@microsoft/typespec-msgraph-reference 1.0.9 → 1.0.10

package/lib/Delos/Beta/main.tsp

@@ -18,6 +18,8 @@ scalar binary; //TODO: Enables support for Edm.Binary
 @privatePreviewDefinition("AgenticSP", "2025-04-14", "2025-07-13", "<theOwner>")
 @deprecatedDefinition("beta:DisplayNameRename", "<ChangeLogCategory>", "2026-04-28", "2027-04-28", "The agentDisplayName property is deprecated. Use displayName instead.")
 @deprecatedDefinition("beta:IdentityIDRename", "<ChangeLogCategory>", "2026-04-28", "2027-04-28", "The agentId property is deprecated. Use identityId instead.")
+@deprecatedDefinition("Rv1MigrationDeprecation", "<ChangeLogCategory>", "2026-04-03", "2026-07-07", "This API is deprecated and will stop returning data on July 7, 2026. Use POST /deviceManagement/reports/getConfigurationPolicyDeviceSummaryReport instead.")
+// Metadata item DeprecatedDefinition_Rv1MigrationDeprecation was already defined with a different value.
 @deprecatedDefinition("DirectoryFeatureRolloutPolicies", "<ChangeLogCategory>", "2021-03-05", "2021-06-30", "Feature Rollout Policies have been grouped with other policies under /policies. The existing /directory/featureRolloutPolicies is deprecated and will stop returning data on 06/30/2021. Please use /policies/featureRolloutPolicies.")
 @deprecatedDefinition("Removal", "<ChangeLogCategory>", "2023-12-05", "2025-12-05", "The users enum value is deprecated. Use specificPeople instead.")
 // Metadata item DeprecatedDefinition_Removal was already defined with a different value.
@@ -2135,6 +2137,20 @@ namespace reference.`microsoft.graph` {
     value: string | null;
   }
 
+  /**
+   * Represents an individual health check result for an NDES connector, containing the metric name and its current status.
+   */
+  @complex model connectorHealthCheck {
+    /**
+     * The name of the health check metric being evaluated.
+     */
+    metricName: connectorHealthCheckMetricName;
+    /**
+     * The current health status for this specific metric, based on error rate thresholds computed from recent connector uploads.
+     */
+    status: ndesConnectorHealthStatus;
+  }
+
   /**
    * Represent connector status
    */
@@ -2230,6 +2246,10 @@ namespace reference.`microsoft.graph` {
    * Remote help - response we provide back to the helper after successfully creating an ACS session
    */
   @complex model createRemoteHelpSessionResponse {
+    /**
+     * The current state of session recording. Null when the tenant is not flighted for session recording.
+     */
+    remoteHelpRecordingState: remoteHelpRecordingState | null;
     /**
      * The unique identifier for a session
      */
@@ -2789,6 +2809,10 @@ namespace reference.`microsoft.graph` {
      * base64-encoded JSON rules content that defines compliance rules to evaluate on the device. When deviceCompliancePolicyScript is set, the rule conditions defined in the JSON are evaluated to determine compliance and the device is marked noncompliant when any rule evaluates to noncompliant. Default is null, when set to default it is not evaluated.
      */
     rulesContent: binary | null;
+    /**
+     * Indicates the interval, in minutes, at which the custom compliance script is evaluated on the device. Allowed range from 1 to 480. Nullable.
+     */
+    runIntervalInMinutes: int32 | null;
   }
 
   /**
@@ -6143,10 +6167,18 @@ namespace reference.`microsoft.graph` {
      * When true, the system allows direct downloads for the AssociatedDomains. When false, the system will not allow direct downloads for the AssociatedDomains. Default is false.
      */
     associatedDomainsDirectDownloadAllowed: boolean | null;
+    cellularSliceConfigurationId: string | null;
+    contentFilterConfigurationId: string | null;
+    /**
+     * The unique identifier of the DDM app configuration to associate with the app.
+     */
+    ddmAppConfigId: guid | null;
+    dnsProxyConfigurationId: string | null;
     /**
      * When true, indicates that the app should not be backed up to iCloud. When false, indicates that the app may be backed up to iCloud. Default is false.
      */
     preventManagedAppBackup: boolean | null;
+    relayConfigurationId: string | null;
     /**
      * When true, the device locks its screen after every transaction that requires a customer’s card PIN. When false, the user can choose the behavior. Default value is false.
      */
@@ -6157,6 +6189,122 @@ namespace reference.`microsoft.graph` {
     vpnConfigurationId: string | null;
   }
 
+  /**
+   * Contains properties used to assign an iOS Declarative Device Management (DDM) Store App to a group.
+   */
+  @complex model iosDdmStoreAppAssignmentSettings extends mobileAppAssignmentSettings {
+    /**
+     * Specifies whether the app may be downloaded over cellular connections. Possible values are: 'alwaysOn', 'alwaysOff', 'storeSettings'. By default, this value is set to 'storeSettings'.
+     */
+    allowDownloadsOverCellular: ddmAppAllowDownloadsOverCellular | null;
+    /**
+     * Domain names to associate with the app
+     */
+    associatedDomains: string[] | null;
+    /**
+     * When true, the system allows direct downloads for the AssociatedDomains. When false, the system will not allow direct downloads for the AssociatedDomains. Default is false.
+     */
+    associatedDomainsDirectDownloadAllowed: boolean | null;
+    /**
+     * Specifies whether the device automatically updates the app. Possible values are: 'alwaysOn', 'alwaysOff', 'storeSettings'. By default, this value is set to 'storeSettings'.
+     */
+    automaticAppUpdates: ddmAppAutomaticAppUpdates | null;
+    /**
+     * The cellular slice identifier, which can be the data network name (DNN) or app category. For DNN, encode the value as 'DNN:name', where 'name' is the carrier-provided DNN name. For app category, encode the value as 'AppCategory:category', where 'category' is a carrier-provided string such as 'Enterprise1'.
+     */
+    cellularSliceConfigurationId: string | null;
+    /**
+     * The unique identifier of the content filter to associate with the app.
+     */
+    contentFilterConfigurationId: string | null;
+    /**
+     * The unique identifier of the DNS proxy to associate with the app.
+     */
+    dnsProxyConfigurationId: string | null;
+    /**
+     * When true, indicates that the app should not be backed up to iCloud. When false, indicates that the app may be backed up to iCloud. Default is false.
+     */
+    preventManagedAppBackup: boolean | null;
+    /**
+     * The unique identifier of the relay to associate with the app.
+     */
+    relayConfigurationId: string | null;
+    /**
+     * When true, the device locks its screen after every transaction that requires a customer's card PIN. When false, the user can choose the behavior. Default value is false.
+     */
+    tapToPayScreenLockEnabled: boolean | null;
+    /**
+     * Specifies the version of the Store app to install. When not set, the device installs the latest version. When set, the device installs the specified version. The device never installs an older version of the app over a newer version.
+     */
+    version: int32 | null;
+    /**
+     * The unique identifier of the VPN Configuration to apply to the app.
+     */
+    vpnConfigurationId: string | null;
+  }
+
+  /**
+   * Contains properties used to assign an iOS Declarative Device Management (DDM) VPP mobile app to a group.
+   */
+  @complex model iosDdmVppAppAssignmentSettings extends mobileAppAssignmentSettings {
+    /**
+     * Specifies whether the app may be downloaded over cellular connections. Possible values are: 'alwaysOn', 'alwaysOff', 'storeSettings'. By default, this value is set to 'storeSettings'.
+     */
+    allowDownloadsOverCellular: ddmAppAllowDownloadsOverCellular | null;
+    /**
+     * Domain names to associate with the app
+     */
+    associatedDomains: string[] | null;
+    /**
+     * When true, the system allows direct downloads for the AssociatedDomains. When false, the system will not allow direct downloads for the AssociatedDomains. Default is false.
+     */
+    associatedDomainsDirectDownloadAllowed: boolean | null;
+    /**
+     * Specifies whether the device automatically updates the app. Possible values are: 'alwaysOn', 'alwaysOff', 'storeSettings'. By default, this value is set to 'storeSettings'.
+     */
+    automaticAppUpdates: ddmAppAutomaticAppUpdates | null;
+    /**
+     * The cellular slice identifier, which can be the data network name (DNN) or app category. For DNN, encode the value as 'DNN:name', where 'name' is the carrier-provided DNN name. For app category, encode the value as 'AppCategory:category', where 'category' is a carrier-provided string such as 'Enterprise1'.
+     */
+    cellularSliceConfigurationId: string | null;
+    /**
+     * The unique identifier of the content filter to associate with the app.
+     */
+    contentFilterConfigurationId: string | null;
+    /**
+     * The unique identifier of the DDM app configuration to associate with the app.
+     */
+    ddmAppConfigId: guid | null;
+    /**
+     * The unique identifier of the DNS proxy to associate with the app.
+     */
+    dnsProxyConfigurationId: string | null;
+    /**
+     * When true, indicates that the app should not be backed up to iCloud. When false, indicates that the app may be backed up to iCloud. Default is false.
+     */
+    preventManagedAppBackup: boolean | null;
+    /**
+     * The unique identifier of the relay to associate with the app.
+     */
+    relayConfigurationId: string | null;
+    /**
+     * When true, the device locks its screen after every transaction that requires a customer's card PIN. When false, the user can choose the behavior. Default value is false.
+     */
+    tapToPayScreenLockEnabled: boolean | null;
+    /**
+     * Whether or not to use device licensing.
+     */
+    useDeviceLicensing: boolean;
+    /**
+     * Specifies the version of the VPP app to install. When not set, the device installs the latest version. When set, the device installs the specified version. The device never installs an older version of the app over a newer version. This property maps to the Version key in Apple's AppManagedInstallBehaviorObject declaration.
+     */
+    version: int32 | null;
+    /**
+     * The unique identifier of the VPN Configuration to apply to the app.
+     */
+    vpnConfigurationId: string | null;
+  }
+
   /**
    * Contains properties of the possible iOS device types the mobile app can run on.
    */
@@ -7268,6 +7416,32 @@ namespace reference.`microsoft.graph` {
     teamIdentifier: string;
   }
 
+  /**
+   * Contains properties used to assign a macOS Declarative Device Management (DDM) VPP mobile app to a group.
+   */
+  @complex model macOsDdmVppAppAssignmentSettings extends mobileAppAssignmentSettings {
+    /**
+     * Specifies whether the device automatically updates the app. Possible values are: 'alwaysOn', 'alwaysOff', 'storeSettings'. By default, this value is set to 'storeSettings'.
+     */
+    automaticAppUpdates: ddmAppAutomaticAppUpdates | null;
+    /**
+     * The unique identifier of the DDM app configuration to associate with the app.
+     */
+    ddmAppConfigId: guid | null;
+    /**
+     * If true, the device installs an iOS or iPadOS app that runs on a Mac with Apple Silicon. This is only used when the app is a VPP app. Default is false.
+     */
+    isIosApp: boolean | null;
+    /**
+     * When TRUE, indicates that the app should be assigned using device licensing. When FALSE, indicates that the app should be assigned using user licensing. By default, this property is set to FALSE.
+     */
+    useDeviceLicensing: boolean;
+    /**
+     * Specifies the version of the VPP app to install. When not set, the device installs the latest version. When set, the device installs the specified version. The device never installs an older version of the app over a newer version. This property maps to the Version key in Apple's AppManagedInstallBehaviorObject declaration.
+     */
+    version: int32 | null;
+  }
+
   /**
    * Properties related to macOS-specific configured and Intune-managed local administrator account
    */
@@ -8668,8 +8842,26 @@ namespace reference.`microsoft.graph` {
     internalUrl: string | null;
   }
 
+  @complex model onPremisesCurrentExportData {
+    clientMachineName: string | null;
+    pendingObjectsAddition: int32 | null;
+    pendingObjectsDeletion: int32 | null;
+    pendingObjectsUpdate: int32 | null;
+    serviceAccount: string | null;
+    successfulLinksProvisioningCount: int64 | null;
+    successfulObjectsProvisioningCount: int32 | null;
+    totalConnectorSpaceObjects: int32 | null;
+  }
+
   @complex model onPremisesDirectorySynchronizationConfiguration {
     accidentalDeletionPrevention: onPremisesAccidentalDeletionPrevention | null;
+    anchorAttribute: string | null;
+    applicationId: string | null;
+    currentExportData: onPremisesCurrentExportData | null;
+    customerRequestedSynchronizationInterval: duration | null;
+    synchronizationClientVersion: string | null;
+    synchronizationInterval: duration | null;
+    writebackConfiguration: onPremisesWritebackConfiguration | null;
   }
 
   @complex model onPremisesDirectorySynchronizationFeature {
@@ -8756,6 +8948,11 @@ namespace reference.`microsoft.graph` {
     singleSignOnMode: singleSignOnMode | null;
   }
 
+  @complex model onPremisesWritebackConfiguration {
+    unifiedGroupContainer: string | null;
+    userContainer: string | null;
+  }
+
   @complex model openIdConnectSetting {
     clientId: string;
     discoveryUrl: string;
@@ -13950,6 +14147,7 @@ namespace reference.`microsoft.graph` {
   }
 
   @entity model admin extends MsGraph.SharedModels.entity {
+    @contains cloudLicensing: reference.`microsoft.graph.cloudLicensing`.adminCloudLicensing | null;
     @contains people: peopleAdminSettings | null;
     @contains serviceAnnouncement: serviceAnnouncement | null;
     @contains sharepoint: sharepoint | null;
@@ -14068,6 +14266,9 @@ namespace reference.`microsoft.graph` {
   @entity model agentIdentity extends servicePrincipal {
     agentIdentityBlueprintId: string;
     @computed createdDateTime: offsetDateTime | null;
+    managerApplications: guid;
+    @references inheritedAppRoleAssignments: appRoleAssignment[];
+    @references inheritedOauth2PermissionGrants: oAuth2PermissionGrant[];
     @references sponsors: directoryObject[];
   }
 
@@ -14079,6 +14280,7 @@ namespace reference.`microsoft.graph` {
 
   @open
   @entity model agentIdentityBlueprintPrincipal extends servicePrincipal {
+    managerApplications: guid;
     @references sponsors: directoryObject[];
   }
 
@@ -16649,6 +16851,10 @@ namespace reference.`microsoft.graph` {
      * Defines a managed app behavior, either warn or block, if the specified Android SafetyNet Attestation requirement fails.
      */
     appActionIfAndroidSafetyNetDeviceAttestationFailed: managedAppRemediationAction;
+    /**
+     * Defines a managed app behavior, either warn, block, or wipe, if Developer Options are enabled on the Android device. If the admin does not set this action, the default is null, which indicates this setting is not configured.
+     */
+    appActionIfDeveloperOptionsEnabled: managedAppRemediationAction | null;
     /**
      * Defines a managed app behavior, either warn, block or wipe, if the screen lock is required on android device but is not set.
      */
@@ -18329,10 +18535,18 @@ namespace reference.`microsoft.graph` {
      * Domains that are accessed through the public internet instead of through VPN, even when per-app VPN is activated
      */
     excludedDomains: string[] | null;
+    /**
+     * Indicates whether local network traffic is excluded from the VPN tunnel. When TRUE, local network traffic bypasses the VPN tunnel. Default value is null. Only takes effect when includeAllNetworks is TRUE or enforceVpnRouting is TRUE. Not applicable when enablePerApp is TRUE.
+     */
+    excludeLocalNetworks: boolean | null;
     /**
      * Identifier provided by VPN vendor when connection type is set to Custom VPN. For example: Cisco AnyConnect uses an identifier of the form com.cisco.anyconnect.applevpn.plugin
      */
     identifier: string | null;
+    /**
+     * Indicates whether most network traffic is routed through the VPN tunnel. When TRUE, most network traffic is sent through the VPN tunnel. Default value is null. Not applicable when enablePerApp is TRUE.
+     */
+    includeAllNetworks: boolean | null;
     /**
      * Login group or domain when connection type is set to Dell SonicWALL Mobile Connection.
      */
@@ -21334,7 +21548,7 @@ namespace reference.`microsoft.graph` {
      */
     @computed lastModifiedDateTime: offsetDateTime;
     /**
-     * Indicates the operating system platform type that this compliance script targets.
+     * Indicates the device platform on which the device compliance script will be executed. Possible values are: windows10AndLater (default), linux. The default value is windows10AndLater.
      */
     platform: deviceComplianceScriptPlatformType | null;
     /**
@@ -21346,7 +21560,7 @@ namespace reference.`microsoft.graph` {
      */
     roleScopeTagIds: string[] | null;
     /**
-     * Specifies whether the PowerShell script runs in 32-bit mode. When set to true, the script runs in a 32-bit PowerShell host. Default is false.
+     * Indicate whether PowerShell script(s) should run as 32-bit
      */
     runAs32Bit: boolean;
     /**
@@ -21860,6 +22074,7 @@ namespace reference.`microsoft.graph` {
     successCount: int32;
   }
 
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model deviceConfigurationUserStateSummary extends entity {
     /**
      * Number of compliant users
@@ -22830,6 +23045,8 @@ namespace reference.`microsoft.graph` {
     /**
      * The device configuration user state summary for this account.
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains deviceConfigurationUserStateSummaries: deviceConfigurationUserStateSummary | null;
     /**
      * The list of device custom attribute shell scripts associated with the tenant.
@@ -25849,6 +26066,7 @@ namespace reference.`microsoft.graph` {
     assignedLicenses: assignedLicense[] | null;
     autoSubscribeNewMembers: boolean | null;
     classification: string | null;
+    cloudLicensing: reference.`microsoft.graph.cloudLicensing`.groupCloudLicensing | null;
     createdByAppId: string | null;
     @computed createdDateTime: offsetDateTime | null;
     description: string | null;
@@ -29006,6 +29224,7 @@ namespace reference.`microsoft.graph` {
    * Contains properties and inherited properties for iOS store apps.
    */
   @entity model iosStoreApp extends mobileApp {
+    appleDeviceAppDeliveryProtocolType: appleDeviceDeliveryProtocol | null;
     /**
      * The iOS architecture for which this app can run on.
      */
@@ -29173,6 +29392,7 @@ namespace reference.`microsoft.graph` {
    * Contains properties and inherited properties for iOS Volume-Purchased Program (VPP) Apps.
    */
   @entity model iosVppApp extends mobileApp {
+    appleDeviceAppDeliveryProtocolType: appleDeviceDeliveryProtocol | null;
     /**
      * The applicable iOS Device Type.
      */
@@ -30819,6 +31039,10 @@ namespace reference.`microsoft.graph` {
    * Contains properties and inherited properties for MacOS Volume-Purchased Program (VPP) Apps.
    */
   @entity model macOsVppApp extends mobileApp {
+    /**
+     * The protocol used to deliver the app to the apple device(s). When the property is set to Declarative Device Management (DDM) protocol ('declarativeDeviceManagement') then it can no longer be modified or updated to 'mobileDeviceManagement' or 'default'. Default value is: 'default' which indicates Apple MDM protocol.
+     */
+    appleDeviceAppDeliveryProtocolType: appleDeviceDeliveryProtocol;
     /**
      * The store URL.
      */
@@ -30957,6 +31181,10 @@ namespace reference.`microsoft.graph` {
      * This is the name of the Wi-Fi network that is broadcast to all devices.
      */
     ssid: string;
+    /**
+     * Indicates whether devices connecting with this Wi-Fi profile must use their physical MAC address instead of a randomized MAC address. When TRUE, it uses the actual Wi-Fi MAC address. When FALSE, it enables the MAC address randomization. Applies to macOS 15 and later. Default is null.
+     */
+    wifiRequirePhysicalMacAddressEnabled: boolean | null;
     /**
      * Indicates whether the Wi-Fi endpoint uses an EAP-based security type. Possible values are: open, wpaPersonal, wpaEnterprise, wep, wpa2Personal, and wpa2Enterprise
      */
@@ -31979,6 +32207,8 @@ namespace reference.`microsoft.graph` {
     /**
      * Security baseline states for this device.
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains securityBaselineStates: securityBaselineState[];
     /**
      * The primary users associated with the managed device.
@@ -33246,6 +33476,10 @@ namespace reference.`microsoft.graph` {
      * Indicates the size of the file after encryption, in bytes.
      */
     sizeEncrypted: int64;
+    /**
+     * Indicates optional error details when uploadState is indicating an error. For example, when uploadState has commitFileFailed value, this field may have the error code of apkIsInvalid. Read-only.
+     */
+    uploadErrorCode: mobileAppContentFileUploadErrorCode | null;
     /**
      * Indicates the state of the current upload request. Possible values are: success, transientError, error, unknown, azureStorageUriRequestSuccess, azureStorageUriRequestPending, azureStorageUriRequestFailed, azureStorageUriRequestTimedOut, azureStorageUriRenewalSuccess, azureStorageUriRenewalPending, azureStorageUriRenewalFailed, azureStorageUriRenewalTimedOut, commitFileSuccess, commitFilePending, commitFileFailed, commitFileTimedOut. Default value is success. This property is read-only.
      */
@@ -33695,6 +33929,14 @@ namespace reference.`microsoft.graph` {
      * Timestamp when on-prem certificate connector was enrolled in Intune.
      */
     enrolledDateTime: offsetDateTime;
+    /**
+     * The collection of individual health check results for this connector. Each entry represents an independent health metric with its current status. Empty when the connector is disconnected or when health has not been evaluated yet. Read-only.
+     */
+    healthChecks: connectorHealthCheck[] | null;
+    /**
+     * The overall health status of the connector, representing the worst status across all individual health checks. This value is pre-computed on each connector upload and may be overridden to disconnected at read time if the connector has not connected recently. Read-only.
+     */
+    healthStatus: ndesConnectorHealthStatus | null;
     /**
      * Last connection time for the Ndes Connector
      */
@@ -35381,6 +35623,8 @@ namespace reference.`microsoft.graph` {
   /**
    * The security baseline per category compliance state summary for the security baseline of the account.
    */
+  @graphDeprecated("Rv1MigrationDeprecation")
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model securityBaselineCategoryStateSummary extends securityBaselineStateSummary {
     /**
      * The category name
@@ -35391,6 +35635,7 @@ namespace reference.`microsoft.graph` {
   /**
    * The security baseline compliance state summary of the security baseline for a device.
    */
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model securityBaselineDeviceState extends entity {
     /**
      * Display name of the device
@@ -35417,6 +35662,7 @@ namespace reference.`microsoft.graph` {
   /**
    * The security baseline compliance state of a setting for a device
    */
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model securityBaselineSettingState extends entity {
     /**
      * The policies that contribute to this setting instance
@@ -35455,6 +35701,7 @@ namespace reference.`microsoft.graph` {
   /**
    * Security baseline state for a device.
    */
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model securityBaselineState extends entity {
     /**
      * The display name of the security baseline
@@ -35475,12 +35722,15 @@ namespace reference.`microsoft.graph` {
     /**
      * The security baseline state for different settings for a device
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains settingStates: securityBaselineSettingState[];
   }
 
   /**
    * The security baseline compliance state summary for the security baseline of the account.
    */
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model securityBaselineStateSummary extends entity {
     /**
      * Number of conflict devices
@@ -35515,14 +35765,20 @@ namespace reference.`microsoft.graph` {
     /**
      * The security baseline per category device state summary
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains categoryDeviceStateSummaries: securityBaselineCategoryStateSummary[];
     /**
      * The security baseline device states
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains deviceStates: securityBaselineDeviceState[];
     /**
      * The security baseline device state summary
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains deviceStateSummary: securityBaselineStateSummary | null;
   }
 
@@ -36744,6 +37000,7 @@ namespace reference.`microsoft.graph` {
     birthday: offsetDateTime;
     businessPhones: string[];
     city: string | null;
+    cloudLicensing: reference.`microsoft.graph.cloudLicensing`.userCloudLicensing | null;
     cloudRealtimeCommunicationInfo: cloudRealtimeCommunicationInfo | null;
     companyName: string | null;
     consentProvidedForMinor: string | null;
@@ -43712,7 +43969,11 @@ namespace reference.`microsoft.graph` {
    */
   @entity model windowsManagedAppProtection extends managedAppPolicy {
     /**
-     * Indicates the sources from which data is allowed to be transferred. Some possible values are allApps or none.
+     * When allowedInboundDataTransferSources is set to selectedApps, this property indicates the location from which data is allowed to be received into the org context. Data from the selected source will be treated as org data and subject to Intune app protection policy.
+     */
+    allowedInboundDataTransferSourceApps: windowsManagedAppDataTransferLocations;
+    /**
+     * Indicates the sources from which data is allowed to be transferred. Some possible values are allApps, none, or selectedApps.
      */
     allowedInboundDataTransferSources: windowsManagedAppDataTransferLevel;
     /**
@@ -43720,7 +43981,11 @@ namespace reference.`microsoft.graph` {
      */
     allowedOutboundClipboardSharingLevel: windowsManagedAppClipboardSharingLevel;
     /**
-     * Indicates the destinations to which data is allowed to be transferred. Some possible values are allApps or none.
+     * When allowedOutboundDataTransferDestinations is set to selectedApps, this property indicates the location to which org data is allowed to be transferred. Data shared with the selected destination is not protected by Intune app protection policy.
+     */
+    allowedOutboundDataTransferDestinationApps: windowsManagedAppDataTransferLocations;
+    /**
+     * Indicates the destinations to which data is allowed to be transferred. Some possible values are allApps, none, or selectedApps.
      */
     allowedOutboundDataTransferDestinations: windowsManagedAppDataTransferLevel;
     /**
@@ -46657,18 +46922,6 @@ namespace reference.`microsoft.graph` {
      */
     wpaPersonal: 4,
     unknownFutureValue: 5,
-    /**
-     * Indicates Android Wi-Fi Security Type is set to WPA2. If supported by the platform, the device will attempt WPA3 first and will fall back to WPA2 if necessary. This restricts the preSharedKey to a string between 8 and 64 characters long. Use AndroidWorkProfileWifiConfiguration to configure basic Wi-Fi options.
-     */
-    wpa2Personal: 6,
-    /**
-     * Indicates Android Wi-Fi Security Type is set to WPA3. The device will not fall back to WPA2. This restricts the preSharedKey to a string between 8 and 64 characters long. Use AndroidWorkProfileWifiConfiguration to configure basic Wi-Fi options.
-     */
-    wpa3Personal: 7,
-    /**
-     * Indicates Android Wi-Fi Security Type is set to WPA3. The device will not fall back to WPA2. Must use AndroidWorkProfileEnterpriseWifiConfiguration type to configure enterprise options.
-     */
-    wpa3Enterprise: 8,
   }
 
   /**
@@ -46843,22 +47096,6 @@ namespace reference.`microsoft.graph` {
      */
     wpaEnterprise: 4,
     unknownFutureValue: 5,
-    /**
-     * Indicates the Wi-Fi Security Type is set to WPA2. If supported by the platform, the device will attempt WPA3 first and will fall back to WPA2 if necessary.
-     */
-    wpa2Personal: 6,
-    /**
-     * Indicates the Wi-Fi Security Type is set to WPA2. If supported by the platform, the device will attempt WPA3 first and will fall back to WPA2 if necessary. Must use AOSPDeviceOwnerEnterpriseWifiConfiguration type to configure enterprise options.
-     */
-    wpa2Enterprise: 7,
-    /**
-     * Indicates the Wi-Fi Security Type is set to WPA3. The device will not fall back to WPA2.
-     */
-    wpa3Personal: 8,
-    /**
-     * Indicates the Wi-Fi Security Type is set to WPA3. The device will not fall back to WPA2. Must use AOSPDeviceOwnerEnterpriseWifiConfiguration type to configure enterprise options.
-     */
-    wpa3Enterprise: 9,
   }
 
   /**
@@ -49022,6 +49259,29 @@ namespace reference.`microsoft.graph` {
     applicationProxy: 0,
   }
 
+  /**
+   * The name of the health check metric being evaluated for an NDES connector.
+   */
+  enum connectorHealthCheckMetricName {
+    /**
+     * Measures connectivity between the connector and the Certificate Authority.
+     */
+    caConnectivity: 0,
+    /**
+     * Measures whether the connector has the required Enroll permission on the certificate template for issuance.
+     */
+    caIssuancePermissions: 1,
+    /**
+     * Measures whether the connector has the required permissions to revoke certificates on the CA.
+     */
+    caRevocationPermissions: 2,
+    /**
+     * Measures whether the configured certificate template is valid and accessible.
+     */
+    certificateTemplate: 3,
+    unknownFutureValue: 4,
+  }
+
   /**
    * Connector health state for connector status
    */
@@ -49241,6 +49501,44 @@ namespace reference.`microsoft.graph` {
     saturday: 6,
   }
 
+  /**
+   * Describes how and when to install an app, specifically whether the app may be downloaded over cellular connections. Maps to Apple's AppManagedInstallBehaviorObject declaration.
+   */
+  enum ddmAppAllowDownloadsOverCellular {
+    /**
+     * The device downloads apps of any size using a cellular network.
+     */
+    alwaysOn: 0,
+    /**
+     * The device doesn't download apps using a cellular network. The device pauses the automatic install or update operation until a different network is active.
+     */
+    alwaysOff: 1,
+    /**
+     * The device uses the settings for the corresponding store when downloading apps.
+     */
+    storeSettings: 2,
+    unknownFutureValue: 3,
+  }
+
+  /**
+   * Specifies the update behavior of the apps installed via VPP. Apps in packages are not automatically updated. Maps to Apple's AppManagedUpdateBehaviorObject declaration.
+   */
+  enum ddmAppAutomaticAppUpdates {
+    /**
+     * The device automatically updates the app to the latest version.
+     */
+    alwaysOn: 0,
+    /**
+     * The device never automatically updates the app.
+     */
+    alwaysOff: 1,
+    /**
+     * The device uses the settings for the corresponding store to determine when to automatically update the app.
+     */
+    storeSettings: 2,
+    unknownFutureValue: 3,
+  }
+
   enum defaultMfaMethodType {
     none: 0,
     mobilePhone: 1,
@@ -51352,6 +51650,10 @@ namespace reference.`microsoft.graph` {
      * Indicates the settings that can be deployed through the Android channel.
      */
     android: 65536,
+    /**
+     * Setting can be deployed through the Intune Open Extensibility channel for scenarios such as Windows Recovery Environment (WinRE) configuration policies.
+     */
+    intuneOpenExtensibility: 131072,
   }
 
   /**
@@ -53604,6 +53906,176 @@ namespace reference.`microsoft.graph` {
     IgnoreLookupReferenceResolutionFailure: 2,
   }
 
+  /**
+   * Indicates the detailed error condition for an eSIM profile operation.
+   */
+  enum eSimProfileErrorDetail {
+    /**
+     * No error.
+     */
+    none: 0,
+    /**
+     * The eSIM card encountered a general failure.
+     */
+    cardGeneralFailure: 1,
+    /**
+     * The confirmation code provided was incorrect.
+     */
+    confirmationCodeIncorrect: 2,
+    /**
+     * The confirmation code was missing.
+     */
+    confirmationCodeMissing: 3,
+    /**
+     * The maximum number of retries for the confirmation code was exceeded.
+     */
+    confirmationCodeMaxRetriesExceeded: 4,
+    /**
+     * The operation is forbidden by policy.
+     */
+    forbiddenByPolicy: 5,
+    /**
+     * The matching ID provided was invalid.
+     */
+    invalidMatchingId: 6,
+    /**
+     * No eligible eSIM profile was found for this device.
+     */
+    noEligibleProfileForThisDevice: 7,
+    /**
+     * There was not enough space on the eSIM card.
+     */
+    notEnoughSpaceOnCard: 8,
+    /**
+     * The operation was aborted.
+     */
+    operationAborted: 9,
+    /**
+     * The eSIM profile EID did not match the device.
+     */
+    profileEidMismatch: 10,
+    /**
+     * The eSIM profile is not available for a new binding.
+     */
+    profileNotAvailableForNewBinding: 11,
+    /**
+     * The eSIM profile has not been released by the operator.
+     */
+    profileNotReleasedByOperator: 12,
+    /**
+     * The remote server encountered a general failure.
+     */
+    remoteServerGeneralFailure: 13,
+    /**
+     * The remote server was unreachable.
+     */
+    remoteServerUnreachable: 14,
+    /**
+     * A timeout occurred while waiting for user consent.
+     */
+    timeoutWaitingForUserConsent: 15,
+    /**
+     * The operation is prohibited by the eSIM profile class.
+     */
+    operationProhibitedByProfileClass: 16,
+    /**
+     * The provisioning profile is not present.
+     */
+    provisioningProfileNotPresent: 17,
+    /**
+     * There is no corresponding request for this operation.
+     */
+    noCorrespondingRequest: 18,
+    /**
+     * A timeout occurred while waiting for a response.
+     */
+    timeoutWaitingForResponse: 19,
+    /**
+     * The ICCID already exists on the device.
+     */
+    iccidAlreadyExists: 20,
+    /**
+     * An error occurred while processing the eSIM profile.
+     */
+    profileProcessingError: 21,
+    /**
+     * The remote server is not trusted.
+     */
+    remoteServerNotTrusted: 22,
+    /**
+     * The maximum number of retries for profile download was exceeded.
+     */
+    profileDownloadMaxRetriesExceeded: 23,
+    /**
+     * The WinHTTP name could not be resolved.
+     */
+    winhttpNameNotResolved: 24,
+    /**
+     * The WinHTTP operation was cancelled.
+     */
+    winhttpOperationCancelled: 25,
+    /**
+     * The status is unspecified.
+     */
+    statusUnspecified: 26,
+    /**
+     * The operation is in progress.
+     */
+    inProgress: 27,
+    /**
+     * The operation is pending user action.
+     */
+    pendingUserAction: 28,
+    /**
+     * An error occurred while setup was in progress.
+     */
+    errorSetupInProgress: 29,
+    /**
+     * The user denied the operation.
+     */
+    errorUserDenied: 30,
+    /**
+     * An internal error occurred.
+     */
+    internalError: 31,
+    /**
+     * The ICCID was not found.
+     */
+    errorIccIdNotFound: 32,
+    /**
+     * Multiple active eSIMs are present but no slot is available.
+     */
+    errorMultipleActiveEsimsNoAvailableSlot: 33,
+    unknownFutureValue: 34,
+  }
+
+  /**
+   * Indicates the state of an eSIM profile on a managed device.
+   */
+  enum eSimProfileState {
+    /**
+     * Unknown state.
+     */
+    `unknown`: 0,
+    /**
+     * The eSIM profile is being installed.
+     */
+    installing: 1,
+    /**
+     * The eSIM profile has been successfully installed.
+     */
+    installed: 2,
+    /**
+     * The eSIM profile is being deleted.
+     */
+    deleting: 3,
+    /**
+     * An error occurred while processing the eSIM profile.
+     */
+    error: 4,
+    unknownFutureValue: 5,
+  }
+
   #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum eventType {
     singleInstance: 0,
@@ -56907,6 +57379,22 @@ namespace reference.`microsoft.graph` {
     userRequestedInstall: 5,
   }
 
+  /**
+   * Optional error codes that can be provided when uploadState of mobileAppContentFile is indicating an error.
+   */
+  enum mobileAppContentFileUploadErrorCode {
+    apkIsInvalid: 1,
+    apkIsMissingSignerCertificates: 2,
+    apkHasInvalidPackageName: 3,
+    apkPackageNameMismatch: 4,
+    apkHasInvalidVersionCode: 5,
+    apkHasVersionCodeMismatch: 6,
+    apkHasInvalidMinSdk: 7,
+    apkMinSdkMismatch: 8,
+    apkVersionNameMismatch: 9,
+    unknownFutureValue: 10,
+  }
+
   /**
    * Contains properties for upload request states.
    */
@@ -57115,6 +57603,33 @@ namespace reference.`microsoft.graph` {
     WriteOnly: 3,
   }
 
+  /**
+   * The health status of an NDES connector or individual health check metric.
+   */
+  enum ndesConnectorHealthStatus {
+    /**
+     * Health has not been evaluated yet for this connector.
+     */
+    `unknown`: 0,
+    /**
+     * All health checks are passing. Error rates are below the attention threshold for all metrics.
+     */
+    noActionRequired: 1,
+    /**
+     * One or more health checks have error rates between the attention and action thresholds.
+     */
+    attentionRequired: 2,
+    /**
+     * One or more health checks have error rates above the action threshold. Investigation is required.
+     */
+    actionRequired: 3,
+    /**
+     * The connector has not connected within the staleness threshold. Applied at read time based on lastConnectionDateTime.
+     */
+    disconnected: 4,
+    unknownFutureValue: 5,
+  }
+
   /**
    * The current status of the Ndes Connector.
    */
@@ -59295,6 +59810,14 @@ namespace reference.`microsoft.graph` {
      * Indicates remote device action to restore the Managed Home Screen kiosk app.
      */
     restoreManagedHomeScreen: 42,
+    /**
+     * Indicates remote device action to trigger an AppleCare-authorized enhanced log collection session on a supervised Apple device.
+     */
+    triggerEnhancedLogCollection: 44,
+    /**
+     * Indicates remote device action to cancel an in-progress enhanced log collection session on a supervised Apple device.
+     */
+    cancelEnhancedLogCollection: 45,
   }
 
   /**
@@ -59331,6 +59854,25 @@ namespace reference.`microsoft.graph` {
     enabled: 2,
   }
 
+  /**
+   * Enumeration indicating the state of session recording
+   */
+  enum remoteHelpRecordingState {
+    /**
+     * Recording is not enabled for this session.
+     */
+    notEnabled: 0,
+    /**
+     * Recording is in progress.
+     */
+    recording: 1,
+    /**
+     * Recording failed.
+     */
+    failed: 2,
+    unknownFutureValue: 3,
+  }
+
   enum requiredLicenses {
     notApplicable: 0,
     microsoftEntraIdFree: 1,
@@ -59586,6 +60128,10 @@ namespace reference.`microsoft.graph` {
      * App was removed in order to install a superseding app.
      */
     appRemovedBySupersedence: 3005,
+    /**
+     * App cannot be installed. One or more of the application's dependencies are in use.
+     */
+    dependencyAppInUse: 3006,
     /**
      * Application failed to uninstall. See error code property for more details.
      */
@@ -59602,6 +60148,18 @@ namespace reference.`microsoft.graph` {
      * Application content was downloaded to the device.
      */
     contentDownloaded: 5002,
+    /**
+     * App enforcement is pending because the app is currently in use.
+     */
+    inUse: 5005,
+    /**
+     * App enforcement was deferred by the user because the app is currently in use.
+     */
+    deferred: 5006,
+    /**
+     * App enforcement was automatically deferred because the app is currently in use and a user response was not available.
+     */
+    autoDeferred: 5007,
   }
 
   enum riskDetail {
@@ -61834,10 +62392,6 @@ namespace reference.`microsoft.graph` {
      * Indicates Wi-Fi security type is associated with WPA3-Personal. Provides stronger encryption using Simultaneous Authentication of Equals (SAE).
      */
     wpa3Personal: 7,
-    /**
-     * Indicates the Wi-Fi Security Type is set to WPA3. The device will not fall back to WPA2. Must use WindowsWifiEnterpriseEAPConfiguration type to configure enterprise options.
-     */
-    wpa3Enterprise: 8,
   }
 
   /**
@@ -62269,6 +62823,7 @@ namespace reference.`microsoft.graph` {
   /**
    * Contains rule types for Win32 LOB apps.
    */
+  #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum win32LobAppRuleType {
     /**
      * Detection rule.
@@ -62278,11 +62833,6 @@ namespace reference.`microsoft.graph` {
      * Requirement rule.
      */
     requirement: 1,
-    /**
-     * Indicates that the associated rule represents an executable for app in-use detection.
-     */
-    inUse: 2,
-    unknownFutureValue: 3,
   }
 
   /**
@@ -63718,7 +64268,6 @@ namespace reference.`microsoft.graph` {
   /**
    * Data can be transferred from/to these classes of apps
    */
-  #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum windowsManagedAppDataTransferLevel {
     /**
      * All apps.
@@ -63728,6 +64277,27 @@ namespace reference.`microsoft.graph` {
      * No apps.
      */
     none: 1,
+    /**
+     * Selected apps only. Allowed locations are specified by the child property.
+     */
+    selectedApps: 2,
+    unknownFutureValue: 3,
+  }
+
+  /**
+   * Windows MAM data transfer locations
+   */
+  @graphFlags
+  enum windowsManagedAppDataTransferLocations {
+    /**
+     * No locations selected.
+     */
+    none: 0,
+    /**
+     * OneDrive for Business. Data transferred to or from this location is subject to app protection policy.
+     */
+    oneDriveForBusiness: 1,
+    unknownFutureValue: 2,
   }
 
   /**
@@ -64496,6 +65066,107 @@ namespace reference.`microsoft.graph.agentic` {
     unknownFutureValue: 4,
   }
 
+}
+@publicNamespace("microsoft.graph.cloudlicensing")
+namespace reference.`microsoft.graph.cloudLicensing` {
+  @complex model groupCloudLicensing {
+    @references assignments: assignment[];
+    @contains usageRights: usageRight[];
+  }
+
+  @complex model service {
+    assignableTo: assigneeTypes;
+    planId: guid;
+    planName: string | null;
+  }
+
+  @complex model subscription {
+    nextLifecycleDate: offsetDateTime;
+    startDate: offsetDateTime;
+    state: subscriptionState;
+    subscriptionId: string;
+    tags: subscriptionTags;
+  }
+
+  @complex model userCloudLicensing {
+    @references assignmentErrors: assignmentError[];
+    @references assignments: assignment[];
+    @contains usageRights: usageRight[];
+    @references waitingMembers: waitingMember[];
+  }
+
+  @entity model adminCloudLicensing extends reference.`microsoft.graph`.entity {
+    @contains allotments: allotment[];
+    @contains assignmentErrors: assignmentError[];
+    @contains assignments: assignment[];
+  }
+
+  @entity model allotment extends reference.`microsoft.graph`.entity {
+    allottedUnits: int32;
+    assignableTo: assigneeTypes;
+    consumedUnits: int32;
+    services: service[];
+    skuId: guid | null;
+    skuPartNumber: string | null;
+    subscriptions: subscription[];
+    @references assignments: assignment[];
+    @references waitingMembers: waitingMember[];
+  }
+
+  @entity model assignment extends reference.`microsoft.graph`.entity {
+    disabledServicePlanIds: guid;
+    @references allotment: allotment | null;
+    @references assignedTo: reference.`microsoft.graph`.directoryObject;
+  }
+
+  @entity model assignmentError extends reference.`microsoft.graph`.entity {
+    code: string;
+    message: string;
+    occurrenceDateTime: offsetDateTime;
+    skuId: guid | null;
+    @references assignedTo: reference.`microsoft.graph`.directoryObject;
+    @references usageRight: usageRight | null;
+  }
+
+  @entity model usageRight extends reference.`microsoft.graph`.entity {
+    services: service[];
+    skuId: guid | null;
+    skuPartNumber: string | null;
+    @references allotments: allotment[];
+    @references assignments: assignment[];
+  }
+
+  @entity model waitingMember extends reference.`microsoft.graph`.entity {
+    waitingSinceDateTime: offsetDateTime;
+    @references allotment: allotment;
+    @references assignedTo: reference.`microsoft.graph`.directoryObject;
+  }
+
+  @graphFlags
+  enum assigneeTypes {
+    none: 0,
+    user: 1,
+    group: 2,
+    device: 4,
+    unknownFutureValue: 8,
+  }
+
+  enum subscriptionState {
+    active: 1,
+    warning: 2,
+    suspended: 3,
+    lockedOut: 4,
+    deleted: 5,
+    unknownFutureValue: 6,
+  }
+
+  @graphFlags
+  enum subscriptionTags {
+    none: 0,
+    trial: 1,
+    unknownFutureValue: 2,
+  }
+
 }
 @publicNamespace("microsoft.graph.security")
 namespace reference.`microsoft.graph.security` {