Microsoft Graph API Documentation

You can provide feedback or suggest improvements to the documentation through several channels:

• Report issues or questions: Use the standard feedback experience on the Microsoft Learn site.
• Propose direct changes: You can fork the repository, apply fixes, and submit a pull request following the CONTRIBUTING.md guidelines.
• Share ideas and programming experience: Post suggestions regarding future versions, code samples, and general developer experience at the Microsoft 365 Developer Platform Tech Community.

To convert an application from single-tenant (AzureADMyOrg) to multitenant (AzureADMultipleOrgs) while restricting access to specific tenants, update the signInAudience and provide signInAudienceRestrictions in a single request.

Use the @odata.type #microsoft.graph.allowedTenantsAudience to define the restrictions and specify the allowedTenantIds.

PATCH https://graph.microsoft.com/beta/applications/{id}
Content-type: application/json

{
  "signInAudience": "AzureADMultipleOrgs",
  "signInAudienceRestrictions": {
    "@odata.type": "#microsoft.graph.allowedTenantsAudience",
    "isHomeTenantAllowed": true,
    "allowedTenantIds": [
      "818ce016-78c2-457c-91d7-c02c2faaa5fe",
      "c62670b0-53a1-4a38-b26c-4093cbaa510a"
    ]
  }
}

To revert a multitenant application back to single-tenant (AzureADMyOrg), update the signInAudience and simultaneously remove signInAudienceRestrictions by setting its type to #microsoft.graph.unrestrictedAudience.

Best Practice: Perform these updates in a single request to avoid a period where the application is multitenant without restrictions, which may violate organizational policies.

PATCH https://graph.microsoft.com/beta/applications/{id}
Content-type: application/json

{
  "signInAudience": "AzureADMyOrg",
  "signInAudienceRestrictions": {
    "@odata.type": "#microsoft.graph.unrestrictedAudience"
  }
}

Redirect files in this repository must follow a specific naming pattern based on the month and year they were created. This pattern is used to manage the lifecycle of redirects, as files are automatically deleted after one year based on the date in their filename.

Pattern: .openpublishing.redirection.<year>-<month>.json

Rules:

• Use the current month and year when creating a new file.
• Do not add new redirects to an existing file that does not match the current month/year.
• If no file exists for the current month/year, create a new one following the pattern.

.openpublishing.redirection.2023-10.json

If a domain is currently linked to an unmanaged tenant but you own the domain, you can use the forceTakeover parameter to take over that domain.

Requirements:

• The domain must be unmanaged.
• The tenant must have already verified ownership of the domain by adding the required TXT records to the domain registrar.

Request Body Parameter:

• forceTakeover (Boolean, optional): Set to true to attempt a takeover. Defaults to false.

POST https://graph.microsoft.com/beta/domains/contoso.com/verify

{
  "forceTakeover": true
}

When calling setUpResourcesFolder, you may encounter a 400 Bad request if the resource folder has already been initialized for that assignment.

Error Details:

• HTTP Status: 400 Bad request
• Error Code: badRequest
• Inner Error Code: folderAlreadyExists
• Message: Resource folder already exists and has previously been set up.

{
    "error": {
        "code": "badRequest",
        "message": "Bad request.",
        "innerError": {
            "code": "folderAlreadyExists",
            "message": "Resource folder already exists and has previously been set up."
        }
    }
}

This example demonstrates a PATCH request to update the display name, content, state, signature enforcement, and bitness of a Win32 LOB app install PowerShell script.

PATCH https://graph.microsoft.com/beta/deviceAppManagement/mobileApps/{mobileAppId}/contentVersions/{mobileAppContentId}/scripts/{mobileAppContentScriptId}
Content-type: application/json
Content-length: 233

{
  "@odata.type": "#microsoft.graph.win32LobAppInstallPowerShellScript",
  "displayName": "Display Name value",
  "content": "Content value",
  "state": "commitSuccess",
  "enforceSignatureCheck": true,
  "runAs32Bit": true
}

This example demonstrates how to configure an RMM agent by providing the agent URL, SHA256 hash, installation parameters, and enabling automatic deployment.

POST https://graph.microsoft.com/beta/deviceManagement/virtualEndpoint/externalPartners/b3548526-e615-3785-3118-be70b3968ec5/configureAgent
Content-Type: application/json

{
  "agentSetting": {
      "agentUrl": "https://rmmExample.microsoft.com/agent/rmmExampleAgent.msi",
      "agentSha256": "EC6AF1EA0367D16DDE6639A89A080A524CEBC4D4BEDFE00ED0CAC4B865A918D8",
      "installParameters": [
          "/quiet",
          "/norestart",
          "TOKENID=e69c1577-d465-4e57-af33-0ddea43feeb1"
      ],
      "autoDeploymentEnabled": true
  }
}