Microsoft Graph .NET Client Library

The federatedIdpMfaBehavior property determines whether Azure AD accepts Multi-Factor Authentication (MFA) performed by a federated identity provider (IdP) when a user accesses an application governed by a conditional access policy.

Possible Values

• acceptIfMfaDoneByFederatedIdp: Azure AD accepts MFA performed by the federated IdP. If the IdP did not perform MFA, Azure AD performs it.
• enforceMfaByFederatedIdp: Azure AD accepts MFA performed by the federated IdP. If the IdP did not perform MFA, Azure AD redirects the request to the federated IdP to perform MFA.
• rejectMfaByFederatedIdp: Azure AD always performs MFA and rejects MFA performed by the federated IdP.
• unknownFutureValue: Reserved for future use.

Important Migration Notes

• federatedIdpMfaBehavior is an evolved version of the SupportsMfa property from the MSOnline v1 PowerShell cmdlet.
• Switching between federatedIdpMfaBehavior and SupportsMfa is not supported.
• Once federatedIdpMfaBehavior is set, Azure AD ignores the SupportsMfa setting.
• If federatedIdpMfaBehavior is never set, Azure AD continues to honor the SupportsMfa setting.
• If neither is set, Azure AD defaults to acceptIfMfaDoneByFederatedIdp behavior.

Use the delta function to track changes in a driveItem and its children over time. This is the only way to guarantee you have read all necessary data for a full local representation of a drive or folder.

Sync Workflow

1. Initial Sync: Call delta without any parameters. The service enumerates the hierarchy and returns pages of items.
2. Pagination: If the response contains an @odata.nextLink, continue calling that URL until you no longer see it or receive an empty set of changes.
3. Apply Changes: Once all pages are received, apply the changes to your local state. Deleted items are identified by the deleted facet; these should be removed from your local state.
4. Future Syncs: To check for new changes later, call delta using the @odata.deltaLink provided in the final response of your previous sync.

Handling Errors

If the service returns an HTTP 410 Gone error (e.g., due to an expired token), it will provide a Location header with a new nextLink to start a fresh enumeration. Use the following logic based on the error code:

• resyncChangesApplyDifferences: Replace local items with the server's version (including deletes) and upload any local changes the server doesn't know about.
• resyncChangesUploadDifferences: Upload local items the service did not return and upload files that differ from the server version.

Permissions Required

GraphServiceClient graphClient = new GraphServiceClient( authProvider );

// Initial request to establish local state
var delta = await graphClient.Me.Drive.Root
	.Delta()
	.Request()
	.GetAsync();

// Subsequent request using a delta token
var nextDelta = await graphClient.Me.Drive.Root
	.Delta("PREVIOUS_DELTA_TOKEN")
	.Request()
	.GetAsync();

When working with subscriptions for these specific resource types, keep the following requirements in mind:

chatMessage, conversationMember, and team/channel/chat

• Resource Data & Encryption: If includeResourceData is set to true, encryption is required. The subscription creation will fail if an encryptionCertificate is not provided.
• chatMessage Specifics: To receive systemEventMessage types for /teams/{id}/channels/{id}/messages or /chats/{id}/messages, you must use the Prefer: include-unknown-enum-members request header.
• Licensing: Certain endpoints like /teams/getAllMessages, /chats/getAllMembers, and /appCatalogs/teamsApps/{id}/installedToChats have licensing and payment requirements. Some support model=A and model=B query parameters, while others only support model=B.

driveItem (OneDrive)

• Personal OneDrive: You can subscribe to the root folder or any subfolder.
• OneDrive for Business: You can only subscribe to the root folder.
• Restriction: You cannot subscribe to individual files; you must subscribe to a folder (the subscription will then cover the hierarchy).

When creating subscriptions for chatMessage, conversationMember, or team, channel, and chat resources, you can opt to include the actual resource data in the notification by setting includeResourceData to true.

Requirements for including resource data:

• Encryption: You MUST specify an encryptionCertificate in the request body. Failure to provide a certificate will cause the subscription creation to fail.
• chatMessage specific: To receive the systemEventMessage value for the messageType enum when subscribing to /teams/{id}/channels/{id}/messages or /chats/{id}/messages, you must include the Prefer: include-unknown-enum-members request header.
• Teams Protected APIs: Before creating chatMessage subscriptions with application permissions, you may need to request access via Protected APIs in Microsoft Teams.

You can customize the group members response using OData query parameters. When using $search, $filter, $orderby, or OData casting, you must include the ConsistencyLevel: eventual request header.

Supported Parameters:

• $filter: Filter members based on properties (e.g., startswith(displayName, 'a')).
• $count: Returns the total number of items. Requires ConsistencyLevel: eventual.
• $select: Select specific properties to return.
• $search: Search on displayName and description. Requires ConsistencyLevel: eventual.
• $expand: Expand related resources.
• OData Cast: Cast the collection to a specific type (e.g., microsoft.graph.user) to filter by type.

var queryOptions = new List<QueryOption>()
{
	new QueryOption("$count", "true"),
	new QueryOption("$search", "\"displayName:Pr\"")
};

var user = await graphClient.Groups["{group-id}"].Members
	.Request( queryOptions )
	.Header("ConsistencyLevel","eventual")
	.Select("displayName,id")
	.OrderBy("displayName")
	.GetAsync();