@microsoft/typespec-msgraph-reference 1.0.5 → 1.0.7

package/lib/Prod/Beta/main.tsp

@@ -8,6 +8,7 @@ scalar binary; //TODO: Enables support for Edm.Binary
 
 
 @deprecatedDefinition("Deprecation", "<ChangeLogCategory>", "2024-04-10", "2026-04-10", "The legacy Graph Security API is deprecated and will stop returning data on January 31, 2025. Please use the new Graph Security API.")
+@deprecatedDefinition("beta:EnhancedRestore", "<ChangeLogCategory>", "2026-05-04", "2027-05-04", "Use structuredQueryExpression instead for structured query support.")
 @deprecatedDefinition("cloudPcConnectionSettings", "<ChangeLogCategory>", "2023-10-12", "2024-08-31", "Starting from August 31, 2024, CloudPcConnectionSettings property will no longer be supported and will be marked as deprecated. Please use CloudPcConnectionSetting instead.")
 @deprecatedDefinition("updatedDatetime", "<ChangeLogCategory>", "2023-10-12", "2024-08-31", "Starting from August 31, 2024, updatedDatetime property will no longer be supported and will be marked as deprecated. Please use lastModifiedDateTime instead.")
 @deprecatedDefinition("crossRegionDisasterRecoveryEnabled", "<ChangeLogCategory>", "2024-11-11", "2025-02-11", "Starting from February 11, 2025, this property will no longer be supported and will be marked as deprecated. If crossRegionDisasterRecoveryEnabled is true, use `disasterRecoveryType = crossRegion` instead, if crossRegionDisasterRecoveryEnabled is false, use `disasterRecoveryType = notconfigured` instead")
@@ -76,6 +77,7 @@ scalar binary; //TODO: Enables support for Edm.Binary
 @deprecatedDefinition("SignInWithAlias", "<ChangeLogCategory>", "2025-03-26", "2025-12-25", "")
 @deprecatedDefinition("Remove_Breakdown_APIs", "<ChangeLogCategory>", "2024-02-02", "2024-02-16", "The Inactive Users By Application Metric is deprecated and will stop returning data on February 16, 2024. Please use the existing Inactive Users API.")
 @deprecatedDefinition("DirectoryFeatureRolloutPolicies", "<ChangeLogCategory>", "2021-03-05", "2021-06-30", "Feature Rollout Policies have been grouped with other policies under /policies. The existing /directory/featureRolloutPolicies is deprecated and will stop returning data on 06/30/2021. Please use /policies/featureRolloutPolicies.")
+@privatePreviewDefinition("remoteTenantGroupsAPI", "2025-12-02", "2028-12-07", "<theOwner>")
 @deprecatedDefinition("Removal", "<ChangeLogCategory>", "2023-12-05", "2025-12-05", "The users enum value is deprecated. Use specificPeople instead.")
 // Metadata item DeprecatedDefinition_Removal was already defined with a different value.
 @deprecatedDefinition("Beta_SensitivityLabels", "<ChangeLogCategory>", "2021-02-15", "2022-08-15", "This API will no longer be accessible, please see microsoft.graph.security.informationProtection APIs.")
@@ -86,7 +88,6 @@ scalar binary; //TODO: Enables support for Edm.Binary
 @deprecatedDefinition("CreationDateTime", "<ChangeLogCategory>", "2020-11-06", "2020-12-31", "The creationDateTime property is deprecated and will stop returning data on December 31, 2020. Please use the createdDateTime property.")
 @deprecatedDefinition("PIM_Iteration2_Deprecation", "<ChangeLogCategory>", "2025-10-27", "2026-10-28", "The PIM Iteration 2 beta API is deprecated and will be removed on October 28, 2026. Please migrate to PIM Iteration 3 API.")
 @deprecatedDefinition("accountEnabledDeprecated", "<ChangeLogCategory>", "2023-02-23", "2023-07-12", "The accountEnabled field will soon be deprecated on 2023-07-12. Please use isEnabled instead.")
-@privatePreviewDefinition("microsoft.applicationAuthorization", "2025-01-01", "2025-12-01", "<theOwner>")
 @deprecatedDefinition("SignIn", "<ChangeLogCategory>", "2024-08-31", "2025-03-31", "SignInTokenProtectionStatus property is being deprecate in favor or more detailed tokenProtectionStatusDetails.  It will be removed from April 2025.")
 // Metadata item DeprecatedDefinition_SignIn was already defined with a different value.
 @deprecatedDefinition("shared", "<ChangeLogCategory>", "2024-03-31", "2027-04-30", "Starting from April 30, 2027, this property will no longer be supported and will be marked as deprecated. Please use sharedByUser instead.")
@@ -525,6 +526,11 @@ namespace reference.`microsoft.graph` {
     type: string;
   }
 
+  @complex model additionalStorageAllocations {
+    bonusQuotaInBytes: int64 | null;
+    subscriptionQuotaInBytes: int64 | null;
+  }
+
   @complex model addressBookAccountTargetContent extends accountTargetContent {
     accountTargetEmails: string[] | null;
   }
@@ -1790,7 +1796,10 @@ namespace reference.`microsoft.graph` {
 
   @complex model artifactQuery {
     artifactType: restorableArtifact | null;
+
+    @graphDeprecated("beta:EnhancedRestore")
     queryExpression: string | null;
+    structuredQueryExpression: restoreSearchArtifactQueryExpression | null;
   }
 
   @complex model assignedLabel {
@@ -2939,8 +2948,12 @@ namespace reference.`microsoft.graph` {
   }
 
   @complex model browseQueryResponseItem {
+    createdBy: identitySet | null;
+    @computed createdDateTime: offsetDateTime | null;
     itemKey: string | null;
     itemsCount: int32 | null;
+    lastModifiedBy: identitySet | null;
+    @computed lastModifiedDateTime: offsetDateTime | null;
     name: string | null;
     sizeInBytes: string | null;
     type: browseQueryResponseItemType;
@@ -4783,6 +4796,10 @@ namespace reference.`microsoft.graph` {
     position: int32 | null;
   }
 
+  @complex model contextMetadata {
+    metadataProperties: customMetadataDictionary;
+  }
+
   @complex model continuousAccessEvaluationSessionControl {
     mode: continuousAccessEvaluationMode | null;
   }
@@ -4989,6 +5006,21 @@ Each data source key can include a filter expression to narrow results and a lis
     userRole: onenoteUserRole | null;
   }
 
+  @complex model correlatedObjectLinkMapping {
+    targetProperty: string | null;
+  }
+
+  @complex model correlatedObjectLinkSource {
+    sourceIdentity: identityInfo | null;
+    targetIdentity: identityInfo | null;
+  }
+
+  @complex model correlatedObjectLinkTarget {
+    correlatedDateTime: offsetDateTime | null;
+    sourceIdentity: identityInfo | null;
+    targetIdentity: identityInfo | null;
+  }
+
   @complex model correlationError {
     code: string;
     message: string;
@@ -5218,6 +5250,10 @@ Each data source key can include a filter expression to narrow results and a lis
     totalBytesUploaded: int64;
   }
 
+  @open
+  @complex model customEmojiFromIdentitySet extends identitySet {
+  }
+
   @complex model customerVoiceSettings {
     isInOrgFormsPhishingScanEnabled: boolean | null;
     isRecordIdentityByDefaultEnabled: boolean | null;
@@ -7901,6 +7937,17 @@ Each data source key can include a filter expression to narrow results and a lis
     rule: string | null;
   }
 
+  @complex model deviceSyncStatusResponse {
+    /**
+     * Indicates the collection of sync component statuses representing infrastructure and policy progress. Each entry represents a component that has started reporting during this sync operation. Components appear in the collection only after they begin executing. Read-only. Not nullable.
+     */
+    components: syncComponent[];
+    /**
+     * Indicates the managed device identifier. Used to correlate this sync status snapshot with the device that was synced. This is the same id used in the managedDevice entity. Example: 'd1e2f3a4-b5c6-7890-abcd-ef1234567890'. Read-only. Not nullable.
+     */
+    deviceId: string;
+  }
+
   @complex model diagnostic {
     message: string | null;
     url: string | null;
@@ -8654,6 +8701,10 @@ Each data source key can include a filter expression to narrow results and a lis
     discoveredSensitiveTypes: discoveredSensitiveType[] | null;
   }
 
+  @complex model evaluationScope {
+    type: evaluationScopeType;
+  }
+
   @abstract
   @complex model eventMessageDetail {
   }
@@ -8874,6 +8925,10 @@ Each data source key can include a filter expression to narrow results and a lis
     value: string | null;
   }
 
+  @complex model externalItemInformationProtectionLabel {
+    sensitivityLabelId: string | null;
+  }
+
   @complex model externalLink {
     href: string | null;
   }
@@ -8919,6 +8974,12 @@ Each data source key can include a filter expression to narrow results and a lis
   @complex model fallbackToMicrosoftProviderOnError extends customExtensionBehaviorOnError {
   }
 
+  @complex model familyMemberStorageQuota {
+    additionalAllocations: additionalStorageAllocations | null;
+    used: int64 | null;
+    user: identity | null;
+  }
+
   @complex model featureTarget {
     id: string | null;
     targetType: featureTargetType | null;
@@ -11144,6 +11205,17 @@ Each data source key can include a filter expression to narrow results and a lis
     submitOnlyLinkAbilities: linkRoleAbilities | null;
   }
 
+  @complex model linkStatistics {
+    correlatedAssigned: int64 | null;
+    correlatedNotAssigned: int64 | null;
+    failToCorrelate: int64 | null;
+    mapping: correlatedObjectLinkMapping | null;
+    total: int64 | null;
+    uncorrelated: int64 | null;
+    `unknown`: int64 | null;
+    unresolvedTarget: int64 | null;
+  }
+
   @complex model listInfo {
     contentTypesEnabled: boolean | null;
     hidden: boolean | null;
@@ -12477,6 +12549,14 @@ Each data source key can include a filter expression to narrow results and a lis
     meetingTimeSuggestions: meetingTimeSuggestion[] | null;
   }
 
+  @complex model member {
+    contactId: string | null;
+    displayName: string | null;
+    key: string | null;
+    recipientType: recipientType;
+    routingType: string | null;
+  }
+
   @complex model membersAddedEventMessageDetail extends eventMessageDetail {
     initiator: identitySet | null;
     members: teamworkUserIdentity[] | null;
@@ -14044,6 +14124,10 @@ Each data source key can include a filter expression to narrow results and a lis
     totalPlaceCount: int32 | null;
   }
 
+  @complex model placeServicePlanInfo {
+    servicePlanId: string | null;
+  }
+
   @open
   @complex model plannerAppliedCategories {
   }
@@ -14426,6 +14510,9 @@ Each data source key can include a filter expression to narrow results and a lis
   @complex model policyLocationDomain extends policyLocation {
   }
 
+  @complex model policyLocationTool extends policyLocation {
+  }
+
   @complex model policyLocationUrl extends policyLocation {
   }
 
@@ -14433,6 +14520,7 @@ Each data source key can include a filter expression to narrow results and a lis
   @complex model policyScopeBase {
     activities: userActivityTypes;
     executionMode: executionMode;
+    locationExclusions: policyLocation[];
     locations: policyLocation[];
     policyActions: dlpActionInfo[];
   }
@@ -14907,7 +14995,9 @@ Each data source key can include a filter expression to narrow results and a lis
   @complex model processContentRequest {
     activityMetadata: activityMetadata;
     contentEntries: processContentMetadataBase[];
+    contextMetadata: contextMetadata | null;
     deviceMetadata: deviceMetadata;
+    evaluationScope: evaluationScope | null;
     integratedAppMetadata: integratedApplicationMetadata;
     protectedAppMetadata: protectedApplicationMetadata | null;
   }
@@ -15000,6 +15090,7 @@ Each data source key can include a filter expression to narrow results and a lis
 
   @complex model protectedApplicationMetadata extends integratedApplicationMetadata {
     applicationLocation: policyLocation | null;
+    sourceLocation: policyLocation | null;
   }
 
   @complex model protectedContent {
@@ -15686,6 +15777,14 @@ Each data source key can include a filter expression to narrow results and a lis
     @references restorePoint: restorePoint | null;
   }
 
+  @complex model restoreSearchArtifactQueryExpression {
+    hasAttachment: boolean | null;
+    items: granularRestoreItems[] | null;
+    recipients: string[] | null;
+    senders: string[] | null;
+    subjects: string[] | null;
+  }
+
   @complex model restoreSessionArtifactCount {
     completed: int32 | null;
     failed: int32 | null;
@@ -15996,6 +16095,27 @@ Each data source key can include a filter expression to narrow results and a lis
     qualityId: string | null;
   }
 
+  @complex model samlAppProfile {
+  }
+
+  @complex model samlAuthnRequest {
+  }
+
+  @complex model samlAuthnStatement {
+  }
+
+  @complex model samlCapturedSummary {
+  }
+
+  @complex model samlCertificate {
+  }
+
+  @complex model samlClaim {
+  }
+
+  @complex model samlConditions {
+  }
+
   @complex model samlIdentitySource extends permissionsDefinitionIdentitySource {
   }
 
@@ -16004,10 +16124,43 @@ Each data source key can include a filter expression to narrow results and a lis
     serviceProviderNameQualifier: string | null;
   }
 
+  @complex model samlNameIdPolicy {
+  }
+
+  @complex model samlRequestedAuthnContext {
+  }
+
+  @complex model samlResponseAssertion {
+  }
+
+  @complex model samlResponseMetadata {
+  }
+
+  @complex model samlResponseStatus {
+  }
+
+  @complex model samlScenarioRun {
+  }
+
+  @complex model samlScreenshot {
+  }
+
+  @complex model samlSignatureDetail {
+  }
+
   @complex model samlSingleSignOnSettings {
     relayState: string | null;
   }
 
+  @complex model samlSubCheck {
+  }
+
+  @complex model samlSubject {
+  }
+
+  @complex model samlSubjectConfirmation {
+  }
+
   @complex model samlTestResults {
   }
 
@@ -16461,6 +16614,7 @@ This model is shared with the CCS retrieval API and search where it is already u
     allProperties: boolean | null;
     credentialsWithUsageSign: boolean | null;
     credentialsWithUsageVerify: boolean | null;
+    enforcementScope: servicePrincipalLockScope;
     isEnabled: boolean;
     tokenEncryptionKeyId: boolean | null;
   }
@@ -16597,6 +16751,7 @@ This model is shared with the CCS retrieval API and search where it is already u
     appId: string | null;
     serviceArea: string | null;
     tenantId: string | null;
+    throttledRequests: int64 | null;
     usageDateTime: offsetDateTime | null;
     usageMB: int64 | null;
     usageRequests: int64 | null;
@@ -17129,6 +17284,25 @@ This model is shared with the CCS retrieval API and search where it is already u
     nameIdPolicyFormat: string | null;
   }
 
+  @complex model syncComponent {
+    /**
+     * Indicates additional information for this sync stage. This is a flexible string that can be null (no additional info), a progress indicator such as '3/6' (completed out of total), or a list of individual item names. Read-only. Nullable.
+     */
+    moreInfo: string | null;
+    /**
+     * Indicates the sync stage name. The backend abstracts internal infrastructure into 6 user-facing stages. Fixed values are: notifyingDevice, deviceConnecting, policies, applications, scripts, compliance. Read-only. Not nullable.
+     */
+    name: string;
+    /**
+     * Indicates the date and time when this stage last reported status. The date and time information is shown using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Read-only. Not nullable.
+     */
+    reportedDateTime: offsetDateTime;
+    /**
+     * Indicates the current status of this sync stage. Default value is none. Possible values are: none, inProgress, success, failure, partialSuccess, unknownFutureValue. Stages only appear in the response once they have started, so none is a schema default and will not typically appear in responses. Read-only. Not nullable.
+     */
+    status: syncComponentStatus;
+  }
+
   @complex model synchronizationError {
     code: string | null;
     message: string | null;
@@ -22187,16 +22361,16 @@ capabilities, skills, security, and other manifest-defined fields.
     additionalInfo: string | null;
 
     @graphDeprecated("beta:DisplayNameRename")
-    agentDisplayName: string;
+    agentDisplayName: string | null;
 
     @graphDeprecated("beta:IdentityIDRename")
-    agentId: string;
+    agentId: string | null;
     blueprintId: string | null;
     clientSessionId: string | null;
     detectedDateTime: offsetDateTime | null;
     detectionTimingType: riskDetectionTimingType;
-    displayName: string | null;
-    identityId: string | null;
+    displayName: string;
+    identityId: string;
     identityType: agentIdentityType;
     @computed lastModifiedDateTime: offsetDateTime | null;
     riskDetail: riskDetail;
@@ -28828,6 +29002,7 @@ capabilities, skills, security, and other manifest-defined fields.
     imageDisplayName: string | null;
     isDisasterRecoveryActive: boolean;
     lastLoginResult: cloudPcLoginResult | null;
+    @computed lastLogoffDateTime: offsetDateTime | null;
     @computed lastModifiedDateTime: offsetDateTime;
     lastRemoteActionResult: cloudPcRemoteActionResult | null;
     managedDeviceId: string | null;
@@ -29274,6 +29449,7 @@ capabilities, skills, security, and other manifest-defined fields.
     isDeletable: boolean | null;
     isReorderable: boolean | null;
     isSealed: boolean | null;
+    isSearchable: boolean | null;
     lookup: lookupColumn | null;
     name: string | null;
     number: numberColumn | null;
@@ -31311,6 +31487,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     heightAdjustableState: placeFeatureEnablement;
     mailboxDetails: mailboxDetails | null;
     mode: placeMode | null;
+    servicePlans: placeServicePlanInfo[];
   }
 
   /**
@@ -33268,9 +33445,6 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     status: appLogUploadState;
   }
 
-  /**
-   * Singleton that acts as container for a collection of Resource Access entities.
-   */
   @entity model deviceManagement extends entity {
     /**
      * The date & time when tenant data moved between scaleunits.
@@ -35849,6 +36023,9 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     @contains recommendationConfiguration: recommendationConfiguration | null;
     @contains recommendations: recommendation[];
     @contains recovery: reference.`microsoft.graph.entraRecoveryServices`.recovery | null;
+
+    @privatePreview("remoteTenantGroupsAPI")
+    @contains remoteTenantGroups: remoteTenantGroup[];
     @contains sharedEmailDomains: sharedEmailDomain[];
     @contains subscriptions: companySubscription[];
     @contains templates: template | null;
@@ -35925,6 +36102,22 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     values: settingTemplateValue[];
   }
 
+  @entity model distributionList extends outlookItem {
+    displayName: string | null;
+    members: member[];
+    notes: string | null;
+    personIdentifier: string | null;
+    @contains distributionListMembers: distributionListMember[];
+    @contains singleValueExtendedProperties: singleValueLegacyExtendedProperty[];
+  }
+
+  @entity model distributionListMember extends entity {
+    contactId: string | null;
+    displayName: string | null;
+    recipientType: recipientType;
+    @references contact: contact | null;
+  }
+
   @entity model dlpEvaluatePoliciesJobResponse extends jobResponseBase {
     result: dlpPoliciesJobResult | null;
   }
@@ -36625,9 +36818,6 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     @contains picture: picture[];
   }
 
-  /**
-   * Represents a container that exposes navigation properties for employee experience resources.
-   */
   @entity model employeeExperience extends MsGraph.SharedModels.entity {
     /**
      * A collection of communities in Viva Engage.
@@ -36646,9 +36836,6 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     @contains roles: engagementRole[];
   }
 
-  /**
-   * Represents a container that exposes navigation properties for employee experience user resources.
-   */
   @entity model employeeExperienceUser extends entity {
     /**
      * Viva Engage roles assigned to the user.
@@ -37334,6 +37521,7 @@ within the time frame of their original request.
   @entity model externalItem extends entity {
     acl: acl[] | null;
     content: externalItemContent | null;
+    informationProtectionLabel: externalItemInformationProtectionLabel | null;
     properties: properties | null;
   }
 
@@ -37768,9 +37956,6 @@ within the time frame of their original request.
     siteId: string | null;
   }
 
-  /**
-   * Represents a Microsoft Entra group.
-   */
   @open
   @entity model group extends directoryObject {
     accessType: groupAccessType | null;
@@ -37859,6 +38044,43 @@ within the time frame of their original request.
     @references transitiveMembers: directoryObject[];
   }
 
+  @entity model groupAnalytics extends entity {
+    assignedRoleCount: int64 | null;
+    calculatedDateTime: offsetDateTime;
+    @computed createdDateTime: offsetDateTime | null;
+    directGroupMemberCount: int64 | null;
+    displayName: string | null;
+    dynamicMembershipType: string | null;
+    groupExpirationDateTime: offsetDateTime | null;
+    groupType: groupTypeEnum;
+    guestOwnerCount: int64 | null;
+    guestTransitiveUserCount: int64 | null;
+    isCloudDistributionListGroup: boolean;
+    isCloudM365Group: boolean;
+    isCloudMailEnabledSecurityGroup: boolean;
+    isCloudSecurityGroup: boolean;
+    isDynamicGroup: boolean;
+    isOnPremiseDistributionListGroup: boolean;
+    isOnPremiseMailEnabledSecurityGroup: boolean;
+    isOnPremiseSecurityGroup: boolean;
+    isValidGroup: boolean;
+    @computed lastRestorationDateTime: offsetDateTime | null;
+    memberOwnerCount: int64 | null;
+    membershipRuleContainsCount: int64 | null;
+    membershipRuleExpressionCount: int64 | null;
+    membershipRuleMatchCount: int64 | null;
+    membershipRuleMemberOfCount: int64 | null;
+    membershipRuleProcessingState: string | null;
+    memberTransitiveUserCount: int64 | null;
+    preferredDataLocation: string | null;
+    sensitivityLabelCount: int64 | null;
+    servicePrincipalOwnerCount: int64 | null;
+    softDeletionDateTime: offsetDateTime | null;
+    tenantId: string;
+    transitiveServicePrincipalCount: int64 | null;
+    transitiveUserCount: int64 | null;
+  }
+
   @entity model groupLifecyclePolicy extends entity {
     alternateNotificationEmails: string | null;
     groupLifetimeInDays: int32 | null;
@@ -38932,6 +39154,10 @@ within the time frame of their original request.
     serverToken: string;
   }
 
+  @entity model identityAnalyticsRoot extends entity {
+    @contains groups: groupAnalytics[];
+  }
+
   @entity model identityApiConnector extends entity {
     authenticationConfiguration: apiAuthenticationConfigurationBase | null;
     displayName: string | null;
@@ -45320,6 +45546,26 @@ within the time frame of their original request.
     isEnabledForAllMicrosoftApplications: boolean | null;
   }
 
+  @entity model microsoftAppsFileStorageContainerAppUsage extends MsGraph.SharedModels.entity {
+    activeContainerCount: int64;
+    activeStorageUsedInBytes: int64;
+    @computed @key appId: string;
+    displayName: string | null;
+  }
+
+  @entity model microsoftAppsFileStorageContainerGeoUsage extends MsGraph.SharedModels.entity {
+    activeContainerCount: int64;
+    activeStorageUsedInBytes: int64;
+    @computed @key dataLocationCode: string;
+    @contains usageByApp: microsoftAppsFileStorageContainerAppUsage[];
+  }
+
+  @entity model microsoftAppsFileStorageContainerUsage extends entity {
+    totalActiveContainerCount: int64;
+    totalActiveStorageUsedInBytes: int64;
+    @contains usageByDataLocation: microsoftAppsFileStorageContainerGeoUsage[];
+  }
+
   @entity model microsoftAuthenticatorAuthenticationMethod extends authenticationMethod {
     clientAppName: microsoftAuthenticatorAuthenticationMethodClientAppName | null;
     deviceTag: string | null;
@@ -46808,9 +47054,6 @@ within the time frame of their original request.
     handler: onInteractiveAuthFlowStartHandler | null;
   }
 
-  /**
-   * Represents a Microsoft online meeting.
-   */
   @open
   @entity model onlineMeeting extends onlineMeetingBase {
     alternativeRecording: stream | null;
@@ -47751,6 +47994,7 @@ within the time frame of their original request.
     label: string | null;
     parentId: string | null;
     phone: string | null;
+    placeId: string | null;
     tags: string[];
     @contains checkIns: checkInClaim[];
     @references children: place[];
@@ -49258,6 +49502,15 @@ within the time frame of their original request.
     @contains targetDeviceGroups: targetDeviceGroup[];
   }
 
+  @privatePreview("remoteTenantGroupsAPI")
+  @entity model remoteTenantGroup extends directoryObject {
+    remoteGroupDisplayName: string | null;
+    remoteGroupId: guid | null;
+    remoteTenantDisplayName: string | null;
+    remoteTenantId: guid | null;
+    remoteTenantPrimaryDomain: string | null;
+  }
+
   @open
   @entity model removeFromLobbyOperation extends commsOperation {
   }
@@ -49279,6 +49532,8 @@ within the time frame of their original request.
     @graphDeprecated("Tasks_And_Plans")
     @contains dailyPrintUsageSummariesByUser: printUsageByUser[];
     @contains healthMonitoring: reference.`microsoft.graph.healthMonitoring`.healthMonitoringRoot | null;
+    @contains identityAnalytics: identityAnalyticsRoot | null;
+    @contains microsoftAppsFileStorageContainerUsageSummary: microsoftAppsFileStorageContainerUsage | null;
     @contains monthlyPrintUsageByPrinter: printUsageByPrinter[];
     @contains monthlyPrintUsageByUser: printUsageByUser[];
 
@@ -49618,7 +49873,6 @@ within the time frame of their original request.
     @contains roleAssignments: roleAssignment[];
   }
 
-  @privatePreview("microsoft.applicationAuthorization")
   @entity model roleManagement extends MsGraph.SharedModels.entity {
     @contains cloudPC: rbacApplicationMultiple | null;
     @contains defender: unifiedRbacApplicationMultiple | null;
@@ -49698,7 +49952,6 @@ within the time frame of their original request.
     floorNumber: int32 | null;
     isTeamsEnabled: boolean;
     nickname: string;
-    placeId: string | null;
     teamsEnabledState: placeFeatureEnablement;
     videoDeviceName: string | null;
   }
@@ -50151,6 +50404,7 @@ within the time frame of their original request.
     @contains alerts_v2: reference.`microsoft.graph.security`.alert[];
     @contains attackSimulation: attackSimulationRoot | null;
     @contains auditLog: reference.`microsoft.graph.security`.auditCoreRoot | null;
+    @contains caseManagement: reference.`microsoft.graph.security`.caseManagementRoot | null;
     @contains cases: reference.`microsoft.graph.security`.casesRoot | null;
     @contains cloudAppSecurityProfiles: cloudAppSecurityProfile[];
     @contains collaboration: reference.`microsoft.graph.security`.collaborationRoot | null;
@@ -51631,6 +51885,9 @@ within the time frame of their original request.
     notificationUrl: string;
     notificationUrlAppId: string | null;
     resource: string;
+    vapidPublicKey: string | null;
+    webPushEncryptionP256dhPublicKey: string | null;
+    webPushEncryptionSecret: string | null;
   }
 
   @entity model summarizedSignIn extends entity {
@@ -52010,6 +52267,7 @@ within the time frame of their original request.
     @contains deletedChats: deletedChat[];
     @contains deletedTeams: deletedTeam[];
     @contains devices: teamworkDevice[];
+    @contains messaging: teamworkMessaging | null;
     @contains teamsAppSettings: teamsAppSettings | null;
     @contains teamTemplates: teamTemplate[];
     @contains workforceIntegrations: workforceIntegration[];
@@ -52018,6 +52276,13 @@ within the time frame of their original request.
   @entity model teamworkBot extends entity {
   }
 
+  @entity model teamworkCustomEmoji extends MsGraph.SharedModels.entity {
+    contentBytes: string | null;
+    createdBy: customEmojiFromIdentitySet;
+    @computed createdDateTime: offsetDateTime;
+    @computed @key displayName: string;
+  }
+
   @entity model teamworkDevice extends entity {
     activityState: teamworkDeviceActivityState | null;
     companyAssetTag: string | null;
@@ -52088,6 +52353,10 @@ within the time frame of their original request.
     contentType: string | null;
   }
 
+  @entity model teamworkMessaging extends entity {
+    @contains customEmojis: teamworkCustomEmoji[];
+  }
+
   @entity model teamworkPeripheral extends entity {
     displayName: string | null;
     productId: string | null;
@@ -52336,9 +52605,6 @@ within the time frame of their original request.
     resultType: threatAssessmentResultType | null;
   }
 
-  /**
-   * The ThumbnailSet resource is a keyed collection of thumbnail resources.
-   */
   @open
   @entity model thumbnailSet extends entity {
     large: thumbnail | null;
@@ -52858,6 +53124,8 @@ within the time frame of their original request.
 
   @entity model unifiedStorageQuota extends entity {
     deleted: int64 | null;
+    familyMembersUsage: familyMemberStorageQuota[] | null;
+    isPooledStorageEnabled: boolean | null;
     manageWebUrl: string | null;
     remaining: int64 | null;
     state: string | null;
@@ -53087,6 +53355,7 @@ within the time frame of their original request.
     @contains deviceManagementTroubleshootingEvents: deviceManagementTroubleshootingEvent[];
     @contains devices: device[];
     @references directReports: directoryObject[];
+    @contains distributionLists: distributionList[];
     @contains drive: drive | null;
     @contains drives: drive[];
     @contains employeeExperience: employeeExperienceUser | null;
@@ -55475,6 +55744,7 @@ within the time frame of their original request.
   }
 
   @entity model voiceAuthenticationMethodConfiguration extends authenticationMethodConfiguration {
+    callerIdNumber: string | null;
     isOfficePhoneAllowed: boolean | null;
     @contains includeTargets: voiceAuthenticationMethodTarget[];
   }
@@ -55513,6 +55783,10 @@ within the time frame of their original request.
    * You purchase multiple licenses for iOS apps through the Apple Volume Purchase Program for Business or Education. This involves setting up an Apple VPP account from the Apple website and uploading the Apple VPP Business or Education token to Intune. You can then synchronize your volume purchase information with Intune and track your volume-purchased app use. You can upload multiple Apple VPP Business or Education tokens.
    */
   @entity model vppToken extends entity {
+    /**
+     * Indicates the delivery protocol used to deliver apps associated with this VPP token. This property is set at token creation and cannot be modified afterward. Default value is default. Possible values are: default, mobileDeviceManagement, declarativeDeviceManagement. Not nullable.
+     */
+    appleDeviceAppDeliveryProtocolType: appleDeviceDeliveryProtocol;
     /**
      * The apple Id associated with the given Apple Volume Purchase Program Token.
      */
@@ -62347,7 +62621,6 @@ within the time frame of their original request.
     floorNumber: int32 | null;
     mode: placeMode | null;
     nickname: string;
-    placeId: string | null;
   }
 
   @entity model x509CertificateAuthenticationMethodConfiguration extends authenticationMethodConfiguration {
@@ -73421,6 +73694,13 @@ within the time frame of their original request.
     IgnoreLookupReferenceResolutionFailure: 2,
   }
 
+  enum evaluationScopeType {
+    tenant: 0,
+    agent: 1,
+    anonymousUser: 2,
+    unknownFutureValue: 3,
+  }
+
   #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum eventType {
     singleInstance: 0,
@@ -73900,6 +74180,15 @@ within the time frame of their original request.
     enabled: 2,
   }
 
+  enum granularRestoreItems {
+    email: 0,
+    note: 1,
+    contact: 2,
+    task: 3,
+    calendar: 4,
+    unknownFutureValue: 5,
+  }
+
   enum groundingEntityType {
     site: 0,
     list: 1,
@@ -74256,6 +74545,13 @@ within the time frame of their original request.
     unknownFutureValue: 2,
   }
 
+  #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
+  enum groupTypeEnum {
+    isCloudGroup: 0,
+    isOnPremiseGroup: 1,
+    isSoftDeletedGroup: 2,
+  }
+
   /**
    * Indicates the supported oems of hardware configuration
    */
@@ -80955,6 +81251,14 @@ within the time frame of their original request.
     externalNonPartner: 8,
   }
 
+  enum recipientType {
+    contact: 0,
+    oneOff: 1,
+    mailbox: 2,
+    privateDL: 3,
+    unknownFutureValue: 4,
+  }
+
   enum recommendationCategory {
     identityBestPractice: 0,
     identitySecureScore: 1,
@@ -82565,6 +82869,13 @@ within the time frame of their original request.
     unknownFutureValue: 2,
   }
 
+  enum servicePrincipalLockScope {
+    notConfigured: 0,
+    foreignTenantOnly: 1,
+    everywhere: 2,
+    unknownFutureValue: 3,
+  }
+
   /**
    * Possible values of xbox service start type
    */
@@ -83167,6 +83478,33 @@ within the time frame of their original request.
     unknownFutureValue: 4,
   }
 
+  /**
+   * A list of possible status states for a sync infrastructure component or policy during a device sync operation.
+   */
+  enum syncComponentStatus {
+    /**
+     * Default. The component has not yet started reporting status. This is a schema default and will not typically appear in responses, as components only appear once they begin executing.
+     */
+    none: 0,
+    /**
+     * Indicates the component is currently executing. For infrastructure components (PNSv1, DCI, SCGW), this means the notification or check-in is in flight. For policies, this means the policy is being applied to the device.
+     */
+    inProgress: 1,
+    /**
+     * Indicates the component completed successfully. The component has finished its work and reported a successful outcome.
+     */
+    success: 2,
+    /**
+     * Indicates the stage encountered an error. When this value is set, the moreInfo property on the syncComponent will contain additional diagnostic details about the failure.
+     */
+    failure: 3,
+    /**
+     * Indicates the stage completed but not all items succeeded. For example, some policies applied successfully while others failed. The moreInfo property may contain details on the partial outcome.
+     */
+    partialSuccess: 4,
+    unknownFutureValue: 5,
+  }
+
   #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum synchronizationDisposition {
     Normal: 0,
@@ -88525,6 +88863,7 @@ namespace reference.`microsoft.graph.cloudLicensing` {
     allottedUnits: int32;
     assignableTo: assigneeTypes;
     consumedUnits: int32;
+    externalServiceIdentifier: string | null;
     services: service[];
     skuId: guid | null;
     skuPartNumber: string | null;
@@ -88549,6 +88888,7 @@ namespace reference.`microsoft.graph.cloudLicensing` {
   }
 
   @entity model usageRight extends reference.`microsoft.graph`.entity {
+    externalServiceIdentifier: string | null;
     services: service[];
     skuId: guid | null;
     skuPartNumber: string | null;
@@ -89269,6 +89609,10 @@ namespace reference.`microsoft.graph.externalConnectors` {
     value: string | null;
   }
 
+  @complex model externalItemInformationProtectionLabel {
+    sensitivityLabelId: string | null;
+  }
+
   @complex model itemIdResolver extends urlToItemResolverBase {
     itemId: string;
     urlMatchInfo: urlMatchInfo | null;
@@ -89380,6 +89724,7 @@ namespace reference.`microsoft.graph.externalConnectors` {
   @entity model externalItem extends reference.`microsoft.graph`.entity {
     acl: acl[] | null;
     content: externalItemContent | null;
+    informationProtectionLabel: externalItemInformationProtectionLabel | null;
     properties: properties | null;
     @contains activities: externalActivity[];
   }
@@ -89739,6 +90084,10 @@ namespace reference.`microsoft.graph.identityGovernance` {
   @complex model cancelScope {
   }
 
+  @complex model countBasedQuarantineCondition extends quarantineCondition {
+    threshold: int64;
+  }
+
   @complex model customTaskExtensionCallbackConfiguration extends reference.`microsoft.graph`.customExtensionCallbackConfiguration {
     @references authorizedApps: reference.`microsoft.graph`.application[];
   }
@@ -89765,6 +90114,10 @@ namespace reference.`microsoft.graph.identityGovernance` {
     @references groups: reference.`microsoft.graph`.group[];
   }
 
+  @complex model guestSponsorTrigger extends workflowExecutionTrigger {
+    minimumRequiredSponsors: int32;
+  }
+
   @complex model membershipChangeTrigger extends workflowExecutionTrigger {
     changeType: membershipChangeType;
   }
@@ -89778,6 +90131,10 @@ namespace reference.`microsoft.graph.identityGovernance` {
     valueType: valueType;
   }
 
+  @complex model percentageBasedQuarantineCondition extends quarantineCondition {
+    percentage: int32;
+  }
+
   @complex model previewFailedTask {
     definitionId: string;
     failureReason: string;
@@ -89793,6 +90150,21 @@ namespace reference.`microsoft.graph.identityGovernance` {
     id: string;
   }
 
+  @abstract
+  @complex model quarantineCondition {
+  }
+
+  @complex model quarantineConfiguration {
+    conditions: quarantineCondition[];
+    matchMode: matchMode;
+  }
+
+  @complex model quarantineDetails {
+    quarantinedDateTime: offsetDateTime | null;
+    quarantineReason: string | null;
+    quarantineType: quarantineType;
+  }
+
   @complex model ruleBasedSubjectSet extends reference.`microsoft.graph`.subjectSet {
     rule: string;
   }
@@ -89879,6 +90251,10 @@ namespace reference.`microsoft.graph.identityGovernance` {
   @complex model workflowExecutionTrigger {
   }
 
+  @complex model workflowSetting {
+    quarantineConfiguration: quarantineConfiguration | null;
+  }
+
   @complex model workflowsInsightsByCategory {
     failedJoinerRuns: int32;
     failedLeaverRuns: int32;
@@ -89921,6 +90297,7 @@ namespace reference.`microsoft.graph.identityGovernance` {
 
   @entity model lifecycleManagementSettings extends reference.`microsoft.graph`.entity {
     emailSettings: reference.`microsoft.graph`.emailSettings;
+    quarantineConfiguration: quarantineConfiguration | null;
     workflowScheduleIntervalInHours: int32;
   }
 
@@ -90036,6 +90413,8 @@ namespace reference.`microsoft.graph.identityGovernance` {
     deletedDateTime: offsetDateTime | null;
     @computed @key id: string;
     nextScheduleRunDateTime: offsetDateTime | null;
+    quarantineDetails: quarantineDetails;
+    settings: workflowSetting;
     version: int32 | null;
     @references executionScope: userProcessingResult[];
 
@@ -90073,6 +90452,7 @@ namespace reference.`microsoft.graph.identityGovernance` {
   }
 
   @entity model workflowVersion extends workflowBase {
+    settings: workflowSetting;
     @computed @key versionNumber: int32;
   }
 
@@ -90128,6 +90508,13 @@ namespace reference.`microsoft.graph.identityGovernance` {
     unknownFutureValue: 6,
     @privatePreview("cancelWorkflows")
     canceling: 7,
+    quarantined: 8,
+  }
+
+  enum matchMode {
+    any: 0,
+    all: 1,
+    unknownFutureValue: 2,
   }
 
   enum membershipChangeType {
@@ -90136,6 +90523,14 @@ namespace reference.`microsoft.graph.identityGovernance` {
     unknownFutureValue: 3,
   }
 
+  enum quarantineType {
+    notQuarantined: 0,
+    countBasedThresholdExceeded: 1,
+    percentageBasedThresholdExceeded: 2,
+    multipleConditionsExceeded: 3,
+    unknownFutureValue: 4,
+  }
+
   enum valueType {
     `enum`: 0,
     `string`: 1,
@@ -92513,7 +92908,8 @@ namespace reference.`microsoft.graph.networkaccess` {
   enum clientFallbackAction {
     bypass: 0,
     block: 1,
-    unknownFutureValue: 2,
+    default: 2,
+    unknownFutureValue: 3,
   }
 
   enum cloudFirewallAction {
@@ -93275,6 +93671,7 @@ namespace reference.`microsoft.graph.search` {
   }
 
 }
+@privatePreviewDefinition("MdcConnectors", "2026-07-02", "2027-01-02", "<theOwner>")
 @deprecatedDefinition("Tasks_And_Plans", "<ChangeLogCategory>", "2026-03-18", "2028-03-18", "Alert category property is deprecated and replaced with alert categories")
 // Metadata item DeprecatedDefinition_Tasks_And_Plans was already defined with a different value.
 @deprecatedDefinition("azureBlobContainer", "<ChangeLogCategory>", "2023-01-19", "2023-04-30", "The azureBlobContainer will be deprecated on April 30, 2023.")
@@ -93286,36 +93683,42 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for A365 AI Execute Tool events.
    */
+  @open
   @complex model a365AiExecuteTool extends auditData {
   }
 
   /**
    * Audit data for A365 AI Inference Call events.
    */
+  @open
   @complex model a365AiInferenceCall extends auditData {
   }
 
   /**
    * Audit data for A365 AI Invoke Agent events.
    */
+  @open
   @complex model a365AiInvokeAgent extends auditData {
   }
 
   /**
    * Audit data for A365 AI Run Summary events.
    */
+  @open
   @complex model a365AiRunSummary extends auditData {
   }
 
   /**
    * Audit data for A365 Span Outputs events.
    */
+  @open
   @complex model a365SpanOutputs extends auditData {
   }
 
   /**
    * Audit data for AAD Risk Detection events.
    */
+  @open
   @complex model aadRiskDetectionAuditRecord extends auditData {
   }
 
@@ -93325,6 +93728,16 @@ namespace reference.`microsoft.graph.security` {
     identityProvider: identityProvider;
   }
 
+  @complex model accountEntityMapping extends entityMapping {
+    aadUserIdColumn: string | null;
+    dnsDomainColumn: string | null;
+    nameColumn: string | null;
+    ntDomainColumn: string | null;
+    sidColumn: string | null;
+    upnColumn: string | null;
+    upnSuffixColumn: string | null;
+  }
+
   @complex model accountObjectIdAction extends automatedAction {
     accountObjectIdColumn: string;
   }
@@ -93370,18 +93783,21 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Advanced eDiscovery events.
    */
+  @open
   @complex model aedAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Agent Admin Activity events.
    */
+  @open
   @complex model agentAdminActivityRecord extends auditData {
   }
 
   /**
    * Audit data for Agent Setting Admin Activity events.
    */
+  @open
   @complex model agentSettingAdminActivity extends auditData {
   }
 
@@ -93395,93 +93811,115 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for AI App Interaction events.
    */
+  @open
   @complex model aiAppInteractionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for AI Execute Tool events.
    */
+  @open
   @complex model aiExecuteToolAuditRecord extends auditData {
   }
 
   /**
    * Audit data for AI Interactions Change Notification events.
    */
+  @open
   @complex model aiInteractionsChangeNotificationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for AI Interactions Export events.
    */
+  @open
   @complex model aiInteractionsExportAuditRecord extends auditData {
   }
 
   /**
    * Audit data for AI Interactions Subscription events.
    */
+  @open
   @complex model aiInteractionsSubscriptionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for AI Invoke Agent events.
    */
+  @open
   @complex model aiInvokeAgentAuditRecord extends auditData {
   }
 
   /**
    * Audit data for AIP Discover events.
    */
+  @open
   @complex model aipDiscover extends auditData {
   }
 
   /**
    * Audit data for AIP File Deleted events.
    */
+  @open
   @complex model aipFileDeleted extends auditData {
   }
 
   /**
    * Audit data for AIP Heart Beat events.
    */
+  @open
   @complex model aipHeartBeat extends auditData {
   }
 
   /**
    * Audit data for AIP Protection Action log request events.
    */
+  @open
   @complex model aipProtectionActionLogRequest extends auditData {
   }
 
   /**
    * Audit data for AIP Scanner Discover Event events.
    */
+  @open
   @complex model aipScannerDiscoverEvent extends auditData {
   }
 
   /**
    * Audit data for AIP Sensitivity Label Action log request events.
    */
+  @open
   @complex model aipSensitivityLabelActionLogRequest extends auditData {
   }
 
   /**
    * Audit data for AIR Admin Action Investigation events.
    */
+  @open
   @complex model airAdminActionInvestigationData extends auditData {
   }
 
   /**
    * Audit data for AIR Investigation events.
    */
+  @open
   @complex model airInvestigationData extends auditData {
   }
 
   /**
    * Audit data for AIR Manual Investigation events.
    */
+  @open
   @complex model airManualInvestigationData extends auditData {
   }
 
+  /**
+   * Audit data for AI Span Outputs events.
+   */
+  @open
+  @complex model aISpanOutputsAuditRecord extends auditData {
+  }
+
   @complex model alertComment {
     comment: string | null;
     createdByDisplayName: string | null;
@@ -93502,6 +93940,39 @@ namespace reference.`microsoft.graph.security` {
     verdict: evidenceVerdict;
   }
 
+  /**
+   * Audit data for Alert Submission events.
+   */
+  @open
+  @complex model alertSubmissionAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Alert Submission Result Detail events.
+   */
+  @open
+  @complex model alertSubmissionResultDetailAuditRecord extends auditData {
+  }
+
+  @complex model alertTemplate {
+
+    // Warning: Malformed version string '2025-01' detected.
+    category: string | null;
+    customDetails: alertCustomDetails | null;
+    description: string;
+    entityMappings: entityMappingConfiguration;
+
+    // Warning: Malformed version string '2025-01' detected.
+    impactedAssets: impactedAsset[];
+
+    // Warning: Malformed version string '2025-01' detected.
+    mitreTechniques: string[] | null;
+    recommendedActions: string | null;
+    severity: alertSeverity;
+    tactics: mitreTactic[];
+    title: string;
+  }
+
   // Warning: Malformed version string '2025-01' detected.
   // Warning: Malformed version string '2025-01' detected.
   @complex model allowFileResponseAction extends responseAction {
@@ -93509,6 +93980,10 @@ namespace reference.`microsoft.graph.security` {
     identifier: fileEntityIdentifier;
   }
 
+  @complex model amazonResourceEntityMapping extends entityMapping {
+    amazonResourceIdColumn: string;
+  }
+
   @complex model amazonResourceEvidence extends alertEvidence {
     amazonAccountId: string | null;
     amazonResourceId: string | null;
@@ -93608,12 +94083,14 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Attack Sim Admin events.
    */
+  @open
   @complex model attackSimAdminAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Attack Sim events.
    */
+  @open
   @complex model attackSimAuditRecord extends auditData {
   }
 
@@ -93627,6 +94104,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Audit Config events.
    */
+  @open
   @complex model auditConfigAuditRecord extends auditData {
   }
 
@@ -93635,6 +94113,7 @@ namespace reference.`microsoft.graph.security` {
    */
   @abstract
   @complex model auditData {
+    dynamicProperties: auditRecordTypeDictionary | null;
   }
 
   @complex model auditInfo {
@@ -93642,9 +94121,17 @@ namespace reference.`microsoft.graph.security` {
     dateTime: offsetDateTime;
   }
 
+  /**
+   * A dictionary of name-value pairs for dynamic audit event properties.
+   */
+  @open
+  @complex model auditRecordTypeDictionary {
+  }
+
   /**
    * Audit data for Audit Search events.
    */
+  @open
   @complex model auditSearchAuditRecord extends auditData {
   }
 
@@ -93681,39 +94168,56 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Azfw Application Rule Aggregation Event events.
    */
+  @open
   @complex model azfwApplicationRuleAggregationEventRecord extends auditData {
   }
 
   /**
    * Audit data for Azfw Dns Query Event events.
    */
+  @open
   @complex model azfwDnsQueryEventRecord extends auditData {
   }
 
   /**
    * Audit data for Azfw Network Rule Event events.
    */
+  @open
   @complex model azfwNetworkRuleEventRecord extends auditData {
   }
 
   /**
    * Audit data for Azure Active Directory Account Logon events.
    */
+  @open
   @complex model azureActiveDirectoryAccountLogonAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Azure Active Directory events.
    */
+  @open
   @complex model azureActiveDirectoryAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Azure Active Directory STS Logon events.
    */
+  @open
   @complex model azureActiveDirectoryStsLogonAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Azure AI Search Audit events.
+   */
+  @open
+  @complex model azureAISearchAuditRecord extends auditData {
+  }
+
+  @complex model azureResourceEntityMapping extends entityMapping {
+    resourceIdColumn: string;
+  }
+
   @complex model azureResourceEvidence extends alertEvidence {
     resourceId: string | null;
     resourceName: string | null;
@@ -93753,66 +94257,77 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for threat campaign events.
    */
+  @open
   @complex model campaignAuditRecord extends auditData {
   }
 
   /**
    * Audit data for CCRAI Policy Violation events.
    */
+  @open
   @complex model ccraiPolicyViolationRecord extends auditData {
   }
 
   /**
    * Audit data for CDP Classifier Health events.
    */
+  @open
   @complex model cdpClassifierHealthRecord extends auditData {
   }
 
   /**
    * Audit data for CDP Cold Crawl Status events.
    */
+  @open
   @complex model cdpColdCrawlStatusRecord extends auditData {
   }
 
   /**
    * Audit data for CDP Consumption Resource events.
    */
+  @open
   @complex model cdpConsumptionResourceRecord extends auditData {
   }
 
   /**
    * Audit data for CDP Content Explorer Aggregate events.
    */
+  @open
   @complex model cdpContentExplorerAggregateRecord extends auditData {
   }
 
   /**
    * Audit data for Cdpdlmai Interaction Insights events.
    */
+  @open
   @complex model cdpdlmaiInteractionInsightsRecord extends auditData {
   }
 
   /**
    * Audit data for CDP DLP Sensitive Endpoint events.
    */
+  @open
   @complex model cdpDlpSensitiveEndpointAuditRecord extends auditData {
   }
 
   /**
    * Audit data for CDP Log events.
    */
+  @open
   @complex model cdpLogRecord extends auditData {
   }
 
   /**
    * Audit data for CDP OCR Billing events.
    */
+  @open
   @complex model cdpOcrBillingRecord extends auditData {
   }
 
   /**
    * Audit data for CDP Resource Scope Change Event events.
    */
+  @open
   @complex model cdpResourceScopeChangeEventRecord extends auditData {
   }
 
@@ -93822,6 +94337,11 @@ namespace reference.`microsoft.graph.security` {
     sensitiveTypeId: string;
   }
 
+  @complex model cloudApplicationEntityMapping extends entityMapping {
+    appIdColumn: string | null;
+    nameColumn: string | null;
+  }
+
   @complex model cloudApplicationEvidence extends alertEvidence {
     appId: int64 | null;
     displayName: string | null;
@@ -93850,18 +94370,21 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Cloud Update Device Config events.
    */
+  @open
   @complex model cloudUpdateDeviceConfigAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Cloud Update Profile Config events.
    */
+  @open
   @complex model cloudUpdateProfileConfigAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Cloud Update Tenant Config events.
    */
+  @open
   @complex model cloudUpdateTenantConfigAuditRecord extends auditData {
   }
 
@@ -93878,120 +94401,154 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Compliance Connector events.
    */
+  @open
   @complex model complianceConnectorAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLM Exchange events.
    */
+  @open
   @complex model complianceDLMExchangeAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLM SharePoint events.
    */
+  @open
   @complex model complianceDLMSharePointAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP Applications events.
    */
+  @open
   @complex model complianceDLPApplicationsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP Applications Classification events.
    */
+  @open
   @complex model complianceDLPApplicationsClassificationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP Endpoint events.
    */
+  @open
   @complex model complianceDLPEndpointAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP Endpoint Discovery events.
    */
+  @open
   @complex model complianceDLPEndpointDiscoveryAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP Enforcement events.
    */
+  @open
   @complex model complianceDLPEnforcementAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP Exchange events.
    */
+  @open
   @complex model complianceDLPExchangeAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP Exchange Classification events.
    */
+  @open
   @complex model complianceDLPExchangeClassificationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP Exchange Classification CDP events.
    */
+  @open
   @complex model complianceDLPExchangeClassificationCdpRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP Exchange Discovery events.
    */
+  @open
   @complex model complianceDLPExchangeDiscoveryAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP SharePoint events.
    */
+  @open
   @complex model complianceDLPSharePointAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP SharePoint Classification events.
    */
+  @open
   @complex model complianceDLPSharePointClassificationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP SharePoint Classification CDP events.
    */
+  @open
   @complex model complianceDLPSharePointClassificationCdpRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance DLP SharePoint Classification Extended events.
    */
+  @open
   @complex model complianceDLPSharePointClassificationExtendedAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance Exchange OCR events.
    */
+  @open
   @complex model complianceExchangeOcrAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Compliance Manager Action events.
    */
+  @open
   @complex model complianceManagerActionRecord extends auditData {
   }
 
+  /**
+   * Audit data for Compliance Policy Grading SharePoint events.
+   */
+  @open
+  @complex model compliancePolicyGradingSharePointAuditRecord extends auditData {
+  }
+
   /**
    * Audit data for Compliance Settings Change events.
    */
+  @open
   @complex model complianceSettingsChangeAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Compliance SIT Grading SharePoint events.
+   */
+  @open
+  @complex model complianceSitGradingSharePointAuditRecord extends auditData {
+  }
+
   /**
    * Audit data for Compliance Supervision Exchange events.
    */
+  @open
   @complex model complianceSupervisionExchangeAuditRecord extends auditData {
   }
 
@@ -94003,12 +94560,19 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Connected AI App Interaction events.
    */
+  @open
   @complex model connectedAIAppInteractionAuditRecord extends auditData {
   }
 
+  @privatePreview("MdcConnectors")
+  @complex model connectorValidateResult {
+    messages: string[];
+  }
+
   /**
    * Audit data for Consumption Resource events.
    */
+  @open
   @complex model consumptionResourceAuditRecord extends auditData {
   }
 
@@ -94048,84 +94612,105 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Content Store Meta events.
    */
+  @open
   @complex model contentStoreMetadataRecord extends auditData {
   }
 
   /**
    * Audit data for Copilot Agent Management events.
    */
+  @open
   @complex model copilotAgentManagementAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Copilot for Security Logging events.
    */
+  @open
   @complex model copilotForSecurityLoggingAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Copilot for Security Trigger events.
    */
+  @open
   @complex model copilotForSecurityTriggerAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Copilot Interaction events.
    */
+  @open
   @complex model copilotInteractionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Copilot Plugin Setting events.
    */
+  @open
   @complex model copilotPluginSettingAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Copilot Prompt Book Setting events.
    */
+  @open
   @complex model copilotPromptBookSettingAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Copilot Session Sharing events.
+   */
+  @open
+  @complex model copilotSessionSharingAuditRecord extends auditData {
+  }
+
   /**
    * Audit data for Copilot Setting events.
    */
+  @open
   @complex model copilotSettingAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Copilot Workspace Setting events.
    */
+  @open
   @complex model copilotWorkspaceSettingAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Core Reporting Settings events.
    */
+  @open
   @complex model coreReportingSettingsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Cortana Briefing events.
    */
+  @open
   @complex model cortanaBriefingAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Critical Asset Management Classification events.
    */
+  @open
   @complex model criticalAssetManagementClassificationRecord extends auditData {
   }
 
   /**
    * Audit data for CRM Entity Operation events.
    */
+  @open
   @complex model crmEntityOperationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Cross Tenant Access Policy events.
    */
+  @open
   @complex model crossTenantAccessPolicyAuditRecord extends auditData {
   }
 
@@ -94137,6 +94722,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Customer Key Service Encryption events.
    */
+  @open
   @complex model customerKeyServiceEncryptionAuditRecord extends auditData {
   }
 
@@ -94149,36 +94735,42 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Data Center Security cmdlet events.
    */
+  @open
   @complex model dataCenterSecurityCmdletAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Data Governance events.
    */
+  @open
   @complex model dataGovernanceAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Data Insights Rest Api events.
    */
+  @open
   @complex model dataInsightsRestApiAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Data Lake Export Operation events.
    */
+  @open
   @complex model dataLakeExportOperationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Data Security Investigation events.
    */
+  @open
   @complex model dataSecurityInvestigationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Data Share Operation events.
    */
+  @open
   @complex model dataShareOperationAuditRecord extends auditData {
   }
 
@@ -94192,18 +94784,28 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Defender Case Management events.
    */
+  @open
   @complex model defenderCaseManagementAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Defender Preview Features events.
    */
+  @open
   @complex model defenderPreviewFeaturesRecord extends auditData {
   }
 
+  /**
+   * Audit data for Defender Security for AI Configuration events.
+   */
+  @open
+  @complex model defenderSecurityForAIConfigurationAuditRecord extends auditData {
+  }
+
   /**
    * Audit data for Deploy Feature Activity events.
    */
+  @open
   @complex model deployFeatureActivityRecord extends auditData {
   }
 
@@ -94211,6 +94813,15 @@ namespace reference.`microsoft.graph.security` {
     deploymentAccessKey: string;
   }
 
+  @complex model detectionAction {
+    alertTemplate: alertTemplate;
+    automatedActions: automatedActionSet | null;
+    organizationalScope: organizationalScope | null;
+
+    // Warning: Malformed version string '2025-01' detected.
+    responseActions: responseAction[] | null;
+  }
+
   @graphDeprecated("Tasks_And_Plans")
   @complex model detonationBehaviourDetails {
     actionStatus: string | null;
@@ -94258,18 +94869,21 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Device Discovery Settings Authenticated Scans events.
    */
+  @open
   @complex model deviceDiscoverySettingsAuthenticatedScansRecord extends auditData {
   }
 
   /**
    * Audit data for Device Discovery Settings Exclusion events.
    */
+  @open
   @complex model deviceDiscoverySettingsExclusionRecord extends auditData {
   }
 
   /**
    * Audit data for Device Discovery Settings events.
    */
+  @open
   @complex model deviceDiscoverySettingsRecord extends auditData {
   }
 
@@ -94315,27 +94929,37 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for eDiscovery events.
    */
+  @open
   @complex model discoveryAuditRecord extends auditData {
   }
 
   /**
    * Audit data for DLP Endpoint events.
    */
+  @open
   @complex model dlpEndpointAuditRecord extends auditData {
   }
 
   /**
    * Audit data for DLP Import Result events.
    */
+  @open
   @complex model dlpImportResultAuditRecord extends auditData {
   }
 
   /**
    * Audit data for DLP Sensitive Information Type Rule Package cmdlet events.
    */
+  @open
   @complex model dlpSensitiveInformationTypeRulePackageCmdletRecord extends auditData {
   }
 
+  @complex model dnsEntityMapping extends entityMapping {
+    domainNameColumn: string;
+    hostIpAddressColumn: string;
+    serverIpColumn: string;
+  }
+
   @complex model dnsEvidence extends alertEvidence {
     dnsServerIp: ipEvidence | null;
     domainName: string | null;
@@ -94348,6 +94972,34 @@ namespace reference.`microsoft.graph.security` {
     justificationMessage: string | null;
   }
 
+  /**
+   * Audit data for Dragon Copilot Access events.
+   */
+  @open
+  @complex model dragonCopilotAccessRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Dragon Copilot Admin events.
+   */
+  @open
+  @complex model dragonCopilotAdminRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Dragon Copilot Clinical Data events.
+   */
+  @open
+  @complex model dragonCopilotClinicalDataRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Dragon Copilot Session events.
+   */
+  @open
+  @complex model dragonCopilotSessionRecord extends auditData {
+  }
+
   @open
   @complex model dynamicColumnValue {
   }
@@ -94355,12 +95007,14 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Dynamics365 Business Central events.
    */
+  @open
   @complex model dynamics365BusinessCentralAuditRecord extends auditData {
   }
 
   /**
    * Audit data for EHR Connector events.
    */
+  @open
   @complex model ehrConnectorAuditBaseRecord extends auditData {
   }
 
@@ -94379,6 +95033,37 @@ namespace reference.`microsoft.graph.security` {
   @complex model enableUserIncidentTaskResponseAction extends incidentTaskResponseAction {
   }
 
+  @abstract
+  @complex model entityMapping {
+  }
+
+  @complex model entityMappingConfiguration {
+    accounts: accountEntityMapping[];
+    amazonResources: amazonResourceEntityMapping[];
+    azureResources: azureResourceEntityMapping[];
+    cloudApplications: cloudApplicationEntityMapping[];
+    dns: dnsEntityMapping[];
+    files: fileEntityMapping[];
+    googleCloudResources: googleCloudResourceEntityMapping[];
+    hosts: hostEntityMapping[];
+    ips: ipEntityMapping[];
+    mailboxes: mailboxEntityMapping[];
+    mailClusters: mailClusterEntityMapping[];
+    mailMessages: mailMessageEntityMapping[];
+    oAuthApplications: oAuthApplicationEntityMapping[];
+    processes: processEntityMapping[];
+    registryValues: registryValueEntityMapping[];
+    securityGroups: securityGroupEntityMapping[];
+    urls: urlEntityMapping[];
+  }
+
+  /**
+   * Audit data for EOP Submission Feed Entity events.
+   */
+  @open
+  @complex model eopSubmissionFeedEntityAuditRecord extends auditData {
+  }
+
   @complex model eventPropagationResult {
     location: string | null;
     serviceName: string | null;
@@ -94394,30 +95079,35 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Exchange Admin events.
    */
+  @open
   @complex model exchangeAdminAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Exchange Aggregated Mailbox events.
    */
+  @open
   @complex model exchangeAggregatedMailboxAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Exchange Aggregated Operation events.
    */
+  @open
   @complex model exchangeAggregatedOperationRecord extends auditData {
   }
 
   /**
    * Audit data for Exchange Mailbox Audit Group events.
    */
+  @open
   @complex model exchangeMailboxAuditGroupRecord extends auditData {
   }
 
   /**
    * Audit data for Exchange Mailbox events.
    */
+  @open
   @complex model exchangeMailboxAuditRecord extends auditData {
   }
 
@@ -94430,9 +95120,17 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Microsoft Fabric events.
    */
+  @open
   @complex model fabricAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Fabric Policy events.
+   */
+  @open
+  @complex model fabricPolicyRecord extends auditData {
+  }
+
   @complex model fileAction extends automatedAction {
     deviceGroupNames: string[] | null;
     sha1Column: string | null;
@@ -94452,6 +95150,12 @@ namespace reference.`microsoft.graph.security` {
     signer: string | null;
   }
 
+  @complex model fileEntityMapping extends entityMapping {
+    nameColumn: string | null;
+    sha1Column: string | null;
+    sha256Column: string | null;
+  }
+
   @complex model fileEvidence extends alertEvidence {
     detectionStatus: detectionStatus | null;
     fileDetails: fileDetails | null;
@@ -94541,6 +95245,10 @@ namespace reference.`microsoft.graph.security` {
     webUrl: string | null;
   }
 
+  @complex model googleCloudResourceEntityMapping extends entityMapping {
+    fullResourceNameColumn: string;
+  }
+
   @complex model googleCloudResourceEvidence extends alertEvidence {
     fullResourceName: string | null;
     location: string | null;
@@ -94564,15 +95272,25 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Healthcare Signal events.
    */
+  @open
   @complex model healthcareSignalRecord extends auditData {
   }
 
   /**
    * Audit data for Hosted RPA events.
    */
+  @open
   @complex model hostedRpaAuditRecord extends auditData {
   }
 
+  @complex model hostEntityMapping extends entityMapping {
+    deviceIdColumn: string | null;
+    dnsDomainColumn: string | null;
+    nameColumn: string | null;
+    netBiosNameColumn: string | null;
+    ntDomainColumn: string | null;
+  }
+
   @complex model hostLogonSessionEvidence extends alertEvidence {
     account: userEvidence | null;
     endUtcDateTime: offsetDateTime | null;
@@ -94612,6 +95330,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for HR Signal events.
    */
+  @open
   @complex model hrSignalAuditRecord extends auditData {
   }
 
@@ -94676,6 +95395,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Hygiene Event events.
    */
+  @open
   @complex model hygieneEventRecord extends auditData {
   }
 
@@ -94716,6 +95436,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Information Barrier Policy Application events.
    */
+  @open
   @complex model informationBarrierPolicyApplicationAuditRecord extends auditData {
   }
 
@@ -94726,6 +95447,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Information Worker Protection events.
    */
+  @open
   @complex model informationWorkerProtectionAuditRecord extends auditData {
   }
 
@@ -94738,24 +95460,28 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Insider Risk Scoped User Insights events.
    */
+  @open
   @complex model insiderRiskScopedUserInsightsRecord extends auditData {
   }
 
   /**
    * Audit data for Insider Risk Scoped Users events.
    */
+  @open
   @complex model insiderRiskScopedUsersRecord extends auditData {
   }
 
   /**
    * Audit data for Integrated Apps App Admin Activity events.
    */
+  @open
   @complex model integratedAppsAppAdminActivityAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Integrated Apps App Settings Admin Activity events.
    */
+  @open
   @complex model integratedAppsAppSettingsAdminActivityAuditRecord extends auditData {
   }
 
@@ -94800,6 +95526,11 @@ namespace reference.`microsoft.graph.security` {
     zone: string | null;
   }
 
+  @complex model ipEntityMapping extends entityMapping {
+    addressColumn: string | null;
+    scopeColumn: string | null;
+  }
+
   @complex model ipEvidence extends alertEvidence {
     countryLetterCode: string | null;
     ipAddress: string | null;
@@ -94810,12 +95541,14 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for IRM Activity Audit Trail events.
    */
+  @open
   @complex model irmActivityAuditTrailRecord extends auditData {
   }
 
   /**
    * Audit data for IRM User Defined Detection events.
    */
+  @open
   @complex model irmUserDefinedDetectionRecord extends auditData {
   }
 
@@ -94841,6 +95574,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Microsoft Kaizala events.
    */
+  @open
   @complex model kaizalaAuditRecord extends auditData {
   }
 
@@ -94916,12 +95650,14 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Label Analytics Aggregate events.
    */
+  @open
   @complex model labelAnalyticsAggregateAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Label Content Explorer events.
    */
+  @open
   @complex model labelContentExplorerAuditRecord extends auditData {
   }
 
@@ -94935,6 +95671,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Large Content Meta events.
    */
+  @open
   @complex model largeContentMetadataAuditRecord extends auditData {
   }
 
@@ -94946,24 +95683,28 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for M365 Compliance Connector events.
    */
+  @open
   @complex model m365ComplianceConnectorAuditRecord extends auditData {
   }
 
   /**
    * Audit data for M365daad events.
    */
+  @open
   @complex model m365daadAuditRecord extends auditData {
   }
 
   /**
    * Audit data for M365odsp Asset Meta events.
    */
+  @open
   @complex model m365odspAssetMetadataRecord extends auditData {
   }
 
   /**
    * Audit data for M365 Search Sections events.
    */
+  @open
   @complex model m365SearchSectionsRecord extends auditData {
   }
 
@@ -94976,6 +95717,10 @@ namespace reference.`microsoft.graph.security` {
     upn: string | null;
   }
 
+  @complex model mailboxEntityMapping extends entityMapping {
+    primaryAddressColumn: string;
+  }
+
   @complex model mailboxEvidence extends alertEvidence {
     displayName: string | null;
     primaryAddress: string | null;
@@ -94983,6 +95728,11 @@ namespace reference.`microsoft.graph.security` {
     userAccount: userAccount | null;
   }
 
+  @complex model mailClusterEntityMapping extends entityMapping {
+    queryColumn: string;
+    sourceColumn: string;
+  }
+
   @complex model mailClusterEvidence extends alertEvidence {
     clusterBy: string | null;
     clusterByValue: string | null;
@@ -94992,9 +95742,17 @@ namespace reference.`microsoft.graph.security` {
     urn: string | null;
   }
 
+  @complex model mailMessageEntityMapping extends entityMapping {
+    networkMessageIdColumn: string;
+    recipientColumn: string;
+    senderColumn: string;
+    subjectColumn: string;
+  }
+
   /**
    * Audit data for Mail Submission events.
    */
+  @open
   @complex model mailSubmissionData extends auditData {
   }
 
@@ -95008,36 +95766,42 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Managed Services events.
    */
+  @open
   @complex model managedServicesAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Managed Tenants events.
    */
+  @open
   @complex model managedTenantsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MAPG Alerts events.
    */
+  @open
   @complex model mapgAlertsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MAPG Onboard events.
    */
+  @open
   @complex model mapgOnboardAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MAPG Policy events.
    */
+  @open
   @complex model mapgPolicyAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MAPG Remediation events.
    */
+  @open
   @complex model mapgRemediationAuditRecord extends auditData {
   }
 
@@ -95054,36 +95818,49 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for MCAS Alerts events.
    */
+  @open
   @complex model mcasAlertsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MDA events.
    */
+  @open
   @complex model mdaAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MDA Data Security Signal events.
    */
+  @open
   @complex model mdaDataSecuritySignalRecord extends auditData {
   }
 
+  /**
+   * Audit data for MDASH events.
+   */
+  @open
+  @complex model mDASHAuditRecord extends auditData {
+  }
+
   /**
    * Audit data for MDATP events.
    */
+  @open
   @complex model mdatpAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MDC Events events.
    */
+  @open
   @complex model mdcEventsRecord extends auditData {
   }
 
   /**
    * Audit data for MDI events.
    */
+  @open
   @complex model mdiAuditRecord extends auditData {
   }
 
@@ -95094,6 +95871,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Mesh Worlds events.
    */
+  @open
   @complex model meshWorldsAuditRecord extends auditData {
   }
 
@@ -95105,153 +95883,185 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Microsoft365 Backup Backup Item events.
    */
+  @open
   @complex model microsoft365BackupBackupItemAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft365 Backup Backup Policy events.
    */
+  @open
   @complex model microsoft365BackupBackupPolicyAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft365 Backup Granular Browse Task events.
    */
+  @open
   @complex model microsoft365BackupGranularBrowseTaskAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft365 Backup Restore Item events.
    */
+  @open
   @complex model microsoft365BackupRestoreItemAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft365 Backup Restore Task events.
    */
+  @open
   @complex model microsoft365BackupRestoreTaskAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft365 Copilot Scheduled Prompt events.
    */
+  @open
   @complex model microsoft365CopilotScheduledPromptAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Defender Experts XDR events.
    */
+  @open
   @complex model microsoftDefenderExpertsXDRAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Flow events.
    */
+  @open
   @complex model microsoftFlowAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Forms events.
    */
+  @open
   @complex model microsoftFormsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Graph Data Connect Consent events.
    */
+  @open
   @complex model microsoftGraphDataConnectConsent extends auditData {
   }
 
   /**
    * Audit data for Microsoft Graph Data Connect Operation events.
    */
+  @open
   @complex model microsoftGraphDataConnectOperation extends auditData {
   }
 
   /**
    * Audit data for Microsoft Purview Data Catalog Operation events.
    */
+  @open
   @complex model microsoftPurviewDataCatalogOperationRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Purview Data Map Operation events.
    */
+  @open
   @complex model microsoftPurviewDataMapOperationRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Purview Metadata Policy Operation events.
    */
+  @open
   @complex model microsoftPurviewMetadataPolicyOperationRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Purview Policy Operation events.
    */
+  @open
   @complex model microsoftPurviewPolicyOperationRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Purview Privacy Audit Event events.
    */
+  @open
   @complex model microsoftPurviewPrivacyAuditEvent extends auditData {
   }
 
   /**
    * Audit data for Microsoft Purview Unified Catalog Operation events.
    */
+  @open
   @complex model microsoftPurviewUnifiedCatalogOperationRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Stream events.
    */
+  @open
   @complex model microsoftStreamAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Teams Admin events.
    */
+  @open
   @complex model microsoftTeamsAdminAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Teams Analytics events.
    */
+  @open
   @complex model microsoftTeamsAnalyticsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Teams events.
    */
+  @open
   @complex model microsoftTeamsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Teams Device events.
    */
+  @open
   @complex model microsoftTeamsDeviceAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Teams Retention Label Action events.
    */
+  @open
   @complex model microsoftTeamsRetentionLabelActionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Teams Sensitivity Label Action events.
    */
+  @open
   @complex model microsoftTeamsSensitivityLabelActionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Microsoft Teams Shifts events.
    */
+  @open
   @complex model microsoftTeamsShiftsAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Microsoft Teams User Concern events.
+   */
+  @open
+  @complex model microsoftTeamsUserConcernAuditRecord extends auditData {
+  }
+
   @complex model migrateSensorsResult {
     failedMigrationSensorIds: string[] | null;
     successfulMigrationSensorIds: string[] | null;
@@ -95260,60 +96070,70 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for MIP Auto Label Exchange Item events.
    */
+  @open
   @complex model mipAutoLabelExchangeItemAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MIP Auto Label Progress Feedback events.
    */
+  @open
   @complex model mipAutoLabelProgressFeedbackAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MIP Auto Label SharePoint Item events.
    */
+  @open
   @complex model mipAutoLabelSharePointItemAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MIP Auto Label SharePoint Policy Location events.
    */
+  @open
   @complex model mipAutoLabelSharePointPolicyLocationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MIP Auto Label Simulation SharePoint Completion events.
    */
+  @open
   @complex model mipAutoLabelSimulationSharePointCompletionRecord extends auditData {
   }
 
   /**
    * Audit data for MIP Auto Label Simulation SharePoint Progress events.
    */
+  @open
   @complex model mipAutoLabelSimulationSharePointProgressRecord extends auditData {
   }
 
   /**
    * Audit data for MIP Auto Label Simulation Statistics events.
    */
+  @open
   @complex model mipAutoLabelSimulationStatisticsRecord extends auditData {
   }
 
   /**
    * Audit data for MIP Exact Data Match events.
    */
+  @open
   @complex model mipExactDataMatchAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MIP Label Analytics events.
    */
+  @open
   @complex model mipLabelAnalyticsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MIP Label events.
    */
+  @open
   @complex model mipLabelAuditRecord extends auditData {
   }
 
@@ -95330,9 +96150,17 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for MOS Agent Info events.
    */
+  @open
   @complex model mosAgentInfoRecord extends auditData {
   }
 
+  /**
+   * Audit data for MOS Agent Info V2 events.
+   */
+  @open
+  @complex model mosAgentInfoRecordV2 extends auditData {
+  }
+
   // Warning: Malformed version string '2025-01' detected.
   // Warning: Malformed version string '2025-01' detected.
   @complex model moveToDeletedItemsResponseAction extends responseAction {
@@ -95354,66 +96182,84 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for MS365D Custom Detection events.
    */
+  @open
   @complex model ms365dCustomDetectionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MS365D Incident events.
    */
+  @open
   @complex model ms365dIncidentAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MS365D Suppression Rule events.
    */
+  @open
   @complex model ms365dSuppressionRuleAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MSDE Custom Collection events.
    */
+  @open
   @complex model msdeCustomCollectionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MSDE General Settings events.
    */
+  @open
   @complex model msdeGeneralSettingsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MSDE Indicators Settings events.
    */
+  @open
   @complex model msdeIndicatorsSettingsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MSDE Response Actions events.
    */
+  @open
   @complex model msdeResponseActionsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for MSDE Roles Settings events.
    */
+  @open
   @complex model msdeRolesSettingsAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for MSP Vector Search Content Metadata events.
+   */
+  @open
+  @complex model mspVectorSearchContentMetadataAuditRecord extends auditData {
+  }
+
   /**
    * Audit data for MSTIC Nation State Notification events.
    */
+  @open
   @complex model msticNationStateNotificationRecord extends auditData {
   }
 
   /**
    * Audit data for Multi Stage Disposition events.
    */
+  @open
   @complex model multiStageDispositionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for My Analytics Settings events.
    */
+  @open
   @complex model myAnalyticsSettingsAuditRecord extends auditData {
   }
 
@@ -95434,9 +96280,14 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Noisy Alert Policy events.
    */
+  @open
   @complex model noisyAlertPolicyAuditRecord extends auditData {
   }
 
+  @complex model oAuthApplicationEntityMapping extends entityMapping {
+    oAuthAppIdColumn: string;
+  }
+
   @complex model oauthApplicationEvidence extends alertEvidence {
     appId: string | null;
     displayName: string | null;
@@ -95453,42 +96304,49 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Office Native events.
    */
+  @open
   @complex model officeNativeAuditRecord extends auditData {
   }
 
   /**
    * Audit data for OME Portal events.
    */
+  @open
   @complex model omePortalAuditRecord extends auditData {
   }
 
   /**
    * Audit data for On Demand SharePoint Classification events.
    */
+  @open
   @complex model onDemandSharePointClassificationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for OneDrive events.
    */
+  @open
   @complex model oneDriveAuditRecord extends auditData {
   }
 
   /**
    * Audit data for On Premises File Share Scanner DLP events.
    */
+  @open
   @complex model onPremisesFileShareScannerDLPAuditRecord extends auditData {
   }
 
   /**
    * Audit data for On Premises SharePoint Scanner DLP events.
    */
+  @open
   @complex model onPremisesSharePointScannerDLPAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Organizational Data In M365 events.
    */
+  @open
   @complex model organizationalDataInM365AuditRecord extends auditData {
   }
 
@@ -95505,273 +96363,330 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Outlook Copilot Automation events.
    */
+  @open
   @complex model outlookCopilotAutomationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for OWA Get Access Token For Resource events.
    */
+  @open
   @complex model owaGetAccessTokenForResourceAuditRecord extends auditData {
   }
 
   /**
    * Audit data for P4AI Assessment Category events.
    */
+  @open
   @complex model p4aiAssessmentCategoryRecord extends auditData {
   }
 
   /**
    * Audit data for P4AI Assessment Fabric Scanner events.
    */
+  @open
   @complex model p4aiAssessmentFabricScannerRecord extends auditData {
   }
 
   /**
    * Audit data for P4AI Assessment Location Result events.
    */
+  @open
   @complex model p4aiAssessmentLocationResultRecord extends auditData {
   }
 
   /**
    * Audit data for P4AI Assessment events.
    */
+  @open
   @complex model p4aiAssessmentRecord extends auditData {
   }
 
+  /**
+   * Audit data for P4 AI Risk Score events.
+   */
+  @open
+  @complex model p4AIRiskScoreRecord extends auditData {
+  }
+
   /**
    * Audit data for People Admin Settings events.
    */
+  @open
   @complex model peopleAdminSettingsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Physical Badging Signal events.
    */
+  @open
   @complex model physicalBadgingSignalAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Places Directory events.
    */
+  @open
   @complex model placesDirectoryAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Chat Message events.
    */
+  @open
   @complex model plannerChatMessageAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Chat Message List events.
    */
+  @open
   @complex model plannerChatMessageListAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Copy Plan events.
    */
+  @open
   @complex model plannerCopyPlanAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Goal events.
    */
+  @open
   @complex model plannerGoalAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Goal List events.
    */
+  @open
   @complex model plannerGoalListAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Plan events.
    */
+  @open
   @complex model plannerPlanAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Plan List events.
    */
+  @open
   @complex model plannerPlanListAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Plan Sensitivity Label events.
    */
+  @open
   @complex model plannerPlanSensitivityLabelAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Roster events.
    */
+  @open
   @complex model plannerRosterAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Roster Sensitivity Label events.
    */
+  @open
   @complex model plannerRosterSensitivityLabelAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Task events.
    */
+  @open
   @complex model plannerTaskAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Task List events.
    */
+  @open
   @complex model plannerTaskListAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Planner Tenant Settings events.
    */
+  @open
   @complex model plannerTenantSettingsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Policy Config Change events.
    */
+  @open
   @complex model policyConfigChangeAuditRecord extends auditData {
   }
 
   /**
    * Audit data for PowerApps Audit App events.
    */
+  @open
   @complex model powerAppsAuditAppRecord extends auditData {
   }
 
   /**
    * Audit data for PowerApps Audit Plan events.
    */
+  @open
   @complex model powerAppsAuditPlanRecord extends auditData {
   }
 
   /**
    * Audit data for PowerApps Audit Resource events.
    */
+  @open
   @complex model powerAppsAuditResourceRecord extends auditData {
   }
 
   /**
    * Audit data for Power BI events.
    */
+  @open
   @complex model powerBIAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Power BI DLP events.
    */
+  @open
   @complex model powerBIDlpAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Power Pages Site events.
    */
+  @open
   @complex model powerPagesSiteAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Power Platform Admin DLP events.
    */
+  @open
   @complex model powerPlatformAdminDlpAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Power Platform Admin Environment events.
    */
+  @open
   @complex model powerPlatformAdminEnvironmentAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Power Platform Administrator Activity events.
    */
+  @open
   @complex model powerPlatformAdministratorActivityRecord extends auditData {
   }
 
   /**
    * Audit data for Power Platform Lockbox Resource Access Request events.
    */
+  @open
   @complex model powerPlatformLockboxResourceAccessRequestAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Power Platform Lockbox Resource Command events.
    */
+  @open
   @complex model powerPlatformLockboxResourceCommandAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Power Platform Service Activity events.
    */
+  @open
   @complex model powerPlatformServiceActivityAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Power Platform Tenant Isolation events.
    */
+  @open
   @complex model powerPlatformTenantIsolationRecord extends auditData {
   }
 
   /**
    * Audit data for Privacy Data Match events.
    */
+  @open
   @complex model privacyDataMatchAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Privacy Data Minimization events.
    */
+  @open
   @complex model privacyDataMinimizationRecord extends auditData {
   }
 
   /**
    * Audit data for Privacy Digest Email events.
    */
+  @open
   @complex model privacyDigestEmailRecord extends auditData {
   }
 
   /**
    * Audit data for Privacy Open Access events.
    */
+  @open
   @complex model privacyOpenAccessAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Privacy Portal events.
    */
+  @open
   @complex model privacyPortalAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Privacy Remediation Action events.
    */
+  @open
   @complex model privacyRemediationActionRecord extends auditData {
   }
 
   /**
    * Audit data for Privacy Remediation events.
    */
+  @open
   @complex model privacyRemediationRecord extends auditData {
   }
 
   /**
    * Audit data for Priva Privacy Assessment Operation events.
    */
+  @open
   @complex model privaPrivacyAssessmentOperationRecord extends auditData {
   }
 
   /**
    * Audit data for Priva Privacy Consent Operation events.
    */
+  @open
   @complex model privaPrivacyConsentOperationRecord extends auditData {
   }
 
+  @complex model processEntityMapping extends entityMapping {
+    sha1Column: string | null;
+    sha256Column: string | null;
+  }
+
   @complex model processEvidence extends alertEvidence {
     detectionStatus: detectionStatus | null;
     imageFile: fileDetails | null;
@@ -95788,48 +96703,56 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Microsoft Project events.
    */
+  @open
   @complex model projectAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Project for the Web Assigned To Me Settings events.
    */
+  @open
   @complex model projectForTheWebAssignedToMeSettingsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Project for the Web Project events.
    */
+  @open
   @complex model projectForTheWebProjectAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Project for the Web Project Settings events.
    */
+  @open
   @complex model projectForTheWebProjectSettingsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Project for the Web Roadmap events.
    */
+  @open
   @complex model projectForTheWebRoadmapAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Project for the Web Roadmap Item events.
    */
+  @open
   @complex model projectForTheWebRoadmapItemAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Project for the Web Roadmap Settings events.
    */
+  @open
   @complex model projectForTheWebRoadmapSettingsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Project for the Web Task events.
    */
+  @open
   @complex model projectForTheWebTaskAuditRecord extends auditData {
   }
 
@@ -95846,36 +96769,42 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Exchange public folder events.
    */
+  @open
   @complex model publicFolderAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Purview Insider Risk Alerts events.
    */
+  @open
   @complex model purviewInsiderRiskAlertsRecord extends auditData {
   }
 
   /**
    * Audit data for Purview Insider Risk Cases events.
    */
+  @open
   @complex model purviewInsiderRiskCasesRecord extends auditData {
   }
 
   /**
    * Audit data for Purview MC Recommendation events.
    */
+  @open
   @complex model purviewMCRecommendationRecord extends auditData {
   }
 
   /**
    * Audit data for Purview Posture Agent events.
    */
+  @open
   @complex model purviewPostureAgentAuditRecord extends auditData {
   }
 
   /**
    * Audit data for quarantine events.
    */
+  @open
   @complex model quarantineAuditRecord extends auditData {
   }
 
@@ -95900,6 +96829,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Records Management events.
    */
+  @open
   @complex model recordsManagementAuditRecord extends auditData {
   }
 
@@ -95915,6 +96845,11 @@ namespace reference.`microsoft.graph.security` {
     registryKey: string | null;
   }
 
+  @complex model registryValueEntityMapping extends entityMapping {
+    keyColumn: string;
+    valueNameColumn: string;
+  }
+
   @complex model registryValueEvidence extends alertEvidence {
     mdeDeviceId: string | null;
     registryHive: string | null;
@@ -95948,12 +96883,14 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Report Submission events.
    */
+  @open
   @complex model reportSubmission extends auditData {
   }
 
   /**
    * Audit data for Report Submission Result Detail events.
    */
+  @open
   @complex model reportSubmissionResultDetail extends auditData {
   }
 
@@ -95986,6 +96923,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Restricted Mode events.
    */
+  @open
   @complex model restrictedModeAuditRecord extends auditData {
   }
 
@@ -96008,12 +96946,14 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Retention Policy events.
    */
+  @open
   @complex model retentionPolicyAuditRecord extends auditData {
   }
 
   /**
    * Audit data for RTI Operations Agent events.
    */
+  @open
   @complex model rtiOperationsAgentAuditRecord extends auditData {
   }
 
@@ -96061,69 +97001,100 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for SBP Configuration Event events.
    */
+  @open
   @complex model sbpConfigurationEventRecord extends auditData {
   }
 
   /**
    * Audit data for SBP Usage Event events.
    */
+  @open
   @complex model sbpUsageEventRecord extends auditData {
   }
 
   /**
    * Audit data for Secure Score evidence events.
    */
+  @open
   @complex model scoreEvidence extends auditData {
   }
 
   /**
    * Audit data for Score Platform Generic events.
    */
+  @open
   @complex model scorePlatformGenericAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Script Run events.
    */
+  @open
   @complex model scriptRunAuditRecord extends auditData {
   }
 
   /**
    * Audit data for search events.
    */
+  @open
   @complex model searchAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Security Compliance Alert events.
    */
+  @open
   @complex model securityComplianceAlertRecord extends auditData {
   }
 
   /**
    * Audit data for Security Compliance Center EOP cmdlet events.
    */
+  @open
   @complex model securityComplianceCenterEOPCmdletAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Security Compliance Insights events.
    */
+  @open
   @complex model securityComplianceInsightsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Security Compliance RBAC events.
    */
+  @open
   @complex model securityComplianceRBACAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Security Compliance User Change events.
    */
+  @open
   @complex model securityComplianceUserChangeAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Security Copilot Identity Management events.
+   */
+  @open
+  @complex model securityCopilotIdentityManagementAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Security Development Lifecycle AI Log events.
+   */
+  @open
+  @complex model securityDevelopmentLifecycleAILogAuditRecord extends auditData {
+  }
+
+  @complex model securityGroupEntityMapping extends entityMapping {
+    distinguishedNameColumn: string | null;
+    objectIdColumn: string | null;
+    sidColumn: string | null;
+  }
+
   @complex model securityGroupEvidence extends alertEvidence {
     activeDirectoryObjectGuid: guid | null;
     displayName: string | null;
@@ -96136,24 +97107,28 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Sensitive Info Remediation Agent events.
    */
+  @open
   @complex model sensitiveInfoRemediationAgentDataRecord extends auditData {
   }
 
   /**
    * Audit data for Sensitivity Label Action events.
    */
+  @open
   @complex model sensitivityLabelActionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Sensitivity Labeled File Action events.
    */
+  @open
   @complex model sensitivityLabeledFileActionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Sensitivity Label Policy Match events.
    */
+  @open
   @complex model sensitivityLabelPolicyMatchAuditRecord extends auditData {
   }
 
@@ -96172,54 +97147,63 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Sentinel AI Tool events.
    */
+  @open
   @complex model sentinelAIToolAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Sentinel Graph events.
    */
+  @open
   @complex model sentinelGraphAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Sentinel Job events.
    */
+  @open
   @complex model sentinelJobAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Sentinel KQL On Lake events.
    */
+  @open
   @complex model sentinelKQLOnLakeAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Sentinel Lake Data Onboarding events.
    */
+  @open
   @complex model sentinelLakeDataOnboardingAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Sentinel Lake Encryption events.
    */
+  @open
   @complex model sentinelLakeEncryptionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Sentinel Lake Onboarding events.
    */
+  @open
   @complex model sentinelLakeOnboardingAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Sentinel Notebook On Lake events.
    */
+  @open
   @complex model sentinelNotebookOnLakeAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Sentinel Package events.
    */
+  @open
   @complex model sentinelPackageAuditRecord extends auditData {
   }
 
@@ -96235,66 +97219,77 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for SharePoint App Permission Operation events.
    */
+  @open
   @complex model sharePointAppPermissionOperationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for SharePoint events.
    */
+  @open
   @complex model sharePointAuditRecord extends auditData {
   }
 
   /**
    * Audit data for SharePoint Comment Operation events.
    */
+  @open
   @complex model sharePointCommentOperationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for SharePoint Content Security Policy events.
    */
+  @open
   @complex model sharePointContentSecurityPolicyAuditRecord extends auditData {
   }
 
   /**
    * Audit data for SharePoint Content Type Operation events.
    */
+  @open
   @complex model sharePointContentTypeOperationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for SharePoint E Signature events.
    */
+  @open
   @complex model sharePointESignatureAuditRecord extends auditData {
   }
 
   /**
    * Audit data for SharePoint Field Operation events.
    */
+  @open
   @complex model sharePointFieldOperationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for SharePoint File Operation events.
    */
+  @open
   @complex model sharePointFileOperationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for SharePoint List Item Operation events.
    */
+  @open
   @complex model sharePointListItemOperationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for SharePoint List Operation events.
    */
+  @open
   @complex model sharePointListOperationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for SharePoint Sharing Operation events.
    */
+  @open
   @complex model sharePointSharingOperationAuditRecord extends auditData {
   }
 
@@ -96311,18 +97306,21 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Skype for Business cmdlets events.
    */
+  @open
   @complex model skypeForBusinessCmdletsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Skype for Business PSTN Usage events.
    */
+  @open
   @complex model skypeForBusinessPSTNUsageAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Skype for Business Users Blocked events.
    */
+  @open
   @complex model skypeForBusinessUsersBlockedAuditRecord extends auditData {
   }
 
@@ -96339,9 +97337,45 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Sonar Detonation Content Meta events.
    */
+  @open
   @complex model sonarDetonationContentMetadata extends auditData {
   }
 
+  /**
+   * Audit data for Sonar Detonation Entity events.
+   */
+  @open
+  @complex model sonarDetonationEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar File Detonation Entity events.
+   */
+  @open
+  @complex model sonarFileDetonationEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar Submission Entity events.
+   */
+  @open
+  @complex model sonarSubmissionEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Sonar URL Detonation Entity events.
+   */
+  @open
+  @complex model sonarUrlDetonationEntityAuditRecord extends auditData {
+  }
+
+  /**
+   * Audit data for Spark Core Custom Live Pool events.
+   */
+  @open
+  @complex model sparkCoreCustomLivePoolRecord extends auditData {
+  }
+
   @complex model sslCertificateEntity {
     address: reference.`microsoft.graph`.physicalAddress | null;
     alternateNames: string[] | null;
@@ -96389,6 +97423,13 @@ namespace reference.`microsoft.graph.security` {
     fileName: string | null;
   }
 
+  /**
+   * Audit data for Submission Entity events.
+   */
+  @open
+  @complex model submissionEntityAuditRecord extends auditData {
+  }
+
   @complex model submissionMailEvidence extends alertEvidence {
     networkMessageId: string | null;
     recipient: string | null;
@@ -96417,48 +97458,56 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Supervisory Review Day X Insights events.
    */
+  @open
   @complex model supervisoryReviewDayXInsightsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Synthetic Probe events.
    */
+  @open
   @complex model syntheticProbeAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Team Copilot Interaction events.
    */
+  @open
   @complex model teamCopilotInteractionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Teams Easy Approvals events.
    */
+  @open
   @complex model teamsEasyApprovalsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Teams Eval Data Hub Admin Operation events.
    */
+  @open
   @complex model teamsEvalDataHubAdminOperationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Teams Eval Data Hub Data Access events.
    */
+  @open
   @complex model teamsEvalDataHubDataAccessAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Teams Eval Data Hub Permission Change events.
    */
+  @open
   @complex model teamsEvalDataHubPermissionChangeAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Teams Healthcare events.
    */
+  @open
   @complex model teamsHealthcareAuditRecord extends auditData {
   }
 
@@ -96492,12 +97541,14 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Teams Updates events.
    */
+  @open
   @complex model teamsUpdatesAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Tenant Allow Block List events.
    */
+  @open
   @complex model tenantAllowBlockListAuditRecord extends auditData {
   }
 
@@ -96525,36 +97576,42 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Threat Finder events.
    */
+  @open
   @complex model threatFinderAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Threat Intelligence Atp Content events.
    */
+  @open
   @complex model threatIntelligenceAtpContentData extends auditData {
   }
 
   /**
    * Audit data for Threat Intelligence Export events.
    */
+  @open
   @complex model threatIntelligenceExportAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Threat Intelligence Mail events.
    */
+  @open
   @complex model threatIntelligenceMailData extends auditData {
   }
 
   /**
    * Audit data for Threat Intelligence Object events.
    */
+  @open
   @complex model threatIntelligenceObjectAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Threat Intelligence Url Click events.
    */
+  @open
   @complex model threatIntelligenceUrlClickData extends auditData {
   }
 
@@ -96570,6 +97627,7 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Microsoft To Do events.
    */
+  @open
   @complex model todoAuditRecord extends auditData {
   }
 
@@ -96583,30 +97641,35 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Trainable Classifier events.
    */
+  @open
   @complex model trainableClassifierAuditRecord extends auditData {
   }
 
   /**
    * Audit data for UAM Operation events.
    */
+  @open
   @complex model uamOperationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Unified Group events.
    */
+  @open
   @complex model unifiedGroupAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Unified Simulation Matched Item events.
    */
+  @open
   @complex model unifiedSimulationMatchedItemAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Unified Simulation Summary events.
    */
+  @open
   @complex model unifiedSimulationSummaryAuditRecord extends auditData {
   }
 
@@ -96617,12 +97680,14 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Universal Print Management events.
    */
+  @open
   @complex model universalPrintManagementAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Universal Print Print Job events.
    */
+  @open
   @complex model universalPrintPrintJobAuditRecord extends auditData {
   }
 
@@ -96633,21 +97698,28 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for URBAC Assignment events.
    */
+  @open
   @complex model urbacAssignmentAuditRecord extends auditData {
   }
 
   /**
    * Audit data for URBAC Enable State events.
    */
+  @open
   @complex model urbacEnableStateAuditRecord extends auditData {
   }
 
   /**
    * Audit data for URBAC Role events.
    */
+  @open
   @complex model urbacRoleAuditRecord extends auditData {
   }
 
+  @complex model urlEntityMapping extends entityMapping {
+    addressColumn: string;
+  }
+
   @complex model urlEvidence extends alertEvidence {
     url: string | null;
   }
@@ -96672,12 +97744,14 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for User Training events.
    */
+  @open
   @complex model userTrainingAuditRecord extends auditData {
   }
 
   /**
    * Audit data for USX Workspace Onboarding events.
    */
+  @open
   @complex model usxWorkspaceOnboardingAuditRecord extends auditData {
   }
 
@@ -96688,156 +97762,189 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for VFAM Create Policy events.
    */
+  @open
   @complex model vfamCreatePolicyAuditRecord extends auditData {
   }
 
   /**
    * Audit data for VFAM Delete Policy events.
    */
+  @open
   @complex model vfamDeletePolicyAuditRecord extends auditData {
   }
 
   /**
    * Audit data for VFAM Update Policy events.
    */
+  @open
   @complex model vfamUpdatePolicyAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Amplify events.
    */
+  @open
   @complex model vivaAmplifyAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Engage Events events.
    */
+  @open
   @complex model vivaEngageEventsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Engage Network Association events.
    */
+  @open
   @complex model vivaEngageNetworkAssociationAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Engage Segment events.
    */
+  @open
   @complex model vivaEngageSegmentAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Glint Advanced Configuration events.
    */
+  @open
   @complex model vivaGlintAdvancedConfigurationAuditRecord extends auditData {
   }
 
+  /**
+   * Audit data for Viva Glint Agentic Campaign events.
+   */
+  @open
+  @complex model vivaGlintAgenticCampaignAuditRecord extends auditData {
+  }
+
   /**
    * Audit data for Viva Glint Feedback Program events.
    */
+  @open
   @complex model vivaGlintFeedbackProgramAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Glint Organizational events.
    */
+  @open
   @complex model vivaGlintOrganizationalDataAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Glint Pulse Program events.
    */
+  @open
   @complex model vivaGlintPulseProgramAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Glint Pulse Program Respondent Rate events.
    */
+  @open
   @complex model vivaGlintPulseProgramRespondentRateAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Glint Question events.
    */
+  @open
   @complex model vivaGlintQuestionAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Glint Role events.
    */
+  @open
   @complex model vivaGlintRoleAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Glint Rubicon events.
    */
+  @open
   @complex model vivaGlintRubiconAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Glint Support Access events.
    */
+  @open
   @complex model vivaGlintSupportAccessAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Glint System events.
    */
+  @open
   @complex model vivaGlintSystemAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Glint User events.
    */
+  @open
   @complex model vivaGlintUserAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Glint User Group events.
    */
+  @open
   @complex model vivaGlintUserGroupAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Goals events.
    */
+  @open
   @complex model vivaGoalsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Learning Admin events.
    */
+  @open
   @complex model vivaLearningAdminAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Learning events.
    */
+  @open
   @complex model vivaLearningAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Pulse Admin events.
    */
+  @open
   @complex model vivaPulseAdminAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Pulse Organizer events.
    */
+  @open
   @complex model vivaPulseOrganizerAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Pulse Report events.
    */
+  @open
   @complex model vivaPulseReportAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Viva Pulse Response events.
    */
+  @open
   @complex model vivaPulseResponseAuditRecord extends auditData {
   }
 
@@ -96851,12 +97958,14 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for WDATP Alerts events.
    */
+  @open
   @complex model wdatpAlertsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Web Content Filtering events.
    */
+  @open
   @complex model webContentFilteringAuditRecord extends auditData {
   }
 
@@ -96878,37 +97987,31 @@ namespace reference.`microsoft.graph.security` {
   /**
    * Audit data for Windows365 Customer Lockbox events.
    */
+  @open
   @complex model windows365CustomerLockboxAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Workplace Analytics events.
    */
+  @open
   @complex model workplaceAnalyticsAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Yammer events.
    */
+  @open
   @complex model yammerAuditRecord extends auditData {
   }
 
   /**
    * Audit data for Yammer User Hiding events.
    */
+  @open
   @complex model yammerUserHidingAuditRecord extends auditData {
   }
 
-  @entity model accountEntityMapping extends entityMapping {
-    aadUserIdColumn: string | null;
-    dnsDomainColumn: string | null;
-    nameColumn: string | null;
-    ntDomainColumn: string | null;
-    sidColumn: string | null;
-    upnColumn: string | null;
-    upnSuffixColumn: string | null;
-  }
-
   @entity model aggregatedEnvironment extends MsGraph.SharedModels.entity {
     count: int32;
     @computed @key kind: string;
@@ -96954,29 +98057,6 @@ namespace reference.`microsoft.graph.security` {
     title: string | null;
   }
 
-  @entity model alertTemplate extends reference.`microsoft.graph`.entity {
-
-    // Warning: Malformed version string '2025-01' detected.
-    category: string | null;
-    customDetails: alertCustomDetails | null;
-    description: string;
-
-    // Warning: Malformed version string '2025-01' detected.
-    impactedAssets: impactedAsset[];
-
-    // Warning: Malformed version string '2025-01' detected.
-    mitreTechniques: string[] | null;
-    recommendedActions: string | null;
-    severity: alertSeverity;
-    tactics: mitreTactic[] | null;
-    title: string;
-    @contains entityMappings: entityMappingConfiguration;
-  }
-
-  @entity model amazonResourceEntityMapping extends entityMapping {
-    amazonResourceIdColumn: string;
-  }
-
   @entity model analyzedEmail extends reference.`microsoft.graph`.entity {
     alertIds: string[] | null;
     attachments: analyzedEmailAttachment[] | null;
@@ -97087,10 +98167,6 @@ namespace reference.`microsoft.graph.security` {
     isAutomatic: boolean;
   }
 
-  @entity model azureResourceEntityMapping extends entityMapping {
-    resourceIdColumn: string;
-  }
-
   @abstract
   @entity model case extends reference.`microsoft.graph`.entity {
     @computed createdDateTime: offsetDateTime | null;
@@ -97101,6 +98177,10 @@ namespace reference.`microsoft.graph.security` {
     status: caseStatus | null;
   }
 
+  @entity model caseManagementRoot extends reference.`microsoft.graph`.entity {
+    @contains cases: reference.`microsoft.graph.security.caseManagement`.case[];
+  }
+
   @entity model caseOperation extends reference.`microsoft.graph`.entity {
     action: caseAction | null;
     completedDateTime: offsetDateTime | null;
@@ -97140,11 +98220,6 @@ namespace reference.`microsoft.graph.security` {
     supportedTrafficTypes: trafficType[];
   }
 
-  @entity model cloudApplicationEntityMapping extends entityMapping {
-    appIdColumn: string | null;
-    nameColumn: string | null;
-  }
-
   @abstract
   @entity model collaborationRoot extends reference.`microsoft.graph`.entity {
     @contains analyzedEmails: analyzedEmail[];
@@ -97187,19 +98262,11 @@ namespace reference.`microsoft.graph.security` {
   @entity model departmentTemplate extends filePlanDescriptorTemplate {
   }
 
-  @entity model detectionAction extends reference.`microsoft.graph`.entity {
-    automatedActions: automatedActionSet | null;
-    organizationalScope: organizationalScope | null;
-
-    // Warning: Malformed version string '2025-01' detected.
-    responseActions: responseAction[] | null;
-    @contains alertTemplate: alertTemplate;
-  }
-
   @entity model detectionRule extends reference.`microsoft.graph`.entity {
     createdBy: string;
     @computed createdDateTime: offsetDateTime;
     description: string | null;
+    detectionAction: detectionAction;
 
     // Warning: Malformed version string '2025-01' detected.
     detectorId: string | null;
@@ -97215,7 +98282,6 @@ namespace reference.`microsoft.graph.security` {
     queryCondition: queryCondition;
     schedule: ruleSchedule;
     status: detectionRuleStatus;
-    @contains detectionAction: detectionAction | null;
   }
 
   @entity model discoveredCloudAppDetail extends reference.`microsoft.graph`.entity {
@@ -97341,12 +98407,6 @@ namespace reference.`microsoft.graph.security` {
     @computed @key stageNumber: string;
   }
 
-  @entity model dnsEntityMapping extends entityMapping {
-    domainNameColumn: string;
-    hostIpAddressColumn: string;
-    serverIpColumn: string;
-  }
-
   @entity model ediscoveryAddToReviewSetOperation extends caseOperation {
     additionalDataOptions: additionalDataOptions | null;
     cloudAttachmentVersion: cloudAttachmentVersion | null;
@@ -97547,30 +98607,6 @@ namespace reference.`microsoft.graph.security` {
     role: entityDefinitionInputRole;
   }
 
-  @abstract
-  @entity model entityMapping extends reference.`microsoft.graph`.entity {
-  }
-
-  @entity model entityMappingConfiguration extends reference.`microsoft.graph`.entity {
-    @contains accounts: accountEntityMapping[];
-    @contains amazonResources: amazonResourceEntityMapping[];
-    @contains azureResources: azureResourceEntityMapping[];
-    @contains cloudApplications: cloudApplicationEntityMapping[];
-    @contains dns: dnsEntityMapping[];
-    @contains files: fileEntityMapping[];
-    @contains googleCloudResources: googleCloudResourceEntityMapping[];
-    @contains hosts: hostEntityMapping[];
-    @contains ips: ipEntityMapping[];
-    @contains mailboxes: mailboxEntityMapping[];
-    @contains mailClusters: mailClusterEntityMapping[];
-    @contains mailMessages: mailMessageEntityMapping[];
-    @contains oAuthApplications: oAuthApplicationEntityMapping[];
-    @contains processes: processEntityMapping[];
-    @contains registryValues: registryValueEntityMapping[];
-    @contains securityGroups: securityGroupEntityMapping[];
-    @contains urls: urlEntityMapping[];
-  }
-
   @entity model environment extends reference.`microsoft.graph`.entity {
     kind: environmentKind;
   }
@@ -97594,12 +98630,6 @@ namespace reference.`microsoft.graph.security` {
     fileContent: string;
   }
 
-  @entity model fileEntityMapping extends entityMapping {
-    nameColumn: string | null;
-    sha1Column: string | null;
-    sha256Column: string | null;
-  }
-
   @entity model filePlanDescriptor extends reference.`microsoft.graph`.entity {
     authority: filePlanAuthority | null;
     category: filePlanAppliedCategory | null;
@@ -97630,10 +98660,6 @@ namespace reference.`microsoft.graph.security` {
     fileUrl: string;
   }
 
-  @entity model googleCloudResourceEntityMapping extends entityMapping {
-    fullResourceNameColumn: string;
-  }
-
   @entity model healthIssue extends reference.`microsoft.graph`.entity {
     additionalInformation: string[];
     @computed createdDateTime: offsetDateTime;
@@ -97686,14 +98712,6 @@ namespace reference.`microsoft.graph.security` {
     @references host: host;
   }
 
-  @entity model hostEntityMapping extends entityMapping {
-    deviceIdColumn: string | null;
-    dnsDomainColumn: string | null;
-    nameColumn: string | null;
-    netBiosNameColumn: string | null;
-    ntDomainColumn: string | null;
-  }
-
   @entity model hostname extends host {
     registrant: string | null;
     registrar: string | null;
@@ -97846,11 +98864,6 @@ namespace reference.`microsoft.graph.security` {
     netblock: string | null;
   }
 
-  @entity model ipEntityMapping extends entityMapping {
-    addressColumn: string | null;
-    scopeColumn: string | null;
-  }
-
   @entity model labelsRoot extends reference.`microsoft.graph`.entity {
     @contains authorities: authorityTemplate[];
     @contains categories: categoryTemplate[];
@@ -97860,22 +98873,6 @@ namespace reference.`microsoft.graph.security` {
     @contains retentionLabels: retentionLabel[];
   }
 
-  @entity model mailboxEntityMapping extends entityMapping {
-    primaryAddressColumn: string;
-  }
-
-  @entity model mailClusterEntityMapping extends entityMapping {
-    queryColumn: string;
-    sourceColumn: string;
-  }
-
-  @entity model mailMessageEntityMapping extends entityMapping {
-    networkMessageIdColumn: string;
-    recipientColumn: string;
-    senderColumn: string;
-    subjectColumn: string;
-  }
-
   @entity model manualAlert extends alert {
     isExcludedFromCorrelation: boolean;
     linkToIncident: int64 | null;
@@ -97888,10 +98885,6 @@ namespace reference.`microsoft.graph.security` {
     name: string | null;
   }
 
-  @entity model oAuthApplicationEntityMapping extends entityMapping {
-    oAuthAppIdColumn: string;
-  }
-
   @entity model passiveDnsRecord extends artifact {
     collectedDateTime: offsetDateTime;
     firstSeenDateTime: offsetDateTime;
@@ -97912,16 +98905,6 @@ namespace reference.`microsoft.graph.security` {
     status: policyStatus | null;
   }
 
-  @entity model processEntityMapping extends entityMapping {
-    sha1Column: string | null;
-    sha256Column: string | null;
-  }
-
-  @entity model registryValueEntityMapping extends entityMapping {
-    keyColumn: string;
-    valueNameColumn: string;
-  }
-
   @entity model retentionEvent extends reference.`microsoft.graph`.entity {
     createdBy: reference.`microsoft.graph`.identitySet | null;
     @computed createdDateTime: offsetDateTime | null;
@@ -97985,12 +98968,6 @@ namespace reference.`microsoft.graph.security` {
     @contains informationProtection: informationProtection | null;
   }
 
-  @entity model securityGroupEntityMapping extends entityMapping {
-    distinguishedNameColumn: string | null;
-    objectIdColumn: string | null;
-    sidColumn: string | null;
-  }
-
   @entity model sensitivityLabel extends reference.`microsoft.graph`.entity {
     color: string | null;
     contentFormats: string[] | null;
@@ -98138,10 +99115,6 @@ namespace reference.`microsoft.graph.security` {
     @references group: reference.`microsoft.graph`.group;
   }
 
-  @entity model urlEntityMapping extends entityMapping {
-    addressColumn: string;
-  }
-
   @entity model urlThreatSubmission extends threatSubmission {
     webUrl: string;
   }
@@ -98949,9 +99922,35 @@ namespace reference.`microsoft.graph.security` {
     TeamsEvalDataHubPermissionChange: 445,
     TeamsEvalDataHubAdminOperation: 446,
     VivaGlintOrganizationalData: 447,
-    ReportSubmission: 448,
-    ReportSubmissionResultDetail: 449,
-    unknownFutureValue: 450,
+    AlertSubmission: 448,
+    AlertSubmissionResultDetail: 449,
+    ComplianceSitGradingSharePoint: 450,
+    CompliancePolicyGradingSharePoint: 451,
+    AzureAISearchAudit: 452,
+    P4AIRiskScoreRecord: 453,
+    DragonCopilotAdmin: 454,
+    AISpanOutputs: 455,
+    EopSubmissionFeedEntity: 456,
+    SonarFileDetonationEntity: 457,
+    SonarSubmissionEntity: 458,
+    SonarUrlDetonationEntity: 459,
+    SubmissionEntity: 460,
+    SonarDetonationEntity: 461,
+    MicrosoftTeamsUserConcern: 462,
+    VivaGlintAgenticCampaign: 463,
+    MSPVectorSearchContentMetadata: 464,
+    FabricPolicy: 465,
+    SecurityCopilotAgentIdentityManagement: 466,
+    CopilotSessionSharing: 467,
+    DragonCopilotAccess: 468,
+    DragonCopilotClinicalData: 469,
+    DragonCopilotSession: 470,
+    MosAgentInfoRecordV2: 471,
+    SecurityDevelopmentLifecycleAILog: 472,
+    MDASH: 473,
+    DefenderSecurityForAIConfiguration: 474,
+    SparkCoreCustomLivePool: 475,
+    unknownFutureValue: 476,
   }
 
   /**
@@ -100279,6 +101278,378 @@ namespace reference.`microsoft.graph.security` {
     unknownFutureValue: 5,
   }
 
+}
+@publicNamespace("microsoft.graph.security.casemanagement")
+namespace reference.`microsoft.graph.security.caseManagement` {
+  @complex model activityResourceDetails {
+    kind: string | null;
+    resourceId: string | null;
+  }
+
+  @complex model alertCounts {
+    active: int32 | null;
+    bySeverity: incidentSeverityCounts | null;
+    byStatus: alertStatusCounts | null;
+    total: int32 | null;
+  }
+
+  @open
+  @complex model alertStatusCounts {
+    inProgress: int32 | null;
+    new: int32 | null;
+    resolved: int32 | null;
+  }
+
+  @complex model attachmentOrigin {
+    resourceId: string | null;
+    resourceType: attachmentOriginType;
+  }
+
+  @complex model booleanValueProperty extends valueProperty {
+    value: boolean;
+  }
+
+  @complex model customFieldDateTimeValue extends customFieldValue {
+    valueDateTime: offsetDateTime | null;
+  }
+
+  @complex model customFieldNumberValue extends customFieldValue {
+    value: int32 | null;
+  }
+
+  @complex model customFieldOptionsValue extends customFieldValue {
+    values: string[];
+  }
+
+  @complex model customFieldStringValue extends customFieldValue {
+    value: string | null;
+  }
+
+  @abstract
+  @complex model customFieldValue {
+  }
+
+  @open
+  @complex model customFieldValues {
+  }
+
+  @complex model exposureCaseAutomation {
+    ruleId: string | null;
+  }
+
+  @complex model exposureCaseGitHub {
+    environmentId: string | null;
+    issueNumber: int32 | null;
+    issueUrl: string | null;
+    primaryAssessmentId: string | null;
+    repoName: string | null;
+  }
+
+  @complex model exposureCaseSeemplicity {
+    configurationId: string | null;
+    configurationName: string | null;
+    providerType: string | null;
+    syncStatus: string | null;
+    ticketCreationTime: offsetDateTime | null;
+    ticketId: string | null;
+    ticketLink: string | null;
+  }
+
+  @complex model impactedAssetsCounts {
+    aiAgents: int32 | null;
+    apps: int32 | null;
+    cloudResources: int32 | null;
+    files: int32 | null;
+    ips: int32 | null;
+    machines: int32 | null;
+    mailboxes: int32 | null;
+    oauthApps: int32 | null;
+    processes: int32 | null;
+    registryKeys: int32 | null;
+    securityGroups: int32 | null;
+    total: int32 | null;
+    urls: int32 | null;
+    users: int32 | null;
+  }
+
+  @complex model incidentSeverityCounts {
+    high: int32 | null;
+    informational: int32 | null;
+    low: int32 | null;
+    medium: int32 | null;
+    `unknown`: int32 | null;
+  }
+
+  @complex model investigation {
+    count: int32 | null;
+    ids: string[];
+    state: string | null;
+  }
+
+  @complex model modifiedProperty {
+    newValue: valueProperty | null;
+    oldValue: valueProperty | null;
+    propertyName: string | null;
+  }
+
+  @complex model stringValueProperty extends valueProperty {
+    value: string | null;
+  }
+
+  @complex model thirdPartyWorkItem {
+    identifier: string;
+    instance: string;
+    @computed lastSyncedOnDateTime: offsetDateTime | null;
+    metadata: thirdPartyWorkItemMetadata | null;
+    provider: thirdPartyWorkItemProvider;
+    syncedBy: string;
+    workItemType: thirdPartyWorkItemType;
+  }
+
+  @open
+  @complex model thirdPartyWorkItemMetadata {
+  }
+
+  @abstract
+  @complex model valueProperty {
+  }
+
+  @abstract
+  @entity model activity extends caseManagementEntity {
+  }
+
+  @entity model attachment extends caseManagementEntity {
+    content: stream | null;
+    description: string | null;
+    displayName: string;
+    fileExtension: string | null;
+    fileSize: int64 | null;
+    origin: attachmentOrigin | null;
+    scanResult: attachmentScanResult;
+  }
+
+  @entity model auditLog extends activity {
+    action: auditAction;
+    details: activityResourceDetails | null;
+    modifiedProperties: modifiedProperty[];
+  }
+
+  @abstract
+  @entity model case extends caseManagementEntity {
+    customFields: customFieldValues | null;
+    displayName: string;
+    status: string;
+    @contains activities: activity[];
+    @contains attachments: attachment[];
+    @contains relations: relation[];
+    @contains tasks: task[];
+  }
+
+  @abstract
+  @entity model caseManagementEntity extends reference.`microsoft.graph`.entity {
+    createdBy: string | null;
+    @computed createdDateTime: offsetDateTime | null;
+    lastModifiedBy: string | null;
+    @computed lastModifiedDateTime: offsetDateTime | null;
+  }
+
+  @entity model comment extends activity {
+    message: string | null;
+  }
+
+  @entity model exposureCase extends case {
+    assignedTo: string | null;
+    automation: exposureCaseAutomation | null;
+    description: string | null;
+    dueDateTime: offsetDateTime | null;
+    emailNotificationRecipients: string[];
+    github: exposureCaseGitHub | null;
+    isGracePeriodEnabled: boolean;
+    priority: string | null;
+    seemplicity: exposureCaseSeemplicity | null;
+    thirdPartyWorkItem: thirdPartyWorkItem | null;
+  }
+
+  @entity model genericCase extends case {
+    assignedTo: string | null;
+    closingNotes: string | null;
+    description: string | null;
+    dueDateTime: offsetDateTime | null;
+    priority: string | null;
+  }
+
+  @entity model incidentCase extends case {
+    aiAgentIds: string[];
+    alertCounts: alertCounts | null;
+    alertPolicyIds: string[];
+    assignedTo: string | null;
+    associatedThreatIds: string[];
+    categories: string[];
+    classification: incidentClassification;
+    cloudScopes: string[];
+    dataSensitivityLabels: string[];
+    dataStreams: string[];
+    detectionSources: string[];
+    determination: incidentDetermination;
+    dueDateTime: offsetDateTime | null;
+    emailNotificationRecipients: string[];
+    firstEventTime: offsetDateTime | null;
+    impactedAssets: impactedAssetsCounts | null;
+    incidentId: int64;
+    incidentWebUrl: string | null;
+    investigation: investigation | null;
+    investigationIds: string[];
+    investigationStates: string[];
+    lastEventTime: offsetDateTime | null;
+    machineGroupIds: string[];
+    osPlatforms: string[];
+    policyNames: string[];
+    priorityScore: int32 | null;
+    productNames: string[];
+    redirectCaseId: int64 | null;
+    redirectIncidentId: int64 | null;
+    serviceSources: string[];
+    severity: incidentSeverity;
+    summary: string | null;
+    systemTags: string[];
+    topRiskScore: int32 | null;
+    workspaceIds: string[];
+  }
+
+  @entity model incidentRelation extends relation {
+  }
+
+  @entity model recommendationRelation extends relation {
+    recommendationType: string | null;
+    resourceGroupName: string | null;
+    subscriptionId: string | null;
+  }
+
+  @abstract
+  @entity model relation extends caseManagementEntity {
+    relatedResourceId: string | null;
+  }
+
+  @entity model task extends caseManagementEntity {
+    assignedTo: string | null;
+    category: caseTaskCategory;
+    closingNotes: string | null;
+    description: string | null;
+    displayName: string;
+    dueDateTime: offsetDateTime | null;
+    priority: caseTaskPriority;
+    status: taskStatus;
+  }
+
+  @entity model workspaceIndicatorRelation extends relation {
+    resourceGroupName: string | null;
+    subscriptionId: string | null;
+    workspaceName: string | null;
+  }
+
+  enum attachmentOriginType {
+    case: 0,
+    comment: 1,
+    task: 2,
+    unknownFutureValue: 3,
+  }
+
+  enum attachmentScanResult {
+    unscanned: 0,
+    noThreatsFound: 1,
+    malicious: 2,
+    unknownFutureValue: 3,
+  }
+
+  enum auditAction {
+    link: 0,
+    unlink: 1,
+    update: 2,
+    delete: 3,
+    create: 4,
+    upload: 5,
+    download: 6,
+    fileUploadMalwareDetected: 7,
+    unknownFutureValue: 8,
+  }
+
+  enum caseTaskCategory {
+    uncategorized: 0,
+    triage: 1,
+    contain: 2,
+    investigate: 3,
+    remediate: 4,
+    prevent: 5,
+    unknownFutureValue: 6,
+  }
+
+  enum caseTaskPriority {
+    notSet: 0,
+    veryLow: 1,
+    low: 2,
+    medium: 3,
+    high: 4,
+    critical: 5,
+    unknownFutureValue: 6,
+  }
+
+  enum incidentClassification {
+    `unknown`: 0,
+    falsePositive: 1,
+    truePositive: 2,
+    informationalExpectedActivity: 3,
+    unknownFutureValue: 4,
+  }
+
+  enum incidentDetermination {
+    `unknown`: 0,
+    apt: 1,
+    malware: 2,
+    securityPersonnel: 3,
+    securityTesting: 4,
+    unwantedSoftware: 5,
+    other: 6,
+    multiStagedAttack: 7,
+    compromisedAccount: 8,
+    phishing: 9,
+    maliciousUserActivity: 10,
+    notMalicious: 11,
+    notEnoughDataToValidate: 12,
+    confirmedActivity: 13,
+    lineOfBusinessApplication: 14,
+    unknownFutureValue: 15,
+  }
+
+  enum incidentSeverity {
+    `unknown`: 0,
+    informational: 1,
+    low: 2,
+    medium: 3,
+    high: 4,
+    unknownFutureValue: 5,
+  }
+
+  enum taskStatus {
+    notSet: 0,
+    new: 1,
+    inProgress: 2,
+    failed: 3,
+    partiallyCompleted: 4,
+    skipped: 5,
+    completed: 6,
+    unknownFutureValue: 7,
+  }
+
+  enum thirdPartyWorkItemProvider {
+    serviceNow: 0,
+    unknownFutureValue: 1,
+  }
+
+  enum thirdPartyWorkItemType {
+    incident: 0,
+    unknownFutureValue: 1,
+  }
+
 }
 @publicNamespace("microsoft.graph.security.dlp")
 namespace reference.`microsoft.graph.security.dlp` {
@@ -101181,6 +102552,10 @@ namespace reference.`microsoft.graph.tenantGovernanceServices` {
 
   @entity model relatedTenant extends reference.`microsoft.graph`.entity {
     @computed createdDateTime: offsetDateTime;
+    /**
+     * Indicates whether this tenant is a Microsoft infrastructure tenant.
+     */
+    isMicrosoftInfrastructure: boolean;
     @references appB2BSignInActivityMetrics: b2BSignInActivityMetrics | null;
     @references b2BRegistrationMetrics: b2bRegistrationMetrics | null;
     @references b2BSignInActivityMetrics: b2BSignInActivityMetrics | null;