@microsoft/typespec-msgraph-reference 1.0.9 → 1.0.11

package/lib/Fairfax/Beta/main.tsp

@@ -48,13 +48,16 @@ scalar binary; //TODO: Enables support for Edm.Binary
 @deprecatedDefinition("notificationSetting", "<ChangeLogCategory>", "2026-04-14", "2026-07-14", "Starting from July 14, 2026, the notificationSetting property will no longer be supported and will be marked as deprecated. This property will not be included as part of the API response.")
 @deprecatedDefinition("selfServiceEnabled", "<ChangeLogCategory>", "2023-08-31", "2023-12-01", "The selfServiceEnabled property is deprecated and will not be supported starting Dec 1, 2023. This property will not be included as part of the API response.")
 @deprecatedDefinition("AuthenticationStrengthsRemove", "<ChangeLogCategory>", "2023-02-01", "2023-03-31", "The 'authenticationStrengths' segment is deprecated. Please use 'authenticationStrength' instead.")
+@deprecatedDefinition("Rv1MigrationDeprecation", "<ChangeLogCategory>", "2026-04-03", "2026-07-07", "This API is deprecated and will stop returning data on July 7, 2026. Use POST /deviceManagement/reports/getConfigurationPolicyDeviceSummaryReport instead.")
+// Metadata item DeprecatedDefinition_Rv1MigrationDeprecation was already defined with a different value.
 @deprecatedDefinition("DirectoryFeatureRolloutPolicies", "<ChangeLogCategory>", "2021-03-26", "2021-06-30", "Feature Rollout Policies have been grouped with other policies under /policies. The existing /directory/featureRolloutPolicies is deprecated and will stop returning data on 06/30/2021. Please use /policies/featureRolloutPolicies.")
 @deprecatedDefinition("Removal", "<ChangeLogCategory>", "2023-12-05", "2025-12-05", "The users enum value is deprecated. Use specificPeople instead.")
 // Metadata item DeprecatedDefinition_Removal was already defined with a different value.
 @deprecatedDefinition("Beta:ItemInsightsOranizationSettings", "<ChangeLogCategory>", "2023-10-17", "2024-01-01", "The Organization ItemInsights endpoint will stop returning data on January 1st, 2024. Please use the new Admin People ItemInsights endpoint.")
 @deprecatedDefinition("Outlook_Tasks", "<ChangeLogCategory>", "2021-02-20", "2023-02-20", "The Outlook tasks API is deprecated and will stop returning data on February 20, 2023. Please use the new To Do API. For more details, please visit https://developer.microsoft.com/en-us/office/blogs/announcing-the-general-availability-of-microsoft-to-do-apis-on-graph/")
 @deprecatedDefinition("CreationDateTime", "<ChangeLogCategory>", "2020-11-06", "2020-12-31", "The creationDateTime property is deprecated and will stop returning data on December 31, 2020. Please use the createdDateTime property.")
-@deprecatedDefinition("Tasks_And_Plans", "<ChangeLogCategory>", "2021-01-18", "2023-01-18", "Owner property is deprecated and will be removed in January 2023. Please use the container property instead.")
+@deprecatedDefinition("Tasks_And_Plans", "<ChangeLogCategory>", "2025-03-26", "2026-03-26", "private preview elements are required to be marked as deprecated")
+// Metadata item DeprecatedDefinition_Tasks_And_Plans was already defined with a different value.
 @deprecatedDefinition("PIM_Iteration2_Deprecation", "<ChangeLogCategory>", "2025-10-27", "2026-10-28", "The PIM Iteration 2 beta API is deprecated and will be removed on October 28, 2026. Please migrate to PIM Iteration 3 API.")
 @deprecatedDefinition("QrPolicyConfigRemove", "<ChangeLogCategory>", "2021-11-12", "2022-02-11", "The qrAuthenticationMethodConfiguration type is deprecated")
 @deprecatedDefinition("accountEnabledDeprecated", "<ChangeLogCategory>", "2023-02-23", "2023-07-12", "The accountEnabled field will soon be deprecated on 2023-07-12. Please use isEnabled instead.")
@@ -2517,6 +2520,20 @@ namespace reference.`microsoft.graph` {
     messageBodyContentType: chatMessageBodyContentType | null;
   }
 
+  @complex model chatMessageCitation {
+    excerpt: string | null;
+    iconType: string | null;
+    id: int32 | null;
+    sensitivityLabel: chatMessageCitationSensitivityLabel | null;
+    title: string | null;
+    webUrl: string | null;
+  }
+
+  @complex model chatMessageCitationSensitivityLabel {
+    description: string | null;
+    displayName: string | null;
+  }
+
   @open
   @complex model chatMessageFromIdentitySet extends identitySet {
   }
@@ -2723,6 +2740,9 @@ namespace reference.`microsoft.graph` {
     resourceType: string;
   }
 
+  @complex model cloudPcAutomaticDiscoveredAppDetail extends cloudPcCloudAppDetail {
+  }
+
   @complex model cloudPcAutopilotConfiguration {
     applicationTimeoutInMinutes: int32;
     devicePreparationProfileId: string;
@@ -2744,6 +2764,13 @@ namespace reference.`microsoft.graph` {
     successfulDeviceIds: string[] | null;
   }
 
+  @complex model cloudPcCloudAppDetail {
+    commandLineArguments: string | null;
+    filePath: string;
+    iconIndex: int32 | null;
+    iconPath: string | null;
+  }
+
   @complex model cloudPcConnectionSetting {
     enableSingleSignOn: boolean;
   }
@@ -2771,6 +2798,13 @@ namespace reference.`microsoft.graph` {
     updatedDateTime: offsetDateTime;
   }
 
+  @complex model cloudPcDiscoveredApp {
+    appDetail: cloudPcCloudAppDetail;
+    appName: string | null;
+    discoveredAppId: string;
+    sourceId: string | null;
+  }
+
   @complex model cloudPcDomainJoinConfiguration {
     domainJoinType: cloudPcDomainJoinType | null;
     geographicLocationType: cloudPcGeographicLocationType | null;
@@ -2824,6 +2858,9 @@ namespace reference.`microsoft.graph` {
     installParameters: string[];
   }
 
+  @complex model cloudPcFilePathAppDetail extends cloudPcCloudAppDetail {
+  }
+
   @complex model cloudPcForensicStorageAccount {
     accessTier: cloudPcStorageAccountAccessTier | null;
     immutableStorage: boolean | null;
@@ -3515,6 +3552,20 @@ namespace reference.`microsoft.graph` {
     value: string | null;
   }
 
+  /**
+   * Represents an individual health check result for an NDES connector, containing the metric name and its current status.
+   */
+  @complex model connectorHealthCheck {
+    /**
+     * The name of the health check metric being evaluated.
+     */
+    metricName: connectorHealthCheckMetricName;
+    /**
+     * The current health status for this specific metric, based on error rate thresholds computed from recent connector uploads.
+     */
+    status: ndesConnectorHealthStatus;
+  }
+
   /**
    * Represent connector status
    */
@@ -3765,6 +3816,10 @@ namespace reference.`microsoft.graph` {
    * Remote help - response we provide back to the helper after successfully creating an ACS session
    */
   @complex model createRemoteHelpSessionResponse {
+    /**
+     * The current state of session recording. Null when the tenant is not flighted for session recording.
+     */
+    remoteHelpRecordingState: remoteHelpRecordingState | null;
     /**
      * The unique identifier for a session
      */
@@ -4450,6 +4505,10 @@ namespace reference.`microsoft.graph` {
      * base64-encoded JSON rules content that defines compliance rules to evaluate on the device. When deviceCompliancePolicyScript is set, the rule conditions defined in the JSON are evaluated to determine compliance and the device is marked noncompliant when any rule evaluates to noncompliant. Default is null, when set to default it is not evaluated.
      */
     rulesContent: binary | null;
+    /**
+     * Indicates the interval, in minutes, at which the custom compliance script is evaluated on the device. Allowed range from 1 to 480. Nullable.
+     */
+    runIntervalInMinutes: int32 | null;
   }
 
   /**
@@ -7227,12 +7286,7 @@ namespace reference.`microsoft.graph` {
     itemMajorVersionLimit: int32 | null;
   }
 
-  @complex model fileStorageContainerTypeAgentSettings {
-    chatEmbedAllowedHosts: string[];
-  }
-
   @complex model fileStorageContainerTypeRegistrationSettings {
-    agent: fileStorageContainerTypeAgentSettings | null;
     isDiscoverabilityEnabled: boolean | null;
     isItemVersioningEnabled: boolean | null;
     isSearchEnabled: boolean | null;
@@ -7244,7 +7298,6 @@ namespace reference.`microsoft.graph` {
   }
 
   @complex model fileStorageContainerTypeSettings {
-    agent: fileStorageContainerTypeAgentSettings | null;
     consumingTenantOverridables: fileStorageContainerTypeSettingsOverride | null;
     isDiscoverabilityEnabled: boolean | null;
     isItemVersioningEnabled: boolean | null;
@@ -8078,10 +8131,18 @@ namespace reference.`microsoft.graph` {
      * When true, the system allows direct downloads for the AssociatedDomains. When false, the system will not allow direct downloads for the AssociatedDomains. Default is false.
      */
     associatedDomainsDirectDownloadAllowed: boolean | null;
+    cellularSliceConfigurationId: string | null;
+    contentFilterConfigurationId: string | null;
+    /**
+     * The unique identifier of the DDM app configuration to associate with the app.
+     */
+    ddmAppConfigId: guid | null;
+    dnsProxyConfigurationId: string | null;
     /**
      * When true, indicates that the app should not be backed up to iCloud. When false, indicates that the app may be backed up to iCloud. Default is false.
      */
     preventManagedAppBackup: boolean | null;
+    relayConfigurationId: string | null;
     /**
      * When true, the device locks its screen after every transaction that requires a customer’s card PIN. When false, the user can choose the behavior. Default value is false.
      */
@@ -8092,6 +8153,122 @@ namespace reference.`microsoft.graph` {
     vpnConfigurationId: string | null;
   }
 
+  /**
+   * Contains properties used to assign an iOS Declarative Device Management (DDM) Store App to a group.
+   */
+  @complex model iosDdmStoreAppAssignmentSettings extends mobileAppAssignmentSettings {
+    /**
+     * Specifies whether the app may be downloaded over cellular connections. Possible values are: 'alwaysOn', 'alwaysOff', 'storeSettings'. By default, this value is set to 'storeSettings'.
+     */
+    allowDownloadsOverCellular: ddmAppAllowDownloadsOverCellular | null;
+    /**
+     * Domain names to associate with the app
+     */
+    associatedDomains: string[] | null;
+    /**
+     * When true, the system allows direct downloads for the AssociatedDomains. When false, the system will not allow direct downloads for the AssociatedDomains. Default is false.
+     */
+    associatedDomainsDirectDownloadAllowed: boolean | null;
+    /**
+     * Specifies whether the device automatically updates the app. Possible values are: 'alwaysOn', 'alwaysOff', 'storeSettings'. By default, this value is set to 'storeSettings'.
+     */
+    automaticAppUpdates: ddmAppAutomaticAppUpdates | null;
+    /**
+     * The cellular slice identifier, which can be the data network name (DNN) or app category. For DNN, encode the value as 'DNN:name', where 'name' is the carrier-provided DNN name. For app category, encode the value as 'AppCategory:category', where 'category' is a carrier-provided string such as 'Enterprise1'.
+     */
+    cellularSliceConfigurationId: string | null;
+    /**
+     * The unique identifier of the content filter to associate with the app.
+     */
+    contentFilterConfigurationId: string | null;
+    /**
+     * The unique identifier of the DNS proxy to associate with the app.
+     */
+    dnsProxyConfigurationId: string | null;
+    /**
+     * When true, indicates that the app should not be backed up to iCloud. When false, indicates that the app may be backed up to iCloud. Default is false.
+     */
+    preventManagedAppBackup: boolean | null;
+    /**
+     * The unique identifier of the relay to associate with the app.
+     */
+    relayConfigurationId: string | null;
+    /**
+     * When true, the device locks its screen after every transaction that requires a customer's card PIN. When false, the user can choose the behavior. Default value is false.
+     */
+    tapToPayScreenLockEnabled: boolean | null;
+    /**
+     * Specifies the version of the Store app to install. When not set, the device installs the latest version. When set, the device installs the specified version. The device never installs an older version of the app over a newer version.
+     */
+    version: int32 | null;
+    /**
+     * The unique identifier of the VPN Configuration to apply to the app.
+     */
+    vpnConfigurationId: string | null;
+  }
+
+  /**
+   * Contains properties used to assign an iOS Declarative Device Management (DDM) VPP mobile app to a group.
+   */
+  @complex model iosDdmVppAppAssignmentSettings extends mobileAppAssignmentSettings {
+    /**
+     * Specifies whether the app may be downloaded over cellular connections. Possible values are: 'alwaysOn', 'alwaysOff', 'storeSettings'. By default, this value is set to 'storeSettings'.
+     */
+    allowDownloadsOverCellular: ddmAppAllowDownloadsOverCellular | null;
+    /**
+     * Domain names to associate with the app
+     */
+    associatedDomains: string[] | null;
+    /**
+     * When true, the system allows direct downloads for the AssociatedDomains. When false, the system will not allow direct downloads for the AssociatedDomains. Default is false.
+     */
+    associatedDomainsDirectDownloadAllowed: boolean | null;
+    /**
+     * Specifies whether the device automatically updates the app. Possible values are: 'alwaysOn', 'alwaysOff', 'storeSettings'. By default, this value is set to 'storeSettings'.
+     */
+    automaticAppUpdates: ddmAppAutomaticAppUpdates | null;
+    /**
+     * The cellular slice identifier, which can be the data network name (DNN) or app category. For DNN, encode the value as 'DNN:name', where 'name' is the carrier-provided DNN name. For app category, encode the value as 'AppCategory:category', where 'category' is a carrier-provided string such as 'Enterprise1'.
+     */
+    cellularSliceConfigurationId: string | null;
+    /**
+     * The unique identifier of the content filter to associate with the app.
+     */
+    contentFilterConfigurationId: string | null;
+    /**
+     * The unique identifier of the DDM app configuration to associate with the app.
+     */
+    ddmAppConfigId: guid | null;
+    /**
+     * The unique identifier of the DNS proxy to associate with the app.
+     */
+    dnsProxyConfigurationId: string | null;
+    /**
+     * When true, indicates that the app should not be backed up to iCloud. When false, indicates that the app may be backed up to iCloud. Default is false.
+     */
+    preventManagedAppBackup: boolean | null;
+    /**
+     * The unique identifier of the relay to associate with the app.
+     */
+    relayConfigurationId: string | null;
+    /**
+     * When true, the device locks its screen after every transaction that requires a customer's card PIN. When false, the user can choose the behavior. Default value is false.
+     */
+    tapToPayScreenLockEnabled: boolean | null;
+    /**
+     * Whether or not to use device licensing.
+     */
+    useDeviceLicensing: boolean;
+    /**
+     * Specifies the version of the VPP app to install. When not set, the device installs the latest version. When set, the device installs the specified version. The device never installs an older version of the app over a newer version. This property maps to the Version key in Apple's AppManagedInstallBehaviorObject declaration.
+     */
+    version: int32 | null;
+    /**
+     * The unique identifier of the VPN Configuration to apply to the app.
+     */
+    vpnConfigurationId: string | null;
+  }
+
   /**
    * Contains properties of the possible iOS device types the mobile app can run on.
    */
@@ -9249,6 +9426,32 @@ namespace reference.`microsoft.graph` {
     teamIdentifier: string;
   }
 
+  /**
+   * Contains properties used to assign a macOS Declarative Device Management (DDM) VPP mobile app to a group.
+   */
+  @complex model macOsDdmVppAppAssignmentSettings extends mobileAppAssignmentSettings {
+    /**
+     * Specifies whether the device automatically updates the app. Possible values are: 'alwaysOn', 'alwaysOff', 'storeSettings'. By default, this value is set to 'storeSettings'.
+     */
+    automaticAppUpdates: ddmAppAutomaticAppUpdates | null;
+    /**
+     * The unique identifier of the DDM app configuration to associate with the app.
+     */
+    ddmAppConfigId: guid | null;
+    /**
+     * If true, the device installs an iOS or iPadOS app that runs on a Mac with Apple Silicon. This is only used when the app is a VPP app. Default is false.
+     */
+    isIosApp: boolean | null;
+    /**
+     * When TRUE, indicates that the app should be assigned using device licensing. When FALSE, indicates that the app should be assigned using user licensing. By default, this property is set to FALSE.
+     */
+    useDeviceLicensing: boolean;
+    /**
+     * Specifies the version of the VPP app to install. When not set, the device installs the latest version. When set, the device installs the specified version. The device never installs an older version of the app over a newer version. This property maps to the Version key in Apple's AppManagedInstallBehaviorObject declaration.
+     */
+    version: int32 | null;
+  }
+
   /**
    * Properties related to macOS-specific configured and Intune-managed local administrator account
    */
@@ -10586,6 +10789,13 @@ namespace reference.`microsoft.graph` {
     networkType: networkType | null;
   }
 
+  @complex model nistClassification {
+    category: string;
+    description: string | null;
+    function: string | null;
+    name: string;
+  }
+
   @complex model noDeviceRegistrationMembership extends deviceRegistrationMembership {
   }
 
@@ -10815,8 +11025,26 @@ namespace reference.`microsoft.graph` {
     internalUrl: string | null;
   }
 
+  @complex model onPremisesCurrentExportData {
+    clientMachineName: string | null;
+    pendingObjectsAddition: int32 | null;
+    pendingObjectsDeletion: int32 | null;
+    pendingObjectsUpdate: int32 | null;
+    serviceAccount: string | null;
+    successfulLinksProvisioningCount: int64 | null;
+    successfulObjectsProvisioningCount: int32 | null;
+    totalConnectorSpaceObjects: int32 | null;
+  }
+
   @complex model onPremisesDirectorySynchronizationConfiguration {
     accidentalDeletionPrevention: onPremisesAccidentalDeletionPrevention | null;
+    anchorAttribute: string | null;
+    applicationId: string | null;
+    currentExportData: onPremisesCurrentExportData | null;
+    customerRequestedSynchronizationInterval: duration | null;
+    synchronizationClientVersion: string | null;
+    synchronizationInterval: duration | null;
+    writebackConfiguration: onPremisesWritebackConfiguration | null;
   }
 
   @complex model onPremisesDirectorySynchronizationFeature {
@@ -10877,6 +11105,7 @@ namespace reference.`microsoft.graph` {
     isAccessibleViaZTNAClient: boolean | null;
     isBackendCertificateValidationEnabled: boolean | null;
     isContinuousAccessEvaluationEnabled: boolean | null;
+    isDeviceAccessEnabled: boolean;
     isDnsResolutionEnabled: boolean | null;
     isHttpOnlyCookieEnabled: boolean | null;
     isOnPremPublishingEnabled: boolean | null;
@@ -10903,6 +11132,11 @@ namespace reference.`microsoft.graph` {
     singleSignOnMode: singleSignOnMode | null;
   }
 
+  @complex model onPremisesWritebackConfiguration {
+    unifiedGroupContainer: string | null;
+    userContainer: string | null;
+  }
+
   @complex model onTokenIssuanceStartCustomExtensionHandler extends onTokenIssuanceStartHandler {
     configuration: customExtensionOverwriteConfiguration | null;
     @references customExtension: onTokenIssuanceStartCustomExtension | null;
@@ -12975,6 +13209,11 @@ This model is shared with the CCS retrieval API and search where it is already u
     searchablePlainTexts: metaDataKeyStringPair[] | null;
   }
 
+  @complex model serviceActivityPerformanceMetric {
+    intervalStartDateTime: offsetDateTime;
+    percentage: float64;
+  }
+
   @complex model serviceActivityValueMetric {
     intervalStartDateTime: offsetDateTime;
     value: int64;
@@ -14028,6 +14267,11 @@ This model is shared with the CCS retrieval API and search where it is already u
     timeslots: timeSlot[] | null;
   }
 
+  @complex model timeOffDetails {
+    isAllDay: boolean;
+    subject: string | null;
+  }
+
   /**
    * Parameter passed to GetHealthMetricTimeSeries when requesting snapshot time series.
    */
@@ -17782,6 +18026,9 @@ This model is shared with the CCS retrieval API and search where it is already u
   @entity model agentIdentity extends servicePrincipal {
     agentIdentityBlueprintId: string;
     @computed createdDateTime: offsetDateTime | null;
+    managerApplications: guid;
+    @references inheritedAppRoleAssignments: appRoleAssignment[];
+    @references inheritedOauth2PermissionGrants: oAuth2PermissionGrant[];
     @references sponsors: directoryObject[];
   }
 
@@ -17793,6 +18040,7 @@ This model is shared with the CCS retrieval API and search where it is already u
 
   @open
   @entity model agentIdentityBlueprintPrincipal extends servicePrincipal {
+    managerApplications: guid;
     @references sponsors: directoryObject[];
   }
 
@@ -20474,6 +20722,10 @@ This model is shared with the CCS retrieval API and search where it is already u
      * Defines a managed app behavior, either warn or block, if the specified Android SafetyNet Attestation requirement fails.
      */
     appActionIfAndroidSafetyNetDeviceAttestationFailed: managedAppRemediationAction;
+    /**
+     * Defines a managed app behavior, either warn, block, or wipe, if Developer Options are enabled on the Android device. If the admin does not set this action, the default is null, which indicates this setting is not configured.
+     */
+    appActionIfDeveloperOptionsEnabled: managedAppRemediationAction | null;
     /**
      * Defines a managed app behavior, either warn, block or wipe, if the screen lock is required on android device but is not set.
      */
@@ -22169,10 +22421,18 @@ This model is shared with the CCS retrieval API and search where it is already u
      * Domains that are accessed through the public internet instead of through VPN, even when per-app VPN is activated
      */
     excludedDomains: string[] | null;
+    /**
+     * Indicates whether local network traffic is excluded from the VPN tunnel. When TRUE, local network traffic bypasses the VPN tunnel. Default value is null. Only takes effect when includeAllNetworks is TRUE or enforceVpnRouting is TRUE. Not applicable when enablePerApp is TRUE.
+     */
+    excludeLocalNetworks: boolean | null;
     /**
      * Identifier provided by VPN vendor when connection type is set to Custom VPN. For example: Cisco AnyConnect uses an identifier of the form com.cisco.anyconnect.applevpn.plugin
      */
     identifier: string | null;
+    /**
+     * Indicates whether most network traffic is routed through the VPN tunnel. When TRUE, most network traffic is sent through the VPN tunnel. Default value is null. Not applicable when enablePerApp is TRUE.
+     */
+    includeAllNetworks: boolean | null;
     /**
      * Login group or domain when connection type is set to Dell SonicWALL Mobile Connection.
      */
@@ -23272,11 +23532,13 @@ This model is shared with the CCS retrieval API and search where it is already u
     body: chatMessageBody;
     channelIdentity: channelIdentity | null;
     chatId: string | null;
+    citations: chatMessageCitation[] | null;
     @computed createdDateTime: offsetDateTime | null;
     deletedDateTime: offsetDateTime | null;
     etag: string | null;
     eventDetail: eventMessageDetail | null;
     from: chatMessageFromIdentitySet | null;
+    hasReplies: boolean;
     importance: chatMessageImportance;
     @computed lastEditedDateTime: offsetDateTime | null;
     @computed lastModifiedDateTime: offsetDateTime | null;
@@ -23716,6 +23978,7 @@ This model is shared with the CCS retrieval API and search where it is already u
     statusDetails: cloudPcStatusDetails | null;
     userAccountType: cloudPcUserAccountType | null;
     userDetail: cloudPcEntraUserDetail | null;
+    userExperienceType: cloudPcUserExperienceType | null;
     userPrincipalName: string | null;
   }
 
@@ -23783,6 +24046,21 @@ This model is shared with the CCS retrieval API and search where it is already u
   @entity model cloudPcBulkTroubleshoot extends cloudPcBulkAction {
   }
 
+  @entity model cloudPcCloudApp extends entity {
+    actionFailedErrorCode: cloudPcCloudAppActionFailedErrorCode | null;
+    actionFailedErrorMessage: string | null;
+    addedDateTime: offsetDateTime | null;
+    appDetail: cloudPcCloudAppDetail;
+    appStatus: cloudPcCloudAppStatus;
+    availableToUser: boolean;
+    description: string | null;
+    discoveredAppName: string;
+    displayName: string;
+    @computed lastPublishedDateTime: offsetDateTime | null;
+    provisioningPolicyId: string;
+    scopeIds: string[] | null;
+  }
+
   /**
    * The user experience analyte connectivity issue entity.
    */
@@ -23952,6 +24230,7 @@ This model is shared with the CCS retrieval API and search where it is already u
     provisioningType: cloudPcProvisioningType | null;
     scopeIds: string[] | null;
     snapshotResetMode: cloudPcSnapshotResetMode;
+    userExperienceType: cloudPcUserExperienceType | null;
     userSettingsPersistenceConfiguration: cloudPcUserSettingsPersistenceConfiguration | null;
     windowsSetting: cloudPcWindowsSetting | null;
 
@@ -25687,7 +25966,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
   /**
    * Singleton entity that acts as a container for all device app management functionality.
    */
-  @entity model deviceAppManagement extends entity {
+  @entity model deviceAppManagement extends MsGraph.SharedModels.entity {
     /**
      * Whether the account is enabled for syncing applications from the Microsoft Store for Business.
      */
@@ -26261,7 +26540,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      */
     @computed lastModifiedDateTime: offsetDateTime;
     /**
-     * Indicates the operating system platform type that this compliance script targets.
+     * Indicates the device platform on which the device compliance script will be executed. Possible values are: windows10AndLater (default), linux. The default value is windows10AndLater.
      */
     platform: deviceComplianceScriptPlatformType | null;
     /**
@@ -26273,7 +26552,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      */
     roleScopeTagIds: string[] | null;
     /**
-     * Specifies whether the PowerShell script runs in 32-bit mode. When set to true, the script runs in a 32-bit PowerShell host. Default is false.
+     * Indicate whether PowerShell script(s) should run as 32-bit
      */
     runAs32Bit: boolean;
     /**
@@ -26787,6 +27066,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     successCount: int32;
   }
 
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model deviceConfigurationUserStateSummary extends entity {
     /**
      * Number of compliant users
@@ -27757,6 +28037,8 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     /**
      * The device configuration user state summary for this account.
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains deviceConfigurationUserStateSummaries: deviceConfigurationUserStateSummary | null;
     /**
      * The list of device custom attribute shell scripts associated with the tenant.
@@ -32213,6 +32495,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     resourceType: string;
     status: recommendationStatus;
     subjectId: string;
+    @contains tags: recommendationTag[];
   }
 
   /**
@@ -34234,6 +34517,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
    * Contains properties and inherited properties for iOS store apps.
    */
   @entity model iosStoreApp extends mobileApp {
+    appleDeviceAppDeliveryProtocolType: appleDeviceDeliveryProtocol | null;
     /**
      * The iOS architecture for which this app can run on.
      */
@@ -34401,6 +34685,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
    * Contains properties and inherited properties for iOS Volume-Purchased Program (VPP) Apps.
    */
   @entity model iosVppApp extends mobileApp {
+    appleDeviceAppDeliveryProtocolType: appleDeviceDeliveryProtocol | null;
     /**
      * The applicable iOS Device Type.
      */
@@ -36087,6 +36372,10 @@ typically alternating request/response, implicitly forming a turn.Represents a c
    * Contains properties and inherited properties for MacOS Volume-Purchased Program (VPP) Apps.
    */
   @entity model macOsVppApp extends mobileApp {
+    /**
+     * The protocol used to deliver the app to the apple device(s). When the property is set to Declarative Device Management (DDM) protocol ('declarativeDeviceManagement') then it can no longer be modified or updated to 'mobileDeviceManagement' or 'default'. Default value is: 'default' which indicates Apple MDM protocol.
+     */
+    appleDeviceAppDeliveryProtocolType: appleDeviceDeliveryProtocol;
     /**
      * The store URL.
      */
@@ -36225,6 +36514,10 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      * This is the name of the Wi-Fi network that is broadcast to all devices.
      */
     ssid: string;
+    /**
+     * Indicates whether devices connecting with this Wi-Fi profile must use their physical MAC address instead of a randomized MAC address. When TRUE, it uses the actual Wi-Fi MAC address. When FALSE, it enables the MAC address randomization. Applies to macOS 15 and later. Default is null.
+     */
+    wifiRequirePhysicalMacAddressEnabled: boolean | null;
     /**
      * Indicates whether the Wi-Fi endpoint uses an EAP-based security type. Possible values are: open, wpaPersonal, wpaEnterprise, wep, wpa2Personal, and wpa2Enterprise
      */
@@ -37248,6 +37541,8 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     /**
      * Security baseline states for this device.
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains securityBaselineStates: securityBaselineState[];
     /**
      * The primary users associated with the managed device.
@@ -38537,6 +38832,10 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      * Indicates the size of the file after encryption, in bytes.
      */
     sizeEncrypted: int64;
+    /**
+     * Indicates optional error details when uploadState is indicating an error. For example, when uploadState has commitFileFailed value, this field may have the error code of apkIsInvalid. Read-only.
+     */
+    uploadErrorCode: mobileAppContentFileUploadErrorCode | null;
     /**
      * Indicates the state of the current upload request. Possible values are: success, transientError, error, unknown, azureStorageUriRequestSuccess, azureStorageUriRequestPending, azureStorageUriRequestFailed, azureStorageUriRequestTimedOut, azureStorageUriRenewalSuccess, azureStorageUriRenewalPending, azureStorageUriRenewalFailed, azureStorageUriRenewalTimedOut, commitFileSuccess, commitFilePending, commitFileFailed, commitFileTimedOut. Default value is success. This property is read-only.
      */
@@ -39009,6 +39308,14 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      * Timestamp when on-prem certificate connector was enrolled in Intune.
      */
     enrolledDateTime: offsetDateTime;
+    /**
+     * The collection of individual health check results for this connector. Each entry represents an independent health metric with its current status. Empty when the connector is disconnected or when health has not been evaluated yet. Read-only.
+     */
+    healthChecks: connectorHealthCheck[] | null;
+    /**
+     * The overall health status of the connector, representing the worst status across all individual health checks. This value is pre-computed on each connector upload and may be overridden to disconnected at read time if the connector has not connected recently. Read-only.
+     */
+    healthStatus: ndesConnectorHealthStatus | null;
     /**
      * Last connection time for the Ndes Connector
      */
@@ -39845,8 +40152,11 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     status: placeOperationStatus;
   }
 
-  @entity model planner extends entity {
+  @entity model planner extends MsGraph.SharedModels.entity {
     @contains buckets: plannerBucket[];
+
+    @graphDeprecated("Tasks_And_Plans")
+    @contains goals: plannerGoal[];
     @contains plans: plannerPlan[];
     @contains rosters: plannerRoster[];
     @contains tasks: plannerTask[];
@@ -39874,6 +40184,18 @@ typically alternating request/response, implicitly forming a turn.Represents a c
   @entity model plannerDelta extends entity {
   }
 
+  @graphDeprecated("Tasks_And_Plans")
+  @entity model plannerGoal extends plannerDelta {
+    displayName: string;
+    finishDate: offsetDateTime | null;
+    notes: itemBody | null;
+    planId: string;
+    priority: int32 | null;
+    startDate: offsetDateTime | null;
+    status: plannerGoalStatus;
+    @references tasks: plannerTask[];
+  }
+
   @entity model plannerGroup extends entity {
     @references plans: plannerPlan[];
   }
@@ -39894,6 +40216,9 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     title: string;
     @references buckets: plannerBucket[];
     @contains details: plannerPlanDetails | null;
+
+    @graphDeprecated("Tasks_And_Plans")
+    @references goals: plannerGoal[];
     @references tasks: plannerTask[];
   }
 
@@ -39934,6 +40259,9 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     @computed createdDateTime: offsetDateTime | null;
     creationSource: plannerTaskCreation | null;
     dueDateTime: offsetDateTime | null;
+
+    @graphDeprecated("Tasks_And_Plans")
+    goalIds: string[];
     hasChat: boolean;
     hasDescription: boolean | null;
     isArchived: boolean | null;
@@ -40711,9 +41039,13 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     actionSteps: actionStep[] | null;
     benefits: string | null;
     category: recommendationCategory;
+    categoryGroup: recommendationCategoryGroup;
+    completedBySystemDateTime: offsetDateTime | null;
+    completedByUserDateTime: offsetDateTime | null;
     @computed createdDateTime: offsetDateTime;
     currentScore: float64 | null;
     displayName: string;
+    failedReviewDateTime: offsetDateTime | null;
     featureAreas: recommendationFeatureAreas[] | null;
     impactStartDateTime: offsetDateTime | null;
     impactType: string | null;
@@ -40722,14 +41054,23 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     lastModifiedBy: string | null;
     @computed lastModifiedDateTime: offsetDateTime | null;
     maxScore: float64 | null;
+    needsMoreActionResourceCount: int32 | null;
+    nistClassifications: nistClassification[];
     postponeUntilDateTime: offsetDateTime | null;
     priority: recommendationPriority;
     recommendationType: recommendationType | null;
     releaseType: string | null;
+    remediatedDateTime: offsetDateTime | null;
     remediationImpact: string | null;
     requiredLicenses: requiredLicenses | null;
     status: recommendationStatus;
+    @computed statusModifiedDateTime: offsetDateTime | null;
     @contains impactedResources: impactedResource[];
+    @contains tags: recommendationTag[];
+  }
+
+  @entity model recommendationTag extends entity {
+    displayName: string;
   }
 
   @open
@@ -41039,6 +41380,9 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     riskState: riskState;
   }
 
+  @entity model riskyAgentDiscoveredAgentIdentity extends riskyAgent {
+  }
+
   @entity model riskyAgentIdentity extends riskyAgent {
     @references agentIdentity: agentIdentity | null;
   }
@@ -41275,7 +41619,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     roleMemberInfo: identity;
   }
 
-  @entity model searchEntity extends entity {
+  @entity model searchEntity extends MsGraph.SharedModels.entity {
   }
 
   @entity model section extends place {
@@ -41340,6 +41684,8 @@ typically alternating request/response, implicitly forming a turn.Represents a c
   /**
    * The security baseline per category compliance state summary for the security baseline of the account.
    */
+  @graphDeprecated("Rv1MigrationDeprecation")
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model securityBaselineCategoryStateSummary extends securityBaselineStateSummary {
     /**
      * The category name
@@ -41350,6 +41696,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
   /**
    * The security baseline compliance state summary of the security baseline for a device.
    */
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model securityBaselineDeviceState extends entity {
     /**
      * Display name of the device
@@ -41376,6 +41723,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
   /**
    * The security baseline compliance state of a setting for a device
    */
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model securityBaselineSettingState extends entity {
     /**
      * The policies that contribute to this setting instance
@@ -41414,6 +41762,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
   /**
    * Security baseline state for a device.
    */
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model securityBaselineState extends entity {
     /**
      * The display name of the security baseline
@@ -41434,12 +41783,15 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     /**
      * The security baseline state for different settings for a device
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains settingStates: securityBaselineSettingState[];
   }
 
   /**
    * The security baseline compliance state summary for the security baseline of the account.
    */
+  @graphDeprecated("Rv1MigrationDeprecation")
   @entity model securityBaselineStateSummary extends entity {
     /**
      * Number of conflict devices
@@ -41474,14 +41826,20 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     /**
      * The security baseline per category device state summary
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains categoryDeviceStateSummaries: securityBaselineCategoryStateSummary[];
     /**
      * The security baseline device states
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains deviceStates: securityBaselineDeviceState[];
     /**
      * The security baseline device state summary
      */
+
+    @graphDeprecated("Rv1MigrationDeprecation")
     @contains deviceStateSummary: securityBaselineStateSummary | null;
   }
 
@@ -42666,7 +43024,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     @contains teamDefinition: team | null;
   }
 
-  @entity model teamwork extends entity {
+  @entity model teamwork extends MsGraph.SharedModels.entity {
     isTeamsEnabled: boolean;
     region: string | null;
     @contains deletedChats: deletedChat[];
@@ -45539,6 +45897,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
   @entity model userSettings extends entity {
     @contains itemInsights: userInsightsSettings | null;
     @contains regionalAndLanguageSettings: regionalAndLanguageSettings | null;
+    @contains workHoursAndLocations: workHoursAndLocationsSetting | null;
   }
 
   @entity model userSignInInsight extends governanceInsight {
@@ -45587,6 +45946,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
   @entity model virtualEndpoint extends entity {
     @contains auditEvents: cloudPcAuditEvent[];
     @contains bulkActions: cloudPcBulkAction[];
+    @contains cloudApps: cloudPcCloudApp[];
     @contains cloudPCs: cloudPC[];
     @contains deviceImages: cloudPcDeviceImage[];
     @contains externalPartners: cloudPcExternalPartner[];
@@ -50439,7 +50799,11 @@ typically alternating request/response, implicitly forming a turn.Represents a c
    */
   @entity model windowsManagedAppProtection extends managedAppPolicy {
     /**
-     * Indicates the sources from which data is allowed to be transferred. Some possible values are allApps or none.
+     * When allowedInboundDataTransferSources is set to selectedApps, this property indicates the location from which data is allowed to be received into the org context. Data from the selected source will be treated as org data and subject to Intune app protection policy.
+     */
+    allowedInboundDataTransferSourceApps: windowsManagedAppDataTransferLocations;
+    /**
+     * Indicates the sources from which data is allowed to be transferred. Some possible values are allApps, none, or selectedApps.
      */
     allowedInboundDataTransferSources: windowsManagedAppDataTransferLevel;
     /**
@@ -50447,7 +50811,11 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      */
     allowedOutboundClipboardSharingLevel: windowsManagedAppClipboardSharingLevel;
     /**
-     * Indicates the destinations to which data is allowed to be transferred. Some possible values are allApps or none.
+     * When allowedOutboundDataTransferDestinations is set to selectedApps, this property indicates the location to which org data is allowed to be transferred. Data shared with the selected destination is not protected by Intune app protection policy.
+     */
+    allowedOutboundDataTransferDestinationApps: windowsManagedAppDataTransferLocations;
+    /**
+     * Indicates the destinations to which data is allowed to be transferred. Some possible values are allApps, none, or selectedApps.
      */
     allowedOutboundDataTransferDestinations: windowsManagedAppDataTransferLevel;
     /**
@@ -52320,6 +52688,12 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     protected: boolean;
   }
 
+  @entity model workHoursAndLocationsSetting extends entity {
+    maxSharedWorkLocationDetails: maxWorkLocationDetails;
+    @contains occurrences: workPlanOccurrence[];
+    @contains recurrences: workPlanRecurrence[];
+  }
+
   @entity model workplace extends MsGraph.SharedModels.entity {
     @contains sensorDevices: workplaceSensorDevice[];
   }
@@ -52367,6 +52741,23 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     tags: string[] | null;
   }
 
+  @entity model workPlanOccurrence extends entity {
+    end: dateTimeTimeZone;
+    placeId: string | null;
+    recurrenceId: string | null;
+    start: dateTimeTimeZone;
+    timeOffDetails: timeOffDetails | null;
+    workLocationType: workLocationType;
+  }
+
+  @entity model workPlanRecurrence extends entity {
+    end: dateTimeTimeZone;
+    placeId: string | null;
+    recurrence: patternedRecurrence;
+    start: dateTimeTimeZone;
+    workLocationType: workLocationType;
+  }
+
   @entity model workPosition extends itemFacet {
     categories: string[] | null;
     colleagues: relatedPerson[] | null;
@@ -52734,6 +53125,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     unknownFutureValue: 2,
     agentIdentityBlueprintPrincipal: 3,
     user: 4,
+    discoveredAgentIdentity: 5,
   }
 
   enum agentIdRiskLevel {
@@ -53899,18 +54291,6 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      */
     wpaPersonal: 4,
     unknownFutureValue: 5,
-    /**
-     * Indicates Android Wi-Fi Security Type is set to WPA2. If supported by the platform, the device will attempt WPA3 first and will fall back to WPA2 if necessary. This restricts the preSharedKey to a string between 8 and 64 characters long. Use AndroidWorkProfileWifiConfiguration to configure basic Wi-Fi options.
-     */
-    wpa2Personal: 6,
-    /**
-     * Indicates Android Wi-Fi Security Type is set to WPA3. The device will not fall back to WPA2. This restricts the preSharedKey to a string between 8 and 64 characters long. Use AndroidWorkProfileWifiConfiguration to configure basic Wi-Fi options.
-     */
-    wpa3Personal: 7,
-    /**
-     * Indicates Android Wi-Fi Security Type is set to WPA3. The device will not fall back to WPA2. Must use AndroidWorkProfileEnterpriseWifiConfiguration type to configure enterprise options.
-     */
-    wpa3Enterprise: 8,
   }
 
   /**
@@ -54097,22 +54477,6 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      */
     wpaEnterprise: 4,
     unknownFutureValue: 5,
-    /**
-     * Indicates the Wi-Fi Security Type is set to WPA2. If supported by the platform, the device will attempt WPA3 first and will fall back to WPA2 if necessary.
-     */
-    wpa2Personal: 6,
-    /**
-     * Indicates the Wi-Fi Security Type is set to WPA2. If supported by the platform, the device will attempt WPA3 first and will fall back to WPA2 if necessary. Must use AOSPDeviceOwnerEnterpriseWifiConfiguration type to configure enterprise options.
-     */
-    wpa2Enterprise: 7,
-    /**
-     * Indicates the Wi-Fi Security Type is set to WPA3. The device will not fall back to WPA2.
-     */
-    wpa3Personal: 8,
-    /**
-     * Indicates the Wi-Fi Security Type is set to WPA3. The device will not fall back to WPA2. Must use AOSPDeviceOwnerEnterpriseWifiConfiguration type to configure enterprise options.
-     */
-    wpa3Enterprise: 9,
   }
 
   /**
@@ -56081,6 +56445,26 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     unknownFutureValue: 1,
   }
 
+  enum cloudPcCloudAppActionFailedErrorCode {
+    cloudAppQuotaExceeded: 0,
+    cloudPcLicenseNotFound: 1,
+    internalServerError: 2,
+    appDiscoveryFailed: 3,
+    unknownFutureValue: 4,
+    iconPathInvalid: 5,
+    filePathInvalid: 6,
+  }
+
+  enum cloudPcCloudAppStatus {
+    preparing: 0,
+    ready: 1,
+    publishing: 2,
+    published: 3,
+    unpublishing: 4,
+    failed: 5,
+    unknownFutureValue: 6,
+  }
+
   enum cloudPCConnectionQualityReportType {
     remoteConnectionQualityReport: 0,
     regionalConnectionQualityTrendReport: 1,
@@ -56470,6 +56854,8 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     dedicated: 0,
     shared: 1,
     unknownFutureValue: 2,
+    sharedByUser: 3,
+    sharedByEntraGroup: 4,
     reserve: 5,
   }
 
@@ -56698,6 +57084,12 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     unknownFutureValue: 2,
   }
 
+  enum cloudPcUserExperienceType {
+    cloudPc: 0,
+    cloudApp: 1,
+    unknownFutureValue: 2,
+  }
+
   enum cloudPcUserSettingsPersistenceStorageSizeCategory {
     fourGB: 0,
     eightGB: 1,
@@ -57251,6 +57643,29 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     applicationProxy: 0,
   }
 
+  /**
+   * The name of the health check metric being evaluated for an NDES connector.
+   */
+  enum connectorHealthCheckMetricName {
+    /**
+     * Measures connectivity between the connector and the Certificate Authority.
+     */
+    caConnectivity: 0,
+    /**
+     * Measures whether the connector has the required Enroll permission on the certificate template for issuance.
+     */
+    caIssuancePermissions: 1,
+    /**
+     * Measures whether the connector has the required permissions to revoke certificates on the CA.
+     */
+    caRevocationPermissions: 2,
+    /**
+     * Measures whether the configured certificate template is valid and accessible.
+     */
+    certificateTemplate: 3,
+    unknownFutureValue: 4,
+  }
+
   /**
    * Connector health state for connector status
    */
@@ -57531,6 +57946,44 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     saturday: 6,
   }
 
+  /**
+   * Describes how and when to install an app, specifically whether the app may be downloaded over cellular connections. Maps to Apple's AppManagedInstallBehaviorObject declaration.
+   */
+  enum ddmAppAllowDownloadsOverCellular {
+    /**
+     * The device downloads apps of any size using a cellular network.
+     */
+    alwaysOn: 0,
+    /**
+     * The device doesn't download apps using a cellular network. The device pauses the automatic install or update operation until a different network is active.
+     */
+    alwaysOff: 1,
+    /**
+     * The device uses the settings for the corresponding store when downloading apps.
+     */
+    storeSettings: 2,
+    unknownFutureValue: 3,
+  }
+
+  /**
+   * Specifies the update behavior of the apps installed via VPP. Apps in packages are not automatically updated. Maps to Apple's AppManagedUpdateBehaviorObject declaration.
+   */
+  enum ddmAppAutomaticAppUpdates {
+    /**
+     * The device automatically updates the app to the latest version.
+     */
+    alwaysOn: 0,
+    /**
+     * The device never automatically updates the app.
+     */
+    alwaysOff: 1,
+    /**
+     * The device uses the settings for the corresponding store to determine when to automatically update the app.
+     */
+    storeSettings: 2,
+    unknownFutureValue: 3,
+  }
+
   @graphFlags
   enum decisionItemPrincipalResourceMembershipType {
     direct: 1,
@@ -59699,6 +60152,10 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      * Indicates the settings that can be deployed through the Android channel.
      */
     android: 65536,
+    /**
+     * Setting can be deployed through the Intune Open Extensibility channel for scenarios such as Windows Recovery Environment (WinRE) configuration policies.
+     */
+    intuneOpenExtensibility: 131072,
   }
 
   /**
@@ -62017,6 +62474,176 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     IgnoreLookupReferenceResolutionFailure: 2,
   }
 
+  /**
+   * Indicates the detailed error condition for an eSIM profile operation.
+   */
+  enum eSimProfileErrorDetail {
+    /**
+     * No error.
+     */
+    none: 0,
+    /**
+     * The eSIM card encountered a general failure.
+     */
+    cardGeneralFailure: 1,
+    /**
+     * The confirmation code provided was incorrect.
+     */
+    confirmationCodeIncorrect: 2,
+    /**
+     * The confirmation code was missing.
+     */
+    confirmationCodeMissing: 3,
+    /**
+     * The maximum number of retries for the confirmation code was exceeded.
+     */
+    confirmationCodeMaxRetriesExceeded: 4,
+    /**
+     * The operation is forbidden by policy.
+     */
+    forbiddenByPolicy: 5,
+    /**
+     * The matching ID provided was invalid.
+     */
+    invalidMatchingId: 6,
+    /**
+     * No eligible eSIM profile was found for this device.
+     */
+    noEligibleProfileForThisDevice: 7,
+    /**
+     * There was not enough space on the eSIM card.
+     */
+    notEnoughSpaceOnCard: 8,
+    /**
+     * The operation was aborted.
+     */
+    operationAborted: 9,
+    /**
+     * The eSIM profile EID did not match the device.
+     */
+    profileEidMismatch: 10,
+    /**
+     * The eSIM profile is not available for a new binding.
+     */
+    profileNotAvailableForNewBinding: 11,
+    /**
+     * The eSIM profile has not been released by the operator.
+     */
+    profileNotReleasedByOperator: 12,
+    /**
+     * The remote server encountered a general failure.
+     */
+    remoteServerGeneralFailure: 13,
+    /**
+     * The remote server was unreachable.
+     */
+    remoteServerUnreachable: 14,
+    /**
+     * A timeout occurred while waiting for user consent.
+     */
+    timeoutWaitingForUserConsent: 15,
+    /**
+     * The operation is prohibited by the eSIM profile class.
+     */
+    operationProhibitedByProfileClass: 16,
+    /**
+     * The provisioning profile is not present.
+     */
+    provisioningProfileNotPresent: 17,
+    /**
+     * There is no corresponding request for this operation.
+     */
+    noCorrespondingRequest: 18,
+    /**
+     * A timeout occurred while waiting for a response.
+     */
+    timeoutWaitingForResponse: 19,
+    /**
+     * The ICCID already exists on the device.
+     */
+    iccidAlreadyExists: 20,
+    /**
+     * An error occurred while processing the eSIM profile.
+     */
+    profileProcessingError: 21,
+    /**
+     * The remote server is not trusted.
+     */
+    remoteServerNotTrusted: 22,
+    /**
+     * The maximum number of retries for profile download was exceeded.
+     */
+    profileDownloadMaxRetriesExceeded: 23,
+    /**
+     * The WinHTTP name could not be resolved.
+     */
+    winhttpNameNotResolved: 24,
+    /**
+     * The WinHTTP operation was cancelled.
+     */
+    winhttpOperationCancelled: 25,
+    /**
+     * The status is unspecified.
+     */
+    statusUnspecified: 26,
+    /**
+     * The operation is in progress.
+     */
+    inProgress: 27,
+    /**
+     * The operation is pending user action.
+     */
+    pendingUserAction: 28,
+    /**
+     * An error occurred while setup was in progress.
+     */
+    errorSetupInProgress: 29,
+    /**
+     * The user denied the operation.
+     */
+    errorUserDenied: 30,
+    /**
+     * An internal error occurred.
+     */
+    internalError: 31,
+    /**
+     * The ICCID was not found.
+     */
+    errorIccIdNotFound: 32,
+    /**
+     * Multiple active eSIMs are present but no slot is available.
+     */
+    errorMultipleActiveEsimsNoAvailableSlot: 33,
+    unknownFutureValue: 34,
+  }
+
+  /**
+   * Indicates the state of an eSIM profile on a managed device.
+   */
+  enum eSimProfileState {
+    /**
+     * Unknown state.
+     */
+    `unknown`: 0,
+    /**
+     * The eSIM profile is being installed.
+     */
+    installing: 1,
+    /**
+     * The eSIM profile has been successfully installed.
+     */
+    installed: 2,
+    /**
+     * The eSIM profile is being deleted.
+     */
+    deleting: 3,
+    /**
+     * An error occurred while processing the eSIM profile.
+     */
+    error: 4,
+    unknownFutureValue: 5,
+  }
+
   enum evaluationScopeType {
     tenant: 0,
     agent: 1,
@@ -64952,6 +65579,14 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     unknownFutureValue: 12,
   }
 
+  enum maxWorkLocationDetails {
+    `unknown`: 0,
+    none: 1,
+    approximate: 2,
+    specific: 3,
+    unknownFutureValue: 4,
+  }
+
   /**
    * App configuration key types.
    */
@@ -65452,6 +66087,22 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     userRequestedInstall: 5,
   }
 
+  /**
+   * Optional error codes that can be provided when uploadState of mobileAppContentFile is indicating an error.
+   */
+  enum mobileAppContentFileUploadErrorCode {
+    apkIsInvalid: 1,
+    apkIsMissingSignerCertificates: 2,
+    apkHasInvalidPackageName: 3,
+    apkPackageNameMismatch: 4,
+    apkHasInvalidVersionCode: 5,
+    apkHasVersionCodeMismatch: 6,
+    apkHasInvalidMinSdk: 7,
+    apkMinSdkMismatch: 8,
+    apkVersionNameMismatch: 9,
+    unknownFutureValue: 10,
+  }
+
   /**
    * Contains properties for upload request states.
    */
@@ -65660,6 +66311,33 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     WriteOnly: 3,
   }
 
+  /**
+   * The health status of an NDES connector or individual health check metric.
+   */
+  enum ndesConnectorHealthStatus {
+    /**
+     * Health has not been evaluated yet for this connector.
+     */
+    `unknown`: 0,
+    /**
+     * All health checks are passing. Error rates are below the attention threshold for all metrics.
+     */
+    noActionRequired: 1,
+    /**
+     * One or more health checks have error rates between the attention and action thresholds.
+     */
+    attentionRequired: 2,
+    /**
+     * One or more health checks have error rates above the action threshold. Investigation is required.
+     */
+    actionRequired: 3,
+    /**
+     * The connector has not connected within the staleness threshold. Applied at read time based on lastConnectionDateTime.
+     */
+    disconnected: 4,
+    unknownFutureValue: 5,
+  }
+
   /**
    * The current status of the Ndes Connector.
    */
@@ -66520,6 +67198,15 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     unknownFutureValue: 3,
   }
 
+  enum plannerGoalStatus {
+    notStarted: 0,
+    onTrack: 1,
+    behind: 2,
+    atRisk: 3,
+    closed: 4,
+    unknownFutureValue: 5,
+  }
+
   enum plannerPlanAccessLevel {
     readAccess: 0,
     readWriteAccess: 1,
@@ -68630,6 +69317,16 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     mdiSecureScore: 3,
   }
 
+  enum recommendationCategoryGroup {
+    strengthenAuthentication: 0,
+    detectAndRespondToThreats: 1,
+    enforceLeastPrivilege: 2,
+    governAppsCredentialsAndAgents: 3,
+    hardenInfrastructure: 4,
+    defenderForIdentity: 5,
+    unknownFutureValue: 6,
+  }
+
   enum recommendationFeatureAreas {
     users: 0,
     groups: 1,
@@ -68641,11 +69338,12 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     unknownFutureValue: 7,
   }
 
-  #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum recommendationPriority {
     low: 0,
     medium: 1,
     high: 2,
+    critical: 3,
+    unknownFutureValue: 4,
   }
 
   enum recommendationStatus {
@@ -68659,6 +69357,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     thirdParty: 7,
     planned: 8,
     alternateMitigation: 9,
+    needsMoreAction: 10,
   }
 
   enum recommendationType {
@@ -68974,6 +69673,14 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      * Indicates remote device action to restore the Managed Home Screen kiosk app.
      */
     restoreManagedHomeScreen: 42,
+    /**
+     * Indicates remote device action to trigger an AppleCare-authorized enhanced log collection session on a supervised Apple device.
+     */
+    triggerEnhancedLogCollection: 44,
+    /**
+     * Indicates remote device action to cancel an in-progress enhanced log collection session on a supervised Apple device.
+     */
+    cancelEnhancedLogCollection: 45,
   }
 
   /**
@@ -69010,6 +69717,25 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     enabled: 2,
   }
 
+  /**
+   * Enumeration indicating the state of session recording
+   */
+  enum remoteHelpRecordingState {
+    /**
+     * Recording is not enabled for this session.
+     */
+    notEnabled: 0,
+    /**
+     * Recording is in progress.
+     */
+    recording: 1,
+    /**
+     * Recording failed.
+     */
+    failed: 2,
+    unknownFutureValue: 3,
+  }
+
   enum replyRestriction {
     everyone: 0,
     authorAndModerators: 1,
@@ -69025,6 +69751,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     microsoftEntraWorkloadId: 5,
     unknownFutureValue: 6,
     aatp: 7,
+    microsoftEntraSuite: 8,
   }
 
   /**
@@ -69317,6 +70044,10 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      * App was removed in order to install a superseding app.
      */
     appRemovedBySupersedence: 3005,
+    /**
+     * App cannot be installed. One or more of the application's dependencies are in use.
+     */
+    dependencyAppInUse: 3006,
     /**
      * Application failed to uninstall. See error code property for more details.
      */
@@ -69333,6 +70064,18 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      * Application content was downloaded to the device.
      */
     contentDownloaded: 5002,
+    /**
+     * App enforcement is pending because the app is currently in use.
+     */
+    inUse: 5005,
+    /**
+     * App enforcement was deferred by the user because the app is currently in use.
+     */
+    deferred: 5006,
+    /**
+     * App enforcement was automatically deferred because the app is currently in use and a user response was not available.
+     */
+    autoDeferred: 5007,
   }
 
   enum riskDetail {
@@ -72001,10 +72744,6 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      * Indicates Wi-Fi security type is associated with WPA3-Personal. Provides stronger encryption using Simultaneous Authentication of Equals (SAE).
      */
     wpa3Personal: 7,
-    /**
-     * Indicates the Wi-Fi Security Type is set to WPA3. The device will not fall back to WPA2. Must use WindowsWifiEnterpriseEAPConfiguration type to configure enterprise options.
-     */
-    wpa3Enterprise: 8,
   }
 
   /**
@@ -72436,6 +73175,7 @@ typically alternating request/response, implicitly forming a turn.Represents a c
   /**
    * Contains rule types for Win32 LOB apps.
    */
+  #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum win32LobAppRuleType {
     /**
      * Detection rule.
@@ -72445,11 +73185,6 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      * Requirement rule.
      */
     requirement: 1,
-    /**
-     * Indicates that the associated rule represents an executable for app in-use detection.
-     */
-    inUse: 2,
-    unknownFutureValue: 3,
   }
 
   /**
@@ -73891,7 +74626,6 @@ typically alternating request/response, implicitly forming a turn.Represents a c
   /**
    * Data can be transferred from/to these classes of apps
    */
-  #suppress "@microsoft/typespec-msgraph/use-evolvable-enum" "Matches shipped CSDL."
   enum windowsManagedAppDataTransferLevel {
     /**
      * All apps.
@@ -73901,6 +74635,27 @@ typically alternating request/response, implicitly forming a turn.Represents a c
      * No apps.
      */
     none: 1,
+    /**
+     * Selected apps only. Allowed locations are specified by the child property.
+     */
+    selectedApps: 2,
+    unknownFutureValue: 3,
+  }
+
+  /**
+   * Windows MAM data transfer locations
+   */
+  @graphFlags
+  enum windowsManagedAppDataTransferLocations {
+    /**
+     * No locations selected.
+     */
+    none: 0,
+    /**
+     * OneDrive for Business. Data transferred to or from this location is subject to app protection policy.
+     */
+    oneDriveForBusiness: 1,
+    unknownFutureValue: 2,
   }
 
   /**
@@ -74475,6 +75230,20 @@ typically alternating request/response, implicitly forming a turn.Represents a c
     failed: 3,
   }
 
+  enum workLocationType {
+    unspecified: 0,
+    office: 1,
+    remote: 2,
+    timeOff: 3,
+    unknownFutureValue: 4,
+  }
+
+  enum workLocationUpdateScope {
+    currentSegment: 1,
+    currentDay: 2,
+    unknownFutureValue: 3,
+  }
+
   enum workplaceSensorEventType {
     badgeIn: 0,
     badgeOut: 1,
@@ -75716,6 +76485,10 @@ namespace reference.`microsoft.graph.identityGovernance` {
     targetSubject: workflowSubject | null;
   }
 
+  @complex model directoryObjectWorkflowSubject extends workflowSubject {
+    @references directoryObject: reference.`microsoft.graph`.directoryObject;
+  }
+
   @complex model groupBasedSubjectSet extends reference.`microsoft.graph`.subjectSet {
     @references groups: reference.`microsoft.graph`.group[];
   }
@@ -75780,6 +76553,14 @@ namespace reference.`microsoft.graph.identityGovernance` {
     totalUsers: int32;
   }
 
+  @complex model subjectSummary {
+    failedSubjects: int32;
+    failedTasks: int32;
+    successfulSubjects: int32;
+    totalSubjects: int32;
+    totalTasks: int32;
+  }
+
   @complex model taskReportSummary {
     failedTasks: int32;
     successfulTasks: int32;
@@ -75940,6 +76721,7 @@ namespace reference.`microsoft.graph.identityGovernance` {
     scheduledDateTime: offsetDateTime;
     startedDateTime: offsetDateTime | null;
     subject: workflowSubject;
+    subjectType: subjectType;
     totalTasksCount: int32;
     totalUnprocessedTasksCount: int32;
     workflowExecutionType: workflowExecutionType;
@@ -76039,6 +76821,7 @@ namespace reference.`microsoft.graph.identityGovernance` {
     isEnabled: boolean;
     isSchedulingEnabled: boolean;
     @computed lastModifiedDateTime: offsetDateTime | null;
+    targetSubjectType: subjectType;
     @references administrationScopeTargets: reference.`microsoft.graph`.directoryObject[];
     @references createdBy: reference.`microsoft.graph`.user | null;
     @references lastModifiedBy: reference.`microsoft.graph`.user | null;
@@ -76131,6 +76914,13 @@ namespace reference.`microsoft.graph.identityGovernance` {
     unknownFutureValue: 4,
   }
 
+  @graphFlags
+  enum subjectType {
+    user: 1,
+    unknownFutureValue: 8,
+    provisioningObject: 16,
+  }
+
   enum valueType {
     `enum`: 0,
     `string`: 1,
@@ -76495,7 +77285,7 @@ namespace reference.`microsoft.graph.networkaccess` {
     @contains traffic: networkAccessTraffic[];
   }
 
-  @entity model networkAccessRoot extends reference.`microsoft.graph`.entity {
+  @entity model networkAccessRoot extends MsGraph.SharedModels.entity {
     @contains alerts: alert[];
     @contains forwardingPolicies: forwardingPolicy[];
     @contains forwardingProfiles: forwardingProfile[];
@@ -77106,6 +77896,19 @@ namespace reference.`microsoft.graph.security` {
     registry: string | null;
   }
 
+  @complex model createAlertInput {
+    category: string;
+    description: string;
+    entityDefinitions: entityDefinition[];
+    isExcludedFromCorrelation: boolean;
+    linkToIncident: int64 | null;
+    mitreTechniques: string[];
+    recommendedActions: string | null;
+    sentinelWorkspace: string | null;
+    severity: alertSeverity;
+    title: string;
+  }
+
   @complex model deploymentAccessKeyType {
     deploymentAccessKey: string;
   }
@@ -77162,6 +77965,13 @@ namespace reference.`microsoft.graph.security` {
   @complex model enableUserIncidentTaskResponseAction extends incidentTaskResponseAction {
   }
 
+  @complex model entityDefinition {
+    entityIdentifier: string;
+    entityType: manualAlertEntityType;
+    identifierValue: string;
+    role: entityDefinitionInputRole;
+  }
+
   @complex model eventPropagationResult {
     location: string | null;
     serviceName: string | null;