  @open
+  @complex model urbacRoleAuditRecord extends auditData {
   }
 
   @complex model urlEvidence extends alertEvidence {
@@ -38120,6 +41191,209 @@ namespace reference.`microsoft.graph.security` {
     userAccount: userAccount | null;
   }
 
+  /**
+   * Audit data for User Training events.
+   */
+  @open
+  @complex model userTrainingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for USX Workspace Onboarding events.
+   */
+  @open
+  @complex model usxWorkspaceOnboardingAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for VFAM Create Policy events.
+   */
+  @open
+  @complex model vfamCreatePolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for VFAM Delete Policy events.
+   */
+  @open
+  @complex model vfamDeletePolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for VFAM Update Policy events.
+   */
+  @open
+  @complex model vfamUpdatePolicyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Amplify events.
+   */
+  @open
+  @complex model vivaAmplifyAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Engage Events events.
+   */
+  @open
+  @complex model vivaEngageEventsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Engage Network Association events.
+   */
+  @open
+  @complex model vivaEngageNetworkAssociationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Engage Segment events.
+   */
+  @open
+  @complex model vivaEngageSegmentAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint Advanced Configuration events.
+   */
+  @open
+  @complex model vivaGlintAdvancedConfigurationAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint Agentic Campaign events.
+   */
+  @open
+  @complex model vivaGlintAgenticCampaignAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint Feedback Program events.
+   */
+  @open
+  @complex model vivaGlintFeedbackProgramAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint Organizational events.
+   */
+  @open
+  @complex model vivaGlintOrganizationalDataAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint Pulse Program events.
+   */
+  @open
+  @complex model vivaGlintPulseProgramAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint Pulse Program Respondent Rate events.
+   */
+  @open
+  @complex model vivaGlintPulseProgramRespondentRateAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint Question events.
+   */
+  @open
+  @complex model vivaGlintQuestionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint Role events.
+   */
+  @open
+  @complex model vivaGlintRoleAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint Rubicon events.
+   */
+  @open
+  @complex model vivaGlintRubiconAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint Support Access events.
+   */
+  @open
+  @complex model vivaGlintSupportAccessAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint System events.
+   */
+  @open
+  @complex model vivaGlintSystemAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint User events.
+   */
+  @open
+  @complex model vivaGlintUserAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Glint User Group events.
+   */
+  @open
+  @complex model vivaGlintUserGroupAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Goals events.
+   */
+  @open
+  @complex model vivaGoalsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Learning Admin events.
+   */
+  @open
+  @complex model vivaLearningAdminAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Learning events.
+   */
+  @open
+  @complex model vivaLearningAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Pulse Admin events.
+   */
+  @open
+  @complex model vivaPulseAdminAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Pulse Organizer events.
+   */
+  @open
+  @complex model vivaPulseOrganizerAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Pulse Report events.
+   */
+  @open
+  @complex model vivaPulseReportAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Viva Pulse Response events.
+   */
+  @open
+  @complex model vivaPulseResponseAuditRecord extends auditData {
+  }
+
   @complex model vmMetadata {
     cloudProvider: vmCloudProvider;
     resourceId: string | null;
@@ -38127,6 +41401,20 @@ namespace reference.`microsoft.graph.security` {
     vmId: string | null;
   }
 
+  /**
+   * Audit data for WDATP Alerts events.
+   */
+  @open
+  @complex model wdatpAlertsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Web Content Filtering events.
+   */
+  @open
+  @complex model webContentFilteringAuditRecord extends auditData {
+  }
+
   @complex model whoisContact {
     address: reference.`microsoft.graph`.physicalAddress | null;
     email: string | null;
@@ -38142,6 +41430,34 @@ namespace reference.`microsoft.graph.security` {
     @references host: host;
   }
 
+  /**
+   * Audit data for Windows365 Customer Lockbox events.
+   */
+  @open
+  @complex model windows365CustomerLockboxAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Workplace Analytics events.
+   */
+  @open
+  @complex model workplaceAnalyticsAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Yammer events.
+   */
+  @open
+  @complex model yammerAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Yammer User Hiding events.
+   */
+  @open
+  @complex model yammerUserHidingAuditRecord extends auditData {
+  }
+
   @entity model alert extends reference.`microsoft.graph`.entity {
     actorDisplayName: string | null;
     additionalData: dictionary | null;
@@ -38182,6 +41498,46 @@ namespace reference.`microsoft.graph.security` {
     title: string | null;
   }
 
+  @entity model analyzedEmail extends reference.`microsoft.graph`.entity {
+    alertIds: string[] | null;
+    attachments: analyzedEmailAttachment[] | null;
+    authenticationDetails: analyzedEmailAuthenticationDetail | null;
+    bulkComplaintLevel: string | null;
+    clientType: string | null;
+    contexts: string[] | null;
+    detectionMethods: string[] | null;
+    directionality: antispamDirectionality | null;
+    distributionList: string | null;
+    dlpRules: analyzedEmailDlpRuleInfo[] | null;
+    emailClusterId: string | null;
+    exchangeTransportRules: analyzedEmailExchangeTransportRuleInfo[] | null;
+    forwardingDetail: string | null;
+    inboundConnectorFormattedName: string | null;
+    internetMessageId: string | null;
+    language: string | null;
+    latestDelivery: analyzedEmailDeliveryDetail | null;
+    loggedDateTime: offsetDateTime | null;
+    networkMessageId: string | null;
+    originalDelivery: analyzedEmailDeliveryDetail | null;
+    overrideSources: string[] | null;
+    phishConfidenceLevel: string | null;
+    policy: string | null;
+    policyAction: string | null;
+    policyType: string | null;
+    primaryOverrideSource: string | null;
+    recipientDetail: analyzedEmailRecipientDetail | null;
+    recipientEmailAddress: string | null;
+    returnPath: string | null;
+    senderDetail: analyzedEmailSenderDetail | null;
+    sizeInBytes: int32 | null;
+    spamConfidenceLevel: string | null;
+    subject: string | null;
+    threatDetectionDetails: threatDetectionDetail[] | null;
+    threatTypes: threatType[] | null;
+    timelineEvents: timelineEvent[] | null;
+    urls: analyzedEmailUrl[] | null;
+  }
+
   @entity model article extends reference.`microsoft.graph`.entity {
     body: formattedContent;
     @computed createdDateTime: offsetDateTime;
@@ -38201,6 +41557,50 @@ namespace reference.`microsoft.graph.security` {
   @entity model artifact extends reference.`microsoft.graph`.entity {
   }
 
+  /**
+   * Root entity for the audit log API.
+   */
+  @entity model auditCoreRoot extends reference.`microsoft.graph`.entity {
+    @contains queries: auditLogQuery[];
+  }
+
+  /**
+   * Represents a query against the unified audit log.
+   */
+  @entity model auditLogQuery extends reference.`microsoft.graph`.entity {
+    administrativeUnitIdFilters: string[] | null;
+    displayName: string | null;
+    filterEndDateTime: offsetDateTime | null;
+    filterStartDateTime: offsetDateTime | null;
+    ipAddressFilters: string[] | null;
+    keywordFilter: string | null;
+    objectIdFilters: string[] | null;
+    operationFilters: string[] | null;
+    recordTypeFilters: auditLogRecordType[] | null;
+    serviceFilters: string[] | null;
+    status: auditLogQueryStatus | null;
+    userPrincipalNameFilters: string[] | null;
+    @contains records: auditLogRecord[];
+  }
+
+  /**
+   * Represents an individual audit log record.
+   */
+  @entity model auditLogRecord extends reference.`microsoft.graph`.entity {
+    administrativeUnits: string[] | null;
+    auditData: auditData | null;
+    auditLogRecordType: auditLogRecordType | null;
+    clientIp: string | null;
+    @computed createdDateTime: offsetDateTime | null;
+    objectId: string | null;
+    operation: string | null;
+    organizationId: string | null;
+    service: string | null;
+    userId: string | null;
+    userPrincipalName: string | null;
+    userType: auditLogUserType | null;
+  }
+
   @entity model authorityTemplate extends filePlanDescriptorTemplate {
   }
 
@@ -38241,6 +41641,11 @@ namespace reference.`microsoft.graph.security` {
     citationUrl: string | null;
   }
 
+  @abstract
+  @entity model collaborationRoot extends reference.`microsoft.graph`.entity {
+    @contains analyzedEmails: analyzedEmail[];
+  }
+
   @abstract
   @entity model dataSet extends reference.`microsoft.graph`.entity {
     createdBy: reference.`microsoft.graph`.identitySet | null;
@@ -38870,6 +42275,7 @@ namespace reference.`microsoft.graph.security` {
     messageConversationExpansion: 64,
     locationsWithoutHits: 256,
     allItemsInFolder: 512,
+    cloudNativeHtmlConversion: 1024,
   }
 
   @graphFlags
@@ -38943,6 +42349,14 @@ namespace reference.`microsoft.graph.security` {
     unknownFutureValue: 31,
   }
 
+  enum antispamDirectionality {
+    `unknown`: 0,
+    inbound: 1,
+    outbound: 2,
+    intraOrg: 3,
+    unknownFutureValue: 127,
+  }
+
   enum antispamTeamsDirection {
     `unknown`: 0,
     inbound: 1,
@@ -38951,6 +42365,514 @@ namespace reference.`microsoft.graph.security` {
     unknownFutureValue: 31,
   }
 
+  /**
+   * Status of an audit log query.
+   */
+  enum auditLogQueryStatus {
+    notStarted: 0,
+    running: 1,
+    succeeded: 2,
+    failed: 3,
+    cancelled: 4,
+    unknownFutureValue: 5,
+  }
+
+  /**
+   * Specifies the type of audit log record.
+   */
+  enum auditLogRecordType {
+    ExchangeAdmin: 1,
+    ExchangeItem: 2,
+    ExchangeItemGroup: 3,
+    SharePoint: 4,
+    SyntheticProbe: 5,
+    SharePointFileOperation: 6,
+    OneDrive: 7,
+    AzureActiveDirectory: 8,
+    AzureActiveDirectoryAccountLogon: 9,
+    DataCenterSecurityCmdlet: 10,
+    ComplianceDLPSharePoint: 11,
+    Sway: 12,
+    ComplianceDLPExchange: 13,
+    SharePointSharingOperation: 14,
+    AzureActiveDirectoryStsLogon: 15,
+    SkypeForBusinessPSTNUsage: 16,
+    SkypeForBusinessUsersBlocked: 17,
+    SecurityComplianceCenterEOPCmdlet: 18,
+    ExchangeAggregatedOperation: 19,
+    PowerBIAudit: 20,
+    CRM: 21,
+    Yammer: 22,
+    SkypeForBusinessCmdlets: 23,
+    Discovery: 24,
+    MicrosoftTeams: 25,
+    ThreatIntelligence: 28,
+    MailSubmission: 29,
+    MicrosoftFlow: 30,
+    AeD: 31,
+    MicrosoftStream: 32,
+    ComplianceDLPSharePointClassification: 33,
+    ThreatFinder: 34,
+    Project: 35,
+    SharePointListOperation: 36,
+    SharePointCommentOperation: 37,
+    DataGovernance: 38,
+    Kaizala: 39,
+    SecurityComplianceAlerts: 40,
+    ThreatIntelligenceUrl: 41,
+    SecurityComplianceInsights: 42,
+    MIPLabel: 43,
+    WorkplaceAnalytics: 44,
+    PowerAppsApp: 45,
+    PowerAppsPlan: 46,
+    ThreatIntelligenceAtpContent: 47,
+    LabelContentExplorer: 48,
+    TeamsHealthcare: 49,
+    ExchangeItemAggregated: 50,
+    HygieneEvent: 51,
+    DataInsightsRestApiAudit: 52,
+    InformationBarrierPolicyApplication: 53,
+    SharePointListItemOperation: 54,
+    SharePointContentTypeOperation: 55,
+    SharePointFieldOperation: 56,
+    MicrosoftTeamsAdmin: 57,
+    HRSignal: 58,
+    MicrosoftTeamsDevice: 59,
+    MicrosoftTeamsAnalytics: 60,
+    InformationWorkerProtection: 61,
+    Campaign: 62,
+    DLPEndpoint: 63,
+    AirInvestigation: 64,
+    Quarantine: 65,
+    MicrosoftForms: 66,
+    ApplicationAudit: 67,
+    ComplianceSupervisionExchange: 68,
+    CustomerKeyServiceEncryption: 69,
+    OfficeNative: 70,
+    MipAutoLabelSharePointItem: 71,
+    MipAutoLabelSharePointPolicyLocation: 72,
+    MicrosoftTeamsShifts: 73,
+    SecureScore: 74,
+    MipAutoLabelExchangeItem: 75,
+    CortanaBriefing: 76,
+    Search: 77,
+    WDATPAlerts: 78,
+    PowerPlatformAdminDlp: 79,
+    PowerPlatformAdminEnvironment: 80,
+    MDATPAudit: 81,
+    SensitivityLabelPolicyMatch: 82,
+    SensitivityLabelAction: 83,
+    SensitivityLabeledFileAction: 84,
+    AttackSim: 85,
+    AirManualInvestigation: 86,
+    SecurityComplianceRBAC: 87,
+    UserTraining: 88,
+    AirAdminActionInvestigation: 89,
+    MSTIC: 90,
+    PhysicalBadgingSignal: 91,
+    TeamsEasyApprovals: 92,
+    AipDiscover: 93,
+    AipSensitivityLabelAction: 94,
+    AipProtectionAction: 95,
+    AipFileDeleted: 96,
+    AipHeartBeat: 97,
+    MCASAlerts: 98,
+    OnPremisesFileShareScannerDlp: 99,
+    OnPremisesSharePointScannerDlp: 100,
+    ExchangeSearch: 101,
+    SharePointSearch: 102,
+    PrivacyDataMinimization: 103,
+    LabelAnalyticsAggregate: 104,
+    MyAnalyticsSettings: 105,
+    SecurityComplianceUserChange: 106,
+    ComplianceDLPExchangeClassification: 107,
+    ComplianceDLPEndpoint: 108,
+    MipExactDataMatch: 109,
+    MSDEResponseActions: 110,
+    MSDEGeneralSettings: 111,
+    MSDEIndicatorsSettings: 112,
+    MS365DCustomDetection: 113,
+    MSDERolesSettings: 114,
+    MAPGAlerts: 115,
+    MAPGPolicy: 116,
+    MAPGRemediation: 117,
+    PrivacyRemediationAction: 118,
+    PrivacyDigestEmail: 119,
+    MipAutoLabelSimulationProgress: 120,
+    MipAutoLabelSimulationCompletion: 121,
+    MipAutoLabelProgressFeedback: 122,
+    DlpSensitiveInformationType: 123,
+    MipAutoLabelSimulationStatistics: 124,
+    LargeContentMetadata: 125,
+    Microsoft365Group: 126,
+    CDPMlInferencingResult: 127,
+    FilteringMailMetadata: 128,
+    CDPClassificationMailItem: 129,
+    CDPClassificationDocument: 130,
+    OfficeScriptsRunAction: 131,
+    FilteringPostMailDeliveryAction: 132,
+    CDPUnifiedFeedback: 133,
+    TenantAllowBlockList: 134,
+    ConsumptionResource: 135,
+    HealthcareSignal: 136,
+    DlpImportResult: 138,
+    CDPCompliancePolicyExecution: 139,
+    MultiStageDisposition: 140,
+    PrivacyDataMatch: 141,
+    FilteringDocMetadata: 142,
+    FilteringEmailFeatures: 143,
+    PowerBIDlp: 144,
+    FilteringUrlInfo: 145,
+    FilteringAttachmentInfo: 146,
+    CoreReportingSettings: 147,
+    ComplianceConnector: 148,
+    PowerPlatformLockboxResourceAccessRequest: 149,
+    PowerPlatformLockboxResourceCommand: 150,
+    CDPPredictiveCodingLabel: 151,
+    CDPCompliancePolicyUserFeedback: 152,
+    WebpageActivityEndpoint: 153,
+    OMEPortal: 154,
+    CMImprovementActionChange: 155,
+    FilteringUrlClick: 156,
+    MipLabelAnalyticsAuditRecord: 157,
+    FilteringEntityEvent: 158,
+    FilteringRuleHits: 159,
+    FilteringMailSubmission: 160,
+    LabelExplorer: 161,
+    MicrosoftManagedServicePlatform: 162,
+    PowerPlatformServiceActivity: 163,
+    ScorePlatformGenericAuditRecord: 164,
+    FilteringTimeTravelDocMetadata: 165,
+    Alert: 166,
+    AlertStatus: 167,
+    AlertIncident: 168,
+    IncidentStatus: 169,
+    Case: 170,
+    CaseInvestigation: 171,
+    RecordsManagement: 172,
+    PrivacyRemediation: 173,
+    DataShareOperation: 174,
+    CdpDlpSensitive: 175,
+    EHRConnector: 176,
+    FilteringMailGradingResult: 177,
+    PublicFolder: 178,
+    PrivacyTenantAuditHistoryRecord: 179,
+    AipScannerDiscoverEvent: 180,
+    EduDataLakeDownloadOperation: 181,
+    M365ComplianceConnector: 182,
+    MicrosoftGraphDataConnectOperation: 183,
+    MicrosoftPurview: 184,
+    FilteringEmailContentFeatures: 185,
+    PowerPagesSite: 186,
+    PowerAppsResource: 187,
+    PlannerPlan: 188,
+    PlannerCopyPlan: 189,
+    PlannerTask: 190,
+    PlannerRoster: 191,
+    PlannerPlanList: 192,
+    PlannerTaskList: 193,
+    PlannerTenantSettings: 194,
+    ProjectForTheWebProject: 195,
+    ProjectForTheWebTask: 196,
+    ProjectForTheWebRoadmap: 197,
+    ProjectForTheWebRoadmapItem: 198,
+    ProjectForTheWebProjectSettings: 199,
+    ProjectForTheWebRoadmapSettings: 200,
+    QuarantineMetadata: 201,
+    MicrosoftTodoAudit: 202,
+    TimeTravelFilteringDocMetadata: 203,
+    TeamsQuarantineMetadata: 204,
+    SharePointAppPermissionOperation: 205,
+    MicrosoftTeamsSensitivityLabelAction: 206,
+    FilteringTeamsMetadata: 207,
+    FilteringTeamsUrlInfo: 208,
+    FilteringTeamsPostDeliveryAction: 209,
+    MDCAssessments: 210,
+    MDCRegulatoryComplianceStandards: 211,
+    MDCRegulatoryComplianceControls: 212,
+    MDCRegulatoryComplianceAssessments: 213,
+    MDCSecurityConnectors: 214,
+    MDADataSecuritySignal: 215,
+    VivaGoals: 216,
+    FilteringRuntimeInfo: 217,
+    AttackSimAdmin: 218,
+    MicrosoftGraphDataConnectConsent: 219,
+    FilteringAtpDetonationInfo: 220,
+    PrivacyPortal: 221,
+    ManagedTenants: 222,
+    UnifiedSimulationMatchedItem: 223,
+    UnifiedSimulationSummary: 224,
+    UpdateQuarantineMetadata: 225,
+    MS365DSuppressionRule: 226,
+    PurviewDataMapOperation: 227,
+    FilteringUrlPostClickAction: 228,
+    IrmUserDefinedDetectionSignal: 229,
+    TeamsUpdates: 230,
+    PlannerRosterSensitivityLabel: 231,
+    MS365DIncident: 232,
+    FilteringDelistingMetadata: 233,
+    ComplianceDLPSharePointClassificationExtended: 234,
+    MicrosoftDefenderForIdentityAudit: 235,
+    SupervisoryReviewDayXInsight: 236,
+    DefenderExpertsforXDRAdmin: 237,
+    CDPEdgeBlockedMessage: 238,
+    HostedRpa: 239,
+    CdpContentExplorerAggregateRecord: 240,
+    CDPHygieneAttachmentInfo: 241,
+    CDPHygieneSummary: 242,
+    CDPPostMailDeliveryAction: 243,
+    CDPEmailFeatures: 244,
+    CDPHygieneUrlInfo: 245,
+    CDPUrlClick: 246,
+    CDPPackageManagerHygieneEvent: 247,
+    FilteringDocScan: 248,
+    TimeTravelFilteringDocScan: 249,
+    MAPGOnboard: 250,
+    VfamCreatePolicy: 251,
+    VfamUpdatePolicy: 252,
+    VfamDeletePolicy: 253,
+    M365DAAD: 254,
+    CdpColdCrawlStatus: 255,
+    PowerPlatformAdministratorActivity: 256,
+    Windows365CustomerLockbox: 257,
+    CdpResourceScopeChangeEvent: 258,
+    ComplianceCCExchangeExecutionResult: 259,
+    CdpOcrCostEstimatorRecord: 260,
+    CopilotInteraction: 261,
+    CdpOcrBillingRecord: 262,
+    ComplianceDLPApplications: 263,
+    UAMOperation: 264,
+    VivaLearning: 265,
+    VivaLearningAdmin: 266,
+    PurviewPolicyOperation: 267,
+    PurviewMetadataPolicyOperation: 268,
+    PeopleAdminSettings: 269,
+    CdpComplianceDLPExchangeClassification: 270,
+    CdpComplianceDLPSharePointClassification: 271,
+    FilteringBulkSenderInsightData: 272,
+    FilteringBulkThresholdInsightData: 273,
+    PrivacyOpenAccess: 274,
+    OWAAuth: 275,
+    ComplianceDLPApplicationsClassification: 276,
+    SharePointESignature: 277,
+    Dynamics365BusinessCentral: 278,
+    MeshWorlds: 279,
+    VivaPulseResponse: 280,
+    VivaPulseOrganizer: 281,
+    VivaPulseAdmin: 282,
+    VivaPulseReport: 283,
+    AIAppInteraction: 284,
+    ComplianceDLMExchange: 285,
+    ComplianceDLMSharePoint: 286,
+    ProjectForTheWebAssignedToMeSettings: 287,
+    CPSOperation: 288,
+    ComplianceDLPExchangeDiscovery: 289,
+    PurviewMCRecommendation: 290,
+    ComplianceDLPEndpointDiscovery: 291,
+    InsiderRiskScopedUserInsights: 292,
+    MicrosoftTeamsRetentionLabelAction: 293,
+    AadRiskDetection: 294,
+    AuditSearch: 295,
+    AuditRetentionPolicy: 296,
+    AuditConfig: 297,
+    Microsoft365BackupBackupPolicy: 298,
+    Microsoft365BackupRestoreTask: 299,
+    Microsoft365BackupRestoreItem: 300,
+    Microsoft365BackupBackupItem: 301,
+    URBACAssignment: 302,
+    URBACRole: 303,
+    URBACEnableState: 304,
+    IRMSecurityAlert: 305,
+    PurviewInsiderRiskCases: 306,
+    PurviewInsiderRiskAlerts: 307,
+    InsiderRiskScopedUsers: 308,
+    CdpConsumptionResource: 309,
+    CreateCopilotPlugin: 310,
+    UpdateCopilotPlugin: 311,
+    DeleteCopilotPlugin: 312,
+    EnableCopilotPlugin: 313,
+    DisableCopilotPlugin: 314,
+    CreateCopilotWorkspace: 315,
+    UpdateCopilotWorkspace: 316,
+    DeleteCopilotWorkspace: 317,
+    EnableCopilotWorkspace: 318,
+    DisableCopilotWorkspace: 319,
+    CreateCopilotPromptBook: 320,
+    UpdateCopilotPromptBook: 321,
+    DeleteCopilotPromptBook: 322,
+    EnableCopilotPromptBook: 323,
+    DisableCopilotPromptBook: 324,
+    UpdateCopilotSettings: 325,
+    P4AIAssessmentRecord: 326,
+    P4AIAssessmentLocationResultRecord: 327,
+    ConnectedAIAppInteraction: 328,
+    PrivaPrivacyConsentOperation: 329,
+    PrivaPrivacyAssessmentOperation: 330,
+    DataCatalogAccessRequests: 331,
+    ComplianceSettingsChange: 332,
+    DataSecurityInvestigation: 333,
+    TeamCopilotInteraction: 334,
+    IRMActivityAuditTrail: 335,
+    SharePointContentSecurityPolicy: 336,
+    CloudUpdateProfileConfig: 337,
+    CloudUpdateTenantConfig: 338,
+    CloudUpdateDeviceConfig: 339,
+    DefenderPreviewFeatures: 340,
+    DeviceDiscoverySettingsExclusion: 341,
+    DeviceDiscoverySettingsAuthenticatedScans: 342,
+    CriticalAssetManagementClassification: 343,
+    DeviceDiscoverySettings: 344,
+    USXWorkspaceOnboarding: 345,
+    VivaGlintAdvancedConfiguration: 346,
+    VivaGlintPulseProgram: 347,
+    VivaGlintPulseProgramRespondentRate: 348,
+    VivaGlintQuestion: 349,
+    VivaGlintRole: 350,
+    VivaGlintRubicon: 351,
+    VivaGlintSupportAccess: 352,
+    VivaGlintSystem: 353,
+    VivaGlintUser: 354,
+    VivaGlintUserGroup: 355,
+    VivaGlintFeedbackProgram: 356,
+    FabricAudit: 357,
+    TrainableClassifier: 358,
+    WebContentFiltering: 359,
+    NoisyAlertPolicy: 360,
+    OnDemandSharePointClassification: 361,
+    AIInteractionsExport: 362,
+    Microsoft365CopilotScheduledPrompt: 363,
+    PlacesDirectory: 364,
+    MDAAudit: 365,
+    OpticalCharacterRecognition: 366,
+    M365SearchSections: 368,
+    OfficeClientRestrictedModeAction: 369,
+    CrossTenantAccessPolicy: 370,
+    OutlookCopilotAutomation: 371,
+    VivaEngageNetworkAssociation: 372,
+    AppAdminActivity: 373,
+    AppSettingsAdminActivity: 374,
+    UniversalPrintPrintJob: 375,
+    SentinelNotebookOnLake: 376,
+    SentinelJob: 377,
+    SentinelGraph: 378,
+    SentinelKQLOnLake: 379,
+    SentinelPackage: 380,
+    VivaAmplifyOutlookSensitivityLabel: 381,
+    CopilotActions: 382,
+    AIInteractionsSubscription: 383,
+    AIInteractionsChangeNotification: 384,
+    FilteringMailMetadataExtended: 385,
+    SentinelLakeOnboarding: 386,
+    SentinelLakeDataOnboarding: 387,
+    OfficeRestrictedModeAction: 388,
+    CopilotForSecurityTrigger: 389,
+    CopilotAgentManagement: 390,
+    P4AIAssessmentFabricScannerRecord: 391,
+    PlannerGoal: 392,
+    PlannerGoalList: 393,
+    ThreatIntelligenceObject: 394,
+    ThreatIntelligenceExport: 395,
+    SubmissionAgenticGradingResult: 396,
+    AgentAdminActivity: 397,
+    DeployFeatureActivity: 398,
+    AgentSettingsAdminActivity: 399,
+    OrganizationalDataInM365: 400,
+    PlannerChatMessage: 401,
+    PlannerChatMessageList: 402,
+    SentinelAITool: 403,
+    M365ODSPAssetMetadata: 404,
+    AIExecuteTool: 405,
+    AIInvokeAgent: 406,
+    AIInferenceCall: 407,
+    CdpClassifierHealthRecord: 408,
+    SensitiveInfoRemediationAgentData: 409,
+    ComplianceDLPEnforcement: 410,
+    A365AIExecuteTool: 411,
+    A365AIInvokeAgent: 412,
+    A365AIInferenceCall: 413,
+    VivaEngageSegment: 414,
+    RTIOperationsAgent: 415,
+    ContentStoreMetadata: 416,
+    CCRAIPolicyViolation: 417,
+    PlannerPlanSensitivityLabel: 418,
+    MosAgentInfoRecord: 419,
+    A365AIRunSummary: 420,
+    UnifiedCatalogConceptAction: 421,
+    DefenderCaseManagement: 422,
+    CopilotForSecurityLogging: 423,
+    VivaEngageEvents: 424,
+    CallActivityEvent: 425,
+    SonarDetonationContentMetadata: 426,
+    UniversalPrintManagement: 427,
+    YammerUserHiding: 428,
+    Microsoft365BackupGranularBrowseTask: 429,
+    PurviewPostureAgent: 430,
+    MSDECustomCollection: 431,
+    SCPUsageEvent: 432,
+    SCPConfigurationEvent: 433,
+    MDCConfigurationEvent: 434,
+    MDCUsageEvent: 435,
+    A365SpanOutputs: 436,
+    PowerPlatformTenantIsolation: 437,
+    CDPDLMAIInteractionInsights: 438,
+    P4AIAssessmentCategoryRecord: 439,
+    SentinelLakeEncryption: 440,
+    AZFWNetworkRule: 441,
+    AZFWDnsQuery: 442,
+    AZFWApplicationRuleAggregation: 443,
+    TeamsEvalDataHubDataAccess: 444,
+    TeamsEvalDataHubPermissionChange: 445,
+    TeamsEvalDataHubAdminOperation: 446,
+    VivaGlintOrganizationalData: 447,
+    AlertSubmission: 448,
+    AlertSubmissionResultDetail: 449,
+    ComplianceSitGradingSharePoint: 450,
+    CompliancePolicyGradingSharePoint: 451,
+    AzureAISearchAudit: 452,
+    P4AIRiskScoreRecord: 453,
+    DragonCopilotAdmin: 454,
+    AISpanOutputs: 455,
+    EopSubmissionFeedEntity: 456,
+    SonarFileDetonationEntity: 457,
+    SonarSubmissionEntity: 458,
+    SonarUrlDetonationEntity: 459,
+    SubmissionEntity: 460,
+    SonarDetonationEntity: 461,
+    MicrosoftTeamsUserConcern: 462,
+    VivaGlintAgenticCampaign: 463,
+    MSPVectorSearchContentMetadata: 464,
+    FabricPolicy: 465,
+    SecurityCopilotAgentIdentityManagement: 466,
+    CopilotSessionSharing: 467,
+    DragonCopilotAccess: 468,
+    DragonCopilotClinicalData: 469,
+    DragonCopilotSession: 470,
+    MosAgentInfoRecordV2: 471,
+    SecurityDevelopmentLifecycleAILog: 472,
+    MDASH: 473,
+    DefenderSecurityForAIConfiguration: 474,
+    SparkCoreCustomLivePool: 475,
+    unknownFutureValue: 476,
+  }
+
+  /**
+   * Type of user associated with an audit log record.
+   */
+  enum auditLogUserType {
+    Regular: 0,
+    Reserved: 1,
+    Admin: 2,
+    DcAdmin: 3,
+    System: 4,
+    Application: 5,
+    ServicePrincipal: 6,
+    CustomPolicy: 7,
+    SystemPolicy: 8,
+    PartnerTechnician: 9,
+    Guest: 10,
+    unknownFutureValue: 11,
+  }
+
   enum behaviorDuringRetentionPeriod {
     doNotRetain: 0,
     retain: 1,
@@ -39091,6 +43013,28 @@ namespace reference.`microsoft.graph.security` {
     unknownFutureValue: 1023,
   }
 
+  enum deliveryAction {
+    `unknown`: 0,
+    deliveredToJunk: 1,
+    delivered: 2,
+    blocked: 3,
+    replaced: 4,
+    unknownFutureValue: 127,
+  }
+
+  enum deliveryLocation {
+    `unknown`: 0,
+    inbox_folder: 1,
+    junkFolder: 2,
+    deletedFolder: 3,
+    quarantine: 4,
+    onprem_external: 5,
+    failed: 6,
+    dropped: 7,
+    others: 10,
+    unknownFutureValue: 127,
+  }
+
   enum deploymentStatus {
     upToDate: 1,
     outdated: 2,
@@ -39188,6 +43132,13 @@ namespace reference.`microsoft.graph.security` {
     unknownFutureValue: 4,
   }
 
+  enum eventSource {
+    system: 0,
+    admin: 1,
+    user: 2,
+    unknownFutureValue: 127,
+  }
+
   enum eventStatusType {
     pending: 0,
     error: 1,
@@ -39479,6 +43430,23 @@ namespace reference.`microsoft.graph.security` {
     unknownFutureValue: 4,
   }
 
+  enum remediationAction {
+    moveToJunk: 1,
+    moveToInbox: 2,
+    hardDelete: 5,
+    softDelete: 6,
+    moveToDeletedItems: 7,
+    unknownFutureValue: 14,
+    moveToQuarantine: 15,
+  }
+
+  enum remediationSeverity {
+    low: 1,
+    medium: 2,
+    high: 3,
+    unknownFutureValue: 127,
+  }
+
   enum retentionTrigger {
     dateLabeled: 0,
     dateCreated: 1,
@@ -39540,6 +43508,7 @@ namespace reference.`microsoft.graph.security` {
     microsoftSentinel: 512,
     microsoftInsiderRiskManagement: 1024,
     microsoftThreatIntelligence: 2048,
+    microsoftSecurityForAI: 4096,
   }
 
   enum serviceStatus {
@@ -39586,6 +43555,41 @@ namespace reference.`microsoft.graph.security` {
     unknownFutureValue: 31,
   }
 
+  enum threatType {
+    `unknown`: 0,
+    spam: 1,
+    malware: 2,
+    phish: 3,
+    none: 4,
+    unknownFutureValue: 127,
+  }
+
+  enum timelineEventType {
+    originalDelivery: 0,
+    systemTimeTravel: 1,
+    dynamicDelivery: 2,
+    userUrlClick: 3,
+    reprocessed: 4,
+    zap: 5,
+    quarantineRelease: 6,
+    air: 7,
+    `unknown`: 8,
+    unknownFutureValue: 127,
+  }
+
+  enum verdictCategory {
+    none: 0,
+    malware: 1,
+    phish: 2,
+    siteUnavailable: 3,
+    spam: 4,
+    decryptionFailed: 5,
+    unsupportedUriScheme: 6,
+    unsupportedFileType: 7,
+    undefined: 8,
+    unknownFutureValue: 127,
+  }
+
   enum vmCloudProvider {
     `unknown`: 0,
     azure: 1,