@microsoft/typespec-msgraph-reference 1.0.6 → 1.0.8

package/lib/Prod/Beta/main.tsp

@@ -77,6 +77,7 @@ scalar binary; //TODO: Enables support for Edm.Binary
 @deprecatedDefinition("SignInWithAlias", "<ChangeLogCategory>", "2025-03-26", "2025-12-25", "")
 @deprecatedDefinition("Remove_Breakdown_APIs", "<ChangeLogCategory>", "2024-02-02", "2024-02-16", "The Inactive Users By Application Metric is deprecated and will stop returning data on February 16, 2024. Please use the existing Inactive Users API.")
 @deprecatedDefinition("DirectoryFeatureRolloutPolicies", "<ChangeLogCategory>", "2021-03-05", "2021-06-30", "Feature Rollout Policies have been grouped with other policies under /policies. The existing /directory/featureRolloutPolicies is deprecated and will stop returning data on 06/30/2021. Please use /policies/featureRolloutPolicies.")
+@privatePreviewDefinition("remoteTenantGroupsAPI", "2025-12-02", "2028-12-07", "<theOwner>")
 @deprecatedDefinition("Removal", "<ChangeLogCategory>", "2023-12-05", "2025-12-05", "The users enum value is deprecated. Use specificPeople instead.")
 // Metadata item DeprecatedDefinition_Removal was already defined with a different value.
 @deprecatedDefinition("Beta_SensitivityLabels", "<ChangeLogCategory>", "2021-02-15", "2022-08-15", "This API will no longer be accessible, please see microsoft.graph.security.informationProtection APIs.")
@@ -525,6 +526,11 @@ namespace reference.`microsoft.graph` {
     type: string;
   }
 
+  @complex model additionalStorageAllocations {
+    bonusQuotaInBytes: int64 | null;
+    subscriptionQuotaInBytes: int64 | null;
+  }
+
   @complex model addressBookAccountTargetContent extends accountTargetContent {
     accountTargetEmails: string[] | null;
   }
@@ -2942,8 +2948,12 @@ namespace reference.`microsoft.graph` {
   }
 
   @complex model browseQueryResponseItem {
+    createdBy: identitySet | null;
+    @computed createdDateTime: offsetDateTime | null;
     itemKey: string | null;
     itemsCount: int32 | null;
+    lastModifiedBy: identitySet | null;
+    @computed lastModifiedDateTime: offsetDateTime | null;
     name: string | null;
     sizeInBytes: string | null;
     type: browseQueryResponseItemType;
@@ -4996,6 +5006,21 @@ Each data source key can include a filter expression to narrow results and a lis
     userRole: onenoteUserRole | null;
   }
 
+  @complex model correlatedObjectLinkMapping {
+    targetProperty: string | null;
+  }
+
+  @complex model correlatedObjectLinkSource {
+    sourceIdentity: identityInfo | null;
+    targetIdentity: identityInfo | null;
+  }
+
+  @complex model correlatedObjectLinkTarget {
+    correlatedDateTime: offsetDateTime | null;
+    sourceIdentity: identityInfo | null;
+    targetIdentity: identityInfo | null;
+  }
+
   @complex model correlationError {
     code: string;
     message: string;
@@ -7912,6 +7937,17 @@ Each data source key can include a filter expression to narrow results and a lis
     rule: string | null;
   }
 
+  @complex model deviceSyncStatusResponse {
+    /**
+     * Indicates the collection of sync component statuses representing infrastructure and policy progress. Each entry represents a component that has started reporting during this sync operation. Components appear in the collection only after they begin executing. Read-only. Not nullable.
+     */
+    components: syncComponent[];
+    /**
+     * Indicates the managed device identifier. Used to correlate this sync status snapshot with the device that was synced. This is the same id used in the managedDevice entity. Example: 'd1e2f3a4-b5c6-7890-abcd-ef1234567890'. Read-only. Not nullable.
+     */
+    deviceId: string;
+  }
+
   @complex model diagnostic {
     message: string | null;
     url: string | null;
@@ -8665,6 +8701,10 @@ Each data source key can include a filter expression to narrow results and a lis
     discoveredSensitiveTypes: discoveredSensitiveType[] | null;
   }
 
+  @complex model evaluationScope {
+    type: evaluationScopeType;
+  }
+
   @abstract
   @complex model eventMessageDetail {
   }
@@ -8934,6 +8974,12 @@ Each data source key can include a filter expression to narrow results and a lis
   @complex model fallbackToMicrosoftProviderOnError extends customExtensionBehaviorOnError {
   }
 
+  @complex model familyMemberStorageQuota {
+    additionalAllocations: additionalStorageAllocations | null;
+    used: int64 | null;
+    user: identity | null;
+  }
+
   @complex model featureTarget {
     id: string | null;
     targetType: featureTargetType | null;
@@ -11159,6 +11205,17 @@ Each data source key can include a filter expression to narrow results and a lis
     submitOnlyLinkAbilities: linkRoleAbilities | null;
   }
 
+  @complex model linkStatistics {
+    correlatedAssigned: int64 | null;
+    correlatedNotAssigned: int64 | null;
+    failToCorrelate: int64 | null;
+    mapping: correlatedObjectLinkMapping | null;
+    total: int64 | null;
+    uncorrelated: int64 | null;
+    `unknown`: int64 | null;
+    unresolvedTarget: int64 | null;
+  }
+
   @complex model listInfo {
     contentTypesEnabled: boolean | null;
     hidden: boolean | null;
@@ -14067,6 +14124,10 @@ Each data source key can include a filter expression to narrow results and a lis
     totalPlaceCount: int32 | null;
   }
 
+  @complex model placeServicePlanInfo {
+    servicePlanId: string | null;
+  }
+
   @open
   @complex model plannerAppliedCategories {
   }
@@ -14449,6 +14510,9 @@ Each data source key can include a filter expression to narrow results and a lis
   @complex model policyLocationDomain extends policyLocation {
   }
 
+  @complex model policyLocationTool extends policyLocation {
+  }
+
   @complex model policyLocationUrl extends policyLocation {
   }
 
@@ -14456,6 +14520,7 @@ Each data source key can include a filter expression to narrow results and a lis
   @complex model policyScopeBase {
     activities: userActivityTypes;
     executionMode: executionMode;
+    locationExclusions: policyLocation[];
     locations: policyLocation[];
     policyActions: dlpActionInfo[];
   }
@@ -14932,6 +14997,7 @@ Each data source key can include a filter expression to narrow results and a lis
     contentEntries: processContentMetadataBase[];
     contextMetadata: contextMetadata | null;
     deviceMetadata: deviceMetadata;
+    evaluationScope: evaluationScope | null;
     integratedAppMetadata: integratedApplicationMetadata;
     protectedAppMetadata: protectedApplicationMetadata | null;
   }
@@ -15024,6 +15090,7 @@ Each data source key can include a filter expression to narrow results and a lis
 
   @complex model protectedApplicationMetadata extends integratedApplicationMetadata {
     applicationLocation: policyLocation | null;
+    sourceLocation: policyLocation | null;
   }
 
   @complex model protectedContent {
@@ -16028,6 +16095,27 @@ Each data source key can include a filter expression to narrow results and a lis
     qualityId: string | null;
   }
 
+  @complex model samlAppProfile {
+  }
+
+  @complex model samlAuthnRequest {
+  }
+
+  @complex model samlAuthnStatement {
+  }
+
+  @complex model samlCapturedSummary {
+  }
+
+  @complex model samlCertificate {
+  }
+
+  @complex model samlClaim {
+  }
+
+  @complex model samlConditions {
+  }
+
   @complex model samlIdentitySource extends permissionsDefinitionIdentitySource {
   }
 
@@ -16036,10 +16124,43 @@ Each data source key can include a filter expression to narrow results and a lis
     serviceProviderNameQualifier: string | null;
   }
 
+  @complex model samlNameIdPolicy {
+  }
+
+  @complex model samlRequestedAuthnContext {
+  }
+
+  @complex model samlResponseAssertion {
+  }
+
+  @complex model samlResponseMetadata {
+  }
+
+  @complex model samlResponseStatus {
+  }
+
+  @complex model samlScenarioRun {
+  }
+
+  @complex model samlScreenshot {
+  }
+
+  @complex model samlSignatureDetail {
+  }
+
   @complex model samlSingleSignOnSettings {
     relayState: string | null;
   }
 
+  @complex model samlSubCheck {
+  }
+
+  @complex model samlSubject {
+  }
+
+  @complex model samlSubjectConfirmation {
+  }
+
   @complex model samlTestResults {
   }
 
@@ -16630,6 +16751,7 @@ This model is shared with the CCS retrieval API and search where it is already u
     appId: string | null;
     serviceArea: string | null;
     tenantId: string | null;
+    throttledRequests: int64 | null;
     usageDateTime: offsetDateTime | null;
     usageMB: int64 | null;
     usageRequests: int64 | null;
@@ -17162,6 +17284,25 @@ This model is shared with the CCS retrieval API and search where it is already u
     nameIdPolicyFormat: string | null;
   }
 
+  @complex model syncComponent {
+    /**
+     * Indicates additional information for this sync stage. This is a flexible string that can be null (no additional info), a progress indicator such as '3/6' (completed out of total), or a list of individual item names. Read-only. Nullable.
+     */
+    moreInfo: string | null;
+    /**
+     * Indicates the sync stage name. The backend abstracts internal infrastructure into 6 user-facing stages. Fixed values are: notifyingDevice, deviceConnecting, policies, applications, scripts, compliance. Read-only. Not nullable.
+     */
+    name: string;
+    /**
+     * Indicates the date and time when this stage last reported status. The date and time information is shown using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'. Read-only. Not nullable.
+     */
+    reportedDateTime: offsetDateTime;
+    /**
+     * Indicates the current status of this sync stage. Default value is none. Possible values are: none, inProgress, success, failure, partialSuccess, unknownFutureValue. Stages only appear in the response once they have started, so none is a schema default and will not typically appear in responses. Read-only. Not nullable.
+     */
+    status: syncComponentStatus;
+  }
+
   @complex model synchronizationError {
     code: string | null;
     message: string | null;
@@ -22220,16 +22361,16 @@ capabilities, skills, security, and other manifest-defined fields.
     additionalInfo: string | null;
 
     @graphDeprecated("beta:DisplayNameRename")
-    agentDisplayName: string;
+    agentDisplayName: string | null;
 
     @graphDeprecated("beta:IdentityIDRename")
-    agentId: string;
+    agentId: string | null;
     blueprintId: string | null;
     clientSessionId: string | null;
     detectedDateTime: offsetDateTime | null;
     detectionTimingType: riskDetectionTimingType;
-    displayName: string | null;
-    identityId: string | null;
+    displayName: string;
+    identityId: string;
     identityType: agentIdentityType;
     @computed lastModifiedDateTime: offsetDateTime | null;
     riskDetail: riskDetail;
@@ -28861,6 +29002,7 @@ capabilities, skills, security, and other manifest-defined fields.
     imageDisplayName: string | null;
     isDisasterRecoveryActive: boolean;
     lastLoginResult: cloudPcLoginResult | null;
+    @computed lastLogoffDateTime: offsetDateTime | null;
     @computed lastModifiedDateTime: offsetDateTime;
     lastRemoteActionResult: cloudPcRemoteActionResult | null;
     managedDeviceId: string | null;
@@ -31345,6 +31487,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     heightAdjustableState: placeFeatureEnablement;
     mailboxDetails: mailboxDetails | null;
     mode: placeMode | null;
+    servicePlans: placeServicePlanInfo[];
   }
 
   /**
@@ -35880,6 +36023,9 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     @contains recommendationConfiguration: recommendationConfiguration | null;
     @contains recommendations: recommendation[];
     @contains recovery: reference.`microsoft.graph.entraRecoveryServices`.recovery | null;
+
+    @privatePreview("remoteTenantGroupsAPI")
+    @contains remoteTenantGroups: remoteTenantGroup[];
     @contains sharedEmailDomains: sharedEmailDomain[];
     @contains subscriptions: companySubscription[];
     @contains templates: template | null;
@@ -45400,6 +45546,26 @@ within the time frame of their original request.
     isEnabledForAllMicrosoftApplications: boolean | null;
   }
 
+  @entity model microsoftAppsFileStorageContainerAppUsage extends MsGraph.SharedModels.entity {
+    activeContainerCount: int64;
+    activeStorageUsedInBytes: int64;
+    @computed @key appId: string;
+    displayName: string | null;
+  }
+
+  @entity model microsoftAppsFileStorageContainerGeoUsage extends MsGraph.SharedModels.entity {
+    activeContainerCount: int64;
+    activeStorageUsedInBytes: int64;
+    @computed @key dataLocationCode: string;
+    @contains usageByApp: microsoftAppsFileStorageContainerAppUsage[];
+  }
+
+  @entity model microsoftAppsFileStorageContainerUsage extends entity {
+    totalActiveContainerCount: int64;
+    totalActiveStorageUsedInBytes: int64;
+    @contains usageByDataLocation: microsoftAppsFileStorageContainerGeoUsage[];
+  }
+
   @entity model microsoftAuthenticatorAuthenticationMethod extends authenticationMethod {
     clientAppName: microsoftAuthenticatorAuthenticationMethodClientAppName | null;
     deviceTag: string | null;
@@ -47828,6 +47994,7 @@ within the time frame of their original request.
     label: string | null;
     parentId: string | null;
     phone: string | null;
+    placeId: string | null;
     tags: string[];
     @contains checkIns: checkInClaim[];
     @references children: place[];
@@ -49335,6 +49502,15 @@ within the time frame of their original request.
     @contains targetDeviceGroups: targetDeviceGroup[];
   }
 
+  @privatePreview("remoteTenantGroupsAPI")
+  @entity model remoteTenantGroup extends directoryObject {
+    remoteGroupDisplayName: string | null;
+    remoteGroupId: guid | null;
+    remoteTenantDisplayName: string | null;
+    remoteTenantId: guid | null;
+    remoteTenantPrimaryDomain: string | null;
+  }
+
   @open
   @entity model removeFromLobbyOperation extends commsOperation {
   }
@@ -49357,6 +49533,7 @@ within the time frame of their original request.
     @contains dailyPrintUsageSummariesByUser: printUsageByUser[];
     @contains healthMonitoring: reference.`microsoft.graph.healthMonitoring`.healthMonitoringRoot | null;
     @contains identityAnalytics: identityAnalyticsRoot | null;
+    @contains microsoftAppsFileStorageContainerUsageSummary: microsoftAppsFileStorageContainerUsage | null;
     @contains monthlyPrintUsageByPrinter: printUsageByPrinter[];
     @contains monthlyPrintUsageByUser: printUsageByUser[];
 
@@ -49775,7 +49952,6 @@ within the time frame of their original request.
     floorNumber: int32 | null;
     isTeamsEnabled: boolean;
     nickname: string;
-    placeId: string | null;
     teamsEnabledState: placeFeatureEnablement;
     videoDeviceName: string | null;
   }
@@ -50228,6 +50404,7 @@ within the time frame of their original request.
     @contains alerts_v2: reference.`microsoft.graph.security`.alert[];
     @contains attackSimulation: attackSimulationRoot | null;
     @contains auditLog: reference.`microsoft.graph.security`.auditCoreRoot | null;
+    @contains caseManagement: reference.`microsoft.graph.security`.caseManagementRoot | null;
     @contains cases: reference.`microsoft.graph.security`.casesRoot | null;
     @contains cloudAppSecurityProfiles: cloudAppSecurityProfile[];
     @contains collaboration: reference.`microsoft.graph.security`.collaborationRoot | null;
@@ -52947,6 +53124,8 @@ within the time frame of their original request.
 
   @entity model unifiedStorageQuota extends entity {
     deleted: int64 | null;
+    familyMembersUsage: familyMemberStorageQuota[] | null;
+    isPooledStorageEnabled: boolean | null;
     manageWebUrl: string | null;
     remaining: int64 | null;
     state: string | null;
@@ -55604,6 +55783,10 @@ within the time frame of their original request.
    * You purchase multiple licenses for iOS apps through the Apple Volume Purchase Program for Business or Education. This involves setting up an Apple VPP account from the Apple website and uploading the Apple VPP Business or Education token to Intune. You can then synchronize your volume purchase information with Intune and track your volume-purchased app use. You can upload multiple Apple VPP Business or Education tokens.
    */
   @entity model vppToken extends entity {
+    /**
+     * Indicates the delivery protocol used to deliver apps associated with this VPP token. This property is set at token creation and cannot be modified afterward. Default value is default. Possible values are: default, mobileDeviceManagement, declarativeDeviceManagement. Not nullable.
+     */
+    appleDeviceAppDeliveryProtocolType: appleDeviceDeliveryProtocol;
     /**
      * The apple Id associated with the given Apple Volume Purchase Program Token.
      */
@@ -62438,7 +62621,6 @@ within the time frame of their original request.
     floorNumber: int32 | null;
     mode: placeMode | null;
     nickname: string;
-    placeId: string | null;
   }
 
   @entity model x509CertificateAuthenticationMethodConfiguration extends authenticationMethodConfiguration {
@@ -73512,6 +73694,13 @@ within the time frame of their original request.
     IgnoreLookupReferenceResolutionFailure: 2,
   }
 
+  enum evaluationScopeType {
+    tenant: 0,
+    agent: 1,
+    anonymousUser: 2,
+    unknownFutureValue: 3,
+  }
+
   #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum eventType {
     singleInstance: 0,
@@ -83289,6 +83478,33 @@ within the time frame of their original request.
     unknownFutureValue: 4,
   }
 
+  /**
+   * A list of possible status states for a sync infrastructure component or policy during a device sync operation.
+   */
+  enum syncComponentStatus {
+    /**
+     * Default. The component has not yet started reporting status. This is a schema default and will not typically appear in responses, as components only appear once they begin executing.
+     */
+    none: 0,
+    /**
+     * Indicates the component is currently executing. For infrastructure components (PNSv1, DCI, SCGW), this means the notification or check-in is in flight. For policies, this means the policy is being applied to the device.
+     */
+    inProgress: 1,
+    /**
+     * Indicates the component completed successfully. The component has finished its work and reported a successful outcome.
+     */
+    success: 2,
+    /**
+     * Indicates the stage encountered an error. When this value is set, the moreInfo property on the syncComponent will contain additional diagnostic details about the failure.
+     */
+    failure: 3,
+    /**
+     * Indicates the stage completed but not all items succeeded. For example, some policies applied successfully while others failed. The moreInfo property may contain details on the partial outcome.
+     */
+    partialSuccess: 4,
+    unknownFutureValue: 5,
+  }
+
   #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum synchronizationDisposition {
     Normal: 0,
@@ -89898,6 +90114,10 @@ namespace reference.`microsoft.graph.identityGovernance` {
     @references groups: reference.`microsoft.graph`.group[];
   }
 
+  @complex model guestSponsorTrigger extends workflowExecutionTrigger {
+    minimumRequiredSponsors: int32;
+  }
+
   @complex model membershipChangeTrigger extends workflowExecutionTrigger {
     changeType: membershipChangeType;
   }
@@ -93451,6 +93671,7 @@ namespace reference.`microsoft.graph.search` {
   }
 
 }
+@privatePreviewDefinition("MdcConnectors", "2026-07-02", "2027-01-02", "<theOwner>")
 @deprecatedDefinition("Tasks_And_Plans", "<ChangeLogCategory>", "2026-03-18", "2028-03-18", "Alert category property is deprecated and replaced with alert categories")
 // Metadata item DeprecatedDefinition_Tasks_And_Plans was already defined with a different value.
 @deprecatedDefinition("azureBlobContainer", "<ChangeLogCategory>", "2023-01-19", "2023-04-30", "The azureBlobContainer will be deprecated on April 30, 2023.")
@@ -94343,6 +94564,11 @@ namespace reference.`microsoft.graph.security` {
   @complex model connectedAIAppInteractionAuditRecord extends auditData {
   }
 
+  @privatePreview("MdcConnectors")
+  @complex model connectorValidateResult {
+    messages: string[];
+  }
+
   /**
    * Audit data for Consumption Resource events.
    */
@@ -97951,6 +98177,10 @@ namespace reference.`microsoft.graph.security` {
     status: caseStatus | null;
   }
 
+  @entity model caseManagementRoot extends reference.`microsoft.graph`.entity {
+    @contains cases: reference.`microsoft.graph.security.caseManagement`.case[];
+  }
+
   @entity model caseOperation extends reference.`microsoft.graph`.entity {
     action: caseAction | null;
     completedDateTime: offsetDateTime | null;
@@ -101048,6 +101278,378 @@ namespace reference.`microsoft.graph.security` {
     unknownFutureValue: 5,
   }
 
+}
+@publicNamespace("microsoft.graph.security.casemanagement")
+namespace reference.`microsoft.graph.security.caseManagement` {
+  @complex model activityResourceDetails {
+    kind: string | null;
+    resourceId: string | null;
+  }
+
+  @complex model alertCounts {
+    active: int32 | null;
+    bySeverity: incidentSeverityCounts | null;
+    byStatus: alertStatusCounts | null;
+    total: int32 | null;
+  }
+
+  @open
+  @complex model alertStatusCounts {
+    inProgress: int32 | null;
+    new: int32 | null;
+    resolved: int32 | null;
+  }
+
+  @complex model attachmentOrigin {
+    resourceId: string | null;
+    resourceType: attachmentOriginType;
+  }
+
+  @complex model booleanValueProperty extends valueProperty {
+    value: boolean;
+  }
+
+  @complex model customFieldDateTimeValue extends customFieldValue {
+    valueDateTime: offsetDateTime | null;
+  }
+
+  @complex model customFieldNumberValue extends customFieldValue {
+    value: int32 | null;
+  }
+
+  @complex model customFieldOptionsValue extends customFieldValue {
+    values: string[];
+  }
+
+  @complex model customFieldStringValue extends customFieldValue {
+    value: string | null;
+  }
+
+  @abstract
+  @complex model customFieldValue {
+  }
+
+  @open
+  @complex model customFieldValues {
+  }
+
+  @complex model exposureCaseAutomation {
+    ruleId: string | null;
+  }
+
+  @complex model exposureCaseGitHub {
+    environmentId: string | null;
+    issueNumber: int32 | null;
+    issueUrl: string | null;
+    primaryAssessmentId: string | null;
+    repoName: string | null;
+  }
+
+  @complex model exposureCaseSeemplicity {
+    configurationId: string | null;
+    configurationName: string | null;
+    providerType: string | null;
+    syncStatus: string | null;
+    ticketCreationTime: offsetDateTime | null;
+    ticketId: string | null;
+    ticketLink: string | null;
+  }
+
+  @complex model impactedAssetsCounts {
+    aiAgents: int32 | null;
+    apps: int32 | null;
+    cloudResources: int32 | null;
+    files: int32 | null;
+    ips: int32 | null;
+    machines: int32 | null;
+    mailboxes: int32 | null;
+    oauthApps: int32 | null;
+    processes: int32 | null;
+    registryKeys: int32 | null;
+    securityGroups: int32 | null;
+    total: int32 | null;
+    urls: int32 | null;
+    users: int32 | null;
+  }
+
+  @complex model incidentSeverityCounts {
+    high: int32 | null;
+    informational: int32 | null;
+    low: int32 | null;
+    medium: int32 | null;
+    `unknown`: int32 | null;
+  }
+
+  @complex model investigation {
+    count: int32 | null;
+    ids: string[];
+    state: string | null;
+  }
+
+  @complex model modifiedProperty {
+    newValue: valueProperty | null;
+    oldValue: valueProperty | null;
+    propertyName: string | null;
+  }
+
+  @complex model stringValueProperty extends valueProperty {
+    value: string | null;
+  }
+
+  @complex model thirdPartyWorkItem {
+    identifier: string;
+    instance: string;
+    @computed lastSyncedOnDateTime: offsetDateTime | null;
+    metadata: thirdPartyWorkItemMetadata | null;
+    provider: thirdPartyWorkItemProvider;
+    syncedBy: string;
+    workItemType: thirdPartyWorkItemType;
+  }
+
+  @open
+  @complex model thirdPartyWorkItemMetadata {
+  }
+
+  @abstract
+  @complex model valueProperty {
+  }
+
+  @abstract
+  @entity model activity extends caseManagementEntity {
+  }
+
+  @entity model attachment extends caseManagementEntity {
+    content: stream | null;
+    description: string | null;
+    displayName: string;
+    fileExtension: string | null;
+    fileSize: int64 | null;
+    origin: attachmentOrigin | null;
+    scanResult: attachmentScanResult;
+  }
+
+  @entity model auditLog extends activity {
+    action: auditAction;
+    details: activityResourceDetails | null;
+    modifiedProperties: modifiedProperty[];
+  }
+
+  @abstract
+  @entity model case extends caseManagementEntity {
+    customFields: customFieldValues | null;
+    displayName: string;
+    status: string;
+    @contains activities: activity[];
+    @contains attachments: attachment[];
+    @contains relations: relation[];
+    @contains tasks: task[];
+  }
+
+  @abstract
+  @entity model caseManagementEntity extends reference.`microsoft.graph`.entity {
+    createdBy: string | null;
+    @computed createdDateTime: offsetDateTime | null;
+    lastModifiedBy: string | null;
+    @computed lastModifiedDateTime: offsetDateTime | null;
+  }
+
+  @entity model comment extends activity {
+    message: string | null;
+  }
+
+  @entity model exposureCase extends case {
+    assignedTo: string | null;
+    automation: exposureCaseAutomation | null;
+    description: string | null;
+    dueDateTime: offsetDateTime | null;
+    emailNotificationRecipients: string[];
+    github: exposureCaseGitHub | null;
+    isGracePeriodEnabled: boolean;
+    priority: string | null;
+    seemplicity: exposureCaseSeemplicity | null;
+    thirdPartyWorkItem: thirdPartyWorkItem | null;
+  }
+
+  @entity model genericCase extends case {
+    assignedTo: string | null;
+    closingNotes: string | null;
+    description: string | null;
+    dueDateTime: offsetDateTime | null;
+    priority: string | null;
+  }
+
+  @entity model incidentCase extends case {
+    aiAgentIds: string[];
+    alertCounts: alertCounts | null;
+    alertPolicyIds: string[];
+    assignedTo: string | null;
+    associatedThreatIds: string[];
+    categories: string[];
+    classification: incidentClassification;
+    cloudScopes: string[];
+    dataSensitivityLabels: string[];
+    dataStreams: string[];
+    detectionSources: string[];
+    determination: incidentDetermination;
+    dueDateTime: offsetDateTime | null;
+    emailNotificationRecipients: string[];
+    firstEventTime: offsetDateTime | null;
+    impactedAssets: impactedAssetsCounts | null;
+    incidentId: int64;
+    incidentWebUrl: string | null;
+    investigation: investigation | null;
+    investigationIds: string[];
+    investigationStates: string[];
+    lastEventTime: offsetDateTime | null;
+    machineGroupIds: string[];
+    osPlatforms: string[];
+    policyNames: string[];
+    priorityScore: int32 | null;
+    productNames: string[];
+    redirectCaseId: int64 | null;
+    redirectIncidentId: int64 | null;
+    serviceSources: string[];
+    severity: incidentSeverity;
+    summary: string | null;
+    systemTags: string[];
+    topRiskScore: int32 | null;
+    workspaceIds: string[];
+  }
+
+  @entity model incidentRelation extends relation {
+  }
+
+  @entity model recommendationRelation extends relation {
+    recommendationType: string | null;
+    resourceGroupName: string | null;
+    subscriptionId: string | null;
+  }
+
+  @abstract
+  @entity model relation extends caseManagementEntity {
+    relatedResourceId: string | null;
+  }
+
+  @entity model task extends caseManagementEntity {
+    assignedTo: string | null;
+    category: caseTaskCategory;
+    closingNotes: string | null;
+    description: string | null;
+    displayName: string;
+    dueDateTime: offsetDateTime | null;
+    priority: caseTaskPriority;
+    status: taskStatus;
+  }
+
+  @entity model workspaceIndicatorRelation extends relation {
+    resourceGroupName: string | null;
+    subscriptionId: string | null;
+    workspaceName: string | null;
+  }
+
+  enum attachmentOriginType {
+    case: 0,
+    comment: 1,
+    task: 2,
+    unknownFutureValue: 3,
+  }
+
+  enum attachmentScanResult {
+    unscanned: 0,
+    noThreatsFound: 1,
+    malicious: 2,
+    unknownFutureValue: 3,
+  }
+
+  enum auditAction {
+    link: 0,
+    unlink: 1,
+    update: 2,
+    delete: 3,
+    create: 4,
+    upload: 5,
+    download: 6,
+    fileUploadMalwareDetected: 7,
+    unknownFutureValue: 8,
+  }
+
+  enum caseTaskCategory {
+    uncategorized: 0,
+    triage: 1,
+    contain: 2,
+    investigate: 3,
+    remediate: 4,
+    prevent: 5,
+    unknownFutureValue: 6,
+  }
+
+  enum caseTaskPriority {
+    notSet: 0,
+    veryLow: 1,
+    low: 2,
+    medium: 3,
+    high: 4,
+    critical: 5,
+    unknownFutureValue: 6,
+  }
+
+  enum incidentClassification {
+    `unknown`: 0,
+    falsePositive: 1,
+    truePositive: 2,
+    informationalExpectedActivity: 3,
+    unknownFutureValue: 4,
+  }
+
+  enum incidentDetermination {
+    `unknown`: 0,
+    apt: 1,
+    malware: 2,
+    securityPersonnel: 3,
+    securityTesting: 4,
+    unwantedSoftware: 5,
+    other: 6,
+    multiStagedAttack: 7,
+    compromisedAccount: 8,
+    phishing: 9,
+    maliciousUserActivity: 10,
+    notMalicious: 11,
+    notEnoughDataToValidate: 12,
+    confirmedActivity: 13,
+    lineOfBusinessApplication: 14,
+    unknownFutureValue: 15,
+  }
+
+  enum incidentSeverity {
+    `unknown`: 0,
+    informational: 1,
+    low: 2,
+    medium: 3,
+    high: 4,
+    unknownFutureValue: 5,
+  }
+
+  enum taskStatus {
+    notSet: 0,
+    new: 1,
+    inProgress: 2,
+    failed: 3,
+    partiallyCompleted: 4,
+    skipped: 5,
+    completed: 6,
+    unknownFutureValue: 7,
+  }
+
+  enum thirdPartyWorkItemProvider {
+    serviceNow: 0,
+    unknownFutureValue: 1,
+  }
+
+  enum thirdPartyWorkItemType {
+    incident: 0,
+    unknownFutureValue: 1,
+  }
+
 }
 @publicNamespace("microsoft.graph.security.dlp")
 namespace reference.`microsoft.graph.security.dlp` {